Documentation Home
Changelog

Broadleaf Commerce 7.1.0-GA

Released on October 16, 2026

The overall theme of the Broadleaf 7.1.0-GA release is largely around updating core 3rd-party dependency baselines to next-generation frameworks—headlined by Spring Framework 7, Spring Boot 4, Spring Security 7, Hibernate ORM 7, Jackson 3, and other libraries along with significant performance optimizations, architectural modernization, and bug fixes.
Detailed information on the changes and necessary steps to implement the updates are available in the 7.0 to 7.1 Migration Notes.

New and Noteworthy

Introduction of @BroadleafIdGenerator

Hibernate 6/7 deprecated and removed support for @GenericGenerator. Broadleaf 7.1 introduces a dedicated @BroadleafIdGenerator annotation backed by IdOverrideTableGenerator (implementing Hibernate's AnnotationBasedGenerator) across more than 100 domain entities. This provides a unified, maintainable ID generation strategy with full support for table ID overrides and explicitly assigned entity identifiers (allowAssignedIdentifiers).

Framework Modernization: Spring 7, Spring Boot 4, Spring Security 7, and Hibernate ORM 7

Broadleaf Commerce 7.1 modernizes its core architecture to support the latest generational releases of Spring and Hibernate. This major upgrade revamps application security, request routing, reflection handling, and JPA data persistence while removing deprecated legacy processors, obsolete annotations, and legacy dialect configurations. These architectural changes deliver improved performance, tighter security standards, and seamless compatibility across all core framework layers. For comprehensive details on each upstream framework release, refer to the Spring Framework 7.0 Release Notes, Spring Boot 4.0 Release Notes, Spring Security Release Notes, and the Hibernate ORM 7.0 Migration Guide.

Library version upgrades

  • Spring Core: Updated to 7.0.9
  • Spring Security: Updated to 7.0.7
  • Spring Boot: Updated to 4.1.1
  • Hibernate: Updated to 7.4.7.Final
  • Solrj: Updated to 9.10.1
  • Jakarta Servlet: Updated to 6.1.0
  • Jakarta XML: Updated to 4.0.4
  • Jakarta Annotation: Updated to 3.0.0
  • Jakarta Validation: Updated to 3.1.1
  • Jakarta Mail: Updated to 2.1.5
  • Jackson: Updated to 3.1.5
  • Ehcache: Updated to 3.12.0
  • Lombok: Updated to 1.18.48
  • Hsql: Updated to 2.7.4
  • Groovy: Updated to 5.0.8
  • Spock: Updated to 2.4-groovy-5.0
  • GEB: Updated to 7.0
  • JUnit: Updated to 6.0.1
  • EasyMock: Updated to 5.7.0
  • GreenMail: Updated to 2.1.13
  • SLF4J: Updated to 2.0.18
  • Log4j-bom: Updated to 2.26.1
  • HttpClient: Updated to 5.6.4
  • Commons-beanutils: Updated to 2.0.0-M2
  • Commons-collections: Updated to 4.6.0
  • Commons-pool: Updated to 2.13.1
  • Commons-cli: Updated to 1.11.0
  • Commons-io: Updated to 2.22.0
  • Commons-dbcp2: Updated to 2.14.0
  • Commons-codec: Updated to 1.22.1
  • Commons-text: Updated to 1.15.0
  • Commons-fileupload: Updated to 1.6.0
  • Commons-validator: Updated to 1.11.0
  • XmlBeans: Updated to 5.4.0
  • Snappy-java: Updated to 1.1.10.8
  • Javassist: Updated to 3.33.0-GA
  • MVEL: Updated to 2.5.4.Final
  • AspectJ Weaver: Updated to 1.9.25.1
  • Tika-core: Updated to 3.3.2
  • Jettison: Updated to 1.5.7
  • Protobuf: Updated to 4.36.1
  • Guava: Updated to 33.7.1-jre
  • Gson: Updated to 2.14.0
  • TwelveMonkeys ImageIO: Updated to 3.14.0

An at-a-glance view of the issues that were closed in this release:

Major Bugs(4)

  • Eliminated performance degradation and database query spikes during cart operations by removing redundant orderService.reloadOrder(order) call inside CartStateFilter when acquiring order locks.
  • Mapped addedOfferCodes in Order and OrderImpl as Set<OfferCode> (LinkedHashSet) instead of List<OfferCode> to avoid Hibernate bag recreation and multiple-bag fetch exceptions when Hibernate filters are enabled.
  • Limited column lengths for entityType (varchar 100) and localeCode (varchar 50) on TranslationImpl so that composite TRANSLATION_INDEX fits within the MySQL InnoDB 3072-byte key prefix limit under utf8mb4 encoding, resolving DDL table creation failures.
  • Fixed shared collection reference exception on order items by removing proxy deproxying workarounds in OrderItemImpl, DiscreteOrderItemImpl, and OrderItemQualifierImpl that triggered org.hibernate.HibernateException: Found shared references to a collection during cloning/copy operations.

