Spring Data JPA 4.1

Apply the Hibernate ORM 7.4 and Spring Boot 4.1 baselines first. These rules cover Spring Data JPA 4.1.1 repositories, generated queries, projections, paging, and bulk mutations.

Repository and service boundaries

• Expose purpose-specific service methods rather than a generic repository directly to controllers, GraphQL resolvers, data REST, message listeners, or tools.
• Authorize the object and transition inside the service transaction; findById, existsById, and DomainClassConverter perform lookup, not ownership checks.
• Derive tenant, owner, status, and security predicates from authenticated server context and include them in the repository query rather than filtering results afterward.
• Do not call save with an attacker-populated entity graph; load the managed object, check its version and scope, then copy only permitted DTO fields.
• Define transaction boundaries on service methods because declared query methods do not automatically inherit all CRUD transaction defaults.
• Do not use @Transactional(readOnly=true) as a write-authorization check; it is an optimization hint and does not reliably reject modifying queries.

Query construction

• Bind values in derived queries, @Query, @NativeQuery, specifications, and Query by Example; allowlist every dynamic property path, operator, projection, and native fragment.
• Never pass request data to JpaSort.unsafe, which deliberately admits sort expressions that ordinary Sort rejects when they contain functions.
• Allowlist ordinary Sort properties too, including nested paths, and lower