DEV Community: Rajen Trivedi

jsoup 1.23.1 is out: here's what actually changed

Rajen Trivedi — Thu, 06 Aug 2026 18:25:55 +0000

jsoup 1.23.1 just dropped and this one is worth paying attention to. Not just a patch release. There are real parser speed gains, meaningful memory improvements, and a security fix that Android and server-side Java devs should know about.

Here's what changed and why it matters.

Add the dependency

Gradle (Groovy):

implementation 'org.jsoup:jsoup:1.23.1'

Gradle (Kotlin DSL):

implementation("org.jsoup:jsoup:1.23.1")

Maven:

<dependency>
  <groupId>org.jsoup</groupId>
  <artifactId>jsoup</artifactId>
  <version>1.23.1</version>
</dependency>

Performance

This was clearly the main focus of the release. Numbers are from OpenJDK 21 benchmarks.

String parsing is 18% faster on average.
The most common use case just got noticeably quicker.

Document doc = Jsoup.parse(htmlString);

InputStream parsing is 11% faster.
Good news if you're parsing HTTP responses or file streams directly.

Document doc = Jsoup.parse(inputStream, "UTF-8", baseUri);

Source position tracking is 70% faster.
If you use Parser.htmlParser().setTrackPosition(true), this is a big one. It was the slowest mode before. Not anymore.

Parser parser = Parser.htmlParser().setTrackPosition(true);
Document doc = Jsoup.parse(htmlString, baseUri, parser);

Source-tracked DOMs use 58 to 65% less memory on medium to large documents.
And the gains hold under concurrent parsing without introducing new contention. If you parse in parallel, you get the memory savings without thread safety trade-offs.

Security fix

The Cleaner had an issue where malformed HTML could sneak markup through when cleaned with a custom Safelist that allowed certain raw-text elements.

// Custom Safelists with raw-text elements were affected
Safelist safelist = Safelist.relaxed().addTags("script");
String cleaned = Jsoup.clean(malformedHtml, safelist);
// In previous versions, some markup could survive this incorrectly

Built-in Safelists like Safelist.basic() and Safelist.relaxed() are not affected. But if you built a custom Safelist with unusual raw-text tag permissions, update now.

What else changed

Better HTML spec alignment.
Parsing of noscript, CDATA, SVG, and MathML now aligns more closely with the HTML living standard. If your parser results on edge-case documents ever felt slightly off, this release tightens that up.

Spec-correct HTTP redirects.
Redirect handling is now safer and follows the HTTP spec more accurately. Fewer surprises when dealing with servers that do non-standard redirect chains.

Fast immutable Element#classList().
Returns an immutable view of the element's class list. Faster to call, safer to use since you can't accidentally mutate it.

Element el = doc.selectFirst("div.card");
Set<String> classes = el.classList();
// immutable, no defensive copy needed
System.out.println(classes); // [card, featured, active]

Direct outer-HTML output to an Appendable.
You can now write an element's outer HTML directly to a StringBuilder, Writer, or any Appendable without going through a String allocation first.

StringBuilder sb = new StringBuilder();
element.outerHtml(sb);
// no intermediate String created

Bug fixes across the board:

RCDATA parsing corrections
XML conversion edge cases
Tag-name handling
Cleaner link detection

Should you update?

Yes, especially if you:

Use setTrackPosition(true): the 70% speed gain alone is worth it
Parse large documents concurrently: the memory savings are real
Built a custom Safelist with raw-text elements: the security fix applies to you

For everyone else it's still an easy drop-in upgrade with no API changes.

Reference: jsoup releases on GitHub

Server Commands I Actually Use, Part 2: Finding What's Actually Deployed

Rajen Trivedi — Thu, 06 Aug 2026 18:15:32 +0000

Hey Dev.to 👋

If you came from Medium, welcome back. Part 1 of this series (Nginx commands for managing a Linux server) got a good response over there, so I decided to keep the series going but bring Part 2 here to Dev.to for a change of scenery.

