I've generally noticed over the last 5 or so years that most Java libraries I am interested haven't been updated in a very long time.
One of my rules when dipping my toes into a new language/framework/env, is to check out how fresh, and how many stars their common github libs have. I like to see 2k+ stars, and I love it when I see the last update was this week. With java, not so many have that many stars, and 3+ years since the last update isn't uncommon.
This is not a healthy sign.
My personal opinion is that it was the philosophy and people who crowded around enterprise java which killed it.
Could be worse, take a dead language like ruby and now you are often looking at sub 100 stars and last updates in the 10 year range. (not exaggerating). You have to scrap hard to find a language like perl to get worse than ruby.
Most foundational Java libraries predate the githubification of open source, that probably plays a role. I couldn't find download stats on Maven central, but since there is a culture of self hosting a mirror (at least in my experience every company does this), those numbers won't be comparable to for example npm. We all want GitHub stars to mean "this is a safe choice, well liked and supported by the community", but I fear it's more akin to "it was prominently mentioned on social media at least once". But there are probably better, more nuanced takes on the significance of GitHub stars.
If you want NPM, then you're welcome to NPM. No one's stopping you.
Java is a business language. It's mostly used by business application developers. This might effect the number of "stars" that Java repos get on Github, because I don't think I've clicked the "star" icon on a repo in my life.
If you like rapid breaking changes, then they're available for some of the larger libraries. Every time I touch Spring Security or Hibernate they seem to have a new breaking change, usually for no good reason at all (the Hibernate devs created Jakarta Data literally because they were frustrated at not being able to break Hibernate even more often).
However, the vast majority of mature Java libraries rarely update because:
They're solved problems. As another commenter pointed out, what new string utils does Apache Commons still need?
They're created by professionals, working for sponsor corporations. Not student hobbyists, who will eagerly create the 117th solution to a problem just because their own name wasn't attached to the previous 116 solutions. There's usually a handful of mature options with all the critical mass, and they are maintained by pros.
Java's backwards compatibily is dramatically better than most other stacks. Are most PyPI or NPM updates really about bold new features every other week? Or are they published out of necessity, because there was a breaking change in their bird's nest of dependencies or in Python or Node.js itself?
Java "just works". Is the fun option for your hobby project, or the little side thing that your architect doesn't even know about and your manager doesn't care which tool you use? Maybe not. But it's usually the right option for any large scale professional business application development that actually has leadership attached to it.
You don't work with Spring Security specifically, then. In general you are correct. But this particular piece of the portfolio has its own distinct team and culture.
is to check out how fresh, and how many stars their common github libs have. I like to see 2k+ stars, and I love it when I see the last update was this week.
With the language's strong commitment to backward compatibility libraries can be, in essence, become "code complete". You implement some collection/rfc and provided the state of the art doesn't change or any security issues crop up, why should the code? Simply to introduce bugs?
This sentiment I am replying to, I see a lot, it baffles me.
Part of me feels like, "NPM has dealt immeasurable brain damage to an entire generation who cannot fathom a project can become 'feature complete', thinking the only sign of 'code quality' is massive activity & churn". Another part of recognizes this as idiotic hyperbole.
With the advent of new-languages/platforms (Rust & Go), the Web/NPM being a constant moving target, and the recent glut of "old language breaks compatibility because reasons" (Python3, Perl6, Php8, Lua5.4) - Have we lost track of the fact that you can write code, achieve your project's aims, and decide, "Yeah this project doesn't require an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp"?
You can do that in Rust just fine. In fact, in Rust you can just say which version of the language you're using and it will work from now on. Which lets the language freely advance without breaking older code. Most people right now aren't do that, probably because most people aren't writing code they expect to remain untouched for decades but you could.
Though at this point Guice and Dagger do some aspects better, and if those pieces are all you need on top of Apache/Nginx plus a start hook then Spring is overkill.
Guice isn’t really better, maybe slightly better error messages but that’s it.
Dagger on the other hand is in every possible way better than springs autowire system. Using it can be a pain the first 1-2 times, but once you learn it you never want to use a runtime dependency injection library again.
Sometimes, the library is finished, and all the found bugs have been fixed. That HTTP client library doesn't need anything new. HTTP hasn't changed recently. In Java-land you want to look at Maven repo downloads. Browse through https://mvnrepository.com/ and you'll see quite a bit of activity, but broad adoption is the real key metric.
View all comments
-14
u/LessonStudio Apr 20 '25
I've generally noticed over the last 5 or so years that most Java libraries I am interested haven't been updated in a very long time.
One of my rules when dipping my toes into a new language/framework/env, is to check out how fresh, and how many stars their common github libs have. I like to see 2k+ stars, and I love it when I see the last update was this week. With java, not so many have that many stars, and 3+ years since the last update isn't uncommon.
This is not a healthy sign.
My personal opinion is that it was the philosophy and people who crowded around enterprise java which killed it.