Complete Spring Boot 4 and Java 25 migration

.github/workflows/codeql-verification.yml

@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Check out candidate
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -46,7 +46,7 @@ jobs:
           "$java_home/bin/java" -version
 
       - name: Install pinned evidence verifier runtime
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14.7'
           check-latest: false
@@ -57,15 +57,15 @@ jobs:
         run: |
           set -euo pipefail
           test -z "$(git status --porcelain)"
-          test "$(git rev-parse 60c31e3750cbad64f5720e2e02f0a9830973193c^{commit})" = \
-            60c31e3750cbad64f5720e2e02f0a9830973193c
-          git merge-base --is-ancestor 60c31e3750cbad64f5720e2e02f0a9830973193c HEAD
-          grep -Fxq 'distributionSha256Sum=55fadd669532a3205d5db95f490bf13971d8b0843526f407f29db0e61f074ab3' \
+          test "$(git rev-parse 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c^{commit})" = \
+            520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c
+          git merge-base --is-ancestor 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c HEAD
+          grep -Fxq 'distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce' \
             .mvn/wrapper/maven-wrapper.properties
           test "$(python --version)" = 'Python 3.14.7'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: java-kotlin
           build-mode: manual
@@ -90,7 +90,7 @@ jobs:
             test-compile
 
       - name: Analyze without publishing temporary alerts
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: '/language:java-kotlin'
           upload: never
@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload verification evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: distributed-cache-codeql-${{ github.sha }}
           path: codeql-results/

.github/workflows/security-release-gate.yml

@@ -24,7 +24,7 @@ jobs:
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
     steps:
       - name: Check out candidate
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -48,7 +48,7 @@ jobs:
           "$java_home/bin/java" -version
 
       - name: Install pinned evidence verifier runtime
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14.7'
           check-latest: false
@@ -59,10 +59,10 @@ jobs:
         run: |
           set -euo pipefail
           test -z "$(git status --porcelain)"
-          test "$(git rev-parse 60c31e3750cbad64f5720e2e02f0a9830973193c^{commit})" = \
-            60c31e3750cbad64f5720e2e02f0a9830973193c
-          git merge-base --is-ancestor 60c31e3750cbad64f5720e2e02f0a9830973193c HEAD
-          grep -Fxq 'distributionSha256Sum=55fadd669532a3205d5db95f490bf13971d8b0843526f407f29db0e61f074ab3' \
+          test "$(git rev-parse 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c^{commit})" = \
+            520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c
+          git merge-base --is-ancestor 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c HEAD
+          grep -Fxq 'distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce' \
             .mvn/wrapper/maven-wrapper.properties
           test "$(python --version)" = 'Python 3.14.7'
           mkdir -p evidence
@@ -512,7 +512,7 @@ jobs:
 
       - name: Upload review evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: distributed-cache-security-${{ github.sha }}
           path: evidence/

.mvn/wrapper/maven-wrapper.properties

@@ -1,4 +1,5 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
-distributionSha256Sum=55fadd669532a3205d5db95f490bf13971d8b0843526f407f29db0e61f074ab3
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
+distributionSha256SumTarGz=80ffca22aed9e8b9713a232f3394fd81d7f20322df75efdb2b047dbd3e3a23bb

SECURITY-MAINTENANCE.md

@@ -8,7 +8,7 @@ The resulting reviewed Maven artifact version is `5.7.3-pasturestack.2`; it is a
 
