Skip to content

Conversation

@mend-for-github-com
Copy link

@mend-for-github-com mend-for-github-com bot commented Aug 5, 2025

This PR contains the following updates:

Package Type Update Change
org.hibernate:hibernate-validator (source) compile major 5.4.1.Final -> 6.2.0.CR1

By merging this PR, the issue #161 will be automatically resolved and closed:

Severity CVSS Score Vulnerability Reachability
High High 7.3 CVE-2025-35036
Medium Medium 6.1 CVE-2023-1932

Release Notes

hibernate/hibernate-validator (org.hibernate:hibernate-validator)

v6.2.0.CR1

Compare Source

v6.1.7.Final

Compare Source

v6.1.6.Final

Compare Source

v6.1.5.Final

Compare Source

v6.1.4.Final

Compare Source

v6.1.3.Final

Compare Source

v6.1.2.Final

Compare Source

** Bug
* HV-1756 - translations - Incorrect variables in the newly added translations

** Task
* HV-1753 - tests - Force Pax-Exam and Karaf to use Maven Central repository with SSL enabled

v6.1.1.Final

Compare Source

** Improvement
* HV-1750 - engine - Add debug log when expression factory has failed to load
* HV-1747 - engine - Allow overriding the message interpolator in PredefinedScopeValidatorFactory context
* HV-1744 - documentation - Use auto-expanding entries in the documentation TOC

** New Feature
* HV-1749 - engine - Introduce a LocaleResolver SPI
* HV-1748 - engine - Improve localization support via Locale.LanguageRange

** Task
* HV-1745 - tests - Bump Jackson test dependency to 2.10.1

v6.1.0.Final

Compare Source

** Bug
* HV-1730 - engine - JavaBeanExecutable fails to initialize for enum type
* HV-1715 - engine - Validation can sometimes proceed to the next group in sequence even after one of the constraints generated a violation

** Improvement
* HV-1729 - performance - Skip allocation of an action for each need to access the context classloader

** Task
* HV-1743 - build - Upgrade maven-compiler-plugin to 3.8.1
* HV-1742 - build - Upgrade to WildFly 18.0.0.Final
* HV-1741 - build - Upgrade ByteBuddy test dependency to 1.10.2
* HV-1740 - engine - Deprecate @​SafeHtml
* HV-1739 - engine - CVE-2019-10219 Security issue with @​SafeHtml
* HV-1738 - build - Update Jackson test dependency to 2.9.10
* HV-1733 - tests - Fix locale settings of PredefinedScopeValidatorFactoryTest
* HV-1732 - build - Change tarLongFileMode to posix for assembly building
* HV-1731 - tck-runner - Move TCK signature check to tck-runner module
* HV-1728 - build - Upgrade to WildFly 17.0.1.Final
* HV-1727 - build - Update Jackson Databind test dependency to 2.9.9.2
* HV-1725 - build - Switch to using Jakarta EE artifacts
* HV-1724 - build - Update to OpenJFX 11.0.2
* HV-1680 - engine - Avoid reflection by using instrumentation - build the enhancer

v6.0.23.Final

Compare Source

v6.0.22.Final

Compare Source

v6.0.21.Final

Compare Source

v6.0.20.Final

Compare Source

v6.0.19.Final

Compare Source

v6.0.18.Final

Compare Source

v6.0.17.Final

Compare Source

v6.0.16.Final

Compare Source

v6.0.15.Final

Compare Source

v6.0.14.Final

Compare Source

v6.0.13.Final

Compare Source

** Bug
* HV-1652 - engine - Fix a few theoretical null pointer dereference issues
* HV-1650 - validators - French translations are badly encoded

v6.0.12.Final

Compare Source

** Bug
* HV-1645 - extensions - Revert HV-1609 due to increased CDI startup caused by ValidateableBeanFilter
* HV-1644 - build - Using Hibernate Validator with Java 11 brings JavaFX on the classpath

** Improvement
* HV-1643 - translations - Fix Russian translation for @​Null constraint

** Task
* HV-1649 - tck-runner - Upgrade to Bean Validation TCK 2.0.4.Final
* HV-1648 - build, integration - Reenable WildFly integration tests for JDK 11
* HV-1647 - tck-runner - Allow running TCK tests in container mode with JDK 11
* HV-1646 - build, integration, tck-runner - Upgrade WildFly to 14.0.0.Beta1
* HV-1627 - build - Upgrade our JPA test dependency to 2.2

v6.0.11.Final

Compare Source

** Bug
* HV-1637 - translations - PropertNotFoundException for @​DecimalMax when using the German translation

** Improvement
* HV-1628 - annotation-processor, engine, tests - Configure a stricter forbidden-apis policy and remove calls deprecated in Java 10
* HV-1615 - translations - Improvements on the dutch translations

