Hibernate organization membership on GitHub
by Yoann Rodiere
Hello,
As part of the move to Commonhaus, I'm currently going through our GitHub
setup, and I'm noticing we have a lot of users with extensive (and I mean
*extensive*, sometimes admin or even owner) access to our
organization/repositories, but who are no longer regular contributors.
Additionally, we also have organization members on GitHub who are not
technically Hibernate members: they have never actually contributed to
Hibernate, but are there for technical reasons, for example because they're
coworkers who helped out with some infrastructure issue.
While it's fine in principle, because we trust these people, it's very,
very far from security best practices. Account hacking happens, email
addresses get stolen, and the people using these GitHub accounts might one
day be an attacker instead of the person we trust.
According to Commonhaus' automated report, we're currently at 32 people
having admin rights on one Hibernate repository or another. Which I think
we can all agree is much more than necessary.
For that reason, I'd like to propose that:
1. *We create an "Alumni" team in our GitHub organization*, moving to that
team anyone who is actually a member, but hasn't contributed for... let's
say 2 years? Of course this isn't a permanent thing, and we can simply move
alumni back to the relevant team if they become active again.
2. *We move non-members out of our GitHub organization*, or to "external
collaborators" (that's a GitHub feature) if still necessary.
3. *We schedule yearly audits of our GitHub configuration* to review access
rights again in the future, and move people to the Alumni team as necessary.
Note moving people in and out of teams will get them notified, so I would
send another email directly to impacted people before/during the move, to
avoid this being seen as personal/insulting. It's really not.
*Thoughts, opinions, +1s?*
Yoann Rodière
Hibernate team
1 month, 4 weeks
New CI machine preview
by Sanne Grinovero
You're all welcome to play with http://54.225.162.168/
however please keep these in mind:
- it's not the final machine: don't put too much effort in creating
nice build scripts as we'll reset it to clean state soon. We *might*
be able to store jobs defined so far, but we might choose not to.
- domain name should be coming: ci.hibernate.org ..not sure when, got
no replies so far from.
- authentication: just click on login, it will use OAuth2 to request
your identity via your GitHub account. Permissions to create new jobs,
edit existing jobs, run a build manually depend on your github account
be part of the Hibernate organization (or not, in which case you have
read only status)
At this stage I'd like to get a feeling if the hardware is powerful
enough, and also we need to select which other plugins we want to use,
I'm looking especially to:
- static analysis reports
- pull requests integration
both are relatively undefined, we can of course start simple and
improve later.. just checking this fits basic needs now.
Sanne
2 months, 1 week
Boilerplate for LGPL+ASL2 agreement
by Yoann Rodiere
Hello,
Marko did some work on the Hibernate GitHub bot so that certain Hibernate
Team Members can be spared the "I accept both LGPL and ASL2" boilerplate in
their PR description (see [1] for full text).
This does not change requirements, and is only intended for convenience,
for frequent contributors. We are still licensing newer versions of our
projects under ASL2, but we still need agreement with LGPL in order to be
able to backport contributions.
*If you are a Hibernate team member on GitHub*, and want this check to be
skipped, please read the text below, check that you agree, and send that
text back verbatim as a reply to this message.
I confirm that all contribution I will make to Hibernate projects will be
> made under the terms of the Apache 2.0 license (
> https://www.apache.org/licenses/LICENSE-2.0.txt) and can be relicensed
> under the terms of the LGPL v2.1 license (
> https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt) in the future at
> the maintainers' discretion.
For the record, we keep track of such members by adding them to the
"license-agreement" team in the Hibernate organization.
[1]
https://github.com/hibernate/hibernate-orm/blob/cda55ae023fc44c29b91b6219...
Cheers,
Yoann Rodière
Hibernate team
4 months, 2 weeks
Re: JDK 25 Initial Release Candidate
by Christian Beikov
Hey David,
Thank you for the updates. Everything looking good on our end:
Hibernate ORM: Version 7.1 tested against 25 (EA 35) / 26 (EA 10). No
problems to report.
Hibernate Validator: Version 9.1 tested against 25 (EA 35) / 26 (EA 10).
No problems to report.
Hibernate Search: Version 8.2 tested against 25 (EA 35) / 26 (EA 10). No
problems to report.
