In Relation To

Hibernate projects are not affected by the vulnerabilities behind CVE-2021-45046 and CVE-2021-44228: none of the Hibernate projects has a runtime dependency on Log4j core.

We use JBoss Logging, which provides a minimal API bridging to your logger backend of choice and does not come with fancy features relying on JNDI lookups.

We do use Log4j during development of the Hibernate libraries as it’s a dependency of our testsuites; therefore we’ve still upgraded all branches.

Today, we released maintenance releases for our Hibernate Validator 6.2 and 7.0 branches.

As of now, you are all aware of the Log4j 2 security issue called Log4Shell announced on Friday. The good news is that Hibernate Validator does NOT use Log4j 2 but uses JBoss Logging as its logging framework.

Why release these versions then? Log4j 2 is only a test dependency of Hibernate Validator (being a test dependency, Log4j 2 doesn’t come in your apps through Hibernate Validator so you don’t have to worry about this issue from the Hibernate Validator perspective), but we already got hit in the past by security scanners being not as fine grained as we would have liked so we preferred to release new versions proactively so that we are sure Hibernate Validator does not get wrongly reported as unsafe.

Hibernate ORM version 5.6.2.Final is now available.

This is a maintenance release of the latest stable branch 5.6; speaking of branches, it’s worth highlight that our main branch is now pointing to the sources of the upcoming version 6.0.

We just published Hibernate Search 6.1.0.Beta1, a beta release of the next minor version of Hibernate Search.

Among the main changes: asynchronous, distributed automatic indexing now scales to more or fewer nodes dynamically, supports multi-tenancy, and pauses during mass indexing; new Jakarta EE artifacts are available alongside the traditional ones for Java EE, the Elasticsearch backend accepts JSON to customize the mapping, and more.

Hibernate Search 6.1.0.Beta1 also includes upgrades to Hibernate ORM 5.6.1.Final and Lucene 8.11, among others.

The second Beta of Hibernate ORM 6.0 has just been released.

Quite a lot has gone into this release, but at a high level -

Hibernate Reactive 1.0.0.Final is the first production-ready release of Hibernate Reactive, the only object-relational mapping solution that supports non-blocking database drivers and a reactive style of interaction with the database.

Hibernate Reactive now supports PostgreSQL, MySQL, MariaDB, Db2, SQL Server, and CockroachDB, and features almost all the functionality of the original Hibernate ORM. Under the hood, Hibernate Reactive uses the Vert.x non-blocking SQL client libraries.

Testing by the Hibernate team shows that use of Hibernate Reactive can, in at least some circumstances, significantly improve performance in situations of high database server load, compared to the use of traditional ORM over JDBC. (However, we must caution that a reactive system isn’t faster than a non-reactive program all or even most of the time!)

We just published three maintenance releases for Hibernate Search: 6.0.7.Final, 5.11.10.Final and 5.10.12.Final.

These releases mainly upgrade Hibernate Search to the latest compatible Hibernate ORM versions, add deprecations in the 5.x versions for features that are no longer present in 6.0, and fix a few bugs.

The Hibernate team is pleased to announce availability of version 5.6.0.Final of our flagship ORM library.

Compared to previous candidate releases, not much has changed:

The first Beta of Hibernate ORM 6.0 has just been released.

We had a few main focuses for this Beta:

The main branch of Hibernate ORM, which will soon be promoted as our 5.6 release, is looking good and stable; we’re happy to announce tag 5.6.0.CR1 was released today and should already be available from your favourite Maven mirrors.

Compared to previous 5.6.0.Beta2, you should see no differences: