[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the routine-maven-updates group with 6 updates in the / directory:

Package	From	To
org.hibernate.orm:hibernate-core	7.4.7.Final	7.4.8.Final
org.codehaus.mojo:build-helper-maven-plugin	3.6.1	3.6.2
org.mongodb:mongodb-driver-sync	5.11.0	5.11.1
org.slf4j:slf4j-nop	2.0.18	2.0.19
org.slf4j:slf4j-api	2.0.18	2.0.19
org.slf4j:slf4j-api	2.0.18	2.0.19
com.velocitypowered:velocity-api	4.1.1	4.2.0

Updates org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.8.Final

Release notes

Sourced from org.hibernate.orm:hibernate-core's releases.

Release 7.4.8

Hibernate ORM 7.4.8.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.8.Final.

You can find the full list of 7.4.8.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.orm:hibernate-core's changelog.

Changes in 7.4.8.Final (September 13, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/40444

** Bug * HHH-20855 SQL Server temporal rounding causing trouble with sub-micro input values * HHH-20849 org.hibernate.query.range.Range#suffix wrongly expects pattern * HHH-20806 Join elimination in 7.x skips @​SQLRestriction when querying by to-one association id * HHH-20805 MySQL schema update fails, if foreignkey related index is unique * HHH-20804 StatefulPersistenceContext.clear() does not release newEntityHolder * HHH-20801 AnyType.guessEntityPersister uses the wrapped proxy instead of the unwrapped implementation in its fallback → UnknownEntityTypeException during flush logging * HHH-20782 @​FilterJoinTable throws NPE when used with explicit HQL join * HHH-20744 UnknownTableReferenceException when querying the non-owning side of a one-to-one-mapping with a pessimistic lock mode * HHH-20675 @​FilterDef(applyToLoadByKey = true) breaks JOIN FETCH of a JOINED-inheritance to-one association: subclass table joins dropped from FROM while their columns remain in SELECT (invalid SQL) * HHH-20632 Regression: UnknownTableReferenceException fetching an @​Any discriminator through treat() (since 7.4.0, HHH-16730) * HHH-20343 HTE (Bulk ID) temporary table ignores PhysicalNamingStrategy when using SequenceGenerator * HHH-19486 SQLGrammarException when joining to subquery with Case expression * HHH-19485 AssertionError when using Subquery with Case in Criteria API * HHH-18911 Usage of ConcreteProxy in lazy loaded ManyToOne reference

** Deprecation * HHH-20862 Deprecate reflection optimizer and related property access APIs

** Task * HHH-20851 Upgrade to ant 1.10.18 * HHH-20848 Drop meaningless "provided" dependency to ant in hibernate-envers

Commits

• 2d3a7b8 [Jenkins release job] Preparing release 7.4.8.Final
• ca17983 [Jenkins release job] changelog.txt updated by release build 7.4.8.Final
• 39d80c7 HHH-19486 Test and fix an alias collision for subquery in FROM clause select ...
• 7e8f5df HHH-19485 Fix FromClause#queryTableReferences potentially initializing a Lazy...
• c53a08c HHH-19485 Fix TableReference#containsAffectedTableName exiting early
• 418fd2d HHH-19485 Reproduce assertion error when selecting case expression through FR...
• c39a73f HHH-20862 Deprecate reflection optimizer and related property access APIs
• 54c3cf0 HHH-20855 Fix SQL Server temporal rounding with sub-micro input values
• e66b6a5 HHH-20744 Skip inverse to-one attributes in follow-on locking
• b55bfc8 Don't use --illegal-field-mutation=deny in JDK 28 testing
• Additional commits viewable in compare view

Updates org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2

Release notes

Sourced from org.codehaus.mojo:build-helper-maven-plugin's releases.

3.6.2

🐛 Bug Fixes

• Replace raw NPEx with customized exception message (#239) @​pzygielo

👻 Maintenance

• Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#248) @​slachiewicz

📦 Dependency updates

• Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#248) @​slachiewicz
• Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (#247) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#244) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 96 to 97 (#246) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#245) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (#241) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 95 to 96 (#240) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 94 to 95 (#235) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 93 to 94 (#233) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#232) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 91 to 92 (#231) @dependabot[bot]

Commits

• 813bc7d [maven-release-plugin] prepare release 3.6.2
• 07d9109 Remove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in Dependabot
• 9abd552 Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0
• 3c15526 Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
• 3b1f104 Bump org.codehaus.mojo:mojo-parent from 96 to 97
• 1749855 Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml
• 5230041 Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3
• c0e9375 Delete .github/release-drafter.yml
• 84a839e Bump org.codehaus.mojo:mojo-parent from 95 to 96
• a85c668 Replace raw NPEx with customized exception message
• Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-sync from 5.11.0 to 5.11.1

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.11.1 (September 10, 2026)

What's Changed

[!WARNING] Starting from driver version 3.3.0, an improper neutralization of a query operator in the GridFS delete methods allowed unintended data deletion.

See JAVA-6283 / CVE-2026-88033]

Upgrade reactive/sync driver version to 5.11.1 or later.

If you cannot upgrade, applications using older driver versions should call another delete overload delete(ObjectId). The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.

[!WARNING] Starting from driver version 4.2.0, cancelling or timing out an encrypted operation while the driver fetches cloud KMS credentials makes it call into freed native memory, crashing or corrupting the application.

See JAVA-6266 / CVE-2026-88032

Upgrade both reactive driver and mongodb-crypt to version 5.11.1 or later.

Full Changelog: mongodb/mongo-java-driver@r5.11.0...r5.11.1

Commits

• e959410 Version: bump 5.11.1
• 0765f4b Merge commit from fork
• 4d78640 Merge commit from fork
• bfda498 Version: bump 5.11.1-SNAPSHOT
• See full diff in compare view

Updates org.slf4j:slf4j-nop from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates com.velocitypowered:velocity-api from 4.1.1 to 4.2.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.