[Snyk] Fix for 2 vulnerabilities

[bogarin]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml
• persistence-modules/spring-hibernate-3/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	SQL Injection SNYK-JAVA-ORGHIBERNATE-15038759	828	org.hibernate:hibernate-core: 3.6.10.Final -> 5.3.38.Final Major version upgrade Proof of Concept
	External Initialization of Trusted Variables or Data Stores SNYK-JAVA-CHQOSLOGBACK-15062482	376	ch.qos.logback:logback-classic: 1.2.6 -> 1.5.25 ch.qos.logback:logback-core: 1.2.6 -> 1.5.25 No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 SQL Injection

[Copilot]

Pull request overview

Updates Maven dependency versions to remediate 2 Snyk-reported vulnerabilities (Logback and Hibernate).

Changes:

• Bump Logback version in the root pom.xml (plus minor XML self-closing tag cleanup).
• Bump Hibernate Core version in persistence-modules/spring-hibernate-3/pom.xml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pom.xml	Updates Logback version property (and minor lifecycle-mapping XML formatting).
persistence-modules/spring-hibernate-3/pom.xml	Updates Hibernate version property for the Spring/Hibernate module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Bumping logback to 1.5.25 while keeping org.slf4j.version at 1.7.32 is very likely incompatible: newer Logback lines are built to work with SLF4J 2.x and can fail at runtime (e.g., missing SLF4J service provider classes) when forced onto SLF4J 1.7 via dependency management. Align the SLF4J + Logback versions (upgrade SLF4J accordingly, or pick a Logback version that is compatible with SLF4J 1.7 / Java 8).

Suggested change

	<logback.version>1.5.25</logback.version>
	<logback.version>1.2.13</logback.version>

[Copilot]

Upgrading hibernate-core from 3.6 to 5.3 in this module is inconsistent with the rest of the module, which is explicitly built around Spring's org.springframework.orm.hibernate3.* integration and Hibernate 3 configuration (e.g., hibernate-configuration-3.0.dtd). With Hibernate 5.3 this setup is expected to break; to make this upgrade work you’ll need to migrate the Spring integration/configuration to the Hibernate 5 variant (e.g., Spring ORM Hibernate 5 support / updated config files), or keep this module on the Hibernate 3 line and address the vulnerability another way (exclude/disable the module, isolate it from production builds, etc.).

Suggested change

	<hibernate.version>5.3.38.Final</hibernate.version>
	<hibernate.version>3.6.10.Final</hibernate.version>