I've been using pre- event listeners to prevent changes being made to the database (by veto-ing them). This works well, but other code is bypassing the listeners...

eg
getCurrentSession().
createQuery("update UserDetailsExtended u set u.passwordCode=null, u.lastLoggedIn=? where u.id=?")
.setParameter(0, now)
.setParameter(1, usersId)
.executeUpdate();

Can anyone tell me if this is meant to bypass the listener? In my mind it is an update on an entity, but stepping through doesn't seem to call the pre- listener.