Our Jakarta Data implementation works by generating classes that implement any @Repository interfaces in the application. The generated classes are @Dependent scoped CDI beans that internally retain a Hibernate StatelessSession instance to use for persistence operations.

The bean being @Dependent scoped means it shares a lifecycle with whatever bean injects it. So this can mean beans with a longer lifecycle than a single request or transaction, e.g. an @ApplicationScoped or @SessionScoped bean, a servlet, an EJB, etc. Those beans can service multiple clients, which means the internal StatelessSession instance needs to deal with that. Currently it does not; it's essentially shared among all clients. That's a problem because despite its name, a StatelessSession does retain state, e.g. JDBC connection related state.

We need a mechanism to manage this StatelessSession in a manner similar to how we manage an injected EntityManager elsewhere. An underlying StatelessSession should only be shared among callers associated with a particular transaction, and if there is no active transaction the session should only be used by a given thread.