Merge branch 'hibernate:main' into main

Author: gavinking

.github/dependabot.yml

@@ -17,4 +17,11 @@ updates:
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
+      interval: monthly
+    groups:
+      workflow-actions:
+        patterns:
+          - "*"
+    allow:
+      - dependency-name: "actions/*"
+      - dependency-name: "redhat-actions/*"

.github/hibernate-github-bot.yml

@@ -60,4 +60,6 @@ develocity:
         pattern: "((?:h2|postgres(?:ql)?|pgsql|mysql|mariadb|mssql|tidb|cockroach(?:db)?|oracle|db2|hsqldb|edb|sybase)(?:.*(?=_ci)|.*))(?:_ci)?"
         replacement: "$1"
       - pattern: "main|HEAD|\\d+.\\d+|PR-\\d+"
-        replacement: "" # Just remove these tags
+        replacement: "" # Just remove these tags
+licenseAgreement:
+  enabled: true

.github/workflows/ci-report.yml

@@ -17,12 +17,12 @@ jobs:
     steps:
       # Checkout target branch which has trusted code
       - name: Check out target branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: ${{ github.ref }}
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -38,7 +38,7 @@ jobs:
           echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: |
             ~/.m2/repository/
@@ -52,7 +52,7 @@ jobs:
 
       - name: Download GitHub Actions artifacts for the Develocity build scans
         id: downloadBuildScan
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           pattern: build-scan-data-*
           github-token: ${{ github.token }}
@@ -75,4 +75,4 @@ jobs:
           done
           exit $status
         env:
-          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
     # Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners
     #          - rdbms: hana
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim Disk Space
@@ -56,7 +56,7 @@ jobs:
           RDBMS: ${{ matrix.rdbms }}
         run: ci/database-start.sh
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -73,7 +73,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -90,7 +90,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -118,14 +118,14 @@ jobs:
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
         with:
           name: build-scan-data-${{ matrix.rdbms }}
           path: ~/.gradle/build-scan-data
 
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-${{ matrix.rdbms }}
@@ -146,12 +146,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - rdbms: oracle_atps
+          - rdbms: oracle_atps_tls
           - rdbms: oracle_db19c
           - rdbms: oracle_db21c
           - rdbms: oracle_db23c
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim disk space and sanitize user home
@@ -162,7 +162,7 @@ jobs:
           RUNID: ${{ github.run_number }}
         run: ci/database-start.sh
       - name: Set up Java 21
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@aafbedb8d382ed0ca6167d3a051415f20c859274 # v1.2.8
         with:
           distribution: 'graalvm'
           java-version: '21'
@@ -179,7 +179,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -196,7 +196,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -216,20 +216,23 @@ jobs:
           RUNID: ${{ github.run_number }}
           # These runners have no HOME variable set by default, we need to explicitly set it to make the build work
           HOME: /root
+          # Needed for TFO (TCP fast open)
+          LD_PRELOAD: /home/opc/libtfojdbc1.so
+          LD_LIBRARY_PATH: /home/opc
         run: ./ci/build-github.sh
         shell: bash
       # Upload build scan data.
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       # That's even on push, because we do not trust Atlas runners to hold secrets: they are shared infrastructure.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ !cancelled() }}"
         with:
           name: build-scan-data-${{ matrix.rdbms }}
           path: ~/.gradle/build-scan-data
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-${{ matrix.rdbms }}
@@ -245,13 +248,13 @@ jobs:
     name: Static code analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim disk space and sanitize user home
         run: .github/ci-prerequisites-atlas.sh
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -268,7 +271,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -285,7 +288,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -311,18 +314,18 @@ jobs:
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
         with:
           name: build-scan-data-sca
           path: ~/.gradle/build-scan-data
 
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-sca
           path: |
             ./**/target/reports/tests/
       - name: Omit produced artifacts from build cache
-        run: ./ci/before-cache.sh
+        run: ./ci/before-cache.sh

.github/workflows/codeql.yml

@@ -37,17 +37,17 @@ jobs:
     steps:
 
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -74,6 +74,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
         with:
-          category: "/language:${{matrix.language}}"
+          category: "/language:${{matrix.language}}"

.idea/.gitignore

@@ -43,11 +43,15 @@
 # assume any information here is accurate.
 
