Hibernate Extension 5.6.15.15-RC

[Zackster]

The Lucee Hibernate ORM extension has a release candidate out: 5.6.15.15-RC

This is a really significant update — Hibernate upgraded from 5.4 to 5.6, plus a large body of bug fixes and improvements accumulated since the 5.4-era extension.

Install:

Lucee 7.0+ (Maven coordinates)

LUCEE_EXTENSIONS=org.lucee:hibernate-extension:5.6.15.15-RC

Lucee 6.2 (extension GUID)

LUCEE_EXTENSIONS=FAD1E8CB-4F45-4184-86359145767C29DE;version=5.6.15.15-RC

What’s new since 5.4 (see announcement threads for details):

• Hibernate 5.4 → 5.6 — core upgrade (5.6.15.10 announcement)
• LDEV-119 — ORMReload() connection leak and NPE under concurrent load fixed
• LDEV-6156 — connection leak: dead reconnect code removed
• LDEV-1992 — entityMerge() after ormClearSession() no longer throws “no Session”
• LDEV-6253 — ORM flush 61% faster (5.6.15.12 announcement)
• LDEV-6267 — ClassCastException when ehcache extension is also installed, fixed by relocating shaded classes
• OOE-28 — NoClassDefFoundError: javax/validation/ValidatorFactory on Lucee 7+ fixed
• LDEV-6225 — Java 17+ JAXB compatibility
• LDEV-4561 — entity events now fire before global event handler, matching ACF
• LDEV-4121 — property defaults apply when loading NULL from DB, matching ACF
• LDEV-2092 — ORMEvictEntity()/ORMEvictCollection() broken with multiple datasources, fixed
• Per-app ORM log level via this.logs (Lucee 7.0+) (5.6.15.13 announcement)
• Concurrent ORM init race condition fixed (Lucee 6.2/7.0)
• Multiple datasource sessions now opened lazily (reduced connection overhead)

Changelog

lucee/extension-hibernate/blob/5.6/CHANGELOG.md

Documentation

We have added a comprehensive set of recipes for ORM

ORM :: Lucee Documentation

Security note — CVE-2026-0603

Dependency scanners may flag a high-severity SQL injection CVE in hibernate-core.

We’ve investigated and it is not exploitable in standard Lucee ORM deployments — the vulnerable code path (InlineIdsOrClauseBulkIdStrategy) requires explicitly opting in via hibernate.hql.bulk_id_strategy, which is not configurable through Lucee ORM settings and is not set anywhere in this extension. The default strategy uses temp tables.

We will be following up with a 7.x Hibernate Release

Previous 5.6 SNAPSHOTS

Lucee Hibernate Extension 5.6.15.10-SNAPSHOT

next time just scream! if a tree falls in the forest and no-ones there etc!

Hibernate Extension 5.6.15.12-SNAPSHOT

Performance Fixes for Large Batch ORM Workloads Investigating an OOM report from a user processing 3.8M entities nightly, we profiled the extension against the Ortus fork and found 5.6.15.11 was 32% slower with 33% more memory usage — despite identical per-entity retained heap. The root cause was transient allocation churn during Hibernate flush dirty-checking, not a memory leak. What changed in 5.6.15.12-SNAPSHOT String.replace() instead of Util.replace() in HibernateCaster.toHibernateType(…

Hibernate Extension 5.6.15.13-SNAPSHOT — per-app ORM logging

Quick update on the Hibernate extension logging front this.logs support (Lucee 7.0+) The extension now respects application-level this.logs for the orm log. Previously, changing the orm log level required configImport(type:"server") which affected every app on the server. Now each appplication.cfc can control its own level: this.logs = { "orm": { "appender": "console", "level": "trace" } }; this.ormSettings = { logSQL: true, logParams: true }; On 6.2, server-level config via Lu…

[psarin]

Should we now be using this extension instead of the Ortus Hibernate extension? I thought the recommendation a few months ago was to use the Ortus one (Ortus Hibernate ORM Extension 6.5.4 Released) - or am I misunderstanding something?

[Zackster]

As per the docs, Ortus have put their fork in maintenance mode, Lucee has taken back responsibility and are actively maintaining our extension again.

You should find this RC a drop in replacement, with a lot of issues resolved and better logging, performance and exceptions!