Hibernate Reactive: Version 4.1 tested against 25 (EA 35) / 26 (EA 10).
No problems to report.
Have a nice weekend,
Christian
Hibernate team
On 12.08.25 11:20, David Delabassee via hibernate-dev wrote:
> Welcome to the OpenJDK Quality Outreach summer update!
>
> Everything is on track for the General Availability of Java 25 on September 16 as the JDK 25 Release Candidate builds (RC1 - builds 35) are now available[1]. If you haven't done so yet, please start testing your project(s) using JDK 26 early-access builds and let us know the results.
>
> Changing topics, the JVM Language Summit (JVMLS) was held last week in Santa Clara (California). JVMLS is a unique event that brings together Java and JVM architects and OpenJDK developers to discuss the evolution and future directions of the platform. The first JVMLS video has just been published, with more to follow. To stay informed about the latest developments, keep an eye on this JVMLS playlist[2].
>
> [1] https://mail.openjdk.org/pipermail/jdk-dev/2025-August/010296.html
> [2] https://www.youtube.com/playlist?list=PLX8CzqL3ArzUOgZpIX6GsoRhPbnij-sco
>
>
> # JDK 25
>
> The JDK 25 early-access builds 35 are available[3], and are provided under the GNU General Public License v2, with the Classpath Exception. The Release Notes are available here[4]. For more details on Java 25, please refer to the “Topics of Interest” section below.
>
> ## JEPs Integrated into JDK 25:
>
> - JEP 470: PEM Encodings of Cryptographic Objects (Preview)
> - JEP 502: Stable Values (Preview)
> - JEP 503: Remove the 32-bit x86 Port
> - JEP 505: Structured Concurrency (5th Preview)
> - JEP 506: Scoped Values
> - JEP 507: Primitive Types in Patterns, instanceof, and switch (3rd Preview)
> - JEP 508: Vector API (1Oth Incubator)
> - JEP 509: JFR CPU-Time Profiling (Experimental)
> - JEP 510: Key Derivation Function API
> - JEP 511: Module Import Declarations
> - JEP 512: Compact Source Files and Instance Main Methods
> - JEP 513: Flexible Constructor Bodies
> - JEP 514: Ahead-of-Time Command-Line Ergonomics
> - JEP 515: Ahead-of-Time Method Profiling
> - JEP 518: JFR Cooperative Sampling
> - JEP 519: Compact Object Headers
> - JEP 520: JFR Method Timing & Tracing
> - JEP 521: Generational Shenandoah
>
>
> ## Changes in Recent JDK 25 Builds of Interest:
>
> - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given [Reported by Apache Lucene]
> - JDK-8356698: JFR: @Contextual
> - JDK-8351594: JFR: Rate-limited sampling of Java events
> - JDK-8241678: Remove PerfData sampling via StatSampler
> - JDK-8356870: HotSpotDiagnosticMXBean.dumpThreads and jcmd Thread.dump_to_file updates
> - JDK-8350689: Turn on timestamp and thread metadata by default for java.security.debug
> - JDK-8354450: A File should be invalid if an element of its name sequence ends with a space
> - JDK-8350880: (zipfs) Add support for read-only zip file systems
> - JDK-8341346: Add support for exporting TLS Keying Material
> - JDK-8345431: Improve jar --validate to detect duplicate or invalid entries
> - JDK-8359170: Added 4 New Root Certificates from Sectigo Limited
> - JDK-8358590: JFR: Include min and max in MethodTiming event
> - JDK-8228773: URLClassLoader constructors should include API note warning that the parent should not be null
> - JDK-8356049: Need a simple way to play back a sound clip
> - JDK-8357955: java.lang.classfile.Signature.ArrayTypeSig.of IAE not thrown for dims > 255
> - JDK-8359729: Remove the multiplex protocol from the RMI specification
>
> Note: A more exauhstive list of changes can be found here[5].
>
> [3] https://jdk.java.net/25/
> [4] https://jdk.java.net/25/release-notes
> [5] https://github.com/openjdk/jdk/compare/jdk-25+25...jdk-25+35
>
>
> # JDK 26
>
> The JDK 26 early-access builds 10 are available[6] and are provided under the GNU General Public License v2, with the Classpath Exception. The release notes are available here[7].
