JPA vs Hibernate — The N+1 Query That Took Down a Dashboard

If you've used Spring Boot with a database, you've used JPA and Hibernate — often without realising they're two different things. JPA is a specification: a set of interfaces and rules. Hibernate is an implementation of that specification. Understanding this distinction isn't academic. It determines whether your persistence layer is portable, what APIs you use, and when Hibernate-specific features are actually worth reaching for.

I once inherited a Spring Boot service that was taking 14 seconds to load a dashboard page. The team had been optimising database indexes for weeks. The real problem? Hibernate was firing 3,200 SQL queries per page load because of an N+1 problem on a lazy-loaded collection that nobody had checked. One JOIN FETCH reduced it to 3 queries and the page loaded in 200ms. The indexes were fine. The Hibernate knowledge was missing.

This article covers the full picture — not just 'JPA is a spec, Hibernate is an implementation' and a code snippet. We'll cover entity lifecycle states, dirty checking, ID generation trade-offs, N+1 queries, optimistic locking, cascade semantics, caching, soft deletes, auditing, pagination, inheritance strategies, testing patterns, and the Hibernate 6 changes that broke half the internet when Spring Boot 3 shipped. By the end, you'll know exactly when to stay in JPA land and when to drop to Hibernate-specific APIs.

What is JPA?

JPA — Java Persistence API, now Jakarta Persistence API — is a specification defined in Jakarta EE. It defines a standard set of interfaces, annotations, and rules for Object-Relational Mapping (ORM) in Java. JPA itself ships no runnable code. It is a contract: if a framework implements JPA, your code will work against that framework.

The core JPA interfaces: EntityManager (your gateway to the database — persist, find, merge, remove), EntityManagerFactory (creates EntityManager instances, one per application), EntityTransaction (controls commit/rollback), and TypedQuery/Query for JPQL queries.

The core JPA annotations: @Entity (marks a class as a database table), @Table (customises the table name), @Id (marks the primary key), @GeneratedValue (auto-generates PK values), @Column (maps to a column), @OneToMany, @ManyToOne, @ManyToMany, @JoinColumn.

Because JPA is a specification, code that only uses JPA interfaces can theoretically switch between implementations — Hibernate, EclipseLink, OpenJPA — without changing business logic. In practice, almost nobody switches. But coding against JPA interfaces keeps your code cleaner and your team's cognitive load lower.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;
import java.util.ArrayList;
import java.util.List;

@Entity
@Table(name = "users")
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, length = 100)
    private String name;

    @Column(unique = true, nullable = false)
    private String email;

    @OneToMany(mappedBy = "user", cascade = CascadeType.ALL, fetch = FetchType.LAZY)
    private List<Order> orders = new ArrayList<>();

    public Long getId() { return id; }
    public void setId(Long id) { this.id = id; }
    public String getName() { return name; }
    public void setName(String name) { this.name = name; }
    public String getEmail() { return email; }
    public void setEmail(String email) { this.email = email; }
    public List<Order> getOrders() { return orders; }
    public void setOrders(List<Order> orders) { this.orders = orders; }
}

What is Hibernate?

Hibernate is the most widely used JPA implementation. It is also the default ORM in Spring Boot — when you add spring-boot-starter-data-jpa, Hibernate is what you get.

Hibernate predates JPA. JPA was actually modelled on Hibernate's original API. When JPA was standardised, Hibernate was updated to implement it — but kept its native API alongside. That is why you will see references to both Session and EntityManager in older Hibernate code.

Hibernate does everything JPA specifies, and then more. It adds features the JPA spec does not cover: the Session API (Hibernate's native equivalent of EntityManager), HQL (Hibernate Query Language, a superset of JPQL), a first-level cache (per Session), a second-level cache (shared across Sessions, pluggable with Ehcache or Redis), batch processing, native query enhancements, entity interceptors, @Formula for computed columns, @DynamicUpdate for partial updates, and StatelessSession for high-throughput bulk operations.

