release: version Spring 7 runtime as 5.7.3-pasturestack.3 (#5)

Author: chen21019

.github/workflows/security-release-gate.yml

@@ -188,10 +188,10 @@ jobs:
         run: |
           set -euo pipefail
           PASTURESTACK_OUTPUT_DIR=dist scripts/pasturestack-build-runtime
-          test -s dist/hazelcast-5.7.3-pasturestack.2.jar
-          sha256sum dist/hazelcast-5.7.3-pasturestack.2.jar | tee evidence/hazelcast-5.7.3-pasturestack.2.jar.sha256
-          jar tf dist/hazelcast-5.7.3-pasturestack.2.jar | grep -Fxq META-INF/LICENSE
-          jar tf dist/hazelcast-5.7.3-pasturestack.2.jar | grep -Fxq META-INF/NOTICE
+          test -s dist/hazelcast-5.7.3-pasturestack.3.jar
+          sha256sum dist/hazelcast-5.7.3-pasturestack.3.jar | tee evidence/hazelcast-5.7.3-pasturestack.3.jar.sha256
+          jar tf dist/hazelcast-5.7.3-pasturestack.3.jar | grep -Fxq META-INF/LICENSE
+          jar tf dist/hazelcast-5.7.3-pasturestack.3.jar | grep -Fxq META-INF/NOTICE
           native_resources=(
             hazelcast/src/main/resources/affinity_helper.c
             hazelcast/src/main/resources/affinity_helper.h
@@ -206,7 +206,7 @@ jobs:
           trap 'rm -rf "$extracted_native"' EXIT
           (
             cd "$extracted_native"
-            jar xf "$GITHUB_WORKSPACE/dist/hazelcast-5.7.3-pasturestack.2.jar" \
+            jar xf "$GITHUB_WORKSPACE/dist/hazelcast-5.7.3-pasturestack.3.jar" \
               lib/linux-x86/libicmp_helper.so \
               lib/linux-x86_64/libaffinity_helper.so \
               lib/linux-x86_64/libicmp_helper.so
@@ -217,7 +217,7 @@ jobs:
             "$extracted_native/lib/linux-x86_64/libaffinity_helper.so"
           cmp hazelcast-tpc-engine/src/main/resources/lib/linux-x86_64/libicmp_helper.so \
             "$extracted_native/lib/linux-x86_64/libicmp_helper.so"
-          if jar tf dist/hazelcast-5.7.3-pasturestack.2.jar | grep -Eq '(^|/)(jet_to_python[^/]*|[^/]+\.py)$'; then
+          if jar tf dist/hazelcast-5.7.3-pasturestack.3.jar | grep -Eq '(^|/)(jet_to_python[^/]*|[^/]+\.py)$'; then
             echo 'The core runtime artifact unexpectedly contains Python extension resources.' >&2
             exit 1
           fi
@@ -295,9 +295,9 @@ jobs:
             -Dfile=pom.xml -DpomFile=pom.xml
           ./mvnw -B org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file \
             -Dfile=hazelcast-parent/pom.xml -DpomFile=hazelcast-parent/pom.xml
-          test -s hazelcast-tpc-engine/target/hazelcast-tpc-engine-5.7.3-pasturestack.2.jar
+          test -s hazelcast-tpc-engine/target/hazelcast-tpc-engine-5.7.3-pasturestack.3.jar
           ./mvnw -B org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file \
-            -Dfile=hazelcast-tpc-engine/target/hazelcast-tpc-engine-5.7.3-pasturestack.2.jar \
+            -Dfile=hazelcast-tpc-engine/target/hazelcast-tpc-engine-5.7.3-pasturestack.3.jar \
             -DpomFile=hazelcast-tpc-engine/pom.xml
           timeout --signal=TERM --kill-after=30s 15m ./mvnw -B \
             org.apache.maven.plugins:maven-help-plugin:3.5.2:effective-pom \
@@ -316,7 +316,7 @@ jobs:
             -DoutputFormat=json \
             -DoutputReactorProjects=false \
             -DoutputDirectory="$PWD/evidence" \
-            -DoutputName=hazelcast-5.7.3-pasturestack.2.cdx \
+            -DoutputName=hazelcast-5.7.3-pasturestack.3.cdx \
             -DschemaVersion=1.6 \
             org.cyclonedx:cyclonedx-maven-plugin:2.9.3:makeBom
           printf '%s  %s\n%s  %s\n' \
@@ -366,18 +366,18 @@ jobs:
             "$TRIVY_IMAGE" rootfs --pkg-types library \
             --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \
             --scanners vuln --severity CRITICAL,HIGH --format json \
-            --output /evidence/hazelcast-5.7.3-pasturestack.2.trivy.json /artifact/hazelcast-5.7.3-pasturestack.2.jar
+            --output /evidence/hazelcast-5.7.3-pasturestack.3.trivy.json /artifact/hazelcast-5.7.3-pasturestack.3.jar
           docker run --rm --network none \
             -v "$PWD/evidence:/evidence" \
             -v "$trivy_cache:/root/.cache/trivy" \
             "$TRIVY_IMAGE" sbom \
             --cache-dir /root/.cache/trivy --skip-db-update --skip-java-db-update --offline-scan \
             --scanners vuln --severity CRITICAL,HIGH --format json \
-            --output /evidence/hazelcast-5.7.3-pasturestack.2.sbom.trivy.json \
-            /evidence/hazelcast-5.7.3-pasturestack.2.cdx.json
+            --output /evidence/hazelcast-5.7.3-pasturestack.3.sbom.trivy.json \
+            /evidence/hazelcast-5.7.3-pasturestack.3.cdx.json
           sha256sum evidence/maven-effective-pom.xml \
-            evidence/maven-runtime-dependency-tree.json evidence/hazelcast-5.7.3-pasturestack.2.cdx.json \
-            evidence/hazelcast-5.7.3-pasturestack.2.sbom.trivy.json evidence/hazelcast-5.7.3-pasturestack.2.trivy.json \
+            evidence/maven-runtime-dependency-tree.json evidence/hazelcast-5.7.3-pasturestack.3.cdx.json \
+            evidence/hazelcast-5.7.3-pasturestack.3.sbom.trivy.json evidence/hazelcast-5.7.3-pasturestack.3.trivy.json \
             evidence/evidence-tools.sha256 \
             evidence/native-resources.sha256 evidence/runtime-toolchain-boundary.txt \
             > evidence/security-evidence.sha256
@@ -388,7 +388,7 @@ jobs:
           set -euo pipefail
           python scripts/pasturestack-verify-maven-evidence.py \
             --effective-pom evidence/maven-effective-pom.xml \
-            --sbom evidence/hazelcast-5.7.3-pasturestack.2.cdx.json \
+            --sbom evidence/hazelcast-5.7.3-pasturestack.3.cdx.json \
             --dependency-tree evidence/maven-runtime-dependency-tree.json \
             --summary evidence/maven-evidence-summary.txt
           sha256sum evidence/maven-evidence-summary.txt >> evidence/security-evidence.sha256
@@ -401,9 +401,9 @@ jobs:
                   return json.load(stream)
 
