We just published a bugfix release for Hibernate Search: 6.0.8.Final.
As mentioned here, Hibernate projects do not use Log4j at runtime and thus are not affected by the various vulnerabilities discovered in Log4j 2 recently.
However, Hibernate Search does use Log4j during its own build, when executing tests, which is why we had to update our test dependency to Log4j 2.17.1 anyway.
Incidentally, this might help with some security sniffers that do not correctly understand the difference between runtime dependencies and test dependencies, leading to Hibernate Search being (falsely) reported as affected by the Log4j vulnerabilities.
HSEARCH-4423: Hibernate Search will no longer incorrectly detect a cycle and fail to process
@IndexingDependency(derivedFrom = …)when the path to source properties contains two properties with the same name, but on different types. Thanks to fraf for reporting this!
HSEARCH-4348: Mapping should now work when the properties are defined inside Groovy Traits. Thanks to Ollie Freeman for his contribution!
HSEARCH-4352: Hibernate Search no longer fails on bootstrap when an un-indexed entity has a derived identifier. When an indexed entity has a derived identifier, Hibernate Search produces a more helpful and actionable error message. Thanks to Al Turker for reporting this!
HSEARCH-4354: Hibernate Search will no longer retrieve and try to interpret Hibernate ORM metadata for properties that are not involved in indexing. This should reduce the impact of metadata parsing bugs in the future.
HSEARCH-4363: Fixed a
NullPointerExceptionthat occurred from time to time on shutdown.
HSEARCH-4391: Fixed images not being displayed in the documentation.
HSEARCH-4408: Fixed syntax highlighting for code example not working anymore in the documentation.
For a full list of changes since the previous release, please see the release notes.
All details are available and up to date on the dedicated page on hibernate.org.