It's a bit weird that PicketLink would require Hibernate (implementation) as a dependency.