Halyx blog

Halyx 1.1.0

2026-11-02T00:00:00.000Z

Halyx 1.1.0 adds a ninth service, function invocation, and reads keys and passwords from a parameter store as they're used, so rotating one no longer means restarting. It also brings Kotlin coroutines to listeners and repositories. Code written for 1.0 keeps compiling and running unchanged.

Release on GitHub

Function invocation#

Issue #22. A FunctionInvoker calls an AWS Lambda function, an Azure Function or a Cloud Run function by name, with each cloud's login: IAM on Lambda, an Entra ID token or a function key on Azure, and a Google ID token on Cloud Run.

Java

FunctionInvoker resize = halyx.provider("images").functionInvoker("resize-image");

FunctionResponse response = resize.invoke(FunctionRequest.builder("{\"key\":\"a.png\"}")
        .header("X-Tenant", tenant)
        .build());

The behaviour is the same on all three clouds:

A function that throws raises UnavailableException, and a missing one NotFoundException. What the function reported is kept whole as a FunctionError cause: Lambda's error message, type and payload, or an HTTP function's status and body (#31).
An invocation runs the function, so it's retried only when the function is configured idempotent.
Requests over a cloud's payload or header limit are refused before they're sent.
trigger starts a Lambda function without waiting. There are async() and reactive views, trace context carried into the function, and halyx.functions in Spring Boot.

A function conformance kit checks every provider: in memory, on Floci's Lambda, the Azure Functions host and Google's Functions Framework, and on real Lambda, Azure Functions and Cloud Run functions. See the functions guide.

Keys and passwords that rotate#

Issue #26. Logging in with IAM or Entra ID is still the best way, but some services take a key or a password. Halyx now reads them from a parameter store as they're used, so a rotation takes effect without a restart:

Azure function keys, on every call.
Cosmos DB account keys and Event Grid access keys, every azure.key-refresh-interval (a minute by default).
Cache and Kafka passwords, each time a connection logs in, as SQL passwords already were.

In Spring Boot, these are secrets entries and auth.secret:

YAML

halyx:
  providers:
    azure:
      type: azure
      properties:
        azure.cosmos.endpoint: https://acme.documents.azure.com:443/
      secrets:
        - property: azure.cosmos.key
          store: app-secrets       # one of halyx.parameter-stores, on any provider
          name: orders-cosmos-key

A missing secret fails the start, naming the entry, and so does a halyx.* value whose ${...} placeholder didn't resolve. Before, Spring left the placeholder as written, and it was sent as the key. The store can be on another cloud: a function on Azure can keep its key in AWS Secrets Manager. See Keys for other services.

Note

Service Bus and App Configuration connection strings are still read once, because their SDKs copy the key when the client is built. For keys that rotate there, log in with Entra ID.

Kotlin coroutines#

Issue #11. A @HalyxListener can be a suspend fun, for subscriptions and stream consumers. Returning acknowledges the message and throwing retries it, as with any listener. Repositories take suspend CRUD methods and derived queries, with Flow results read page by page.

@HalyxListener("billing")
suspend fun onOrder(placed: CloudEvent) {
    invoices.put(BlobKey.of(placed.subject().orElseThrow()), render(placed)).awaitSingle()
}

Tested on Boot 3.5 (Kotlin 1.9) and Boot 4 (Kotlin 2.3). See Reactive applications.

Also in 1.1.0#

API compatibility checks (#4): every build compares each published module with the last release, the provider SPI included, and fails on an incompatible change. 1.1.0 was checked against 1.0.0.
Dependency scanning: OSV-Scanner checks every published module and the samples on each change, and weekly.
Dependencies: tested on Spring Boot 4.1.2 and 3.5.16, and on the Google Cloud libraries 26.91.0, with the OpenTelemetry API held at 1.67.0 for a security fix.

