[
https://issues.apache.org/jira/browse/WW-5722?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121819#comment-18121819
]
Lukasz Lenart commented on WW-5722:
-----------------------------------
Hibernate 6.x has now been tried and fails the same way. Dependabot PR #1970
({{hibernate-core}} 5.6.15.Final -> 6.6.58.Final, WW-5750) fails all five
{{Build and Test}} jobs on
{{classInclusion_hibernateProxy_allowProxyObjectAccess}} in
{{SecurityMemberAccessTest}} and {{ExternalSecurityMemberAccessTest}} with
{{IllegalArgumentException: object is not an instance of declaring class}}.
So the proxy break starts at 6.x, not 7.x, and 6.x is no cheaper intermediate
step. #1970 was closed with Dependabot told to ignore the 6.x major; the move
off 5.6 is folded into this ticket.
> Support Hibernate 7.x - bump the optional hibernate-core dependency from
> 5.6.15.Final
> -------------------------------------------------------------------------------------
>
> Key: WW-5722
> URL: https://issues.apache.org/jira/browse/WW-5722
> Project: Struts 2
> Issue Type: Dependency
> Components: Core
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 8.0.0
>
>
> {{struts2-core}} declares {{org.hibernate:hibernate-core}} {{5.6.15.Final}}
> as an optional compile dependency ({{core/pom.xml}}). It is used in exactly
> two classes, {{org.apache.struts2.util.ProxyUtil}} and
> {{org.apache.struts2.util.StrutsProxyService}}, to detect Hibernate proxies
> ({{HibernateProxy}}) and unwrap them ({{Hibernate.unproxy}}) so that
> {{SecurityMemberAccess}} can apply the allowlist to the real entity class.
> Dependabot PR #1905 (5.6.15.Final -> 7.4.7.Final) was closed on 2026-09-11
> rather than merged: all three {{Build and Test}} jobs fail on
> {code}SecurityMemberAccessTest.classInclusion_hibernateProxy_allowProxyObjectAccess:1000
> IllegalArgumentException: object is not an instance of declaring class
> {code}
> (also through {{ExternalSecurityMemberAccessTest}}). The test builds a
> {{HibernateProxy}} with a JDK dynamic proxy ({{mockHibernateProxy}} in
> {{SecurityMemberAccessTest}}), and the Hibernate 7 {{HibernateProxy}} /
> {{Hibernate.unproxy}} contract no longer works with that shape. Dependabot
> was told to ignore the 7.x major, so it will not reopen it.
> h3. Scope
> * Decide the supported Hibernate range for Struts 8: 7.x requires Jakarta
> Persistence 3.2, i.e. Jakarta EE 11, so this goes with the same baseline
> decision as WW-5721 (default Spring line). Hibernate 6.x (JPA 3.1, Jakarta EE
> 10) may be an intermediate step, but it has not been tested either - do not
> assume 6.x passes because only 7.x was tried.
> * Update {{ProxyUtil}} / {{StrutsProxyService}} for the new proxy API if the
> runtime detection needs it, and rewrite the test double so it exercises the
> real contract instead of a dynamic-proxy stand-in.
> * Bump {{hibernate-core}} in {{core/pom.xml}} and confirm
> {{SecurityMemberAccessTest}} and {{ExternalSecurityMemberAccessTest}} pass on
> all three CI matrices, including the Jakarta EE 11 + Spring 7 one.
> h3. Related
> * PR #1905 - the failing bump
> * WW-5721 - default Spring 6.2.x is OSS-EOL, same Jakarta EE 11 baseline
> question
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
