You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Spring Boot 3 | 3.5.14 | 3.5.16 | Legacy Spring 6 compatibility tests |
56
-
| Spring Framework 6 | 6.2.18 | 6.2.19 | Spring 6 integration tests |
57
-
| Spring Boot 4 | 4.0.6 | 4.1.1 | Primary Spring 7 integration tests |
58
-
| Spring Framework 7 | 7.0.7 | 7.0.9 | Spring 7 integration tests |
55
+
| Spring Boot | 4.1.0 | 4.1.1 | Runtime and integration tests |
56
+
| Spring Framework | 7.0.8 | 7.0.9 | Runtime and integration tests |
59
57
| Jetty test servers | Jetty 9.4.58 | removed | Schema Registry and Hadoop test infrastructure |
60
58
61
-
The Jackson updates address the High-severity findings reported against the original shaded runtime by the Trivy Java vulnerability database on 2026-07-22, including `GHSA-r7wm-3cxj-wff9`, `CVE-2026-54512`, and `CVE-2026-54513`. The 2026-08-07 full-source review also covers Netty, gRPC Java, Aircompressor, MINA, Tomcat, PostgreSQL JDBC, Hibernate ORM, LZ4 Java, and Spring advisories tracked by GitHub and the respective upstream security notices. The 2026-08-23 maintenance pass additionally updates the shared dependency-management boundary for Apache HTTP Core/Client, Commons Configuration, OpenTelemetry, Log4j, Bouncy Castle, ZooKeeper, Wire, Micrometer, RabbitMQ, Plexus Utils, Logback, and Vert.x. The obsolete Log4j 1 bridge was removed from the Elasticsearch 7 tests, the legacy MySQL connector coordinate was replaced with `com.mysql:mysql-connector-j`, and the unused Hadoop `jsonschema2pojo-core` transitive was excluded at its direct introducing dependency. The sole Commons Lang 2 test call was migrated to the already managed Commons Lang 3 API before excluding Commons Lang 2 from the same path. The final compatibility pass moves the product and CI target to Java 25 LTS, upgrades Netty and Lettuce together onto the 4.2-native line, replaces JLine's Jansi provider with the Java FFM provider, and migrates Protobuf serializers to the stable `Message` API so generated classes from both the previous V3 hierarchy and Protobuf Java 4 remain supported. Java gRPC remains at 1.83.1, while the Python runtime uses 1.83.0 because gRPC patch releases are language-specific and 1.83.1 is not published on PyPI. Aircompressor remains at the current reviewed 2.0.3 release. The standalone command-line test fixtures now pin stable Maven plugin releases and use the intended compiler release setting so their build output is reproducible. Hibernate ORM 5.6 has no patched release and is end-of-life, so the distribution test was migrated to the current stable 7.4 line instead of suppressing the alert or deleting coverage. LZ4 Java 1.11.2 was accepted only after matching its Maven Central publication to the upstream security release, signed tag history, and verified commits. Development and test scope reduces production reachability, but it does not make vulnerable code safe to execute in CI or release builds.
59
+
The Jackson updates address the High-severity findings reported against the original shaded runtime by the Trivy Java vulnerability database on 2026-07-22, including `GHSA-r7wm-3cxj-wff9`, `CVE-2026-54512`, and `CVE-2026-54513`. The 2026-08-07 full-source review also covers Netty, gRPC Java, Aircompressor, MINA, Tomcat, PostgreSQL JDBC, Hibernate ORM, LZ4 Java, and Spring advisories tracked by GitHub and the respective upstream security notices. The 2026-08-23 maintenance pass additionally updates the shared dependency-management boundary for Apache HTTP Core/Client, Commons Configuration, OpenTelemetry, Log4j, Bouncy Castle, ZooKeeper, Wire, Micrometer, RabbitMQ, Plexus Utils, Logback, and Vert.x. The obsolete Log4j 1 bridge was removed from the Elasticsearch 7 tests, the legacy MySQL connector coordinate was replaced with `com.mysql:mysql-connector-j`, and the unused Hadoop `jsonschema2pojo-core` transitive was excluded at its direct introducing dependency. The sole Commons Lang 2 test call was migrated to the already managed Commons Lang 3 API before excluding Commons Lang 2 from the same path. The final compatibility pass moves the product, fixtures, and CI target to Java 25 LTS, upgrades Netty and Lettuce together onto the 4.2-native line, replaces JLine's Jansi provider with the Java FFM provider, and migrates Protobuf serializers to the stable `Message` API so generated classes from both the previous V3 hierarchy and Protobuf Java 4 remain supported. Java gRPC remains at 1.83.1, while the Python runtime uses 1.83.0 because gRPC patch releases are language-specific and 1.83.1 is not published on PyPI. Parquet 1.18.0 still compiles against Aircompressor 2.0.3's byte-array API; Aircompressor v3 is not binary-compatible because it moved to a separate artifact, package, and MemorySegment API. The standalone command-line test fixtures now pin stable Maven plugin releases and use Java 25 so their build output matches the product runtime. Hibernate ORM 5.6 has no patched release and is end-of-life, so the distribution test was migrated to the current stable 7.4 line instead of suppressing the alert or deleting coverage. LZ4 Java 1.11.2 was accepted only after matching its Maven Central publication to the upstream security release, signed tag history, and verified commits. Development and test scope reduces production reachability, but it does not make vulnerable code safe to execute in CI or release builds.
