惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Spread Privacy
Spread Privacy
A
Arctic Wolf
T
Threatpost
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
The GitHub Blog
The GitHub Blog
博客园 - 聂微东
Cyberwarzone
Cyberwarzone
博客园 - Franky
V2EX - 技术
V2EX - 技术
The Hacker News
The Hacker News
量子位
TaoSecurity Blog
TaoSecurity Blog
Last Week in AI
Last Week in AI
C
CERT Recently Published Vulnerability Notes
P
Palo Alto Networks Blog
Scott Helme
Scott Helme
D
DataBreaches.Net
T
Troy Hunt's Blog
T
Threat Research - Cisco Blogs
美团技术团队
雷峰网
雷峰网
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
H
Hacker News: Front Page
D
Docker
C
Check Point Blog
G
GRAHAM CLULEY
H
Heimdal Security Blog
IT之家
IT之家
博客园 - 叶小钗
The Cloudflare Blog
H
Help Net Security
M
MIT News - Artificial intelligence
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
Security Archives - TechRepublic
Security Archives - TechRepublic
N
Netflix TechBlog - Medium
Apple Machine Learning Research
Apple Machine Learning Research
I
Intezer
P
Proofpoint News Feed
S
Security Affairs
P
Privacy International News Feed
U
Unit 42
Application and Cybersecurity Blog
Application and Cybersecurity Blog
Webroot Blog
Webroot Blog
Google DeepMind News
Google DeepMind News
大猫的无限游戏
大猫的无限游戏
人人都是产品经理
人人都是产品经理
N
News and Events Feed by Topic
Know Your Adversary
Know Your Adversary
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Recap — M0 Foundations
Ankit Verma · 2026-06-16 · via DEV Community

This module built one thing, from many angles: the container — the part of Spring that creates your objects, wires them together, and hands them out. Eight articles each zoomed in on a different corner of it. This recap zooms back out. The goal here is not to re-explain each topic, but to show how they are all the same idea seen from different sides, so the whole module collapses into a picture you can hold in your head at once.

So before the details, here is the single sentence the entire module hangs on: the container is a factory that runs at startup, and almost every feature you met is just that factory doing a little extra work while it builds a bean. Keep that sentence close. Everything below is a way of filling it in.

The factory, in one picture

Picture an assembly line that runs exactly once, when your application boots. You hand it a list of what to build and how the pieces fit. It builds every object your app is made of, connects them, sets them on a shelf, and hands them out on request for the rest of the program's life.

That assembly line is the container. The objects it builds and manages are beans. An object you create yourself with new is not a bean — Spring never touched it — and that distinction is the thread running through every trap in this module.

The factory does four things at startup, and the order matters: it reads recipes, works out who needs whom, builds from the bottom up, and caches each result.

ApplicationContext ctx = SpringApplication.run(App.class, args);
OrderService svc = ctx.getBean(OrderService.class); // already built and wired

By the time run returns, the work is done. Asking for a bean is instant because the building already happened. Every other topic in the module is a detail about how that one startup pass works.

Why we hand the work over at all

The module opened with a question of control. Left alone, a class builds its own collaborators with new — and in doing so it welds together two unrelated decisions: what it needs, and which exact thing it gets and how that thing is built.

class OrderService {
    private final PaymentGateway gateway = new PaymentGateway(new HttpClient());
}

Pulling those two decisions apart is the whole point. The class should declare what it needs and let something outside choose and supply the which. Handing that choice to the framework is Inversion of Control — your code stops creating its own collaborators. The way the collaborator then arrives is Dependency Injection — it is passed in from outside.

@Service
class OrderService {
    private final PaymentGateway gateway;

    OrderService(PaymentGateway gateway) {   // declares the need, receives it
        this.gateway = gateway;
    }
}

IoC is the idea; DI is the delivery. And the delivery has a preferred form for a mechanical reason, not a stylistic one: constructor injection makes the field final, makes the object impossible to build half-wired, and makes it testable with a plain new in a unit test. That preference for the constructor is a decision the rest of the module keeps cashing in.

How a single bean comes to life

Once you accept that the factory builds your beans, the natural next question is how it builds one. The answer is a fixed four-stage sequence — the bean lifecycle:

  1. Instantiate — construct the raw object.
  2. Populate — inject field- and setter-style dependencies.
  3. Initialize — run setup now that everything is wired.
  4. Destroy — run teardown at an orderly shutdown.

The order is the lesson. A field-injected dependency is null if you touch it in the constructor, because populate (stage 2) has not run yet. Setup that needs dependencies belongs in @PostConstruct (stage 3), where wiring is guaranteed complete. Teardown mirrors it in @PreDestroy (stage 4).

Notice how this rewards constructor injection again: it folds populate into instantiate, so a constructor-injected bean is never half-there. The lifecycle is just the factory's per-bean routine, and most of its surprises come from forgetting which stage runs when.

How many, and how long

The lifecycle describes one bean's journey. Scope answers the other two questions about it: how many instances exist, and how long each lives.

  • Singleton — one instance per container, the default, shared by everyone.
  • Prototype — a fresh instance on every request, built on demand.
  • Request and session — one instance per HTTP request or per user session.