** Remove Feature
* HV-1624 - engine - Remove the StaticFieldELResolver

** Task
* HV-1641 - build - Use the OSS snapshot repository to download the JavaFX dependencies when building with JDK 11
* HV-1640 - build - Add compatibility with the latest JDK 11 build 22
* HV-1610 - integration - Reenable OSGi tests for JDK 10
* HV-1608 - build - Have the build work with JDK 11
* HV-1577 - engine - Use Stax instead of JAXB to parse the XML descriptors

v6.0.10.Final

Compare Source

** Bug
* HV-1614 - engine - Unable to specify constraints at more than 1 nested parameter of a typed container
* HV-1609 - integration - CDI extension should not rely on @​WithAnnotations filtering
* HV-1604 - engine - Initializing JPATraversableResolver fails with IllegalAccessException
* HV-1598 - engine - Fix the behavior of XML default-validated-executable-types

** Improvement
* HV-1612 - translations - Add Dutch translation of the validation messages
* HV-1611 - translations - Be consistent in the case of the validation messages
* HV-1592 - engine - Make ConstraintValidator declaration stricter
* HV-1534 - engine - Allow getter constraints to be specified for subclasses in XML configuration

** Task
* HV-1607 - build - Have the build work with JDK 10
* HV-1606 - tck-runner - Update TCK to 2.0.3.Final
* HV-1605 - build - Update Surefire to 2.21.0 for JDK 10 support

v6.0.9.Final

Compare Source

** Bug
* HV-1596 - engine - NPE upon upgrade from HV 5.x to 6.0.8
* HV-1594 - integration - Add javax.annotation:javax.annotation-api to the hibernate-validator-javax-money Karaf feature
* HV-1589 - engine - HibernateConstraintValidators are not correctly cached

** Improvement
* HV-1597 - engine - Allow overriding the constraint validator payload at the Validator level with null
* HV-1595 - engine - Move ConstraintValidatorPayload to ConstraintValidatorContext
* HV-1593 - integration - Split the hibernate-validator Karaf feature in several smaller features
* HV-1587 - engine - Reduce the already processed work units tracking impact
* HV-1586 - performance - Various improvements to performance tests
* HV-1585 - engine - Omit the cache lookup in AbstractMessageInterpolator for the simple text messages

** Task
* HV-1578 - build - Disable the generation of @​Generated annotation for JBoss Logging

v6.0.8.Final

Compare Source

** Bug
* HV-1554 - integration - OSGi tests running on Payara fail randomly
* HV-1551 - engine - Validator not found for @​Size on non-parameterized Map/Collection properties
* HV-1461 - engine - ExecutableHelper#overrides does not work correctly with the method containing generic and non generic parameters

** Improvement
* HV-1582 - build, integration - Make the classmate OSGi version range less strict
* HV-1581 - build - Make the Felix integration tests fail when a test fails
* HV-1580 - build - Fix the path of the setupModules.groovy script
* HV-1576 - build, integration - Upgrade the integration tests and the base WildFly version to WildFly 12
* HV-1573 - build - Ignore the Maven wrapper files in the license check
* HV-1572 - documentation - Make the custom container type value extractor example more clear in the documentation
* HV-1569 - tck-runner - updateStandaloneXml.groovy shoud take into account the property overridden with the command line
* HV-1568 - engine - Prevent possible NullPointerException in ValidatorFactoryScopedContext.Builder
* HV-1567 - engine - Make ValidationOrderGenerator global to the ValidatorFactory
* HV-1566 - engine - Cache type variable index for performance reasons
* HV-1565 - documentation - Add missing security manager permissions for JBoss Logging and Classmate in the documentation
* HV-1564 - build - Upgrade the Maven plugins
* HV-1563 - build - Update the TCK to 2.0.2.Final and reenable all the TCK tests with JDK 9
* HV-1562 - build - JDK9+ build improvements
* HV-1560 - engine - Remove Guava as dependency from engine
* HV-1559 - build - Align dependency versions with what's in WildFly 11
* HV-1553 - translations - Update Spanish translation of constraint messages
* HV-1543 - engine - Simplify ConstraintTree in the case of non composing constraints
* HV-1444 - engine - Support container only detectable at runtime for global cascaded validation and introduce a cache for the value extractors

