Yes Hibernate 3.6.0 requires slf4j.jar.
You should read up what slf4j is and how it works. It basically just providing a API set that other application (like hibernate) can compile against it and starting use a Logger object that has no implementation to it. To see any logging, you must choose a slf4j logging implementation (eg: log4j, jdk, or logback). So yes, whenever you (or any application that) use slf4j, you always needs the actual logging implementation go with it. Think of slf4j as an Java interface that always needs a concrete class to do something useful.
In your case, to use log4j and slf4j cleanly with Hibernate and Spring, you can exclude the commons logging from Spring dependency. You need to use the jcl-over-sl4j.jar that acts just one, but it will actually redirect all calls into to slf4j, then in turn use your log4j as actual logging.
http://www.slf4j.org/legacy.htmlIf you look at latest Spring release of maven dep, they don't even bring in commons-logging anymore, and so you don't even need to exclude it explicitly. Read their ref manual, and they even give you example on how to do this.