Hibernate ORM 7.2

Apply the Java 17 baseline first. These rules cover Hibernate ORM 7.2.24.Final, which runs on JDK 17, 21, or 25 and implements Jakarta Persistence 3.2.

Queries

• Pass every request-derived value as a named or ordinal parameter of createQuery, createSelectionQuery, createMutationQuery, or createNativeQuery; concatenated query text bypasses binding.
• Keep hibernate.criteria.value_handling_mode at its bind default; inline renders implicit criteria values as SQL literals, while explicit CriteriaBuilder.parameter() arguments stay bound either way.
• Never pass user input to CriteriaBuilder.literal(), which inlines its argument even in bind mode.
• Express dynamic filtering with 7.x Restriction factories on SelectionSpecification and MutationSpecification, not HQL fragments glued from request fields.
• Sort with Order.asc(SingularAttribute) from the static metamodel, allowlisting the attribute name with the Order.by(Class, String, SortDirection) overload.
• @SQLRestriction, @Filter conditions, @SQLSelect, @SQLInsert, @SQLUpdate, @SQLDelete, and @ColumnTransformer are fixed build-time SQL; bind @ParamDef filter arguments and use documented JDBC placeholders in custom SQL.
• Keep incubating hibernate.query.hql.json_functions_enabled and hibernate.query.hql.xml_functions_enabled off unless needed, never building JSON or XML path arguments from request data.
• Set hibernate.query.fail_on_pagination_over_collection_fetch=true; its false default lets a paginated collection fetch join load everything and paginate in memory.