每日新聞摘要

This issue highlights major Spring platform releases and related ecosystem updates. Spring Boot 4.0.0 is now GA with a Java 17 baseline, first-class Java 25 support, comprehensive null-safety via JSpecify, and a fully modularized codebase. Spring Cloud 2025.1.0 (Oakwood) follows, aligning the cloud-native stack with Framework 7 and adding enhancements in function discovery and binder priorities. The newsletter also points to JEP previews targeted for JDK 26 (Structured Concurrency and Lazy Constants), tooling and framework notes (Spring Framework 7.0.1, Spring Modulith 2.0, Spring Batch 6.0.0, Spring AMQP 4.0.0, Spring Integration 7.0.0), and runtime/framework updates like Quarkus and Micronaut. Webinars and podcasts are listed, plus technical commentary (Werner Vogels’ 2026 predictions). Pick of the week: Baeldung’s course roadmap and an ending Black Friday promotion.

本期聚焦 Spring 平台及生态的重要发布：Spring Boot 4.0.0 正式发布，确立 Java 17 基线并提供对 Java 25 的一流支持，同时通过 JSpecify 提供全面的空值安全并完成代码模块化；紧随其后的 Spring Cloud 2025.1.0（Oakwood）将云原生栈与 Framework 7 对齐，并在功能发现与 binder 优先级上带来增强。文中还链接到面向 JDK 26 的 JEP 预览（结构化并发、Lazy Constants）、多项工具与框架版本更新（如 Spring Framework、Modulith、Batch、AMQP、Integration、Quarkus、Micronaut）以及相关的网络研讨会与播客。精选四：Baeldung 的课程路线图与即将结束的 Black Friday 活动。

This article examines techniques to achieve reliable background location tracking in React Native on Android, aiming for precise ~1-meter movement updates. It explains why JavaScript alone is insufficient and recommends using native Android capabilities or bridging to native modules to run location logic in a foreground service. The author covers configuring high-accuracy location requests, adjusting distance and time intervals, handling Android background restrictions and runtime permissions, and balancing battery impact. Practical steps include implementing native listeners, using the fused location provider or LocationManager appropriately, and ensuring the app maintains a foreground service or uses background work APIs to receive continual updates. The guide emphasizes testing across device manufacturers and Android versions, and considering platform limits to achieve consistent, performant background tracking.

本文介绍在 Android 上通过 React Native 实现后台定位追踪以达到约 1 米移动更新的实践。文章指出仅用 JavaScript 不足以保证后台持续和高精度定位，建议将定位逻辑交由原生模块或通过 bridge 在前台服务或受支持的后台机制中运行。内容涵盖配置高精度定位请求、调整距离与时间间隔、应对 Android 的后台限制与权限管理，以及平衡电池影响。实作要点包括使用融合定位或 LocationManager、建立原生监听器并确保使用合适的前台服务或后台工作 API，最后强调需在不同厂商与 Android 版本上充分测试以获得稳定且高效的追踪效果。

This article explains how to build an Android TV app using Jetpack Compose with robust D‑Pad (remote) navigation handling. It highlights the importance of reliable remote navigation for a good TV user experience and situates the discussion within the author's multipart series (Part‑5) on Medium. The post directs readers to continue reading on Medium for implementation details and practical guidance. Overall, the piece serves as a focused entry in the series about integrating Jetpack Compose with Android TV navigation concerns, emphasizing the need to handle D‑Pad events and focus behavior to produce smooth, predictable remote-driven interfaces.

本文说明如何使用 Jetpack Compose 构建 Android TV 应用，并聚焦于实现稳健的 D‑Pad（遥控器）导航处理，强调远程导航对电视用户体验的关键性。作为作者在 Medium 上系列文章的第5部分，文章提示读者到 Medium 上继续阅读以获取完整实现细节。总体来看，此篇作为系列中的一环，主要讨论在 Android TV 环境下如何处理遥控器事件和焦点行为，以确保界面的导航流畅且行为可预测。

In "Kotlin Coroutine Dispatchers," Anand Gaur emphasizes that Kotlin coroutines are now an essential skill for Android developers because they enable cleaner, more stable, and higher-performing applications. The article focuses on dispatchers as a core coroutine concept that determines the execution context for coroutines, influencing threading, concurrency, and responsiveness. Understanding dispatchers helps developers keep work off the main thread, manage resource usage, and make asynchronous behavior predictable and maintainable. The piece serves as a practical introduction for engineers who want to apply coroutines effectively in Android projects, explaining why dispatchers matter and how grasping their role contributes to robust, responsive app design.

