The 30 second answer
I put a timeout on every remote call so threads never hang. A circuit breaker fails fast once the error rate crosses a threshold, and a bulkhead caps concurrent calls so one dependency can't take every thread. I retry only idempotent calls, with capped backoff and jitter, because retries add load to a struggling service. And I add a fallback, like cached data or a degraded response.
Timeouts on every call, so threads aren't stuck. A circuit breaker (Resilience4j: CLOSED, OPEN, HALF_OPEN) fails fast once the error rate crosses a threshold. A bulkhead caps concurrent calls to that dependency so it can't use all threads. Retries only for idempotent calls, with capped backoff and jitter. Plus a fallback, such as cached data or a degraded response. Follow-up: Why can retries make it worse? (They multiply load on a struggling service; the Builders' Library says to cap them.)