           source = load('evidence/source-security.json')
-          artifact = load('evidence/hazelcast-5.7.3-pasturestack.2.trivy.json')
-          dependency_scan = load('evidence/hazelcast-5.7.3-pasturestack.2.sbom.trivy.json')
-          sbom = load('evidence/hazelcast-5.7.3-pasturestack.2.cdx.json')
+          artifact = load('evidence/hazelcast-5.7.3-pasturestack.3.trivy.json')
+          dependency_scan = load('evidence/hazelcast-5.7.3-pasturestack.3.sbom.trivy.json')
+          sbom = load('evidence/hazelcast-5.7.3-pasturestack.3.cdx.json')
           maven_tree = load('evidence/maven-runtime-dependency-tree.json')
           source_vulnerabilities = [
               item
@@ -489,7 +489,7 @@ jobs:
               or None in component_purls
               or len(component_refs) != len(set(component_refs))
               or len(component_purls) != len(set(component_purls))
-              or maven_root != ('com.hazelcast', 'hazelcast', '5.7.3-pasturestack.2')
+              or maven_root != ('com.hazelcast', 'hazelcast', '5.7.3-pasturestack.3')
               or sbom_root != maven_root
               or root_ref not in dependency_refs
               or dependency_refs != allowed_refs
@@ -507,7 +507,7 @@ jobs:
           docker run --rm --network none \
             -v "$PWD/evidence:/evidence:ro" \
             cyclonedx/cyclonedx-cli:0.33.1@sha256:252c2e26f468c25fea1e63ecde1bc3198ad6e9dbb57f5ed3236bddcb2281b3a7 \
-            validate --input-file /evidence/hazelcast-5.7.3-pasturestack.2.cdx.json \
+            validate --input-file /evidence/hazelcast-5.7.3-pasturestack.3.cdx.json \
             --input-format json --input-version v1_6 --fail-on-errors
 