>
> ## Changes in Recent JDK 26 Builds of Interest:
>
> - JDK-8361380: ARM32: Atomic stubs should be in pre-universe [Reported by JaCoCo]
> - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
> - JDK-8359809: AttributeList, RoleList and UnresolvedRoleList should never accept other types of Object
> - JDK-8268406: Deallocate jmethodID native memory
> - JDK-8314180: Disable XPath in XML Signatures
> - JDK-8330940: Impossible to create a socket backlog greater than 200 on Windows 8+
> - JDK-8357653: Inner classes of type parameters emitted as raw types in signatures
> - JDK-8347114: JMXServiceURL should require an explicit protocol
> - JDK-8309399: JVMTI spec needs to clarify when OPAQUE_FRAME is thrown for reasons other than a native method
> - JDK-8361212: Remove AffirmTrust root CAs
> - JDK-8353925: Remove Sun Microsystems JCE Code Signing Root CA
> - JDK-8361964: Remove outdated algorithms from requirements and add PBES2 algorithms
> - JDK-8332623: Remove setTTL()/getTTL() methods from DatagramSocketImpl/MulticastSocket and MulticastSocket.send(DatagramPacket, byte)
> - JDK-8359760: Remove the jdk.jsobject module
> - JDK-8356557: Update CodeSource::implies API documentation and deprecate java.net.SocketPermission class for removal
> - JDK-8310932: [win] Install the JDK in a per-release directory pointed to by a shared junction
> - JDK-8359956: Support algorithm constraints and certificate checks in SunX509 key manager
> - JDK-8359395: XML signature generation does not support user provided SecureRandom
> - JDK-8356645: Javac should utilize new ZIP file system read-only access mode
>
> Note: A complete list of changes can be found here[8].
>
> [6] https://jdk.java.net/26/
> [7] https://jdk.java.net/26/release-notes
> [8] https://github.com/openjdk/jdk/compare/jdk-26+1...jdk-26+10
>
>
> # Topics of Interest
>
> - Java 25 Encodes PEM
> https://inside.java/2025/06/19/newscast-93/
>
> - JDK 25: Just Be Lazy
> https://inside.java/2025/07/29/just-be-lazy/
>
> - JDK 25: A Sneak Peek at the Stable Values API
> https://inside.java/2025/07/22/javaone-stablevalues/
>
> - Java 25 is ALSO no LTS Version
> https://inside.java/2025/07/03/newscast-94/
>
> - JVMLS: The not-so-final word on `final`
> https://inside.java/2025/08/12/jvmls-final-to-immutable/
>
> - HTTP/3 in Java
> https://inside.java/2025/07/31/newscast-96/
>
> - Project Leyden's AOT / Shifting Java Startup into High Gear
> https://inside.java/2025/06/29/javaone-leyden-aot/
>
> - Java Security Evolution - Out with the Old, In with the New
> https://inside.java/2025/07/20/javaone-security/
>
> - Java GPGPU Enablement: Are We There Yet?
> https://inside.java/2025/07/14/javaone-hat/
>
> - Podcast “Deprecations & Removals” with Stuart Marks
> https://inside.java/2025/07/28/podcast-039/
>
> - Podcast “Integrity by Default” with Ron Pressler
> https://inside.java/2025/06/24/podcast-038/
>
> - A New Model for Java Object Initialization
> https://inside.java/2025/07/27/javaone-object-initialization/
>
> - ZGC: Paving the GC On-Ramp
> https://inside.java/2025/07/10/javaone-zgc/
>
> - Marshalling: Data-Oriented Serialization
> https://inside.java/2025/07/08/javaone-marshalling/
>
> - Interconnecting Java and Native Code with the FFM API
> https://inside.java/2025/06/14/javaone-ffm/
>
> - FFM vs. Unsafe. Safety (Sometimes) Has a Cost
> https://inside.java/2025/06/12/ffm-vs-unsafe/
>
> - Java Gets a JSON API
> https://inside.java/2025/07/17/newscast-95/
>
> ~
>
>
> That’s it for now. If you run into any issues while testing your projects with the latest JDK 26 early-access builds, don’t hesitate to reach out. The end of summer is going to be exciting and busy with the Java 25 launch coming up, so stay tuned!
