I've been burned by JSR 380 enough times to appreciate a validation framework that doesn't drag in a whole ecosystem of dependencies. Solon's validation system lives in solon-security-validation — a single plugin that gives you 20+ annotations, entity validation, and custom validators, all without pulling in javax.validation or jakarta.validation.
Let me walk through what I've found useful.
The Two-Phase Validation Model
Solon separates validation into two phases:
Context validation (pre-injection) — runs before method parameters are resolved. Annotations on the method itself check headers, cookies, IP, or request-level constraints.