The other JPA implementations exist — EclipseLink (the JPA reference implementation, used in GlassFish/Payara), OpenJPA (Apache project, less active), DataNucleus (supports JPA and JDO) — but Hibernate dominates. In my 10+ years of Java development, I have never seen a production application use anything other than Hibernate as the JPA provider. That does not mean you should ignore portability. It means Hibernate-specific features are fair game when they solve a real problem.

package io.thecodeforge.hibernate_vs_jpa;

import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.hibernate.StatelessSession;
import java.util.List;

public class HibernateSessionExample {

    public void demonstrateHibernateNativeAPI(SessionFactory sessionFactory) {
        // Hibernate Session — the native equivalent of JPA EntityManager
        Session session = sessionFactory.getCurrentSession();

        // HQL — superset of JPQL, supports FROM without SELECT
        List<User> users = session.createQuery(
            "FROM User u WHERE u.email LIKE :domain", User.class)
            .setParameter("domain", "%@example.com")
            .setFirstResult(0)
            .setMaxResults(20)
            .getResultList();

        // Hibernate-specific: batch insert
        session.setJdbcBatchSize(50);
        for (int i = 0; i < users.size(); i++) {
            session.persist(users.get(i));
            if (i % 50 == 0) {
                session.flush();
                session.clear();
            }
        }

        // StatelessSession — bypasses first-level cache entirely
        StatelessSession stateless = sessionFactory.openStatelessSession();
        var tx = stateless.beginTransaction();
        try {
            var scroll = stateless.createQuery("FROM User", User.class)
                .scroll(org.hibernate.ScrollMode.FORWARD_ONLY);
            while (scroll.next()) {
                User u = scroll.get();
                stateless.update(u);
            }
            tx.commit();
        } catch (Exception e) {
            tx.rollback();
            throw e;
        } finally {
            stateless.close();
        }
    }
}

Hibernate 6 and Spring Boot 3 — What Changed

Spring Boot 3 shipped with Hibernate 6, and it broke more things than most major version upgrades. If you are on Spring Boot 2.x and planning to upgrade, or starting fresh on Boot 3, these changes matter.

The package namespace moved from javax.persistence to jakarta.persistence. Every import in every entity class needs updating. This is a find-and-replace, but it touches every file.

Hibernate 6 changed the default ID generation strategy. GenerationType.AUTO now picks SEQUENCE instead of TABLE. If your database was relying on the TABLE strategy's hibernate_sequences table, your IDs will start from a different sequence after the upgrade. In production, this means new records get IDs that overlap with existing ones. I have seen this cause primary key conflicts on tables that had no unique constraint beyond the PK.

The dialect system was overhauled. The old spring.jpa.database-platform property still works but Hibernate 6 can auto-detect the dialect from the JDBC URL. In most cases, you can remove the explicit dialect configuration entirely.

HQL got stricter. Implicit joins that worked in Hibernate 5 may throw syntax errors in Hibernate 6. SELECT u.orders FROM User u without an explicit JOIN no longer works — you need SELECT o FROM User u JOIN u.orders o.

The second-level cache integration moved from Ehcache 3 to JCache (JSR-107). If you were using Ehcache directly, the configuration changes are significant.

Bottom line: if you are on Boot 3 with Hibernate 6, enable SQL logging, run your full test suite, and check every query that uses HQL or native SQL. The upgrade is worth it — Hibernate 6 has better performance, better type safety, and better Jakarta EE alignment — but it is not transparent.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;

// Hibernate 6: GenerationType.AUTO defaults to SEQUENCE, not TABLE
@Entity
public class Product {

    @Id
    // In Hibernate 5: AUTO picked TABLE strategy
    // In Hibernate 6: AUTO picks SEQUENCE strategy
    // Explicit is better — specify the strategy you want
    @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "product_seq")
    @SequenceGenerator(name = "product_seq", sequenceName = "product_sequence", allocationSize = 50)
    private Long id;

    @Column(nullable = false)
    private String name;

    @Column(precision = 10, scale = 2)
    private java.math.BigDecimal price;
}

// application.properties for Hibernate 6 / Spring Boot 3
// spring.jpa.hibernate.ddl-auto=validate
// spring.jpa.show-sql=true
// spring.jpa.properties.hibernate.format_sql=true
// spring.jpa.open-in-view=false
// No dialect needed — Hibernate 6 auto-detects from JDBC URL

JPA vs Hibernate — The Core Distinction

The distinction maps cleanly to the specification vs implementation pattern common across Java EE:

JPA defines EntityManager; Hibernate implements it — and also provides Session, its own earlier API that does the same thing. JPA defines JPQL for queries; Hibernate supports JPQL and extends it with HQL (extra functions, FROM without SELECT, etc.). JPA defines @Cacheable for second-level caching; Hibernate implements the cache with @Cache and lets you choose the region factory. JPA defines cascading and fetch strategies; Hibernate adds extra fetch modes (SUBSELECT, BATCH) not in the spec.