** New Feature
* HV-1529 - engine - Allow to pass a payload to the constraint validators

** Sub-task
* HV-1556 - integration - Felix tests are referencing an outdated snapshot version
* HV-1555 - integration - Upgrade Payara (used for the Felix tests) to 5.Beta1

** Task
* HV-1584 - tck-runner - Include JavaFX tests in TCK runs (local and incontainer)
* HV-1583 - build - Update javax.el dependency to 3.0.1-b09
* HV-1570 - build - Update JBoss Logging to version 3.3.2.Final
* HV-1558 - build - Put the distribution files to upload into distribution/target/dir so that release scripts find them
* HV-1557 - build - Remove old release scripts from the repository
* HV-1550 - build - Clarify the build output in the Travis build
* HV-1549 - build - Use mvn install instead of mvn verify in the Travis build

v6.0.7.Final

Compare Source

** Task
* HV-1548 - build - Upgrade the Bean Validation API and TCK to 2.0.1.Final

v6.0.6.Final

Compare Source

** Improvement
* HV-1533 - engine - Small performance improvements
* HV-1531 - engine - Regroup the ValidatorFactory scoped properties in ValidatorFactoryContext
* HV-1530 - annotation-processor - Add CodePointLength to supported AP types
* HV-1527 - engine - Separate Group and MetaConstraint - Path processed units in ValidationContext
* HV-1525 - engine - Various AbstractMessageInterpolator performance improvements
* HV-1524 - engine - Log temporal validation tolerance only if it has been explicitly set
* HV-1522 - engine - Improve performance of ConstraintViolationImpl hashCode() method
* HV-1506 - engine - Regroup the Validator scoped properties in ValidationContext

** New Feature
* HV-1541 - engine - Add new constraint for ISBN

** Task
* HV-1546 - engine - Reintroduce AnnotationProcessingOptions
* HV-1545 - engine - Reintroduce hibernate.validator.constraint_mapping_contributor
* HV-1538 - engine - Make the @​Incubating annotation @​Documented
* HV-1537 - engine - Reintroduce ReflectionParameterNameProvider to avoid API breakage
* HV-1536 - engine - Update description of required permissions in the reference guide
* HV-1535 - build - Use the default style for JavaDoc

v6.0.5.Final

Compare Source

** Bug
* HV-1520 - engine - Fix *ProcessedUnit equals() implementations
* HV-1516 - validators - E-mail validator does not allow IDN ascii domain labels

** Improvement
* HV-1519 - build - Fix the jqassistant build
* HV-1518 - engine - Various minor cleanups
* HV-1515 - translations - Add missing strings to the simplified Chinese translation
* HV-1514 - performance - Update the versions used in the benchmarks and make the latest benchmark compatible with BV 1.1
* HV-1512 - engine, performance - Improve initialization cost of all logger classes
* HV-1511 - engine - Don't expose AnnotationDescriptor in AnnotationDef
* HV-1505 - engine - Create ConstraintAnnotationDescriptor for typed access to groups() etc.
* HV-1497 - engine - Extend the ConstraintValidator#initialize() contract

** New Feature
* HV-1493 - engine - Support a temporal validation tolerance when applying temporal constraints
* HV-1466 - validators - Add a @​UniqueElements constraints

** Task
* HV-1513 - engine - Rename static logger fields from "log" to "LOG"

v6.0.4.Final

Compare Source

** Bug
* HV-1508 - engine - Reset the hashCode of PathImpl when we remove the leaf node
* HV-1373 - engine - Validator calls objects hashCode() after failed @​NotNull validation

** Improvement
* HV-1509 - engine - Reference constraint validator factory consistently
* HV-1507 - engine - Avoid resetting the PathImpl.hashCode() when setting the property value
* HV-1503 - engine - Store the initialized ConstraintValidator in ConstraintTree
* HV-1502 - engine - Use AnnotationDescriptor to access annotations information
* HV-1323 - engine - Drop WARN log message in ParameterMessageInterpolator instantiation
* HV-1040 - engine - Field-level constraint performance impairment

** Task
* HV-1501 - build - Update the base versions for API comparison and performance tests
* HV-1472 - integration - Provide patch file for WildFly 11 Final

v6.0.3.Final

Compare Source

** Bug
* HV-1494 - validators - Hibernate Validator specific @​NotEmpty used on return type throws an exception
* HV-1492 - engine - Parameters passed in wrong order to log method
* HV-1490 - engine - Feature detection in ConstraintHelper not consistent with what is required by HV
* HV-1485 - engine - ConstraintViolationImpl is not serializable if the constraint can target a generic type (typically Collection)
* HV-1481 - engine - @​Valid ignores Iterables/Arrays returned by methods with a generic return type
* HV-1478 - build, integration - hibernate-validator-cdi has invalid OSGi manifest
* HV-1474 - engine - Incorrect NodeImpl hashCode()/equals() contract
* HV-1184 - engine - JaCoCo code coverage fails since ConstraintDescriptorImpl#buildAnnotationParameterMap() does not filter out synthetic methods