       - name: Upload review evidence

Dockerfile.pasturestack

@@ -19,12 +19,12 @@ FROM scratch
 
 ARG VCS_REF
 LABEL org.opencontainers.image.title="PastureStack Distributed Cache Runtime" \
-      org.opencontainers.image.description="PastureStack artifact 5.7.3-pasturestack.2 with Hazelcast cluster runtime 5.7.3 and reviewed security updates" \
+      org.opencontainers.image.description="PastureStack artifact 5.7.3-pasturestack.3 with Hazelcast cluster runtime 5.7.3 and reviewed security updates" \
       org.opencontainers.image.source="https://github.com/PastureStack/distributed-cache-runtime" \
       org.opencontainers.image.revision="$VCS_REF" \
       org.opencontainers.image.licenses="Apache-2.0 OR LicenseRef-Hazelcast-Community" \
       org.opencontainers.image.vendor="PastureStack"
 
-COPY --from=build /src/dist/hazelcast-5.7.3-pasturestack.2.jar /opt/pasturestack/vendor/hazelcast-5.7.3-pasturestack.2.jar
-COPY --from=build /src/dist/hazelcast-5.7.3-pasturestack.2.jar.sha256 /opt/pasturestack/vendor/hazelcast-5.7.3-pasturestack.2.jar.sha256
+COPY --from=build /src/dist/hazelcast-5.7.3-pasturestack.3.jar /opt/pasturestack/vendor/hazelcast-5.7.3-pasturestack.3.jar
+COPY --from=build /src/dist/hazelcast-5.7.3-pasturestack.3.jar.sha256 /opt/pasturestack/vendor/hazelcast-5.7.3-pasturestack.3.jar.sha256
 COPY LICENSE NOTICE ORIGIN.md SECURITY-MAINTENANCE.md /opt/pasturestack/licenses/

ORIGIN.md

@@ -5,7 +5,7 @@ This repository is derived from the public [Hazelcast repository](https://github
 - Upstream release: `v5.7.0`
 - Upstream boundary commit: `60c31e3750cbad64f5720e2e02f0a9830973193c`
 - PastureStack maintenance line: linear commits after that upstream boundary
-- Maintained artifact: PastureStack Maven artifact 5.7.3-pasturestack.2 (numeric Hazelcast cluster runtime 5.7.3), based on Hazelcast 5.7.0, with reviewed source and dependency security updates
+- Maintained artifact: PastureStack Maven artifact 5.7.3-pasturestack.3 (numeric Hazelcast cluster runtime 5.7.3), based on Hazelcast 5.7.0, with reviewed source and dependency security updates
 
 The upstream Git history, copyright notices, author records, `LICENSE`, `NOTICE`, and file-level license headers are retained. PastureStack's maintenance commits do not replace or relicense upstream work, and PastureStack does not claim authorship of upstream contributions.
 

