Merge branch 'main' into HHH-19001

Author: gavinking

.git-blame-ignore-revs

@@ -1,3 +1,7 @@
 # Initial commits that enabled spotless automatic formatting
 59731c089e9d649a663c81d9622b54557d6aba37
 4d63ffd98cdead513ab0be0fa23f9787423092d3
+# Envers removal/restore
+9c7dd3bf34dfbb2f4fa9eb79a0294c2cc759c836
+b2a528f2945cee26667b22b867ccef143b7c430c
+4273f1cde06f3622f50c2846078398c1977a49c4

.github/dependabot.yml

@@ -17,4 +17,11 @@ updates:
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
+      interval: monthly
+    groups:
+      workflow-actions:
+        patterns:
+          - "*"
+    allow:
+      - dependency-name: "actions/*"
+      - dependency-name: "redhat-actions/*"

.github/workflows/ci-report.yml

@@ -17,12 +17,12 @@ jobs:
     steps:
       # Checkout target branch which has trusted code
       - name: Check out target branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: ${{ github.ref }}
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -38,7 +38,7 @@ jobs:
           echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: |
             ~/.m2/repository/
@@ -52,7 +52,7 @@ jobs:
 
       - name: Download GitHub Actions artifacts for the Develocity build scans
         id: downloadBuildScan
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           pattern: build-scan-data-*
           github-token: ${{ github.token }}
@@ -75,4 +75,4 @@ jobs:
           done
           exit $status
         env:
-          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
     # Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners
     #          - rdbms: hana
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim Disk Space
@@ -56,7 +56,7 @@ jobs:
           RDBMS: ${{ matrix.rdbms }}
         run: ci/database-start.sh
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -73,7 +73,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -90,7 +90,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -118,14 +118,14 @@ jobs:
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
         with:
           name: build-scan-data-${{ matrix.rdbms }}
           path: ~/.gradle/build-scan-data
 
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-${{ matrix.rdbms }}
@@ -151,7 +151,7 @@ jobs:
           - rdbms: oracle_db21c
           - rdbms: oracle_db23c
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim disk space and sanitize user home
@@ -162,7 +162,7 @@ jobs:
           RUNID: ${{ github.run_number }}
         run: ci/database-start.sh
       - name: Set up Java 21
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@aafbedb8d382ed0ca6167d3a051415f20c859274 # v1.2.8
         with:
           distribution: 'graalvm'
           java-version: '21'
@@ -179,7 +179,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -196,7 +196,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -216,20 +216,23 @@ jobs:
           RUNID: ${{ github.run_number }}
           # These runners have no HOME variable set by default, we need to explicitly set it to make the build work
           HOME: /root
+          # Needed for TFO (TCP fast open)
+          LD_PRELOAD: /home/opc/libtfojdbc1.so
+          LD_LIBRARY_PATH: /home/opc
         run: ./ci/build-github.sh
         shell: bash
       # Upload build scan data.
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       # That's even on push, because we do not trust Atlas runners to hold secrets: they are shared infrastructure.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ !cancelled() }}"
         with:
           name: build-scan-data-${{ matrix.rdbms }}
           path: ~/.gradle/build-scan-data
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-${{ matrix.rdbms }}
@@ -245,13 +248,13 @@ jobs:
     name: Static code analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
       - name: Reclaim disk space and sanitize user home
         run: .github/ci-prerequisites-atlas.sh
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -268,7 +271,7 @@ jobs:
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Cache Maven/Gradle Dependency/Dist Caches
         id: cache-maven
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it's not a pull request, we restore and save the cache
         if: github.event_name != 'pull_request'
         with:
@@ -285,7 +288,7 @@ jobs:
             ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
             ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         # if it a pull request, we restore the cache but we don't save it
         if: github.event_name == 'pull_request'
         with:
@@ -311,18 +314,18 @@ jobs:
       # The actual publishing must be done in a separate job (see ci-report.yml).
       # We don't write to the remote cache as that would be unsafe.
       - name: Upload GitHub Actions artifact for the Develocity build scan
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
         with:
           name: build-scan-data-sca
           path: ~/.gradle/build-scan-data
 
       - name: Upload test reports (if Gradle failed)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: test-reports-java11-sca
           path: |
             ./**/target/reports/tests/
       - name: Omit produced artifacts from build cache
-        run: ./ci/before-cache.sh
+        run: ./ci/before-cache.sh

.github/workflows/codeql.yml

@@ -37,17 +37,17 @@ jobs:
     steps:
 
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -74,6 +74,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@7e3036b9cd87fc26dd06747b7aa4b96c27aaef3a # v3.28.4
         with:
-          category: "/language:${{matrix.language}}"
+          category: "/language:${{matrix.language}}"

.idea/.gitignore

@@ -43,11 +43,15 @@
 # assume any information here is accurate.
 