In Spring Boot with Spring Data JPA, you almost never touch EntityManager or Session directly. Spring Data repositories (JpaRepository) wrap JPA, which wraps Hibernate. But when you need to tune performance — batch fetching, custom HQL, second-level cache, statistics — you drop to Hibernate-specific APIs.

The pragmatic rule: code against JPA by default. Reach for Hibernate-specific APIs only when you have a concrete need that JPA cannot satisfy. Do not import org.hibernate.Session in a service that only does CRUD — that is premature coupling.

package io.thecodeforge.hibernate_vs_jpa;

import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Query;
import java.util.List;
import java.util.Optional;

// Spring Data JPA — you never see EntityManager or Session
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByEmail(String email);
    List<User> findByStatusOrderByCreatedAtDesc(UserStatus status);

    // JPQL — portable across JPA providers
    @Query("SELECT u FROM User u JOIN FETCH u.orders WHERE u.id = :id")
    Optional<User> findByIdWithOrders(@Param("id") Long id);

    // EntityGraph — declarative fetch path, JPA standard
    @org.springframework.data.jpa.repository.EntityGraph(attributePaths = {"orders"})
    List<User> findAll();
}

The Entity Lifecycle — The Concept Most Tutorials Skip

Every JPA entity exists in one of four states. Understanding these states is fundamental to understanding why persist() does not immediately hit the database, why merge() returns a different object, and what 'detached entity passed to persist' errors mean.

New (Transient): The object exists in Java memory but Hibernate knows nothing about it. No database row corresponds to it. You created it with new User().

Managed (Persistent): The object is tracked by the persistence context (EntityManager/Session). Any changes to it are automatically detected and flushed to the database at transaction commit. This is dirty checking.

Detached: The object was once managed, but the persistence context was closed (transaction ended, EntityManager cleared). It has a database row, but Hibernate no longer tracks changes. Calling persist() on a detached entity throws an exception. You must use merge() to reattach it.

Removed: The object is scheduled for deletion. The actual DELETE happens at flush time.

The critical transitions: persist() takes a transient entity to managed. detach() takes a managed entity to detached. merge() takes a detached entity and returns a new managed copy. remove() takes a managed entity to removed.

Note that merge() returns a NEW object. The original detached entity is not reattached — a new managed copy is created. This is why you must always use the return value of merge(): user = entityManager.merge(user); not just entityManager.merge(user); and continuing to use the old reference.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.EntityManager;
import jakarta.persistence.EntityManagerFactory;
import jakarta.persistence.EntityTransaction;

public class EntityLifecycleDemo {

    private final EntityManagerFactory emf;

    public EntityLifecycleDemo(EntityManagerFactory emf) {
        this.emf = emf;
    }

    public void demonstrateLifecycle() {
        EntityManager em = emf.createEntityManager();
        EntityTransaction tx = em.getTransaction();

        // 1. TRANSIENT — new object, Hibernate knows nothing
        User user = new User();
        user.setName("Jane");
        user.setEmail("jane@example.com");
        // user is transient — no database row, no persistence context tracking

        tx.begin();

        // 2. MANAGED — persist() moves it into the persistence context
        em.persist(user);
        // user is now managed. Any changes are tracked via dirty checking.
        // The INSERT SQL may not fire immediately — it fires at flush time.

        user.setName("Jane Doe");  // dirty check: Hibernate detects this change
        // At flush time: UPDATE users SET name='Jane Doe' WHERE id=1

        tx.commit();  // flush happens here — INSERT + UPDATE executed
        em.close();   // persistence context closes

        // 3. DETACHED — em is closed, user is no longer tracked
        user.setName("Janet");
        // This change is LOST — Hibernate is not tracking user anymore

        EntityManager em2 = emf.createEntityManager();
        EntityTransaction tx2 = em2.getTransaction();
        tx2.begin();