 Adam Warski <[email protected]> adamw <[email protected]>
+Adar Lieber-Dembo <[email protected]>
 Alex Snaps <[email protected]> <[email protected]>
+Alexander Kotlyarov <[email protected]>
+Alexey Nesterov <[email protected]> <[email protected]>
 Andrea Boriero <[email protected]> <[email protected]>
 Andrej Golovnin <[email protected]> Andrej Golovnin <[email protected]>
 Andrig Miller <[email protected]> andrigtmiller <[email protected]>
 Andrig Miller <[email protected]> andy.miller <[email protected]>
+Arcadiy Ivanov <[email protected]> <[email protected]>
 Barry LaFond <[email protected]> blafond <[email protected]>
 Boris Korogvich <[email protected]> VEINHORN <[email protected]>
 Brett Meyer <[email protected]> <[email protected]>
@@ -61,6 +65,7 @@ Chris Cranford <[email protected]> <[email protected]> Naros
 Chris Cranford <[email protected]> <[email protected]>
 Chris Cranford <[email protected]> cranforc <[email protected]>
 Christoph Dreis <[email protected]> ChristophDreis <[email protected]>
+Daniel Heinrich <[email protected]>
 Dave Repshas <[email protected]> drepshas <[email protected]>
 David M. Carr <[email protected]> davidmc24 <[email protected]>
 David M. Carr <[email protected]> dcarr <[email protected]>
@@ -82,26 +87,37 @@ Hardy Ferentschik <[email protected]> <[email protected]>
 Hardy Ferentschik <[email protected]> <[email protected]>
 Harsh Panchal <[email protected]> BOOTMGR <[email protected]>
 Hernán Chanfreau <[email protected]> hernan <[email protected]>
+Ivan Munic <[email protected]>
 Jaikiran Pai <[email protected]> Jaikiran <[email protected]>
+Janario Oliveira <[email protected]> <[email protected]>
+Janario Oliveira <[email protected]> <[email protected]>
 Jeremy Whiting <[email protected]> Jeremy Whiting <[email protected]>
 John O'Hara <[email protected]> johara <[email protected]>
 John O'Hara <[email protected]> <[email protected]>
 John O'Hara <[email protected]> JohnOhara <[email protected]>
 John O'Hara <[email protected]> John OHara <[email protected]>
 John Verhaeg <[email protected]> John Verhaeg <[email protected]>
 John Verhaeg <[email protected]> JPAV <[email protected]>
+Laurent Almeras <[email protected]> <[email protected]>
+Laurent Almeras <[email protected]> <[email protected]>
+Leonard Siu <[email protected]>
 Loïc LEFEVRE <[email protected]> LLEFEVRE <[email protected]>
 Luis Barreiro <[email protected]> barreiro <[email protected]>
 Lukasz Antoniak <[email protected]> lukasz-antoniak <[email protected]>
+Matthew Vance <[email protected]>
 Marco Belladelli <[email protected]> marco <[email protected]>
 Marco Belladelli <[email protected]> <[email protected]>
+Michael Nachmias <[email protected]> <[email protected]>
 Misty Stanley-Jones <[email protected]> misty <[email protected]>
 Misty Stanley-Jones <[email protected]> <mstanley@cheezel.(none)>
 Misty Stanley-Jones <[email protected]> mstanleyjones <[email protected]>
 Nathan Xu <[email protected]> <[email protected]>
 Nathan Xu <[email protected]> <[email protected]>
+Nelson Rodrigues <[email protected]>
+Nikolay Mukhanov <[email protected]>
 Oliver Breidenbach <[email protected]> obr <[email protected]>
-Radim Vansa <[email protected]> rvansa <[email protected]> 
+Radim Vansa <[email protected]> rvansa <[email protected]>
+Rob Worsnop <[email protected]> <[email protected]>
 Sanne Grinovero <[email protected]> <[email protected]>
 Scott Marlow <[email protected]> Scott Marlow <[email protected]>
 Scott Marlow <[email protected]> smarlow <[email protected]>
@@ -110,6 +126,7 @@ Ståle W. Pedersen <[email protected]> <[email protected]>
 Steve Ebersole <[email protected]> <steve@apollo.(none)>
 Steve Ebersole <[email protected]> <steve@t510.(none)>
 Strong Liu <[email protected]> <[email protected]>
+Viacheslav Rarata <[email protected]>
 Vlad Mihalcea <[email protected]> <[email protected]>
 Vlad Mihalcea <[email protected]> <[email protected]>
 Vlad Mihalcea <[email protected]> <Vlad Mihalcea>

.idea/icon.svg

@@ -47,14 +47,14 @@ stage('Configure') {
 		// We want to enable preview features when testing newer builds of OpenJDK:
 		// even if we don't use these features, just enabling them can cause side effects
 		// and it's useful to test that.
-		new BuildEnvironment( testJdkVersion: '20', testJdkLauncherArgs: '--enable-preview' ),
 		new BuildEnvironment( testJdkVersion: '21', testJdkLauncherArgs: '--enable-preview' ),
 		new BuildEnvironment( testJdkVersion: '23', testJdkLauncherArgs: '--enable-preview' ),
+		new BuildEnvironment( testJdkVersion: '24', testJdkLauncherArgs: '--enable-preview' ),
 		// The following JDKs aren't supported by Hibernate ORM out-of-the box yet:
 		// they require the use of -Dnet.bytebuddy.experimental=true.
 		// Make sure to remove that argument as soon as possible
 		// -- generally that requires upgrading bytebuddy after the JDK goes GA.
-		new BuildEnvironment( testJdkVersion: '24', testJdkLauncherArgs: '--enable-preview -Dnet.bytebuddy.experimental=true' )
+		new BuildEnvironment( testJdkVersion: '25', testJdkLauncherArgs: '--enable-preview -Dnet.bytebuddy.experimental=true' )
 	];
 
 	if ( env.CHANGE_ID ) {
@@ -249,7 +249,7 @@ void ciBuild(buildEnv, String args) {
 			}
 		}
 	}
-	else if ( buildEnv.node && buildEnv.node != 's390x' ) { // We couldn't get the code below to work on s390x for some reason.
+	else if ( buildEnv.node != 's390x' ) { // We couldn't get the code below to work on s390x for some reason.
 		// Pull request: we can't pass credentials to the build, since we'd be exposing secrets to e.g. tests.
 		// We do the build first, then publish the build scan separately.
 		tryFinally({