Hibernate ORM 6.6

Apply the Java 11 baseline first. These rules cover Hibernate ORM 6.6.56.Final, which implements Jakarta Persistence 3.1 and runs on JDK 11, 17, 21, 25 from 6.6.40, or 26 from 6.6.49.

Query construction and parameters

• Bind every request-derived value through setParameter on queries created by createQuery, createSelectionQuery, createMutationQuery, createNativeQuery, or createStoredProcedureQuery.
• Build dynamic predicates with the Jakarta Persistence CriteriaBuilder, using parameter() expressions for values, because 6.6 has no typed Restriction or specification API to fall back on.
• Leave hibernate.criteria.value_handling_mode at its bind default, since the inline mode renders criteria values as SQL literals instead of JDBC bind parameters.
• Keep user input out of CriteriaBuilder.literal(), which requests SQL literal rendering even when the value handling mode is bind; use parameter() and setParameter for explicit bind parameters.
• Sort with Order.asc(SingularAttribute) against the generated static metamodel, and allowlist attribute names before using the Order.by(Class, String, SortDirection) overload.
• Escape or reject % and _ in a finder parameter annotated @Pattern, because the generated code turns that parameter into a like condition.
• Keep the query text in @HQL and @SQL metamodel generator methods static, passing every variable value as a method parameter that becomes a bound query parameter.
• Set hibernate.query.fail_on_pagination_over_collection_fetch=true, because the false default lets a paginated