README.md

@@ -3,7 +3,7 @@
 > [!IMPORTANT]
 > This repository is a narrowly scoped PastureStack fork of Hazelcast 5.7.0. It preserves the upstream Git history, copyright notices, license files, and authorship. PastureStack does not claim ownership of upstream work and is not affiliated with or endorsed by Hazelcast, Inc.
 
-The maintained Maven artifact `5.7.3-pasturestack.2` keeps the upstream 5.7.0 API and applies a reviewed set of source hardening, runtime-library updates, and build-time integration dependency updates required by PastureStack. Generated Hazelcast cluster metadata reports numeric runtime version `5.7.3`, because the cluster protocol does not accept a Maven qualifier. See [ORIGIN.md](ORIGIN.md) for provenance and [SECURITY-MAINTENANCE.md](SECURITY-MAINTENANCE.md) for the exact delta and release gates. The original upstream README follows unchanged below.
+The maintained Maven artifact `5.7.3-pasturestack.3` keeps the upstream 5.7.0 API and applies a reviewed set of source hardening, runtime-library updates, and build-time integration dependency updates required by PastureStack. Generated Hazelcast cluster metadata reports numeric runtime version `5.7.3`, because the cluster protocol does not accept a Maven qualifier. See [ORIGIN.md](ORIGIN.md) for provenance and [SECURITY-MAINTENANCE.md](SECURITY-MAINTENANCE.md) for the exact delta and release gates. The original upstream README follows unchanged below.
 
 ---
 

SECURITY-MAINTENANCE.md

@@ -4,7 +4,7 @@
 
 The PastureStack maintenance delta intentionally preserves the Hazelcast 5.7.0 API while updating reviewed runtime and build-time dependencies with published security fixes:
 
-The resulting reviewed Maven artifact version is `5.7.3-pasturestack.2`; it is a PastureStack maintenance release based on upstream `5.7.0`, not an upstream Hazelcast release. Hazelcast's cluster protocol parser accepts numeric product versions only, so generated runtime metadata deliberately reports `5.7.3`. The artifact version must be used by Maven coordinates, filenames, the artifact carrier, SBOM, and release evidence; the numeric runtime version must be used by cluster/member compatibility code.
+The resulting reviewed Maven artifact version is `5.7.3-pasturestack.3`; it is a PastureStack maintenance release based on upstream `5.7.0`, not an upstream Hazelcast release. Hazelcast's cluster protocol parser accepts numeric product versions only, so generated runtime metadata deliberately reports `5.7.3`. The artifact version must be used by Maven coordinates, filenames, the artifact carrier, SBOM, and release evidence; the numeric runtime version must be used by cluster/member compatibility code.
 
 | Component | Upstream 5.7.0 | PastureStack maintained version | Scope |
 | --- | --- | --- | --- |
@@ -24,7 +24,7 @@ The resulting reviewed Maven artifact version is `5.7.3-pasturestack.2`; it is a
 | Checkstyle | 12.3.1 | 14.0.0 | Build-time source policy |
 | gRPC Java / Python | 1.73.0 | 1.83.1 / 1.83.0 | gRPC and cloud extension dependencies |
 | Aircompressor | 2.0.2 | 2.0.3 | Current Parquet 1.18 byte-array codec dependency; Aircompressor v3 uses a different artifact/package and MemorySegment API |
-| Hazelcast test-job dependency | 5.0.5 | 5.7.3-pasturestack.2 | Command-line integration test fixtures |
+| Hazelcast test-job dependency | 5.0.5 | 5.7.3-pasturestack.3 | Command-line integration test fixtures |
 | Maven Compiler Plugin | implicit | 3.15.0 | Reproducible test-fixture builds |
 | Maven JAR Plugin | 3.1.2 | 3.5.1 | Reproducible test-fixture packaging |
 | Maven Install Plugin | implicit | 3.1.4 | Latest stable Maven 3-compatible install lifecycle |
@@ -100,9 +100,9 @@ All Spring Boot 3 / Spring Framework 6 compatibility profiles and the `hazelcast
 A release is acceptable only when all of the following are true:
 
