[cld-sec]

Snyk has created this PR to upgrade org.hibernate:hibernate-entitymanager from 5.2.10.Final to 5.3.39.Final.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 52 versions ahead of your current version.

• The recommended version was released 4 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	XML External Entity (XXE) Injection SNYK-JAVA-DOM4J-174153	300	Proof of Concept
	SQL Injection SNYK-JAVA-ORGHIBERNATE-584563	300	No Known Exploit
	XML External Entity (XXE) Injection SNYK-JAVA-DOM4J-2812975	300	No Known Exploit
	SQL Injection SNYK-JAVA-ORGHIBERNATE-15038759	300	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[cld-sec]

The upgrade from Hibernate 5.2 to 5.3 is a high-risk migration that introduces several breaking changes requiring configuration and potential code modifications to maintain existing behavior.

Key Breaking Changes:

• @TableGenerator Behavior Change: To comply with the JPA specification, the value stored by @TableGenerator is now the last used value, not the next value. This will break primary key generation for existing data. [1]

  • Recommendation: You must set the configuration property hibernate.id.generator.stored_last_used to false to revert to the previous behavior. [1]

• @SequenceGenerator Naming Change: The default strategy for naming sequences has changed. Hibernate 5.3 now uses the generator's logical name as the physical sequence name by default, which can lead to "sequence does not exist" errors if they don't match. [7]

  • Recommendation: To restore the old behavior, set the property hibernate.model.generator_name_as_sequence_name to false. [7]

• Query Parameter Changes:

  • Support for JDBC-style ? parameters in HQL and JPQL queries has been removed. This feature was deprecated since version 4.1. Code using this syntax must be updated to use named parameters (e.g., :myParam) or JPA-style positional parameters (e.g., ?1). [1]
  • For native SQL queries, positional parameter binding is now 1-based instead of 0-based. A compatibility flag (hibernate.query.sql.jdbc_style_params_base=true) is available to temporarily revert this. [1]

• JPA 2.2 Support: Hibernate 5.3 implements the JPA 2.2 specification, which introduces new features and potential behavioral changes. [1, 5]

Source: Hibernate ORM 5.3 Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.