Latest posts from Codename One.
Blog
Insights, release updates, tutorials, and engineering notes from the Codename One team.
SQLite Across Every Port: One Contract, One Encrypted File Format
The original com.codename1.db implementation delegated SQLite calls to the database supplied by each operating system. We knew this was less portable than the rest of Codename One, but fixing it meant taking ownership of SQLite on every target. That looked like a deep rabbit hole, so we exposed escape hatches instead. The pluggable SpatiaLite work we described in 2018 is one example. ...
App Hardening: One Obfuscation Pipeline Across Every Port
Obfuscating only the Android artifact is a poor security model for a cross-platform application. Codename One App Hardening transforms the merged application before it splits into Android, iOS, JavaScript, Windows, Linux, and desktop builds. We set the target at DexGuard-class resistance: rename useful symbols, remove plaintext application strings where the target permits it, distort selected control flow, and keep crash reports readable. This is not a claim that reverse engineering becomes impossible. It is a commitment to make the same security decision cover the whole application instead of leaving every port to a different tool and configuration. ...
The Third-Generation GUI Builder: One Workspace for Every Form
We have rebuilt the Codename One GUI Builder again. This is its third generation. The interesting part is not another drag-and-drop surface. It is what we kept, what Maven broke, and why a visual editor must understand the whole project instead of opening one generated form at a time. This is a smaller rewrite than the second generation Steve Hannah built. His guided layout work remains the foundation. PR #5523 replaces the surrounding shell with a Maven-first Codename One application that moves between forms, CSS, and Java without leaving the workspace. ...
App Shield: Your Server Should Not Trust the App Calling It
Any security check that runs only on a phone can be patched out on that phone. App Shield moves the final decision to your server by attaching a short-lived, server-verified attestation token to protected requests. Greetings from Thailand. My family dragged me here for a forced vacation. It is a lovely country, but beaches, sunshine, and the sea aren’t really my thing. The GitHub Actions downtime didn’t help either, so progress was slower than usual this week. Several interesting PRs are still in progress, and we chose not to rush them. ...
Why Codename One Is Moving Beyond Maven Central
Editor’s note, August 28, 2026. The migration described below is complete. The dual-publish window ran as planned and new releases now go to the Codename One repository only. Maven Central keeps every version published before today and nothing has been removed from it, so existing projects pinned to one of those versions are unaffected. A project needs the repository block shown below to see releases published from today onward; generated projects have had it since the Initializr change. The rest of this post is left as written. ...
A Polyline Is Not a Route
A polyline can draw the points you give it. It cannot discover the road between them. PR #5480 adds com.codename1.maps.routing, a portable route model and service layer for road geometry, distance, duration, waypoints, alternatives, legs, steps, and encoded polylines. We talked about routing in Friday’s release post. The two-line route For the common case, give Routing a map and two coordinates: ...
On-Device AI and MCP on Every Port
There are two very different ways to connect AI to an application. One puts the model inside the feature: OCR a receipt, identify a language, segment a person, or run an application-owned model. The other lets an agent stand outside the application, inspect its semantic UI, and operate it while a developer watches. That second path is extraordinarily useful for debugging. It is also a control channel, so where it listens matters. ...
Health Data Without Fake Certainty
The hardest part of a health API is not reading a heart-rate number. It is knowing what that number means, which store supplied it, whether anything is missing, and what the application is legally allowed to do next. PR #5475 merged a cross-platform health API for HealthKit, Health Connect, recorded workouts, nutrition, Bluetooth health sensors, and deterministic simulation into the core. The implementation has compile, link, and automated coverage. Real-device testing remains important for store permissions and sensor hardware. ...
Push V3: One Message From Your Server to Every Surface
Push notifications should be application infrastructure, not a pile of expiring certificates and provider-specific JSON. This week we merged Push V3 into the Codename One core and completed its new cloud implementation. It gives an application a typed message model, managed provider credentials, subscriptions, server-side segments, campaigns, analytics, and a direct path into Surfaces. There is also one thing every existing push developer should do now: ...
Compact Strings Cut Character Storage in Half
PR #5421 adds compact strings to ParparVM. Strings that fit in Latin-1 now use a byte[]; strings that need wider code units continue to use char[]. ParparVM previously stored every Java String in a char[]. Class names, JSON keys, URLs, numbers, log messages, and much Western European text therefore used two bytes per code unit when one byte was enough. The implementation follows the basic approach in JEP 254 for modern HotSpot. ParparVM also had to preserve fused allocation without adding another pointer to every string. ...
A Lightweight Rich Text Component Without a Web View
PR #5421 adds RichTextComponent, a read-only component for formatted application text. It supports headings, inline styles, lists, links, and images without embedding a web view. A SpanLabel applies one style to wrapped text. A BrowserComponent renders a complete web page. RichTextComponent covers formatted document content between those two cases and participates in ordinary Codename One layout. Rich text inside a scrollable container A common screen mixes formatted text with buttons, images, forms, and other Codename One components inside one scrollable container. A BrowserComponent is a poor fit for that layout because it owns a rectangular native surface and its own page viewport. The browser’s document height does not naturally become the height of a child inside the parent Codename One layout. ...
Pure Codename One Text Editing Without Native Overlays
PR #5386 adds a pure Codename One text-editing path. EditField, RichTextArea, and CodeEditor can now keep their document, selection, and painting inside the lightweight UI while each port supplies keyboard and input-method events. Text input must handle virtual keyboards, hardware keys, autocorrect, dictation, marked text from an input method editor, bidirectional text, selection, clipboard formats, and accessibility geometry. Codename One traditionally delegates that work to a native platform field placed over the lightweight component during editing. The overlay remains the default for TextField and TextArea. It can create a small visual jump, and it cannot participate in lightweight painting for syntax highlights, rich runs, masks, inline images, or a custom selection model. ...