Stefano Cordio

@scordio
296 Followers
48 Following
124 Posts

Software Engineer @ EPAM Systems

AssertJ Maintainer

GitHubhttps://github.com/scordio
Securing the AI software supply chain: Security results across 67 open source projects

The GitHub Secure Open Source Fund helped 67 critical AI‑stack projects accelerate fixes, strengthen ecosystems, and advance open source resilience.

The GitHub Blog

📢 AssertJ joined the GitHub Secure Open Source Fund, a program that leveled up security across 67 open source projects.

What changed for us: SHA pinning, immutable releases, incident response plan, and a mindset shift toward security awareness 🔒

The impact? More robust JVM assertions 🚀

@GeePawHill glad to hear it! We'll do our best to improve Kotlin compatibility in version 4, stay tuned 🙂

https://github.com/assertj/assertj/issues/3838

Improve Kotlin compatibility · Issue #3838 · assertj/assertj

In version 4, we want to bring Kotlin more into the spotlight and resolve long-standing issues related to it.

GitHub
🤷

📢 AssertJ 3.27.7 has been released!

This fixes CVE-2026-24400 🔒

Happy assertions!

https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7

Release v3.27.7 · assertj/assertj

🔒 Security Core Fix XXE vulnerability in isXmlEqualTo assertion (CVE-2026-24400) See GHSA-rqfh-9r24-8c9r for details; many thanks to @wxt201 and @Song-Li for responsibly reporting it! 🚫 Deprec...

GitHub

Last but not least, the test suite is now much stronger as the relevant JSON marshalling is black-box tested.

If you're curious about the details, take a look at this PR 👇

https://github.com/spring-projects/spring-batch-extensions/pull/196

Replace `notion-sdk-jvm` with Spring Framework's HTTP Service Client by scordio · Pull Request #196 · spring-projects/spring-batch-extensions

Closes Replace notion-sdk-jvm with custom Spring Rest Client #154

GitHub

Jackson doesn't really need any introduction, and I lost track of how many times I wondered, "Can I really do this with Jackson?!"

After the changes, how the extension communicates with Notion is fully an implementation detail, tailored to its scope and no longer exposed to users. All public types are now decorated with Jackson annotations, and there is no need for an intermediate layer to handle request & response conversion.

Notion recently deprecated the database endpoints that Spring Batch Notion indirectly uses, and a new pattern should be adopted. Unfortunately, the maintainer has no bandwidth for this, so I've taken the opportunity to rewrite what is needed with the Spring HTTP Service Client and Jackson 3.

The HTTP Service Client really stands out for its brevity and ease of use. Plus, the versioning support introduced in Framework 7 is a perfect match for the Notion API.

• It offers a larger API surface than Spring Batch Notion requires, available to users transitively
• It pulls Kotlin and Gson as transitive dependencies
• It can slow down the adoption of new Notion API types and versions
• Browsing its sources from Java is challenging, like with any Kotlin library

🍃 Who replaced a third-party dependency with a Spring HTTP Service Client and is happy about it? 🙋‍♂️

In Spring Batch Notion, access to the Notion API was done via Notion SDK JVM, a Kotlin library that abstracts the REST communication. While it’s charming for a quick start, it has a few drawbacks:

🧵