Minor Bugs(10)

  • Suppressed verbose Hibernate ORM deprecation warnings and connection pooling notices in common.properties.
  • Updated labels and descriptions for field value override toggles in System Property management (Override_Generated_FieldValue).
  • In CriteriaTranslatorImpl, updated ID column metadata checks from deprecated SingleColumnType to AbstractStandardBasicType for admin grid ordering.
  • Fixed DataDTODeserializer to gracefully handle empty strings and whitespace for quantity, pk, and other properties during rule builder JSON deserialization.
  • In AdminAuditableListener, ensured dateCreated and createdBy audit metadata are properly populated for entities configured with an embedded AdminAuditable.
  • In DefaultFieldMetadataProvider, added column size calculation fallback via column.getColumnSize(dialect, mappingContext) when column length metadata returns 0.
  • In SkuImpl.equals(), compare SKU IDs using getId() instead of direct field access this.id, ensuring equality comparisons succeed when evaluating uninitialized lazy Hibernate proxies.
  • Updated FieldPathBuilder to resolve polymorphic entity types using Hibernate 7's JpaMetamodel (SqmCriteriaNodeBuilder.getDomainModel()) and check PluralAttribute via path.getModel().
  • Added null check on adminUser in BroadleafAdminTypedEntityRequestFilter.adminUserHasAccess() to prevent NullPointerException when the administrative user cannot be resolved from session.
  • Fixed sequence generator corruption detection inconsistency calculations and auto-correction formula in SequenceGeneratorCorruptionDetection to account for incrementSize, preventing false-positive sequence updates with Hibernate 6/7 allocation rules.

Enhancements(19)

  • Upgraded the baseline dependencies upgrade like Spring, Hibernate and other libraries mentioned above.
  • Migrated legacy Hibernate @Index annotations to standard JPA @Table(indexes = {@Index(...)}).
  • Cleaned up deprecated legacy ContentProcessor in CMS module in favor of modern presentation processing.
  • Introduced BroadleafOracleDialect to map Java Boolean types to SQL NUMBER(1,0) for Oracle databases.
  • Added support for explicitly assigned entity identifiers (allowAssignedIdentifiers) in IdOverrideTableGenerator.
  • Configured <parameters>true</parameters> in maven-compiler-plugin for Java reflection parameter name retention.
  • Updated Spring XML configuration files to replace deprecated collectionRef with sourceRef on merge bean post-processors.
  • Added AdminFieldController providing a dedicated /selectize endpoint for dynamic search field auto-complete in admin forms.
  • Cleaned up admin entity friendly names across CMS and OpenAdmin message bundles, replacing placeholder strings with human-readable labels.
  • Added @Persister annotation in org.broadleafcommerce.common.extensibility.jpa for declarative custom persister support with Hibernate 7.
  • Refactored BroadleafUrlParamUtils to use Spring's UriComponentsBuilder, removing legacy dependency on Apache HttpClient 4's URIBuilder.
  • Introduced custom @BroadleafIdGenerator annotation to replace deprecated Hibernate @GenericGenerator across more than 100 domain entities.
  • Added establishThinRequestContext() in BroadleafRequestProcessor and BroadleafAdminRequestProcessor for lightweight request context initialization.
  • Added paginated order retrieval by date range readOrdersByDateRangePaginated() in OrderDao and OrderDaoImpl for high-throughput batch order processing.
  • Modernized UpdateExecutor native query execution with Hibernate BasicTypeReference[] and TypedParameterValue, and migrated cache eviction to TimestampsCache.
  • Modernized Spring Security configuration to use PathPatternRequestMatcher, updated DaoAuthenticationProvider constructors, and removed obsolete channel processors.
  • Introduced ErrorsProcessor (blErrorsProcessor) for managing form validation error messages across tabs, supporting admin.form.validation.errors.hideTopLevelFieldErrors.
  • Optimized out-of-sync cached cart synchronization by recording dateUpdated attributes and introducing configurable cache refresh handling (order.outOfSyncCache.refresh) in OrderDaoImpl.
  • Added performance indexes for customer lookups: CUSTOMER_USERNAME_INDEX on BLC_CUSTOMER(USER_NAME) and CUST_PWD_TOKEN_CUST_USED_IDX on BLC_CUSTOMER_PASSWORD_TOKEN(CUSTOMER_ID, TOKEN_USED_FLAG).

Total Resolved Issues: 33