If you haven't read Part 1 yet, it covers the core Nginx workflow: checking if Nginx is running, testing configs before reloading, enabling and disabling sites, reading logs, and testing URLs. You can find it here:

Part 1 on Medium: Nginx Commands I Actually Use: A Running Guide for Managing a Linux Server

This part is different. It's not about Nginx specifically. It's about a problem that shows up after you've been deploying things for a while.

You've got a frontend here, a backend there, some Nginx config you wrote three weeks ago, maybe a Docker container you spun up to test something and then... left running. And then one day something breaks and you're sitting there thinking: okay, what even is on this server right now?

That's what this part is about.

Quick note on setup: I work from a Windows laptop, connecting over SSH via PowerShell. All the commands below run on the server after you SSH in.

ssh {deploy-user}@{your-server-ip}

Anything in {curly braces} is a placeholder. Swap in your own values before running.

List All Files (Structure Only)
Tree View with Sizes
Full Deployment Snapshot in One Command
Find What's Eating Your Disk Space
Quick Reference

1. List All Files (Structure Only)

The bluntest possible tool. Shows every file under the directories you care about, sorted, no frills.

find /var/www/ /home/{deploy-user}/ -type f 2>/dev/null | sort

Output:

/home/deploy/api/build.gradle.kts
/home/deploy/api/src/main/Application.kt
/var/www/{site-1}/index.html
/var/www/{site-1}/robots.txt
/var/www/{site-2}/index.html

Good for a quick "what's actually in here" check. Pipe it through grep if you're looking for something specific, like a file you vaguely remember deploying but can't place.

find /var/www/ /home/{deploy-user}/ -type f 2>/dev/null | sort | grep "robots"

Output:

/var/www/{site-1}/robots.txt

2. Tree View with Sizes

Same idea but actually readable. Shows the folder structure visually with file sizes alongside.

# Only needed once if tree isn't installed
sudo apt install -y tree

tree -h /var/www/ /home/{deploy-user}/ -I 'node_modules|.git'

Output:

/var/www/
├── [4.0K]  {site-1}
│   ├── [ 612]  index.html
│   └── [ 128]  robots.txt
└── [4.0K]  {site-2}
    └── [ 890]  index.html

/home/deploy/
└── [4.0K]  api
    ├── [1.2K]  build.gradle.kts
    └── [4.0K]  src

The -I 'node_modules|.git' flag skips folders that have thousands of files and none of them are yours. Add more patterns as needed:

tree -h /var/www/ /home/{deploy-user}/ -I 'node_modules|.git|build|.gradle'

I reach for this one more than the flat list. The tree shape makes it much easier to see what belongs where at a glance.

3. Full Deployment Snapshot in One Command

This is the one I actually use when I need to remember what I've built.

I kept running ls on different directories separately, then forgetting what I'd already checked. So I started keeping one long command that dumps everything relevant in one go: frontend folders, backend apps, Nginx configs, Docker containers, top to bottom.

echo "=== FRONTEND: {site-1} ===" && \
find /var/www/{site-1} -maxdepth 1 -type f | sort && \
echo "" && \
echo "=== FRONTEND: {site-2} ===" && \
find /var/www/{site-2} -maxdepth 1 -type f | sort && \
echo "" && \
echo "=== BACKEND APPS ===" && \
find /home/{deploy-user} -maxdepth 2 -type f 2>/dev/null | grep -v ".git" | sort && \
echo "" && \
echo "=== NGINX CONFIGS ===" && \
ls -la /etc/nginx/sites-available/ && \
echo "" && \
echo "=== DOCKER CONTAINERS ===" && \
docker ps -a --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"

Output (what it actually looks like):

=== FRONTEND: {site-1} ===
/var/www/{site-1}/index.html
/var/www/{site-1}/robots.txt

=== FRONTEND: {site-2} ===
/var/www/{site-2}/index.html

=== BACKEND APPS ===
/home/deploy/api/build.gradle.kts
/home/deploy/api/Dockerfile

=== NGINX CONFIGS ===
-rw-r--r-- 1 root root 1.1K Jul 20 {site-1}
-rw-r--r-- 1 root root  980 Jul 31 {site-2}

=== DOCKER CONTAINERS ===
NAMES        IMAGE          STATUS         PORTS
{app-name}   {image-name}   Up 3 days      0.0.0.0:{port}->{port}/tcp

The command looks long but it's not complicated. It's literally just the same few commands chained together with && and echo separators. Adapt the folder paths and site names to match your setup, then save it somewhere because you will want it again.

