Latest posts from Codename One.
Blog
Insights, release updates, tutorials, and engineering notes from the Codename One team.
App Intents: One Java Declaration for Siri, Spotlight, and Shortcuts
@AppIntent can expose a public static Java method to Siri, Spotlight, and Shortcuts. The same declaration can also drive an Android launcher shortcut or an internal application command. PR #5559 adds com.codename1.intents and the build-time annotations behind that integration. The build generates only the native declarations each target supports. For encrypted SQLite and the rest of this week’s work, see the weekly release overview. ...
CodeScanner.scan(): Barcode Scanning Without Rebuilding the Camera Pipeline
The new vision analyzers could read barcodes, faces, poses, text, documents, and segmentation masks. Scanning one QR code still meant opening a camera, configuring a session, listening for frames, converting each frame, feeding a pipeline, moving the result to the event thread, and restoring the previous form. The low-level layer remains necessary for custom camera products. It should not be a prerequisite for reading one code or counting faces. ...
Tapjacking Protection: Rejecting Android Touches Behind an Overlay
We are continuing our security hardening work with protection for the input path. A confirmation screen can be correct and still receive a tap the user did not understand. On Android, another application can draw over the screen and make a transfer button look like part of a different interaction. PR #5553 adds tapjacking and screen-overlay protection to DeviceIntegrity. It can report the condition, drop the full gesture, and ask Android 12 or newer to prevent overlay windows on a sensitive screen. ...
One Java API for HomeKit, Matter, and Google Home
A light can expose brightness through a HomeKit characteristic or a Matter cluster. Application code should ask for brightness, not carry both platform identifiers and two sets of value rules. PR #5554 adds com.codename1.home, a portable model for listing accessories, reading and writing traits, watching changes, running scenes, and commissioning Matter devices. The API also reports cases where the platforms cannot give the same answer. For the other work that shipped this week, see the weekly release overview. ...
JavaScript Find in Page: DOM Text Above the Codename One Canvas
Browser search cannot find pixels. That was the JavaScript port’s text model: Codename One drew each glyph onto a canvas, so a visible label was invisible to find-in-page, text selection, and ordinary browser text machinery. PR #5552 keeps the canvas renderer and promotes eligible visible text into a DOM layer. Codename One still measures and places every run. The browser handles the part it is better at: text rasterization, selection, search, accessibility, input metadata, and device-pixel resolution. ...
Watch Apps: One Codebase, Two Real Applications
A watch app is not a second form in the phone process. It is another application on another device, with its own storage, startup sequence, and periods when the other side is unreachable. PR #5487 now builds an Apple Watch companion from codename1.watchMain. On Wear OS, the same entry point becomes the Android product when codename1.watchStandalone=true; a companion Wear APK beside the phone application is not generated yet. The release also adds one phone-to-watch API that maps to WCSession on Apple platforms and the Wearable Data Layer on Android. ...
SQLite Across Every Port: One Contract, One Encrypted File Format
The original com.codename1.db implementation delegated SQLite calls to the database supplied by each operating system. We knew this was less portable than the rest of Codename One, but fixing it meant taking ownership of SQLite on every target. That looked like a deep rabbit hole, so we exposed escape hatches instead. The pluggable SpatiaLite work we described in 2018 is one example. ...
App Hardening: One Obfuscation Pipeline Across Every Port
Obfuscating only the Android artifact is a poor security model for a cross-platform application. Codename One App Hardening transforms the merged application before it splits into Android, iOS, JavaScript, Windows, Linux, and desktop builds. We set the target at DexGuard-class resistance: rename useful symbols, remove plaintext application strings where the target permits it, distort selected control flow, and keep crash reports readable. This is not a claim that reverse engineering becomes impossible. It is a commitment to make the same security decision cover the whole application instead of leaving every port to a different tool and configuration. ...
The Third-Generation GUI Builder: One Workspace for Every Form
We have rebuilt the Codename One GUI Builder again. This is its third generation. The interesting part is not another drag-and-drop surface. It is what we kept, what Maven broke, and why a visual editor must understand the whole project instead of opening one generated form at a time. This is a smaller rewrite than the second generation Steve Hannah built. His guided layout work remains the foundation. PR #5523 replaces the surrounding shell with a Maven-first Codename One application that moves between forms, CSS, and Java without leaving the workspace. ...
App Shield: Your Server Should Not Trust the App Calling It
Any security check that runs only on a phone can be patched out on that phone. App Shield moves the final decision to your server by attaching a short-lived, server-verified attestation token to protected requests. Greetings from Thailand. My family dragged me here for a forced vacation. It is a lovely country, but beaches, sunshine, and the sea aren’t really my thing. The GitHub Actions downtime didn’t help either, so progress was slower than usual this week. Several interesting PRs are still in progress, and we chose not to rush them. ...
Why Codename One Is Moving Beyond Maven Central
Codename One is starting a staged move from Maven Central to a repository we operate on Cloudflare R2. This is not a story about Maven Central being bad. Sonatype runs expensive public infrastructure and has every right to define usage limits or sell a commercial service. Our release shape is simply a bad fit for those limits, and passing that infrastructure bill to Codename One users would make less sense than serving the same signed Maven layout ourselves. ...
A Polyline Is Not a Route
A polyline can draw the points you give it. It cannot discover the road between them. PR #5480 adds com.codename1.maps.routing, a portable route model and service layer for road geometry, distance, duration, waypoints, alternatives, legs, steps, and encoded polylines. We talked about routing in Friday’s release post. The two-line route For the common case, give Routing a map and two coordinates: ...