Current state of QueryDSL?

[IceBlizz6]

I am currently using QueryDSL in several projects, and i'm quite happy with it.

https://mvnrepository.com/artifact/com.querydsl/querydsl-jpa
Latest update was July 2021.
That is now more than 1 year ago, and it is starting to make me nervous.

So i wanted to ask if there are any future plans for this project?
Is this project now in maintenance mode?
Are there any suggested or recommended alternatives to QueryDSL that are still being actively worked on?

[orgesballa]

@jwgmeligmeyling Since you are the main contributor, can you elaborate on this?
Thank you

[jwgmeligmeyling]

Well the 5.0.0 release solved almost our entire backlog, with important features like Java 9+ support, removal of Guava as dependency, fixing Hibernate 5.4 integration, support for the Java 8 date/time API instead of Joda date/time. The few bugs that have been reported since have been very minor, non blocking to the fast majority of users.

The various "ideas" ventilated in our issue tracker receive little to no affirmative community feedback and are rarely accompanied by a pull request. If you are convinced an idea is awesome, why not spend the time contributing it yourself and giving it back to the community? Or if you want to buy it off, sponsor the project instead.

Valuable ideas however, as well as important fixes or incompatibilities with future versions of Java or dependencies will be addressed in the future.

Why would stable software be a reason to worry?

[IceBlizz6]

Thank you for taking the time to reply.
There are many reasons for why a project may stop release of updates.
From my experience this usually boils down to author abandoning it and jumping on to a different project.
This can create problems for users over time, especially because the project dependencies are not being updated and may have known security vulnerabilities.

I wrote my initial message because i noticed the lack of updates and thought that QueryDSL may have falled into this hole aswell.
Glad to hear that this is not the case and that you seem to be on top of things.

[jwgmeligmeyling]

The CVE's reported in Maven Central are known CVE's for the database drivers we use as test scoped dependency. We don't bring those transitively to users using Querydsl. There are no CVE's for Querydsl 5.0.0 itself or any of its compile-time / runtime dependencies.

I think this is very misleading from Maven Central to indicate these CVE's as vulnerabilities and as a maintainer its actually rather annoying.

I think the best "workaround" for us would be to use the flatten maven plugin that just removes all test scoped dependencies from the pom file that gets deployed with the Maven artefact.

[jwgmeligmeyling]

Perhaps you'll find it reassuring to know as well that the querydsl-jpa contributors also maintain the Blaze-Persistence Querydsl integration which received bugfixes as recent as August 28th, 2022.

[nyg]

Hello, why not release a new version (e.g. 5.0.1 or 5.1)? There have been a lot of contributions since the last release but nobody can actually profit from them as they are not released.

[imhansai]

Is there an adaptation plan related to springboot 3.x? There have been many related issues. For example, #3525