>
> PS: If you no longer wish to receive OpenJDK Quality Outreach updates, please let me know.
>
> --David
> _______________________________________________
> hibernate-dev mailing list -- hibernate-dev(a)lists.jboss.org
> To unsubscribe send an email to hibernate-dev-leave(a)lists.jboss.org
> Privacy Statement: https://www.redhat.com/en/about/privacy-policy
> List Archives: https://lists.jboss.org/archives/list/hibernate-dev@lists.jboss.org/messa...
4 months, 3 weeks
JDK 25 Initial Release Candidate
by David Delabassee
Welcome to the OpenJDK Quality Outreach summer update!
Everything is on track for the General Availability of Java 25 on September 16 as the JDK 25 Release Candidate builds (RC1 - builds 35) are now available[1]. If you haven't done so yet, please start testing your project(s) using JDK 26 early-access builds and let us know the results.
Changing topics, the JVM Language Summit (JVMLS) was held last week in Santa Clara (California). JVMLS is a unique event that brings together Java and JVM architects and OpenJDK developers to discuss the evolution and future directions of the platform. The first JVMLS video has just been published, with more to follow. To stay informed about the latest developments, keep an eye on this JVMLS playlist[2].
[1] https://mail.openjdk.org/pipermail/jdk-dev/2025-August/010296.html
[2] https://www.youtube.com/playlist?list=PLX8CzqL3ArzUOgZpIX6GsoRhPbnij-sco
# JDK 25
The JDK 25 early-access builds 35 are available[3], and are provided under the GNU General Public License v2, with the Classpath Exception. The Release Notes are available here[4]. For more details on Java 25, please refer to the “Topics of Interest” section below.
## JEPs Integrated into JDK 25:
- JEP 470: PEM Encodings of Cryptographic Objects (Preview)
- JEP 502: Stable Values (Preview)
- JEP 503: Remove the 32-bit x86 Port
- JEP 505: Structured Concurrency (5th Preview)
- JEP 506: Scoped Values
- JEP 507: Primitive Types in Patterns, instanceof, and switch (3rd Preview)
- JEP 508: Vector API (1Oth Incubator)
- JEP 509: JFR CPU-Time Profiling (Experimental)
- JEP 510: Key Derivation Function API
- JEP 511: Module Import Declarations
- JEP 512: Compact Source Files and Instance Main Methods
- JEP 513: Flexible Constructor Bodies
- JEP 514: Ahead-of-Time Command-Line Ergonomics
- JEP 515: Ahead-of-Time Method Profiling
- JEP 518: JFR Cooperative Sampling
- JEP 519: Compact Object Headers
- JEP 520: JFR Method Timing & Tracing
- JEP 521: Generational Shenandoah
## Changes in Recent JDK 25 Builds of Interest:
- JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given [Reported by Apache Lucene]
- JDK-8356698: JFR: @Contextual
- JDK-8351594: JFR: Rate-limited sampling of Java events
- JDK-8241678: Remove PerfData sampling via StatSampler
- JDK-8356870: HotSpotDiagnosticMXBean.dumpThreads and jcmd Thread.dump_to_file updates
- JDK-8350689: Turn on timestamp and thread metadata by default for java.security.debug
- JDK-8354450: A File should be invalid if an element of its name sequence ends with a space
- JDK-8350880: (zipfs) Add support for read-only zip file systems
- JDK-8341346: Add support for exporting TLS Keying Material
- JDK-8345431: Improve jar --validate to detect duplicate or invalid entries
- JDK-8359170: Added 4 New Root Certificates from Sectigo Limited
- JDK-8358590: JFR: Include min and max in MethodTiming event
- JDK-8228773: URLClassLoader constructors should include API note warning that the parent should not be null
- JDK-8356049: Need a simple way to play back a sound clip
- JDK-8357955: java.lang.classfile.Signature.ArrayTypeSig.of IAE not thrown for dims > 255
- JDK-8359729: Remove the multiplex protocol from the RMI specification
Note: A more exauhstive list of changes can be found here[5].
[3] https://jdk.java.net/25/
[4] https://jdk.java.net/25/release-notes
[5] https://github.com/openjdk/jdk/compare/jdk-25+25...jdk-25+35
# JDK 26
The JDK 26 early-access builds 10 are available[6] and are provided under the GNU General Public License v2, with the Classpath Exception. The release notes are available here[7].