Before the release, every real-cloud tier passed on AWS, Azure and Google Cloud, with Spring Boot 3.5 and 4, including the key rotation tests on Azure. The portable orders service passed on EKS, GKE and AKS. The results are in Cloud testing.

Upgrading#

Bump the BOM; nothing else changes.

implementation(platform("dev.halyx:halyx-bom:1.1.0"))

From 1.1.0, security fixes go to the 1.1 line.

Halyx 1.0.2

2026-10-25T00:00:00.000Z

Halyx 1.0.2 fixes the JSON cache codec on Spring Boot 4 and changes how cancelled reactive calls behave. It also adds a quickstart sample for applications that don't use Spring.

Release on GitHub

Fixes#

JSON cache codec on Spring Boot 4#

Issue #9. With halyx.cache-manager.codec=json, and with Jackson 2 also on the classpath (halyx-azure brings it in), the codec used Jackson 2 without Java date/time support. Caching a value that held an Instant failed. Jackson 3 is now always preferred when it's present.

Cancelling a reactive call#

Issue #12. Cancelling a ReactiveHalyx call that had already started, with timeout() for example, interrupted its thread on the default virtual-thread scheduler and on boundedElastic. That could abort a blocking SDK call partway through.

Now a call that has started runs to completion, and its result is dropped, as documented. A call cancelled before it starts never runs.

Note

Calls on the non-blocking path are cancelled with the subscription, and the driver may abort the request. The reactive guide now says so.

Samples#

Plain Java quickstart#

Issue #2, contributed in #8. halyx-samples/plain-java-quickstart shows object storage, messaging and parameters without Spring. It runs on the in-memory provider by default, or on a cloud that you pick with system properties. The README and Getting started link to it.

Upgrading#

Bump the BOM; nothing else changes.

implementation(platform("dev.halyx:halyx-bom:1.0.2"))

Halyx 1.0.1

2026-10-23T10:29:00.000Z

Halyx 1.0.1 is a patch release with two fixes. If you build with Gradle on Spring Boot 3.5, you need it.

Release on GitHub

Fixes#

Gradle with Spring Boot 3.5#

halyx-aws, halyx-azure and halyx-gcp failed to resolve. halyx-kafka brought in both the patched at.yawk.lz4:lz4-java and the org.lz4:lz4-java that Boot 3.5's kafka-clients depends on, and Gradle refuses two modules that declare the same capability.

halyx-kafka now excludes org.lz4:lz4-java, so only the patched one is on the classpath. That holds for Maven builds too.

`ReactiveBlobStore.getBody` closes on time#

The blob is now closed before the completion or error reaches the subscriber, as documented, rather than just after it.

Upgrading#

Bump the BOM; nothing else changes.

implementation(platform("dev.halyx:halyx-bom:1.0.1"))

Halyx 1.0.0

2026-10-23T06:45:00.000Z

Halyx 1.0.0 is out: one Java API for object storage, NoSQL documents, messaging, events, streams, SQL databases, caches, and parameters and secrets on AWS, Azure and Google Cloud, built over each cloud's own SDKs.

Get started Release on GitHub

Requirements#

Java 21 or later.
For Spring Boot applications, Spring Boot 3.5 or 4.