"Shared," in the singleton line, is the dangerous word, and it leads to the module's most common bug. Because one singleton serves every thread at once, any mutable field on it is a race condition.

@Service
class CartService {
    private int itemCount;          // one field, every thread, lost updates
    void addItem() { itemCount++; }
}

The rule that falls out is short: keep singletons stateless. Immutable shared state — your injected dependencies — is exactly what a singleton is good at; mutable shared state is the trap.

Which container is doing all this

Up to here, "the container" has been a single idea. In Spring's code it wears two names, and the difference matters. BeanFactory is the minimal contract — store recipes, build beans lazily on request. ApplicationContext extends it and staffs it.

That staffing is the whole reason you always use the ApplicationContext. Features like @Autowired and @PostConstruct are not part of the factory core — each is a plugin called a BeanPostProcessor that gets a crack at every bean during the lifecycle. The bare BeanFactory registers none of them, so it silently ignores your annotations. The ApplicationContext registers them all automatically, and it builds singletons eagerly at startup — so a broken wiring fails at boot, on your machine, not three days later in production.

ApplicationContext ctx = new AnnotationConfigApplicationContext("com.shop");
// every annotation honored, every singleton already built

This is the same fail-fast instinct constructor injection showed with circular dependencies: surface the problem at the safest possible moment.

How you tell the factory what exists — and how it finds it

The factory needs recipes. Where they come from is the configuration style, and Spring has had three, each fixing the last one's pain:

  • XML — all wiring in an external file. Central, but verbose and string-typed.
  • Annotations@Component and friends mark the class itself. The default for your own code.
  • Java config@Bean methods inside a @Configuration class. The way to register classes you cannot annotate, like third-party objects.

All three end as the same internal bean definitions, which is why one app mixes them freely. Java config carries one subtlety worth keeping: Spring wraps a @Configuration class in a proxy so that a call from one @Bean method to another returns the shared bean instead of building a second one.

For the annotation style, component scanning is how the factory actually finds your marked classes. @ComponentScan walks a base package and everything beneath it — and only ever downward, which is why the main class lives in the root package, and why a class above the scan's start point silently never registers. The stereotypes@Service, @Repository, @Controller — are just @Component with a role attached, scanned identically, though @Repository earns exception translation as a bonus.

How the factory connects the beans

With every bean found and defined, the last job is wiring them — autowiring. The rule is resolution by type: the container finds the one bean whose type fits a dependency and injects it. One match and the wiring is silent.

The interesting part is the tie-break, when two beans fit one slot. The container refuses to guess and fails fast; you break the tie three ways:

  • Parameter name — a quiet fallback that matches the injection point's name to a bean name.
  • @Primary — one global default, declared on the bean.
  • @Qualifier — a named choice at the injection point, which overrides @Primary.

And when a dependency might legitimately be absent, Optional<T> or ObjectProvider<T> make that explicit instead of crashing.

The two threads that run through everything

Step back and two ideas turn out to connect almost every topic.

The first is the proxy — a same-shaped stand-in the factory can hand you instead of the bare bean. It is not one feature; it is the same trick reused everywhere. It is how @Transactional opens a transaction around your method. It is how a request-scoped bean gets injected into a singleton — the proxy resolves to the right per-request instance on each call. It is how a @Configuration class avoids building a bean twice. And its timing — created after @PostConstruct runs — is why init code self-calling a proxied method quietly skips the wrapper. Once you see the proxy, a dozen "how does Spring even do that?" questions share one answer.

The second is fail-fast: surface a mistake at the earliest, safest moment. Eager singleton startup catches broken wiring at boot. Constructor injection turns a circular dependency into a boot-time error instead of a production StackOverflowError. An ambiguous autowire stops the app rather than picking the wrong bean. The strictness is the safety.

The traps, as one family

Almost every gotcha in this module is the same mistake wearing different clothes — a mismatch between when injection happens and when you use the result:

  • A field-injected dependency touched in the constructor is null — populate runs after the constructor.
  • A mutable field on a singleton races — one instance is wired once and shared across every thread.
  • A prototype injected into a singleton freezes — injection is a one-time event, so you get one prototype forever; reach for ObjectProvider to pull a fresh one each call.
  • A proxied method self-called inside @PostConstruct skips the proxy — the wrapper is not built yet.

See them together and they stop being four facts to memorize. They are all consequences of one truth: for a singleton, wiring happens exactly once, at startup.

The one picture to keep

If you keep only one thing from this module, keep the factory. The container reads recipes, builds your beans bottom-up in dependency order, can wrap each one in a proxy, caches the results, and fails fast when something does not fit. Inversion of Control is why you hand the work over; dependency injection is how the pieces arrive; the lifecycle is how one bean is assembled; scope is how many and how long; the ApplicationContext is the fully-staffed factory that runs it; configuration, scanning, and autowiring are how it learns what to build and connects it all.

Everything heavier you meet from here — AOP, transactions, web request handling, data access — is a variation on this one startup pass. The factory does not go away. It just keeps finding new work to do while it builds your beans.