As far as I know, only hibernate is using cglib and so its component-info.xml should be referencing the required version rather than directly from the server build-thirdparty.xml. Gavin says the correct version is now 2.1.3 which make the 2.1.1 reference out of date and this is the reason the server should not be setting the version. Even if there was a direct usage, hibernate needs to be declaring its compatibility with a version.