fix(deps): bump the prod-deps group with 2 updates

[dependabot]

Bumps the prod-deps group with 2 updates: org.springframework.boot:spring-boot-starter-parent and org.hibernate.orm:hibernate-jpamodelgen.

Updates org.springframework.boot:spring-boot-starter-parent from 4.0.6 to 4.1.0

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.1.0

Full release notes for Spring Boot 4.1 are available on the wiki.

⭐ New Features

• Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause #50211
• Reduce memory consumption when repeatedly calling WritableJson.toByteArray #49428

🐞 Bug Fixes

• MailSender auto-configuration does not enable hostname verification #50747
• Artemis auto-configuration uses a predictable default location for the embedded broker's data #50745
• Embedded LDAP SSL should not be enabled when its bundle is empty #50700
• InetAddressFilter.externalAddresses does not exclude special purpose addresses from RFC 6890 #50668
• NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50645
• SSL should not be enabled when a SSL bundle is overridden to an empty string #50635
• Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50633
• Configuration property metadata includes incorrect class references #50632
• Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50618
• RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50612
• NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50610
• SpringJtaPlatform should have been deprecated since 4.1.0-M3 #50592
• Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50510
• ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50417
• Created StackTracePrinter instances have no access to the Environment #50414
• MappingsEndpoint reports the context's own ID as parentId when a parent exists #50412
• Buildpack module does not validate long-to-int casts #50410
• Gradle gRPC support fails if protobuf-java dependency is used instead of protobuf-java-util #50405
• GraphQL WebSocket support does not configure allowed origins #50394
• Spring Boot Loader Does Not Support RSA and EC Signed Jars #50298
• Meter registries are not removed from the global registry when the context is closed #50287
• DataSourceBuilder cannot derive a DataSource from a lazy connection proxy #50271
• Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50266
• Bean definitions can be added with an initializer before setAllowBeanDefinitionOverriding is called #50264
• EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50261
• Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50258
• ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50234
• NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50228
• Missing dependency management for spring-boot-web-server-test #50224
• Spring Batch support for MongoDB modules are not included in dependency management #50223
• Apply HTML escaping to timestamp attribute in Whitelabel error page #50216
• GrpcServerHealthScheduler is not started in servlet environments #50209
• Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50204

📔 Documentation

• Fix reference to Gradle documentation for module replacement #50647
• Document SSL reloading with Let's Encrypt #50630
• Remove the use of Optional from Data Neo4j repository examples #50622
• Fix typos in documentation #50620

... (truncated)

Commits

• ac2cfe0 Release v4.1.0
• 1a5815c Upgrade to Spring Batch 6.0.4
• a8364ff Merge branch '4.0.x'
• 9755ff2 Upgrade to Spring Batch 6.0.4
• 6a6dedc Upgrade to Spring Integration 7.1.0
• db7b2b9 Merge branch '4.0.x'
• d549d07 Upgrade to Spring Integration 7.0.5
• 4d9e463 Merge branch '3.5.x' into 4.0.x
• b068647 Upgrade to Spring Integration 6.5.9
• 198af99 Merge branch '4.0.x'
• Additional commits viewable in compare view

Updates org.hibernate.orm:hibernate-jpamodelgen from 7.2.12.Final to 7.4.1.Final

Release notes

Sourced from org.hibernate.orm:hibernate-jpamodelgen's releases.

Release 7.4.1

Hibernate ORM 7.4.1.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.1.Final.

You can find the full list of 7.4.1.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Release 7.4.0

Hibernate ORM 7.4.0.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.0.Final.

You can find the full list of 7.4.0.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

... (truncated)

Changelog

Sourced from org.hibernate.orm:hibernate-jpamodelgen's changelog.

Changes in 7.4.1.Final (June 09, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/39004

** Bug * HHH-20537 XML embeddable mapping ignores access attribute when processing attributes * HHH-20536 and element inside are silently ignored in XML mappings * HHH-20518 After updating from 7.3.6 to 7.4.0 hibernate enhance fails * HHH-20517 FOR UPDATE ... SKIP LOCKED on Oracle 23+ fails if there's a lob column * HHH-20514 XML mapping does not apply optimistic-lock attribute for associations * HHH-20513 XML entity mapping ignores <mutable>false</mutable> configuration * HHH-20504 DataException (Parameter is not set) when updating only a collection of a versioned entity with with a @​SQLUpdate * HHH-20500 SchemaManager#truncate(String tableName) fails with UnsupportedOperationException * HHH-20499 Ensure LONG32 JdbcType with LOB DDL type, bound via setString, are treated as LOBs * HHH-20498 Unnest on HANA uses clob/nclob for xmltable that is not supported * HHH-20484 HbmXmlTransformer Generates Invalid for * HHH-20483 HbmXmlTransformer removes quotes from table names * HHH-20481 HbmXmlTransformer should normalize type attribute values to Java type names during XML Conversion * HHH-20477 HbmXmlTransformer Ignores Cascade Attributes for Mappings * HHH-20465 Full Stateless Session mutation support for @​Audited entities * HHH-20453 Combining @​Temporal entity mappings and a @​Changelog leads to CCE * HHH-20386 Metamodel generator / Processor loses generic type parameter for Set in Hibernate 7 * HHH-20159 Wrong aliases in tuple transformer

** Improvement * HHH-20495 Make sure we release resources (if needed) after stateless session operations

Changes in 7.4.0.Final (May 26, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/39172

** Bug * HHH-20454 HbmXmlTransformer generates an incorrect mapping for an HBM file containing a association with a property-ref attribute. * HHH-20451 Hbm is ignored during HbmXmlTransformer conversion * HHH-20418 @​Access on entity wrongly affects @​MappedSuperclass default * HHH-20394 Cascade profile causes LAZY associations to be eagerly fetched even if they won't be affected * HHH-20357 Component.sortProperties() reorders Envers originalId key, breaking joined audit-table FK/joins for JOINED inheritance * HHH-20324 AnnotationException: overrides mapping specified using '@​JoinColumnOrFormula' thrown when join column is overridden via XML mapping * HHH-20125 ClassCastException on merge during polymorphic embeddable replace * HHH-19214 Record as @​IdClass - some tests are failing when record componets of ID class are not alphabetically sorted, but passing when sorted

** Improvement * HHH-20432 Increase the minimum container / worker threads to 4 to reduce build time * HHH-20423 Relax the strict JPQL compliance and make select optional * HHH-20419 Make BytecodeEnhancedTestEngine better compatible with Maven's parallel test execution * HHH-19417 FetchProfile not properly overridden in mapping.xml

... (truncated)

Commits

• e4d1f92 [Jenkins release job] Preparing release 7.4.1.Final
• f1ec2ae [Jenkins release job] changelog.txt updated by release build 7.4.1.Final
• 79527f1 HHH-20518 Do not exclude plexus-utils and add missing xml-utils for the maven...
• fa146cd HHH-20537 XML embeddable mapping ignores access attribute when processing att...
• 3a9c95a HHH-20537 Add test for issue
• 86e037a HHH-20536 <read> and <write> element inside <attribute-override> are silently...
• e3fadef HHH-20536 Add test for issue
• 82da261 document plans for Hibern8 and JPA4 in Query API [7.4] (#12519)
• 74f9a4d Update TCK to always run for 7.4 PRs / run Search update job for PRs
• f97f47f Enable automatic releases for 7.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud