text: Hibernate Validator 6.1.0.Final and 6.0.18.Final released - In Relation To
  Posted by Guillaume Smet | Nov 20, 2019 Hibernate Validator Releases
  This blog post is long overdue but here comes the proper announcement of Hibernate Validator 6.1.0.Final and 6.0.18.Final.
  Hibernate Validator 6.0.18.Final includes only bugfixes. It is a recommended upgrade for everyone using Hibernate Validator and it is a drop-in replacement for 6.0.17.Final.
  6.1.0.Final is our latest and greatest. It is based on Jakarta Bean Validation. More on that one in a bit.
  We have been made aware of a CVE-2019-10219 related to the @SafeHtml constraint and it was fixed in both 6.0.18.Final and 6.1.0.Final.
  The gist of the issue is that the constraint could potentially accept processing instructions (think <?php) or code embedded in comments (think IE conditional Javascript execution or SSI - yeah that one is old) as a valid input. This particular issue was fixed and our implementation should be safe enough now.
  However, we came to the conclusion that the @SafeHtml constraint was fragile, highly security-sensitive and depending on an external library that wasn't designed for this purpose. Having it included in core Hibernate Validator was not a very good idea. That's why we deprecated it and marked it for removal.
  There is no magic plan here so our users will have to maintain this constraint themselves, either in their own projects or why not in a centralized Open Source project. We have a very nice article about how to declare your own constraints to Hibernate Validator here.
  This was not an easy decision and we already had quite some feedback about it. But we think it's for the best in the long run.
  Move to Jakarta Bean Validation
  Hibernate Validator 6.1.0.Final is now using the Jakarta Bean Validation artifacts as the Bean Validation specification and API have been moved to Eclipse Jakarta.
  The new API artifact is jakarta.validation:jakarta.validation-api. Be careful about potential conflicts if you are using other dependencies that depend on the older javax.validation artifact.
  There are no API changes, just a change of Maven coordinates.
  PropertyNodeNameProvider SPI
  We now provide a way to customize the property names that are used in the ConstraintViolations. For instance, you can now extract the property names from your Jackson annotations by leveraging this new feature.
  The new contract is called PropertyNodeNameProvider and you can find out more about it in our documentation.
  We made a number of structural changes to:
  Further reduce our memory usage and improve our performances;
  Pave the way for what we call free form validation e.g. JSON validation. We are not there yet but part of the infrastructure work has been done.
  To be honest, Quarkus users are using 6.1 for a while as it contains a lot of bootstrap changes necessary to optimize Hibernate Validator for Quarkus.
  The old bootstrap is still there for all the other Hibernate Validator consumers but, if you are curious, have a look at the Quarkus Hibernate Validator extension and at the new PredefinedScopeValidatorFactory.
  We now support @Digits on MonetaryAmount.
  We now have Chinese (both traditional and simplified), Danish, Italian, Polish and Romanian translations.
  The propertyPath is now available in HibernateMessageInterpolatorContext.
  Our JPMS and OSGI module names are now identical: org.hibernate.validator and org.hibernate.validator.cdi: that means that the OSGi bundle names have changed.
  The complete list of fixed issues can be found on our JIRA:
  The whole 6.1 cycle
  6.1.0.Final specifically
  Getting 6.1.0.Final
  org.hibernate.validator:hibernate-validator:6.1.0.Final
  org.hibernate.validator:hibernate-validator-cdi:6.1.0.Final
  org.hibernate.validator:hibernate-validator-annotation-processor:6.1.0.Final
  If you want to benefit from the new features of this version on WildFly, we also provide WildFly patches for WildFly 17.0.1 and WildFly 18. You can read about how to apply such patches here.
  This version only contains bugfixes.
  Getting 6.0.18.Final
  org.hibernate.validator:hibernate-validator:6.0.18.Final
  org.hibernate.validator:hibernate-validator-cdi:6.0.18.Final
  org.hibernate.validator:hibernate-validator-annotation-processor:6.0.18.Final
  If you want to benefit from the new features of this version on WildFly, we also provide WildFly patches for WildFly 17.0.1 and WildFly 16. You can read about how to apply such patches here.