Anand Gaur 在《Kotlin Coroutine Dispatchers》中指出，Kotlin 协程对于现代 Android 开发者至关重要，能够让应用更清晰、稳定并提升性能。文章聚焦于 dispatchers 这一核心概念：它决定协程运行的上下文，从而影响线程使用、并发行为和界面响应性。掌握 dispatchers 有助于将耗时任务移出主线程、管理资源并使异步逻辑更可预测、易维护。总体而言，本文为希望在 Android 项目中高效使用协程的工程师提供了概念性的介绍与实践上的指引。

This article explains how to implement an authentication interceptor when using OkHttp3 together with Retrofit for API handling. It outlines why an interceptor is the appropriate place to attach authentication headers and how to integrate that interceptor with Retrofit's OkHttp client. The piece highlights practical responsibilities such as injecting access tokens into outbound requests, managing token expiration and refresh flows, and propagating authentication errors in a controlled way. It also warns against common pitfalls—such as creating infinite request loops during token refresh—and recommends keeping token storage and refresh logic separate from request construction to preserve clarity and thread-safety. Overall, the guidance is pragmatic and focused on making auth handling secure, reliable, and maintainable in an OkHttp+Retrofit stack.

本文介绍在使用 OkHttp3 与 Retrofit 处理 API 时，如何正确实现认证拦截器。文章说明拦截器是附加认证头的合适位置，并介绍如何将其与 Retrofit 的 OkHttp 客户端集成。重点包括在出站请求中注入访问 Token、处理 Token 过期和刷新流程，以及以受控方式传播认证错误；同时提醒要规避常见问题，例如刷新引起的无限请求循环，并建议将 Token 存储与刷新逻辑独立于请求构建以保持清晰性与线程安全。总体上，提供务实的做法以确保在 OkHttp+Retrofit 环境中实现安全且可维护的认证处理。

This article examines how error handling operates in Kotlin Coroutines specifically when using async, await(), and awaitAll(). It outlines the general behaviors developers should expect when exceptions occur inside asynchronous coroutines, how awaiting results affects exception propagation and cancellation, and the practical differences between awaiting single deferred results versus awaiting multiple deferred results. The piece aims to help readers understand how exceptions surface to parent scopes and how to structure coroutine code to handle failures predictably. While focused on conceptual explanation, the discussion is intended to guide safer use of async/await patterns so that errors can be detected and managed effectively in concurrent Kotlin code.

本文聚焦于在 Kotlin 协程中使用 async、await() 与 awaitAll() 时的错误处理机制，说明当异步协程内部发生异常时应有的行为与预期结果。文章阐述等待结果（await）如何影响异常传播与协程取消，以及单个 Deferred 与多个 Deferred（通过 awaitAll()）在错误处理上的差别。目的是帮助开发者理解异常何时会冒泡到父作用域，以及如何组织协程代码以便在并发场景下可靠地检测与处理错误。

This short article urges Kotlin developers to stop writing boilerplate code and highlights KSP (Kotlin Symbol Processing) together with Kotlin 2.2's experimental macros as tools to automate routine scaffolding. It states that these mechanisms can handle about 80% of scaffolding tasks automatically, which can reduce manual repetitive work and improve development efficiency. The piece emphasizes learning how to integrate KSP and macros into projects to scale code generation and streamline common patterns. Although concise, it points readers to a full Medium post for further details and examples. The core message is that adopting KSP and Kotlin 2.2 macros can substantially cut down on boilerplate, help maintain consistent scaffolding, and free developers to focus on core application logic.

本文呼吁 Kotlin 开发者停止手写样板代码，介绍如何通过 KSP（Kotlin Symbol Processing）与 Kotlin 2.2 的实验性宏来自动化大部分支架代码。文章指出，该组合大约可以自动处理 80% 的样板工作，有助于减少重复代码、提升维护性与开发效率。内容简短但引导读者到 Medium 原文以获取更详细的说明、实现细节与示例，便于在项目中引入自动化生成流程。

This article presents the concept of building real-time collaboration and live data synchronization on Android by using Ktor's asynchronous WebSocket capabilities. It frames WebSockets as the mechanism for low-latency, bidirectional communication and highlights Ktor as a Kotlin-friendly library to enable persistent connections between clients and servers. The piece is aimed at Android developers interested in adding live sync features—such as collaborative editing or shared state updates—and outlines why async WebSockets are suited to those scenarios. Readers can expect an overview of the approach and considerations for integrating Ktor WebSockets into Android projects, with the goal of enabling responsive, synchronized experiences across devices.