 1. The upstream `v5.7.0` boundary recorded in [ORIGIN.md](ORIGIN.md) is an ancestor of the candidate, and every later commit remains on the linear PastureStack maintenance line.
-2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.2, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.16 is downloaded only from Maven Central; its ZIP and tar.gz distributions are verified against separate committed SHA-256 values before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 4.1.1, and Spring Framework 7.0.9. It also verifies that Jansi, all Spring Boot 3 / Spring Framework 6 compatibility profiles and artifacts, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
+2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.3, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.16 is downloaded only from Maven Central; its ZIP and tar.gz distributions are verified against separate committed SHA-256 values before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 4.1.1, and Spring Framework 7.0.9. It also verifies that Jansi, all Spring Boot 3 / Spring Framework 6 compatibility profiles and artifacts, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
 3. Maven's resolved dependency graph contains those reviewed versions, no older duplicate of the same artifacts, no Elasticsearch HLRC/server/Lucene legacy graph in the Elasticsearch connector, and no `org.eclipse.jetty` graph in the Kafka, SQL, Hadoop distribution, Azure, or S3 modules.
-4. The produced file is `hazelcast-5.7.3-pasturestack.2.jar`; its embedded core Maven metadata reports 5.7.3-pasturestack.2, its generated cluster runtime metadata reports numeric version 5.7.3, and its embedded Jackson metadata reports Jackson 2.22.2 and Jackson 3.2.2. The full source commit and abbreviated revision embedded in `GeneratedBuildProperties` must match the OCI revision supplied to the build; unresolved placeholders are rejected during packaging.
+4. The produced file is `hazelcast-5.7.3-pasturestack.3.jar`; its embedded core Maven metadata reports 5.7.3-pasturestack.3, its generated cluster runtime metadata reports numeric version 5.7.3, and its embedded Jackson metadata reports Jackson 2.22.2 and Jackson 3.2.2. The full source commit and abbreviated revision embedded in `GeneratedBuildProperties` must match the OCI revision supplied to the build; unresolved placeholders are rejected during packaging.
 5. Relevant core, Spring, database, and distribution integration tests pass on Java 25 LTS. The focused source-boundary suite must retain its expected suite and test counts so an accidentally undiscovered test cannot appear successful.
 6. Both standalone source-boundary gates complete successfully on the release JDK.
 7. `trivy fs --offline-scan --scanners vuln --severity CRITICAL,HIGH` reports zero Critical and zero High findings across the resolved source POMs.

distribution/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>com.hazelcast</groupId>
         <artifactId>hazelcast-root</artifactId>
-        <version>5.7.3-pasturestack.2</version>
+        <version>5.7.3-pasturestack.3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

extensions/avro/pom.xml

@@ -30,7 +30,7 @@
     <parent>
         <groupId>com.hazelcast.jet</groupId>
         <artifactId>hazelcast-jet-extensions</artifactId>
-        <version>5.7.3-pasturestack.2</version>
+        <version>5.7.3-pasturestack.3</version>
     </parent>
 
     <properties>

extensions/cdc-debezium/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>com.hazelcast.jet</groupId>
         <artifactId>hazelcast-jet-extensions</artifactId>
-        <version>5.7.3-pasturestack.2</version>
+        <version>5.7.3-pasturestack.3</version>
     </parent>
 
     <properties>

extensions/cdc-mysql/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>com.hazelcast.jet</groupId>
         <artifactId>hazelcast-jet-extensions</artifactId>
-        <version>5.7.3-pasturestack.2</version>
+        <version>5.7.3-pasturestack.3</version>
     </parent>
 
     <properties>

extensions/cdc-postgres/pom.xml

@@ -29,7 +29,7 @@
     <parent>
         <groupId>com.hazelcast.jet</groupId>
         <artifactId>hazelcast-jet-extensions</artifactId>
-        <version>5.7.3-pasturestack.2</version>
+        <version>5.7.3-pasturestack.3</version>
     </parent>
 
     <properties>