 Adam Warski <[email protected]> adamw <[email protected]>
+Adar Lieber-Dembo <[email protected]>
 Alex Snaps <[email protected]> <[email protected]>
+Alexander Kotlyarov <[email protected]>
+Alexey Nesterov <[email protected]> <[email protected]>
 Andrea Boriero <[email protected]> <[email protected]>
 Andrej Golovnin <[email protected]> Andrej Golovnin <[email protected]>
 Andrig Miller <[email protected]> andrigtmiller <[email protected]>
 Andrig Miller <[email protected]> andy.miller <[email protected]>
+Arcadiy Ivanov <[email protected]> <[email protected]>
 Barry LaFond <[email protected]> blafond <[email protected]>
 Boris Korogvich <[email protected]> VEINHORN <[email protected]>
 Brett Meyer <[email protected]> <[email protected]>
@@ -61,6 +65,7 @@ Chris Cranford <[email protected]> <[email protected]> Naros
 Chris Cranford <[email protected]> <[email protected]>
 Chris Cranford <[email protected]> cranforc <[email protected]>
 Christoph Dreis <[email protected]> ChristophDreis <[email protected]>
+Daniel Heinrich <[email protected]>
 Dave Repshas <[email protected]> drepshas <[email protected]>
 David M. Carr <[email protected]> davidmc24 <[email protected]>
 David M. Carr <[email protected]> dcarr <[email protected]>
@@ -82,26 +87,37 @@ Hardy Ferentschik <[email protected]> <[email protected]>
 Hardy Ferentschik <[email protected]> <[email protected]>
 Harsh Panchal <[email protected]> BOOTMGR <[email protected]>
 Hernán Chanfreau <[email protected]> hernan <[email protected]>
+Ivan Munic <[email protected]>
 Jaikiran Pai <[email protected]> Jaikiran <[email protected]>
+Janario Oliveira <[email protected]> <[email protected]>
+Janario Oliveira <[email protected]> <[email protected]>
 Jeremy Whiting <[email protected]> Jeremy Whiting <[email protected]>
 John O'Hara <[email protected]> johara <[email protected]>
 John O'Hara <[email protected]> <[email protected]>
 John O'Hara <[email protected]> JohnOhara <[email protected]>
 John O'Hara <[email protected]> John OHara <[email protected]>
 John Verhaeg <[email protected]> John Verhaeg <[email protected]>
 John Verhaeg <[email protected]> JPAV <[email protected]>
+Laurent Almeras <[email protected]> <[email protected]>
+Laurent Almeras <[email protected]> <[email protected]>
+Leonard Siu <[email protected]>
 Loïc LEFEVRE <[email protected]> LLEFEVRE <[email protected]>
 Luis Barreiro <[email protected]> barreiro <[email protected]>
 Lukasz Antoniak <[email protected]> lukasz-antoniak <[email protected]>
+Matthew Vance <[email protected]>
 Marco Belladelli <[email protected]> marco <[email protected]>
 Marco Belladelli <[email protected]> <[email protected]>
+Michael Nachmias <[email protected]> <[email protected]>
 Misty Stanley-Jones <[email protected]> misty <[email protected]>
 Misty Stanley-Jones <[email protected]> <mstanley@cheezel.(none)>
 Misty Stanley-Jones <[email protected]> mstanleyjones <[email protected]>
 Nathan Xu <[email protected]> <[email protected]>
 Nathan Xu <[email protected]> <[email protected]>
+Nelson Rodrigues <[email protected]>
+Nikolay Mukhanov <[email protected]>
 Oliver Breidenbach <[email protected]> obr <[email protected]>
-Radim Vansa <[email protected]> rvansa <[email protected]> 
+Radim Vansa <[email protected]> rvansa <[email protected]>
+Rob Worsnop <[email protected]> <[email protected]>
 Sanne Grinovero <[email protected]> <[email protected]>
 Scott Marlow <[email protected]> Scott Marlow <[email protected]>
 Scott Marlow <[email protected]> smarlow <[email protected]>
@@ -110,6 +126,7 @@ Ståle W. Pedersen <[email protected]> <[email protected]>
 Steve Ebersole <[email protected]> <steve@apollo.(none)>
 Steve Ebersole <[email protected]> <steve@t510.(none)>
 Strong Liu <[email protected]> <[email protected]>
+Viacheslav Rarata <[email protected]>
 Vlad Mihalcea <[email protected]> <[email protected]>
 Vlad Mihalcea <[email protected]> <[email protected]>
 Vlad Mihalcea <[email protected]> <Vlad Mihalcea>

.idea/icon.svg

@@ -5,12 +5,15 @@ project really) strong and successful.
 
 # Legal
 
-All original contributions to Hibernate are licensed under the 
-[GNU Lesser General Public License (LGPL)](https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt), 
-version 2.1 or later, or, if another license is specified as governing the file or directory being 
-modified, such other license.
-
-The LGPL text is included verbatim in the [lgpl.txt](lgpl.txt) file in the root directory of the ORM repository.
+All original contributions to Hibernate are licensed under the
+[Apache License version 2.0 (Apache-2.0)](https://www.apache.org/licenses/LICENSE-2.0.txt),
+or, if another license is specified as governing the file or directory being modified, such other license.
+The Apache-2.0 license text is included verbatim in the [`LICENSE.txt`](LICENSE.txt) file
+
+Note that Hibernate ORM 7.0.0.Beta4 and earlier are distributed under 
+[a different license](https://github.com/hibernate/hibernate-orm/blob/6.6/CONTRIBUTING.md#legal). 
+To allow for potential backporting, the Hibernate team asks contributors to dual-license their contribution.
+A Pull Request template already applies the proper wording to make it easy.
 
 All contributions are subject to the [Developer Certificate of Origin (DCO)](https://developercertificate.org/).