        // WRONG: em2.persist(user);  // throws EntityExistsException — detached entity

        // CORRECT: merge() returns a NEW managed copy
        User managedUser = em2.merge(user);
        // managedUser is managed. user (the original) is still detached.
        managedUser.setName("Janet Updated");
        // This change IS tracked — managedUser is in em2's persistence context

        tx2.commit();
        em2.close();

        // 4. REMOVED — entity scheduled for deletion
        EntityManager em3 = emf.createEntityManager();
        EntityTransaction tx3 = em3.getTransaction();
        tx3.begin();

        User toDelete = em3.find(User.class, 1L);
        em3.remove(toDelete);
        // toDelete is now in REMOVED state. DELETE fires at flush/commit.

        tx3.commit();
        em3.close();
    }
}

Dirty Checking — How Hibernate Knows What to Update

Dirty checking is the mechanism by which Hibernate detects which entity fields have changed since they were loaded, and generates the appropriate UPDATE statements. It is always on for managed entities and it is the reason you never need to call an explicit update() method in JPA.

When you load an entity with find() or a query, Hibernate stores a snapshot of the entity's state in the persistence context. At flush time, it compares the current state to the snapshot. If any field differs, Hibernate generates an UPDATE for that entity. If nothing changed, no SQL is fired.

This is why @Transactional(readOnly=true) matters. When Spring marks a transaction as readOnly, Hibernate can skip dirty checking entirely — it does not need to compare snapshots because it knows nothing will change. For read-heavy services, this saves CPU cycles proportional to the number of entities loaded in that transaction.

The cost of dirty checking is proportional to the number of managed entities in the persistence context. If you load 10,000 entities in a single transaction, Hibernate compares all 10,000 at flush time. This is where session.clear() in batch processing comes in — it empties the persistence context so dirty checking does not grow unbounded.

package io.thecodeforge.hibernate_vs_jpa;

import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
public class UserService {

    private final UserRepository userRepository;

    public UserService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    // readOnly=true — Hibernate skips dirty checking
    // No snapshot comparison, no unnecessary UPDATE statements
    @Transactional(readOnly = true)
    public User getUser(Long id) {
        return userRepository.findById(id).orElseThrow();
        // Even if you modify the returned object, no UPDATE fires
        // because the transaction is marked readOnly
    }

    // readOnly=false (default) — dirty checking is active
    @Transactional
    public void updateUserName(Long id, String newName) {
        User user = userRepository.findById(id).orElseThrow();
        user.setName(newName);
        // Hibernate detects the change via dirty checking
        // At commit: UPDATE users SET name='newName' WHERE id=1
        // You never call an explicit update() — Hibernate handles it
    }

    // Batch processing — clear session to prevent unbounded dirty checking
    @Transactional
    public void bulkUpdateStatus(UserStatus oldStatus, UserStatus newStatus) {
        var users = userRepository.findByStatus(oldStatus);
        for (int i = 0; i < users.size(); i++) {
            users.get(i).setStatus(newStatus);
            if (i % 50 == 0 && i > 0) {
                userRepository.flush();
                userRepository.clear();  // empties persistence context
            }
        }
    }
}

ID Generation Strategies — The Performance Trap Nobody Warns You About

JPA provides four ID generation strategies, and the choice has real performance implications that most tutorials ignore.

IDENTITY: Uses database auto-increment (MySQL AUTO_INCREMENT, SQL Server IDENTITY). Simple, but it disables Hibernate's JDBC batch inserts. The reason: Hibernate needs the ID before it can batch the INSERT, but the ID is only available after the INSERT executes. Every INSERT is a separate round-trip. For bulk inserts, this is catastrophically slow.

SEQUENCE: Uses a database sequence (PostgreSQL, Oracle). Supports batch inserts because Hibernate can pre-allocate a range of IDs (allocationSize) in a single sequence call, then batch the INSERTs. This is the correct default for PostgreSQL and Oracle.

TABLE: Uses a separate table to simulate a sequence. Works on all databases but is the slowest option — an extra table lock for every ID allocation. Avoid it unless you are on MySQL and need portability.

