Lukasz Lenart created WW-5722:
---------------------------------
Summary: Support Hibernate 7.x - bump the optional hibernate-core
dependency from 5.6.15.Final
Key: WW-5722
URL: https://issues.apache.org/jira/browse/WW-5722
Project: Struts 2
Issue Type: Dependency
Components: Core
Reporter: Lukasz Lenart
Fix For: 8.0.0
{{struts2-core}} declares {{org.hibernate:hibernate-core}} {{5.6.15.Final}} as
an optional compile dependency ({{core/pom.xml}}). It is used in exactly two
classes, {{org.apache.struts2.util.ProxyUtil}} and
{{org.apache.struts2.util.StrutsProxyService}}, to detect Hibernate proxies
({{HibernateProxy}}) and unwrap them ({{Hibernate.unproxy}}) so that
{{SecurityMemberAccess}} can apply the allowlist to the real entity class.
Dependabot PR #1905 (5.6.15.Final -> 7.4.7.Final) was closed on 2026-09-11
rather than merged: all three {{Build and Test}} jobs fail on
{code}SecurityMemberAccessTest.classInclusion_hibernateProxy_allowProxyObjectAccess:1000
IllegalArgumentException: object is not an instance of declaring class
{code}
(also through {{ExternalSecurityMemberAccessTest}}). The test builds a
{{HibernateProxy}} with a JDK dynamic proxy ({{mockHibernateProxy}} in
{{SecurityMemberAccessTest}}), and the Hibernate 7 {{HibernateProxy}} /
{{Hibernate.unproxy}} contract no longer works with that shape. Dependabot was
told to ignore the 7.x major, so it will not reopen it.
h3. Scope
* Decide the supported Hibernate range for Struts 8: 7.x requires Jakarta
Persistence 3.2, i.e. Jakarta EE 11, so this goes with the same baseline
decision as WW-5721 (default Spring line). Hibernate 6.x (JPA 3.1, Jakarta EE
10) may be an intermediate step, but it has not been tested either - do not
assume 6.x passes because only 7.x was tried.
* Update {{ProxyUtil}} / {{StrutsProxyService}} for the new proxy API if the
runtime detection needs it, and rewrite the test double so it exercises the
real contract instead of a dynamic-proxy stand-in.
* Bump {{hibernate-core}} in {{core/pom.xml}} and confirm
{{SecurityMemberAccessTest}} and {{ExternalSecurityMemberAccessTest}} pass on
all three CI matrices, including the Jakarta EE 11 + Spring 7 one.
h3. Related
* PR #1905 - the failing bump
* WW-5721 - default Spring 6.2.x is OSS-EOL, same Jakarta EE 11 baseline
question
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