62
60
63
61
Debezium was migrated from the end-of-life 1.9 line to 3.6.1.Final. The CDC implementation now uses the current schema-history SPI and configuration keys (`schema.history.internal`, `topic.prefix`, and the `*.include.list` / `*.exclude.list` family). PostgreSQL snapshot mode `NEVER` maps to the current `NO_DATA` mode, while custom snapshotters use the current Debezium snapshotter SPI and custom-name setting. This is a runtime migration, not an alert suppression.
64
62
@@ -95,14 +93,14 @@ The standalone release gates `scripts/check-xml-parser-hardening` and `scripts/c
95
93
96
94
The reviewed core JAR build invokes Maven and the pinned JDK; it does not compile the repository's C source companions or package the optional Python extension. The gate records hashes for the tracked C headers, C sources, and prebuilt native resources, then requires the native bytes embedded in the JAR to match the tracked resources exactly. It also rejects Python extension resources in the core JAR. Python 3.14.7 is pinned only for evidence validation in CI. A C compiler therefore is not a hidden input to this artifact build, and the verifier Python is not a deployed runtime component.
97
95
98
-
The opt-in `spring-5` compatibility profile has been removed because Spring Boot 2.7 and Spring Framework 5.3 are end-of-life. The maintained compatibility matrix starts at Spring Boot 3 / Spring Framework 6 and also covers Spring Boot 4 / Spring Framework 7. XML schema names such as `hazelcast-spring-5.7.xsd` identify the Hazelcast schema version and are unrelated to the removed Spring Framework 5 dependency line.
96
+
All Spring Boot 3 / Spring Framework 6 compatibility profiles and the `hazelcast-spring-boot3` artifact have been removed. The maintained runtime is Spring Boot 4 / Spring Framework 7 only. XML schema names such as `hazelcast-spring-5.7.xsd` identify the Hazelcast schema version and are unrelated to a Spring Framework dependency line.
99
97
100
98
## Required Release Gates
101
99
102
100
A release is acceptable only when all of the following are true:
103
101
104
102
1. The upstream `v5.7.0` boundary recorded in [ORIGIN.md](ORIGIN.md) is an ancestor of the candidate, and every later commit remains on the linear PastureStack maintenance line.
105
-
2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.2, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.14 is downloaded only from Maven Central and is verified against the committed SHA-256 before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 3.5.16 and 4.1.1, and Spring Framework 6.2.19 and 7.0.9. It also verifies that Jansi, the removed Spring 5 profile, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
103
+
2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.2, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.16 is downloaded only from Maven Central; its ZIP and tar.gz distributions are verified against separate committed SHA-256 values before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 4.1.1, and Spring Framework 7.0.9. It also verifies that Jansi, all Spring Boot 3 / Spring Framework 6 compatibility profiles and artifacts, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
106
104
3. Maven's resolved dependency graph contains those reviewed versions, no older duplicate of the same artifacts, no Elasticsearch HLRC/server/Lucene legacy graph in the Elasticsearch connector, and no `org.eclipse.jetty` graph in the Kafka, SQL, Hadoop distribution, Azure, or S3 modules.
107
105
4. The produced file is `hazelcast-5.7.3-pasturestack.2.jar`; its embedded core Maven metadata reports 5.7.3-pasturestack.2, its generated cluster runtime metadata reports numeric version 5.7.3, and its embedded Jackson metadata reports Jackson 2.22.2 and Jackson 3.2.2. The full source commit and abbreviated revision embedded in `GeneratedBuildProperties` must match the OCI revision supplied to the build; unresolved placeholders are rejected during packaging.
108
106
5. Relevant core, Spring, database, and distribution integration tests pass on Java 25 LTS. The focused source-boundary suite must retain its expected suite and test counts so an accidentally undiscovered test cannot appear successful.
0 commit comments