Pragmatic Engineer's 2023 Stripe profile covered a 20M-line Ruby codebase and strict API review
Pragmatic Engineer spent months talking with David Singleton, then Stripe's CTO, for a December 2023 profile of engineering at a company of about 7,000 people. The excerpt covers scale, stack and process but does not show how Stripe assigned a directly responsible individual, so that practice cannot be benchmarked from it.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence40
buildOne report1 publisher Jenkins' Java 21 floor cuts off build agents on AIX 7.1, HP-UX and RHEL 6
Jenkins now needs Java 21 or 25 on agents too, a dev.to author reports, while AIX 7.1, HP-UX and Solaris 10 hosts stop at Java 8. Upgrading to pass an audit disconnects them, and the community Agent8 workaround is experimental on real hardware.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−10
- Incentives40
- Confidence45
Red Hat says its Lightwell project has fixed more than 400 novel vulnerabilities in foundational Java libraries since launching in June. Teams running pinned, older Java dependencies should expect more fixes to land, and Red Hat is selling backports built for their exact versions.
Perspective Coverage
7 publishers
- Builder
- Builder 35%
- Operator
- Operator 40%
- Investor
- Investor 25%
Reality
- Evidence55
- Adoption30
- Hype gap+35
- Incentives75
- Confidence60
Korea's regulator widens its AI security exemption to about 15 more financial firms
Korea's Financial Services Commission is due on the 7th to name about 15 more financial firms exempt from network separation rules, after a first round of 10. Network separation rules are what stop lenders running AI security tools, so the list decides who can use AI against AI-driven hacking.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence50
buildOne report1 publisher Three kinds of write land the same 'system' value in Spring Data JPA's created_by
Four annotations and one @EnableJpaAuditing fill created_by in five minutes. The hook underneath is a no-argument method that can only see the thread doing the write, and a dev.to walkthrough starts where that leaves a scheduler.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives22
- Confidence55
buildOne report1 publisher Adding a second thread collapses the hand-rolled CAS counter by 9x
A JMH sweep at 1, 2, 4, 6 and 8 threads on four cores puts a synchronized counter ahead of a hand-rolled compare-and-swap loop once every thread shares one instance, and the confidence intervals never overlap.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+15
- Incentives22
- Confidence48
buildOne report1 publisher Treating the database administrator as the attacker moves settlement out of the primary Postgres
Viktor Khudiaiev's reference implementation hands the attacker full admin on the transaction database, then keeps MAC issuance and settlement SQL in separate services on a protected instance. Everything still runs on one Windows host.
Reality
- Evidence34
- Adoption
- Not scored
- Hype gap−14
- Incentives38
- Confidence52
buildOne report1 publisher A Jackson Databind CVE fix ships in the Payara release that removes @Traced
JDK 27 went GA the same week Azul Payara 7.4.0 patched an unauthenticated CPU-exhaustion bug in Jackson Databind and dropped MicroProfile OpenTracing, so the security upgrade now carries an instrumentation edit with it.
Reality
- Evidence60
- Adoption32
- Hype gap+8
- Incentives45
- Confidence64
buildOne report1 publisher Refunding TX-18491 instead of TX-18419 passes every check the endpoint can run
In a dev.to walkthrough an agent refunds the wrong one of two identical charges, and because the refund service only sees an ID and an amount, the author's fix keys idempotency to the customer's intent instead of the HTTP request.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+12
- Incentives22
- Confidence48
buildOne report1 publisher A smaller GC trigger floor cut ParparVM's resident memory from 98 MB to 38 MB
Codename One went looking for stack allocation to explain Go's edge and ended up tuning when its collector runs. Three attempts to size the heap allowance from the live set failed because the sweep counters miss live objects.
Reality
- Evidence55
- Adoption20
- Hype gap+10
- Incentives60
- Confidence55
buildOne report1 publisher A filter rejects a request before Spring picks the controller that would have handled it
Spring gives three places to run code around a request, and each one sees a different amount. A dev.to walkthrough puts filters outside the DispatcherServlet, interceptors inside it, and aspects around any bean method.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap0
- Incentives12
- Confidence62
buildOne report1 publisher A one-element edit to a compiled class registered a Forge mod's handlers on a dedicated server
A DawnCraft player's Spellbound Book attacks fired in singleplayer and did nothing on his dedicated server. The handler class was annotated Dist.CLIENT. With no mod source on hand, the fix went into the .class file.
Reality
- Evidence66
- Adoption12
- Hype gap−5
- Incentives20
- Confidence58
buildOne report1 publisher Netflix's ja must derive module coordinates for 520 of Maven Central's top 1,000 artifacts
Danny Thomas's preview toolchain makes module-info.java the source of truth for dependencies, packaging and symbol search, so a coding agent working from a shell can resolve and navigate a Java project without an IDE index.
Reality
- Evidence46
- Adoption22
- Hype gap+12
- Incentives62
- Confidence56
buildOne report1 publisher Upgrading to JDK 27 switches TLS 1.3 handshakes to hybrid post-quantum key exchange
Oracle's JDK 27 release notes put hybrid post-quantum key exchange for TLS 1.3 into the default configuration. The migration now belongs to whoever schedules the runtime upgrade.
Publishers:inside.java
Reality
- Evidence55
- Adoption12
- Hype gap+22
- Incentives80
- Confidence55
buildOne report1 publisher Caret's author handed the spec to the agent that can read the repository
A month and a half of prototyping an experimental functional language with Codex ended with eight artifacts around the repository and a documentation flow in which ChatGPT writes the prompts and Codex writes the spec.
Reality
- Evidence26
- Adoption12
- Hype gap+22
- Incentives30
- Confidence52
buildOne report1 publisher A Java 25 upgrade stops Flutter Android builds still pinned to Gradle 8.14
Flutter's deprecation notice and its Java 25 incompatibility error both put the floor at Gradle 9.1.0, so a developer whose machine tools moved forward lost an Android build while the project stayed exactly as it was.
Reality
- Evidence62
- Adoption18
- Hype gap0
- Incentives12
- Confidence55
buildOne report1 publisher A Fastjson RCE walks in through the annotation check, not the type blacklist
CVE-2026-16723 fires against Fastjson 1.x with AutoType disabled and no known gadget class, because the @JSONType trust branch fetches an attacker-hosted class over HTTP just to read a metadata flag.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence45
buildOne report1 publisher IntelliJ IDEA 2026.2 changes the log expression on a running server without a redeploy
JetBrains' walkthrough finds a discount bug in a containerised gRPC server by attaching a debugger on port 5005 and editing log expressions between requests. Those expressions run inside the server's VM.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives90
- Confidence58
buildConfirmed4 publishers JEP 527's hybrid key exchange landed as a stable feature on September 15, and the same JDK makes G1 the collector on small machines and cuts every object header to 64 bits. Serial is still one flag away.
Perspective Coverage
4 publishers
- Builder
- Builder 51%
- Operator
- Operator 36%
- Investor
- Investor 13%
Reality
- Evidence74
- Adoption33
- Hype gap+50
- Incentives60
- Confidence72
buildOne report1 publisher A four-rule refund check runs $14,600 a year through the cheapest Claude model
A dev.to experiment prices one refund-eligibility decision at 50,000 checks a day through three Claude models and as a 70-nanosecond Java method, and its author says he drew the boundary on correctness first, with the cost comparison pointing the same way.
Reality
- Evidence58
- Adoption10
- Hype gap−10
- Incentives30
- Confidence48
Earlier coverage
- The AI coding gap to staff for is validation, not more seats
Product · August 15, 2026 · One report1 publisher