What's in it#

Object storage on S3, Azure Blob Storage and Cloud Storage, with parallel transfers, presigned URLs and conditional writes.
NoSQL documents on DynamoDB, Cosmos DB and Firestore, with secondary indexes and transactions, plus Spring Data repositories with derived queries, optimistic locking and keyset scrolling.
Messaging on SNS and SQS, Service Bus and Pub/Sub: listeners, batched acknowledgements, sessions, claim checks and tracing.
Events as CloudEvents 1.0, published to EventBridge, Event Grid namespace topics and Eventarc Advanced.
Streams on Amazon MSK, Event Hubs and Managed Service for Apache Kafka, with consumer groups, retries, dead letters, and idempotent and transactional producers, plus Spring for Apache Kafka with Halyx's cloud login.
SQL databases through JDBC and R2DBC, logging in with RDS IAM, Entra ID or Cloud SQL IAM, or through the Cloud SQL connector.
Caches on ElastiCache, Azure Cache for Redis, Azure Managed Redis and Memorystore, with cloud IAM login and a Spring CacheManager.
Parameters and secrets from SSM Parameter Store, Secrets Manager, App Configuration, Key Vault, Parameter Manager, Secret Manager and Vault, with Spring configuration import (halyx:) and reload.
Credentials: each cloud's default chain, plus assumed AWS roles, impersonated Google service accounts and Entra ID service principals. That includes a federated token from another cloud, so no secret is stored.
Spring Boot: properties for every service, health indicators, Micrometer metrics, and @HalyxListener methods.
Reactive and asynchronous APIs for every service, non-blocking where the SDK's async client allows.
A portable microservice sample that runs one image unchanged on EKS, GKE and AKS.
AI skills for migrating a Spring Boot service to Halyx, reviewing one for portability, and creating a new one.

Modules#

Module	What it adds
`halyx-bom`	One version for every Halyx module, and for the Cloud SQL connector
`halyx-core`	The portable API, provider SPI, error model, interceptors and an in-memory provider
`halyx-aws`	S3, DynamoDB, SNS, SQS, EventBridge, SSM Parameter Store, Secrets Manager, ElastiCache, RDS and MSK IAM login
`halyx-azure`	Blob Storage, Cosmos DB, Service Bus, Event Grid namespaces, Key Vault, App Configuration, Event Hubs, and Entra ID login for caches and databases
`halyx-gcp`	Cloud Storage, Firestore, Pub/Sub, Eventarc Advanced, Secret Manager, Parameter Manager, Managed Kafka, and IAM login for Memorystore and Cloud SQL
`halyx-vault`	HashiCorp Vault KV v2 parameters and secrets
`halyx-redis`, `halyx-sql`, `halyx-r2dbc`, `halyx-kafka`	Redis and Valkey caches, a pooled JDBC `DataSource`, a pooled R2DBC `ConnectionFactory`, and Kafka streams, each with cloud IAM login
`halyx-reactor`	`Mono` and `Flux` views of every service
`halyx-micrometer`	Observations of every operation, and trace context carried through messages, events and stream records
`halyx-spring-data-document`	Spring Data repositories over DynamoDB, Cosmos DB and Firestore
`halyx-spring-boot-starter`	Spring Boot auto-configuration, on Boot 3.5 and 4
`halyx-tck`	The conformance kits, for testing a provider

Each jar has a Java module name, such as dev.halyx for halyx-core and dev.halyx.aws for halyx-aws.

Testing#

Every service passes the conformance kits on the in-memory provider, on each cloud's emulators and on the real clouds, with Spring Boot 3.5 and 4. The latest results are in the cloud testing reports.

Known limitations#

Note

Not yet run on real clouds: MSK Serverless (the test account's plan doesn't allow it), Azure Database for MySQL with Entra ID, and the service principal's certificate login.

Some calls still block underneath, on a virtual thread: Cloud Storage, Service Bus receives, and Cosmos DB and Firestore read-then-write calls.
R2DBC to SQL Server is password-only, because its driver takes no access tokens.

The roadmap has what comes next.

Halyx blog

Halyx 1.1.0

Function invocation#

Keys and passwords that rotate#

Kotlin coroutines#

Also in 1.1.0#

Upgrading#

Halyx 1.0.2

Fixes#

JSON cache codec on Spring Boot 4#

Cancelling a reactive call#

Samples#

Plain Java quickstart#

Upgrading#

Halyx 1.0.1

Fixes#

Gradle with Spring Boot 3.5#

ReactiveBlobStore.getBody closes on time#

Upgrading#

Halyx 1.0.0

Requirements#

What's in it#

Modules#

Testing#

Known limitations#

`ReactiveBlobStore.getBody` closes on time#