本文介绍了如何在 Android 平台上通过 Ktor 的异步 WebSocket 功能实现实时协作和数据同步。文章指出 WebSocket 能提供低延迟、双向通信，并将 Ktor 描述为适合 Kotlin 生态的工具，用于建立和维护持久连接。面向希望在应用中加入共享状态或协同编辑等实时功能的 Android 开发者，文章提供了整体思路与整合注意点，帮助读者理解如何将 Ktor WebSocket 应用于跨设备的实时同步场景。

This article contrasts coroutines and threads and explains when to prefer each approach. It begins from the premise that synchronization issues are a common source of bugs and aims to show concrete situations where threads outclass coroutines — for example, when strict isolation, predictable scheduling, or compatibility with blocking legacy APIs matter. Conversely, coroutines are highlighted for their lightweight nature, composability, and efficiency in many asynchronous workloads. Rather than endorsing one as universally superior, the piece frames the decision as a trade-off: coroutines reduce boilerplate and scale well for many I/O-bound tasks, while threads remain the safer choice for CPU-bound work, deterministic thread-local behavior, or when synchronization complexity demands stronger isolation. The guidance is to evaluate workload, synchronization needs, and system constraints to select the best model.

本文对比协程与线程，并说明在何种场景下应优先采用哪种方法。作者以同步问题常带来难以处理的错误为出发点，指出当需要严格隔离、确定性调度或与阻塞式旧有 API 集成时，线程通常更稳妥；而在大量异步、I/O 密集或需轻量并发控制的场景下，协程凭借低开销和良好组合性更适合。文章强调这不是一场单方面的胜负论，而是根据 CPU 绑定程度、同步复杂度和系统限制等条件进行权衡，从而减少竞态与同步错误并提升可维护性。

Kotlin's contract functions let developers inform the compiler about a function's effects on control flow and types, enabling smarter type narrowing and safer APIs. By declaring a contract—such as indicating a predicate implies a receiver is non-null or that a lambda is invoked exactly once—you provide the Kotlin compiler with precise guarantees for static analysis. This improves smart casts, reduces runtime checks, and lets API authors express intent that the compiler can enforce. Although powerful, contracts are an advanced feature that many Android developers miss. Learning to write concise, correct contracts yields clearer code, fewer defensive checks, and better integration with Kotlin's type system and null-safety, ultimately improving both API design and compiler-assisted correctness.

Kotlin 的契约函数允许开发者向编译器说明函数对控制流与类型的影响，从而启用更聪明的类型缩窄和更安全的 API。通过声明契约（例如：在某个谓词为真时接收者必定非空，或某个 lambda 仅被调用一次），为编译器提供可用于静态分析的明确保证。这可以改进 smart casts、减少运行时检查，并使 API 作者以编译期可校验的方式表达意图。尽管功能强大，但契约是进阶特性，许多 Android 开发者容易忽视。掌握简洁正确的契约写法，有助于代码更清晰、减少防御性检查，并改善与 Kotlin 类型系统和 null-safety 的配合。

This tutorial explains how to perform wildcard-style searches in Elasticsearch using Java, covering wildcard, prefix, regexp and fuzzy queries, their use cases, and implementation examples with the Elasticsearch Java client. It explains wildcard() for flexible patterns using * and ?, recommends targeting keyword subfields for exact matching and shows case-insensitive search by lowercasing terms and .caseInsensitive(true). It describes prefix() for optimized starts-with/autocomplete, regexp() for Lucene-style complex patterns, and fuzzy() for typo tolerance using Levenshtein distance via fuzziness 'AUTO'. The article includes Java implementations for each query type, a helper to extract results, and unit and integration testing guidance, with mocked responses and Docker-based ElasticsearchContainer setup for reproducible integration tests. It concludes by highlighting trade-offs and pointing to the full code on GitHub.

本文介绍了如何在 Java 中对 Elasticsearch 进行通配符式搜索，涵盖了 wildcard、prefix、regexp 和 fuzzy 四种查询方法及其利弊。文章说明了 wildcard() 如何用 * 和 ? 实现灵活匹配，并建议针对 .keyword 子字段执行精确匹配、将搜索词小写化并使用 caseInsensitive 来获得可预测结果；prefix() 适用于 starts-with/自动补全场景，regexp() 支持复杂的 Lucene 风格正则表达式，而 fuzzy() 则通过 Levenshtein 距离（fuzziness: 'AUTO'）实现容错匹配。文中提供了每种查询的 Java 实现、结果提取辅助方法，以及单元测试与通过 ElasticsearchContainer 在 Docker 中运行的集成测试示例，并指向 GitHub 上的完整代码。