4. Find What's Eating Your Disk Space

I added this one after noticing the server getting slower and realizing I had months of old build artifacts sitting in /home/deploy/api/build that nobody had cleaned up. This command would have caught it immediately.

du -ah /var/www/ /home/{deploy-user}/ 2>/dev/null | sort -rh | head -50

Output:

1.2G  /home/deploy/api/build
340M  /home/deploy/api/build/libs/app.jar
88M   /var/www/{site-1}/assets
12M   /var/www/{site-2}
4.0K  /var/www/{site-2}/index.html

Biggest to smallest, top 50 results. If your disk is filling up and you don't know why, this usually tells you in about three seconds.

Drop head -50 if you want the full unfiltered list.

Quick Reference

Flat file list: find /var/www/ /home/{deploy-user}/ -type f 2>/dev/null | sort
Tree with sizes: tree -h /var/www/ /home/{deploy-user}/ -I 'node_modules|.git'
Full snapshot: the long one in section 3 (copy, adapt, save it)
Disk usage: du -ah /var/www/ /home/{deploy-user}/ 2>/dev/null | sort -rh | head -50

That's Part 2. Short and focused on one problem: knowing what's actually on your server.

Stay tuned for Part 3.

If Part 1 on Medium was useful too, drop it a like there. Helps more people find it.

What's new in our latest Android dependency bumps — ConstraintLayout, Firebase, Intercom, Auth0

Rajen Trivedi — Sat, 01 Aug 2026 18:51:37 +0000

We just bumped four dependencies in the app. Here's what each one brings.

implementation 'androidx.constraintlayout:constraintlayout:2.2.2'
implementation platform('com.google.firebase:firebase-bom:34.17.0')
implementation 'io.intercom.android:intercom-sdk:18.6.0'
implementation 'com.auth0.android:auth0:4.0.1'

ConstraintLayout 2.2.2

The library's in maintenance mode now — Google's steering everyone toward Compose for new UI — so releases here are small, focused patches. This one carries forward a binary compatibility fix in constraintlayout-core that landed in the 2.2.x line.

Firebase BoM 34.17.0

The BoM pins compatible versions across every Firebase library you pull in. This release lands close behind:

Firebase AI Logic (17.14.0) — new factory methods exposing thoughtSignature/isThought on response parts, plus automatic function calling for LiveGenerativeModel
Authentication (24.2.0) — fixed an auth timeout on dual-stack Wi-Fi, where long IPv6 timeouts were blocking IPv4 fallback
Cloud Firestore (26.4.1) — now caches documents over 1MB by chunk-reading from local SQLite; fixed a debug-logging OOM caused by large payloads
Cloud Messaging (25.1.1) — fixed a re-registration bug tied to Firebase installation ID changes
Crashlytics (20.1.0) — on API 37+, fatal event reports now carry OOM/anomaly context from the ProfilingManager API
Firebase Installations (19.1.2) — internal storage moved from SharedPreferences to DataStore
Performance Monitoring (22.0.6) — fixed _app_start traces getting incorrectly suppressed on API 34+
SQL Connect (17.3.2) — several fixes to realtime query subscriptions around auth-token refresh and expiry

Intercom Android SDK 18.6.0

Pinch-to-zoom, double-tap-to-zoom, and pan on full-screen image attachments
Fixed an ANR during Intercom.initialize() caused by Keystore and persisted-identity reads blocking the calling thread
Fixed the keyboard covering form fields in Canvas Kit sheets — IME insets are now handled correctly
Fixed a crash from a null trustedFileExtensions value in persisted attachment settings
Fixed empty list items rendering a dangling bullet in message and survey text
Intercom's flagged that the next major version moves to Kotlin 2.3 and will require a minimum Kotlin version of 2.0, for binary compatibility

Auth0.Android 4.0.1

4.0.1 sits on top of the 4.0.0 major release, which is where the breaking changes live:

useDPoP moved off WebAuthProvider and onto the login builder
PasskeyProvider and PasskeyManager have been removed, with no direct replacement in this version
The redundant SecureCredentialsManager constructors are gone, down to a single constructor
minSdkVersion is now 31+

New in exchange: SSOCredentialsDeserializer for SSO credential deserialization, Storage.removeAll() with a default 60s minimum TTL, ephemeral session support for Chrome Custom Tabs login, and DefaultClient rebuilt around a Builder pattern for configurable HTTP client options.