AUTO: Lets the provider pick. In Hibernate 5, this defaulted to TABLE. In Hibernate 6, it defaults to SEQUENCE. Never rely on AUTO — always specify the strategy explicitly.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;

public class IdGenerationDemo {

    // STRATEGY 1: IDENTITY — simple, but disables batch inserts
    @Entity
    @Table(name = "users_identity")
    public static class UserIdentity {
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Long id;
        private String name;
    }

    // STRATEGY 2: SEQUENCE — supports batch inserts, best for PostgreSQL/Oracle
    @Entity
    @Table(name = "users_sequence")
    public static class UserSequence {
        @Id
        @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "user_seq")
        @SequenceGenerator(
            name = "user_seq",
            sequenceName = "user_sequence",
            allocationSize = 50  // pre-allocate 50 IDs per sequence call
        )
        private Long id;
        private String name;
    }

    // STRATEGY 3: TABLE — portable but slowest
    @Entity
    @Table(name = "users_table")
    public static class UserTable {
        @Id
        @GeneratedValue(strategy = GenerationType.TABLE, generator = "user_tbl")
        @TableGenerator(
            name = "user_tbl",
            table = "id_generator",
            pkColumnName = "gen_name",
            valueColumnName = "gen_value",
            pkColumnValue = "user_id",
            allocationSize = 25
        )
        private Long id;
        private String name;
    }
}

The N+1 Query Problem — The Most Expensive Hibernate Mistake

The N+1 problem is the most common performance issue in Hibernate applications, and it is caused by lazy loading. When you load a list of N Users and then access their Orders, Hibernate fires 1 query for the users and then N additional queries — one per user — to load the orders. At scale, this is catastrophic.

I have debugged this in production more times than I can count. The symptom is always the same: a page loads fine with 10 records but grinds to a halt with 100. The database CPU spikes. The APM tool shows thousands of identical queries with different IDs. The developer swears the code is correct because it works in development with 5 test records.

Four ways to fix it: 1. JOIN FETCH in JPQL: forces an eager join for that specific query without changing the entity mapping. 2. @EntityGraph: declares fetch paths declaratively on the repository method. 3. @BatchSize on the association: Hibernate loads lazy collections in batches of N instead of one at a time. 4. Spring Data Projections: fetch only the fields you need, no associations loaded.

The default FetchType.LAZY on @OneToMany is correct — you do not want to load all associations every time. The fix is to fetch eagerly only when you explicitly need the data.

package io.thecodeforge.hibernate_vs_jpa;

import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Query;
import org.springframework.data.jpa.repository.EntityGraph;
import org.springframework.data.repository.query.Param;
import java.util.List;

public interface UserRepository extends JpaRepository<User, Long> {

    // THE PROBLEM: findAll() loads users, then accessing orders triggers N queries
    // 1 query: SELECT * FROM users
    // N queries: SELECT * FROM orders WHERE user_id = ? (one per user)

    // FIX 1: JOIN FETCH — one query with an inner join
    @Query("SELECT u FROM User u JOIN FETCH u.orders WHERE u.status = :status")
    List<User> findActiveUsersWithOrders(@Param("status") UserStatus status);

    // FIX 2: EntityGraph — one query with a left join, declarative
    @EntityGraph(attributePaths = {"orders"})
    List<User> findAll();

    // FIX 3: Projection — fetch only what you need, no associations loaded
    // interface UserSummary {
    //     String getName();
    //     String getEmail();
    //     int getOrderCount();  // derived via @Query
    // }
    // @Query("SELECT u.name as name, u.email as email, SIZE(u.orders) as orderCount FROM User u")
    // List<UserSummary> findUserSummaries();
}

// FIX 3b: @BatchSize on the entity (Hibernate-specific)
// @OneToMany(mappedBy = "user", fetch = FetchType.LAZY)
// @org.hibernate.annotations.BatchSize(size = 25)
// private List<Order> orders;
// Instead of N queries, fires ceiling(N/25) queries

FetchType.EAGER — The Default That Should Not Exist

This deserves its own section because it causes more production incidents than any other Hibernate configuration issue.

JPA specifies that @ManyToOne and @OneToOne default to FetchType.EAGER. This means every time you load an entity with a @ManyToOne relationship, Hibernate also loads the related entity — even if you never access it. For a single entity, this is fine. For a list query returning 1,000 entities, each with an EAGER @ManyToOne, you get 1,000 extra queries or a massive join.