** Improvement
* HV-1499 - documentation - Update the getting started guide with the latest additions to the policy file
* HV-1487 - engine - Add an option to disable the TraversableResolver result cache
* HV-1486 - engine - Add a toString() to AnnotationParameters
* HV-1482 - engine - Reduce visibility of some of the value extractors
* HV-1480 - engine - Performance and memory allocation improvements
* HV-1479 - validators - Document requirement of java.xml.bind module on Java 9 when using XML descriptors
* HV-1476 - build - Update checkstyle to latest
* HV-1475 - build - Update Maven dependencies
* HV-1469 - engine - ScriptEvaluatorFactory should be scoped to the validator factory
* HV-1417 - documentation - Documentation - Discuss ContainerElementTypeDescriptor and al.
* HV-1415 - documentation - Documentation - Discuss the Path API
* HV-937 - documentation - Make use of custom asciidoctor template to change numbering of examples and cross referencing in documentation

** New Feature
* HV-1496 - engine - Add @​CodePointLength constraint that validates code point length
* HV-1463 - engine - Make bootstrapping of script evaluators for @​ScriptAssert more flexible

** Task
* HV-1488 - integration - Upgrade WildFly to 11.0.0.CR1
* HV-1464 - documentation - Remove requirement for CLA

v6.0.2.Final

Compare Source

** Bug
* HV-1471 - engine - Properly reset the context after constraint validation
* HV-1470 - annotation-processor - ConstraintValidatorCheck should be made a warning

** Task
* HV-1467 - translations - Add missing Portuguese constraint violation messages
* HV-1462 - integration - Provide patch file for WildFly 11 Beta1
* HV-1395 - annotation-processor - Support OptionalInt/OptionalDouble/OptionalLong in the annotation processor

v6.0.1.Final

Compare Source

** Improvement
* HV-1460 - build - Remove the Maven version prerequisite as it's redundant with the enforcer configuration and now generates a warning
* HV-1459 - build - Add a "sigtest" profile to make running the SigTest test easier
* HV-1457 - translations - Update the Persian translation
* HV-1456 - engine - Fix comments mixed up by Eclipse refactorings
* HV-1455 - engine - Improve Validator#validate...() sanity checks
* HV-1454 - build - Support JDK 9 build 180
* HV-1452 - engine - Add Spanish translations for BV 2.0 constraints
* HV-1448 - engine - Remove some superfluous fields from metamodel
* HV-1447 - engine - Remove metadata for unconstrained methods from the aggregated metamodel
* HV-1445 - engine - Remove BeanConfiguration cache in AnnotationMetadataProvider
* HV-1443 - engine - AbstractConstrainedElement#isConstrained() should also return true if there are group conversions without cascading
* HV-1442 - engine - Fix root cascading metadata for arrays in the programmatic API
* HV-1441 - engine - Clean up the initialization of CascadingMetaData
* HV-1439 - engine - Improve overall performances
* HV-1438 - engine - Narrow down value extractors considered for cascaded validation to the ones compatible
* HV-1437 - engine - Look at reducing the runtime memory usage of the ValidatorFactory
* HV-1422 - documentation - Extract properties for base URLs commonly used in the reference guide
* HV-1405 - tests - Review assertCorrectPropertyPathStringRepresentations usage

** Task
* HV-1446 - engine - Remove UnconstrainedEntityMetaDataSingleton
* HV-1440 - integration - Provide patch file for WildFly 11 Alpha1
* HV-1420 - documentation - Reference documentation update

v6.0.0.Final

Compare Source

** Improvement
* HV-1458 - engine - Avoid performance regression for cascaded validation
* HV-1451 - engine - Add @​PastOrPresent and @​FutureOrPresent messages

** Task
* HV-1453 - build - Upgrade to final versions of BV API and TCK

v5.4.3.Final

Compare Source

v5.4.2.Final

Compare Source


  • If you want to rebase/retry this PR, check this box
@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Aug 5, 2025
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/main-org.hibernate-hibernate-validator-6.x branch from 5ba2550 to a8ac5be Compare August 7, 2025 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

1 participant