@MockitoSpyBean, introduced in Spring Framework 6.2, is an annotation for wrapping an existing Spring bean with a Mockito spy in tests. Unlike a mock, a spy delegates to the original implementation unless a method is stubbed, allowing partial mocking while preserving the bean’s initialization, dependencies, lifecycle callbacks and proxies. This differs from the older @SpyBean which created a replacement spy instance and could disrupt proxy chains or lifecycle behavior; @MockitoSpyBean instead retrieves the real bean Spring created and wraps it, making it proxy-safe and more predictable in complex or AOP/transactional scenarios. Migration is straightforward: replacing @SpyBean with @MockitoSpyBean typically requires no further changes, and it integrates Mockito more tightly with the Spring TestContext. It’s recommended for new projects and integration tests where you want to observe or stub interactions without discarding real application logic.

@MockitoSpyBean 是在 Spring Framework 6.2 中引入的测试注解，用于将应用上下文中已经创建的真实 bean 包装成 Mockito spy。与完全替换的 mock 不同，spy 会在未被 stub 的情况下调用真实方法，这使得在保持真实实现的同时可进行部分模拟。與舊的 @SpyBean 不同，@MockitoSpyBean 不是替換 bean，而是獲取 Spring 已建立的實例並包裝，從而保留生命周期、相依及代理，避免破壞 AOP 或事务代理鏈。將現有測試從 @SpyBean 遷移到 @MockitoSpyBean 通常很簡單，且建議在新專案和整合測試中使用。

Many Kotlin apps appear clean but remain insecure because language-level features like null-safety do not prevent practical attacks. Common risks include token and credential theft from plaintext SharedPreferences, man-in-the-middle network attacks due to weak TLS or no certificate pinning, reverse engineering and logic bypass from hardcoded keys or minimal obfuscation, supply-chain dependency problems, and runtime tampering on rooted/emulated/debugger-enabled devices. Frequent developer mistakes are storing sensitive data in plain storage, hardcoding secrets, blindly trusting deep links and backend responses, and failing to enable proper obfuscation or tamper detection. Recommended baseline protections include EncryptedSharedPreferences with Keystore, enforcing TLS 1.3 plus certificate pinning, Play Integrity API and tamper protection, R8 obfuscation with runtime detection, and validating all external inputs.

看起来整洁的 Kotlin 应用并不等于安全；语言层面的 null-safety 无法阻止现实攻击。常见风险包括在未加密的 SharedPreferences 存储敏感数据、因弱 TLS 或未实施证书绑定而遭遇 MITM、代码中硬编码密钥或 token 被逆向与逻辑绕过、供应链依赖问题，以及在 root/模拟器或启用调试时的运行时篡改。开发者常犯错误有明文存储敏感信息、未做证书绑定或使用弱 TLS、代码中硬编码密钥、盲目信任 deep link 与后端响应，以及缺乏混淆与反篡改措施。建议使用 EncryptedSharedPreferences + Keystore、强制 TLS 1.3 与证书绑定、加入 Play Integrity 与篡改保护、启用 R8 混淆与运行时检测，并对所有外部输入进行验证。

In "5 Coroutine Mistakes That Are Killing Your App Performance," Prakash Sharma outlines five common coroutine-related errors that can undermine an application's responsiveness and efficiency. The article describes how improper coroutine usage can manifest as increased latency, resource contention, unpredictable scheduling, and reduced stability, and it emphasizes the importance of diagnosing these issues in real codebases. Sharma walks readers through root-cause explanations, detection techniques and performance observations, and suggests practical mitigation approaches to restore more predictable concurrency behavior. The piece is aimed at developers who use coroutines and need to spot anti-patterns, measure their impact, and apply corrective steps to improve throughput and reliability. For detailed examples, metrics and step-by-step fixes, readers are directed to the full Medium article.

Prakash Sharma 的文章《正在毁掉你应用性能的 5 个 Coroutine 错误》概述了五类常见的 coroutine 误用，阐明这些误用如何在实际应用中引发响应变慢、资源争用与稳定性下降等性能问题。文章强调在代码中识别反模式的重要性，介绍了问题诊断的观察方式与性能量测，并提出可行的缓解思路，帮助开发者改善并发行为与资源利用效率。想了解具体示例、测量数据和逐步修复方法，请参考原始 Medium 文章。

This article presents practical Kotlin patterns tailored for server-side development that help tidy Spring and Ktor backends, reduce repetitive boilerplate, and make concurrency safer while remaining compatible with the JVM. Rather than proposing radical rewrites, it advocates idiomatic Kotlin techniques that integrate cleanly with existing JVM frameworks to streamline common backend tasks, clarify structure, and lower maintenance costs. The discussion emphasizes concise abstractions and consistent patterns to cut repetition across handlers, wiring, and configuration, and stresses choosing approaches that respect JVM semantics to avoid interoperability and runtime friction. Aimed at backend developers, the piece offers pragmatic strategies for producing cleaner, safer, and more maintainable Kotlin server code without abandoning the Java ecosystem.