The rule: set FetchType.LAZY on every @ManyToOne and @OneToOne unless you have a specific reason not to. Yes, JPA defaults to EAGER. JPA's defaults are wrong for production use. Override them.

For @OneToMany and @ManyToMany, JPA already defaults to LAZY, which is correct. Never change these to EAGER unless you enjoy debugging Cartesian products in production.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;

@Entity
public class Order {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    // WRONG: JPA defaults to EAGER for @ManyToOne
    // Every Order query also loads the User — even if you do not need it
    // @ManyToOne
    // private User user;

    // CORRECT: explicitly set LAZY
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "user_id")
    private User user;

    // @OneToOne also defaults to EAGER — override it
    @OneToOne(fetch = FetchType.LAZY, cascade = CascadeType.ALL)
    @JoinColumn(name = "shipping_address_id")
    private Address shippingAddress;

    private java.math.BigDecimal totalAmount;
}

// The impact:
// List<Order> orders = orderRepository.findAll();  // 1000 orders
// EAGER @ManyToOne User: 1000 additional SELECT queries (or one massive JOIN)
// LAZY @ManyToOne User: 0 additional queries until you call order.getUser()

Optimistic Locking — Prevent Lost Updates Without Pessimistic Locks

Optimistic locking is a concurrency control strategy that detects conflicts without locking rows. It works by adding a version column to the entity. Every time Hibernate updates the row, it increments the version and checks that the version in the database matches the one loaded. If another transaction updated the row in between, the versions mismatch, and Hibernate throws OptimisticLockException.

This is the correct strategy for most web applications. Users rarely edit the same record at the same time. Optimistic locking is cheap for reads and only fails on write conflicts. Pessimistic locks (SELECT ... FOR UPDATE) would block reads on the row, which is overkill for typical CRUD.

The JPA @Version annotation works with any numeric type (int, long, or Timestamp). Hibernate handles the version check automatically at flush time.

Common trap: if you load an entity, detach it, then later merge it, the merge will check the version. If another transaction updated it in between, merge throws OptimisticLockException. The fix: reload the entity before merging, or handle the exception and retry.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;

@Entity
@Table(name = "products")
public class Product {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Version  // tells Hibernate to use optimistic locking
    private int version;

    @Column(nullable = false)
    private String name;

    @Column(nullable = false)
    private int quantity;

    // getters/setters omitted for brevity
}

// Spring Data JPA handles everything:
// repository.findById(id).orElseThrow(); // version is loaded
// product.setQuantity(newQuantity);
// repository.save(product); // version check at flush
// If another thread updated this row, OptimisticLockException is thrown

Cascade Operations — Don't Cascade Everything

Cascading tells Hibernate to propagate an operation from a parent entity to its children. For example, CascadeType.PERSIST means when you persist a User, all Orders in that user's orders collection are also persisted. CascadeType.ALL means every operation is propagated: PERSIST, MERGE, REMOVE, REFRESH, DETACH.

The mistake: using CascadeType.ALL on every association. This causes unexpected deletes. If you cascade REMOVE from Order to Product, deleting an Order deletes the Product — which is probably not what you want.

The safe approach: use CascadeType.PERSIST and CascadeType.MERGE on @OneToMany that own the child's lifecycle. Never cascade REMOVE or ALL to entities that have independent lifecycles. For @ManyToOne on the child side, do not cascade at all.

package io.thecodeforge.hibernate_vs_jpa;

import jakarta.persistence.*;
import java.util.ArrayList;
import java.util.List;

@Entity
@Table(name = "categories")
public class Category {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @OneToMany(mappedBy = "category",
               cascade = {CascadeType.PERSIST, CascadeType.MERGE}, // NOT ALL
               orphanRemoval = true)
    private List<Product> products = new ArrayList<>();
}

// orphanRemoval=true means: if you remove a Product from the products list,
// Hibernate deletes it from the database. This is safer than CascadeType.REMOVE
// because it's explicit: you must modify the collection.

// NEVER do this:
// @OneToMany(cascade = CascadeType.ALL)
// private List<Product> products;
// Deleting a Category deletes all its Products = probable data loss.