References

How to Generate APK from AAB File Using Bundletool (Super Simple Guide)

Rajen Trivedi — Thu, 09 Apr 2026 16:19:33 +0000

Hey devs! 👋

We all know Google Play now prefers Android App Bundles (AAB) for publishing because they generate optimized APKs for each device.

But in real-world development, we often need a single APK for:

Testing on physical devices
Sharing with QA teams
Quick installs without Play Store

Here is the easiest and official way to convert your .aab file into an .apk using Google’s Bundletool.

🛠️ Step 1: Download Bundletool

Go to the official GitHub releases:
👉 https://github.com/google/bundletool/releases/latest
Download the latest file:

   bundletool-all-x.x.x.jar

Place the .jar file:

In the same folder as your .aab file OR
Remember its full path

⚙️ Step 2: Generate `.apks` File (Universal Mode)

Open Command Prompt (Windows) or Terminal (Mac/Linux) and run:

java -jar bundletool-all-1.18.3.jar build-apks --bundle=app-release.aab --output=myapp.apks --mode=universal

🔁 Replace:

bundletool-all-1.18.3.jar → your actual jar filename
app-release.aab → your AAB file path/name

📦 Output:

myapp.apks

By default, this is signed with a debug keystore.

📦 Step 3: Extract the APK

Rename the file:

   ren myapp.apks myapp.zip

Extract it using:

WinRAR
7-Zip
Default OS extractor

Inside, you’ll find:

   universal.apk

🎉 That’s your final APK!

You can rename it:

app-release.apk

🔐 Generate Signed APK (Recommended for QA)

If you want a release-signed APK, use your keystore:

java -jar bundletool-all-1.18.3.jar build-apks \
  --bundle=app-release.aab \
  --output=myapp.apks \
  --mode=universal \
  --ks=your-keystore.jks \
  --ks-key-alias=your_alias \
  --ks-pass=pass:your_keystore_password \
  --key-pass=pass:your_key_password

🧠 Common Tips & Troubleshooting

✅ Check Java installation:

  java -version

📁 Keep files in the same folder to avoid path issues
📦 Universal APK is larger (contains all device configs)
🚫 Not for Play Store — upload AAB only
❌ Error: Unable to access jarfile
- Check filename and path carefully

🏁 Conclusion

That’s it! 🎯

In less than 2 minutes, you can convert any .aab into an .apk using Bundletool — no GUI tools needed.

If you run into any issues, drop the error in the comments — happy to help! 😊

DEV Community: Rajen Trivedi

jsoup 1.23.1 is out: here's what actually changed

Add the dependency

Performance

Security fix

What else changed

Should you update?

Server Commands I Actually Use, Part 2: Finding What's Actually Deployed

Table of Contents

1. List All Files (Structure Only)

2. Tree View with Sizes

3. Full Deployment Snapshot in One Command

4. Find What's Eating Your Disk Space

Quick Reference

What's new in our latest Android dependency bumps — ConstraintLayout, Firebase, Intercom, Auth0

ConstraintLayout 2.2.2

Firebase BoM 34.17.0

Intercom Android SDK 18.6.0

Auth0.Android 4.0.1

How to Generate APK from AAB File Using Bundletool (Super Simple Guide)

🛠️ Step 1: Download Bundletool

⚙️ Step 2: Generate .apks File (Universal Mode)

🔁 Replace:

📦 Step 3: Extract the APK

🔐 Generate Signed APK (Recommended for QA)

🧠 Common Tips & Troubleshooting

🏁 Conclusion

⚙️ Step 2: Generate `.apks` File (Universal Mode)