## Changes in Recent JDK 26 Builds of Interest:
- JDK-8361380: ARM32: Atomic stubs should be in pre-universe [Reported by JaCoCo]
- JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
- JDK-8359809: AttributeList, RoleList and UnresolvedRoleList should never accept other types of Object
- JDK-8268406: Deallocate jmethodID native memory
- JDK-8314180: Disable XPath in XML Signatures
- JDK-8330940: Impossible to create a socket backlog greater than 200 on Windows 8+
- JDK-8357653: Inner classes of type parameters emitted as raw types in signatures
- JDK-8347114: JMXServiceURL should require an explicit protocol
- JDK-8309399: JVMTI spec needs to clarify when OPAQUE_FRAME is thrown for reasons other than a native method
- JDK-8361212: Remove AffirmTrust root CAs
- JDK-8353925: Remove Sun Microsystems JCE Code Signing Root CA
- JDK-8361964: Remove outdated algorithms from requirements and add PBES2 algorithms
- JDK-8332623: Remove setTTL()/getTTL() methods from DatagramSocketImpl/MulticastSocket and MulticastSocket.send(DatagramPacket, byte)
- JDK-8359760: Remove the jdk.jsobject module
- JDK-8356557: Update CodeSource::implies API documentation and deprecate java.net.SocketPermission class for removal
- JDK-8310932: [win] Install the JDK in a per-release directory pointed to by a shared junction
- JDK-8359956: Support algorithm constraints and certificate checks in SunX509 key manager
- JDK-8359395: XML signature generation does not support user provided SecureRandom
- JDK-8356645: Javac should utilize new ZIP file system read-only access mode
Note: A complete list of changes can be found here[8].
[6] https://jdk.java.net/26/
[7] https://jdk.java.net/26/release-notes
[8] https://github.com/openjdk/jdk/compare/jdk-26+1...jdk-26+10
# Topics of Interest
- Java 25 Encodes PEM
https://inside.java/2025/06/19/newscast-93/
- JDK 25: Just Be Lazy
https://inside.java/2025/07/29/just-be-lazy/
- JDK 25: A Sneak Peek at the Stable Values API
https://inside.java/2025/07/22/javaone-stablevalues/
- Java 25 is ALSO no LTS Version
https://inside.java/2025/07/03/newscast-94/
- JVMLS: The not-so-final word on `final`
https://inside.java/2025/08/12/jvmls-final-to-immutable/
- HTTP/3 in Java
https://inside.java/2025/07/31/newscast-96/
- Project Leyden's AOT / Shifting Java Startup into High Gear
https://inside.java/2025/06/29/javaone-leyden-aot/
- Java Security Evolution - Out with the Old, In with the New
https://inside.java/2025/07/20/javaone-security/
- Java GPGPU Enablement: Are We There Yet?
https://inside.java/2025/07/14/javaone-hat/
- Podcast “Deprecations & Removals” with Stuart Marks
https://inside.java/2025/07/28/podcast-039/
- Podcast “Integrity by Default” with Ron Pressler
https://inside.java/2025/06/24/podcast-038/
- A New Model for Java Object Initialization
https://inside.java/2025/07/27/javaone-object-initialization/
- ZGC: Paving the GC On-Ramp
https://inside.java/2025/07/10/javaone-zgc/
- Marshalling: Data-Oriented Serialization
https://inside.java/2025/07/08/javaone-marshalling/
- Interconnecting Java and Native Code with the FFM API
https://inside.java/2025/06/14/javaone-ffm/
- FFM vs. Unsafe. Safety (Sometimes) Has a Cost
https://inside.java/2025/06/12/ffm-vs-unsafe/
- Java Gets a JSON API
https://inside.java/2025/07/17/newscast-95/
~
That’s it for now. If you run into any issues while testing your projects with the latest JDK 26 early-access builds, don’t hesitate to reach out. The end of summer is going to be exciting and busy with the Java 25 launch coming up, so stay tuned!
PS: If you no longer wish to receive OpenJDK Quality Outreach updates, please let me know.
--David
4 months, 3 weeks
