Spring Data JPA 4.0

Apply the Hibernate ORM 7.2 and Spring Boot 4.0 baselines first. These rules cover Spring Data JPA 4.0.7 on the 2025.1 release train: repository exposure, generated and declared queries, value expressions, sorting and paging, specifications, projections, and bulk mutation.

Release alignment and repository exposure

• Build the Sort for a @NativeQuery or @Query(nativeQuery = true) method in code from an allowlisted client key, never from a request-supplied Sort or Pageable, because native ORDER BY text isn't checked against the entity's properties. On 4.0.0 through 4.0.6, which predate the 4.0.7 fix, the sort-expression check also accepted characters outside the ASCII punctuation pattern, so a crafted Sort value could reach that clause and be used to infer data on databases that accept non-ASCII SQL syntax.
• Keep the stack the 4.0 train was built against together — Spring Framework 7.0, the matching Spring Data Commons 4.0 release, Hibernate ORM 7.2, Jakarta Persistence 3.2, and Java 17 or later — by letting the Spring Data release-train BOM and Boot's dependency management choose those versions, instead of overriding one of them on its own.
• Keep JpaRepository, JpaSpecificationExecutor, QueryByExampleExecutor, and QuerydslPredicateExecutor behind purpose-built service methods; a repository interface handed to a controller, GraphQL resolver, message listener, or agent tool is an unrestricted query surface.
• Authorize the specific record and the specific state transition inside the transaction that loads it, because findById, existsById,