本文介绍一组实用的 Kotlin 做法，针对服务器端开发，旨在整理 Spring 与 Ktor 后端、减少重复样板代码并提升并发安全，同时保持与 JVM 的兼容性。作者主张采用惯用且能与现有 JVM 框架良好整合的 Kotlin 技巧，透过简洁的抽象和一致的设计，精简处理流程、配置和路由等重复工作，降低维护成本，并避免与 JVM 运行时发生摩擦。文章作为务实参考，提供后端工程师在不放弃 Java 生态的前提下，编写更清晰、更安全且更易维护的 Kotlin 服务器代码的策略。

This article covers how to use three core Jetpack Compose techniques—AnimatedVisibility, animateContentSize(), and placement animations—to produce fluid, structural layout transitions in Android apps. It explains the roles of each API: AnimatedVisibility for enter/exit animations of composables, animateContentSize() for smoothing size changes of containers and views, and placement-related APIs to animate item moves and reordering. The piece emphasizes practical patterns for combining these tools so UI changes feel cohesive rather than jarring, touching on coordination of timing and easing and on when to apply each technique. The guidance helps developers decide which animation primitive fits common scenarios (appearance/disappearance, container resizing, list rearrangement) and how to integrate them in Compose-based layouts to improve perceived responsiveness and polish.

本文讲述如何在 Jetpack Compose 中使用 AnimatedVisibility、animateContentSize() 和位置（placement）动画来实现流畅的结构性布局过渡。分别阐明每个 API 的作用：AnimatedVisibility 负责组件的进入/退出动画，animateContentSize() 用于平滑组件或容器的尺寸变化，位置动画则处理列表项或组件重排时的移动表现。文章强调实用组合模式与时序、缓动的协调，帮助开发者在常见情境下判断并整合合适的动画原语，从而使界面变化更自然、提升交互质感。

Shiv Chauhan explains practical approaches for migrating a large, mature Android app to Kotlin without disrupting releases. The article discourages fear of migration and outlines a pragmatic, incremental path that modernises parts of the codebase while preserving the running application. It emphasizes leveraging Kotlin–Java interoperability to move components gradually, maintaining strong automated testing and continuous integration to catch regressions early, and employing feature flags, monitoring, and staged rollouts to keep user-facing behavior stable. The piece aims to reassure engineering teams that migration need not be a risky rewrite: with small, well-tested steps, clear risk controls, and attention to release processes, teams can modernise high-traffic apps serving hundreds of thousands of users while keeping to scheduled releases. He also shares lessons and practical tips to lower risk and keep product momentum during the transition.

Shiv Chauhan 在文章中阐述，面对为数十万活跃用户服务的成熟移动应用，将代码迁移到 Kotlin 并非不可承受之重。作者倡导采取增量式策略，依靠 Kotlin 与 Java 的互操作性逐步现代化代码，同时结合严格的自动化测试、持续集成、监控以及功能开关与分批上线等发布手段，既能控制风险又能维持既有的发版节奏与用户体验。文章旨在提供实用建议与风险管控方法，帮助团队在不中断发布的前提下稳健推进现代化迁移。

This article highlights that Kotlin apps can harbour overlooked security flaws despite developers' confidence after building them. It emphasizes that a sense of assurance does not guarantee safety, and that many security issues remain under-discussed in the Kotlin community. The piece calls for developers to reconsider assumptions, pay closer attention to potential weaknesses in their codebases, and make security a deliberate part of development and review processes. Readers are encouraged to consult the full article on ProAndroidDev for specific examples, analyses, and recommended mitigation approaches provided by the author, Vaibhav Shakya (Mr Neo). Overall, the message is a prompt to move beyond complacency and to adopt more rigorous security practices when developing Kotlin applications.

文章指出，尽管开发者在构建 Kotlin 应用后常有自信，但仍可能存在鲜为人知的安全缺陷。作者提醒不要将信心等同于安全，因为许多潜在问题没有得到充分讨论或审视，可能影响应用的可靠性和用户数据安全。文章呼吁开发者重新审视既有假设，将安全性有意识地纳入开发与代码审查流程，以避免疏忽带来的风险。要了解具体示例、分析与缓解建议，请阅读 ProAndroidDev 上 Vaibhav Shakya（Mr Neo）发表的完整文章。总体讯息是：别自满，主动加强安全实践。