 | Component | Upstream 5.7.0 | PastureStack maintained version | Scope |
 | --- | --- | --- | --- |
-| Java release / cloud test VM | 17 / Java 8 or 17 | 25 LTS / Ubuntu 24.04 LTS | Compiler target, CI, and cloud integration runtime |
+| Java release / cloud test VM | 17 / retired mixed-runtime fixtures | 25 LTS / Ubuntu 24.04 LTS | Compiler target, CI, and cloud integration runtime |
 | Container build JDK | Unpinned release line | Temurin 25.0.4+7 on Ubuntu 24.04, digest pinned | Reproducible OCI build stage aligned with CI; build-only `unzip` preserves Maven ZIP checksum verification; a bounded 1.2 GiB Maven heap prevents javac OOM on the 2 GiB builder |
 | Jackson 2 core and databind | 2.21.2 | 2.22.2 | Shaded runtime |
 | Jackson 3 core, databind, and JR | 3.1.2 | 3.2.2 | Shaded runtime |
@@ -23,7 +23,7 @@ The resulting reviewed Maven artifact version is `5.7.3-pasturestack.2`; it is a
 | Janino | 3.1.10 | 3.1.12 | SQL expression runtime |
 | Checkstyle | 12.3.1 | 14.0.0 | Build-time source policy |
 | gRPC Java / Python | 1.73.0 | 1.83.1 / 1.83.0 | gRPC and cloud extension dependencies |
-| Aircompressor | 2.0.2 | 2.0.3 | Hadoop compression dependency |
+| Aircompressor | 2.0.2 | 2.0.3 | Current Parquet 1.18 byte-array codec dependency; Aircompressor v3 uses a different artifact/package and MemorySegment API |
 | Hazelcast test-job dependency | 5.0.5 | 5.7.3-pasturestack.2 | Command-line integration test fixtures |
 | Maven Compiler Plugin | implicit | 3.15.0 | Reproducible test-fixture builds |
 | Maven JAR Plugin | 3.1.2 | 3.5.1 | Reproducible test-fixture packaging |
@@ -52,13 +52,11 @@ The resulting reviewed Maven artifact version is `5.7.3-pasturestack.2`; it is a
 | Logback | 1.3.15 | 1.6.3 | Test logging |
 | Vert.x Core | 4.5.24 | 5.1.6 | Cloud integration tests |
 | Apache Hadoop | 3.4.3 | 3.5.0 | Hadoop, Azure, and S3 connector runtime |
-| Spring Boot 3 | 3.5.14 | 3.5.16 | Legacy Spring 6 compatibility tests |
-| Spring Framework 6 | 6.2.18 | 6.2.19 | Spring 6 integration tests |
-| Spring Boot 4 | 4.0.6 | 4.1.1 | Primary Spring 7 integration tests |
-| Spring Framework 7 | 7.0.7 | 7.0.9 | Spring 7 integration tests |
+| Spring Boot | 4.1.0 | 4.1.1 | Runtime and integration tests |
+| Spring Framework | 7.0.8 | 7.0.9 | Runtime and integration tests |
 | Jetty test servers | Jetty 9.4.58 | removed | Schema Registry and Hadoop test infrastructure |
 
-The Jackson updates address the High-severity findings reported against the original shaded runtime by the Trivy Java vulnerability database on 2026-07-22, including `GHSA-r7wm-3cxj-wff9`, `CVE-2026-54512`, and `CVE-2026-54513`. The 2026-08-07 full-source review also covers Netty, gRPC Java, Aircompressor, MINA, Tomcat, PostgreSQL JDBC, Hibernate ORM, LZ4 Java, and Spring advisories tracked by GitHub and the respective upstream security notices. The 2026-08-23 maintenance pass additionally updates the shared dependency-management boundary for Apache HTTP Core/Client, Commons Configuration, OpenTelemetry, Log4j, Bouncy Castle, ZooKeeper, Wire, Micrometer, RabbitMQ, Plexus Utils, Logback, and Vert.x. The obsolete Log4j 1 bridge was removed from the Elasticsearch 7 tests, the legacy MySQL connector coordinate was replaced with `com.mysql:mysql-connector-j`, and the unused Hadoop `jsonschema2pojo-core` transitive was excluded at its direct introducing dependency. The sole Commons Lang 2 test call was migrated to the already managed Commons Lang 3 API before excluding Commons Lang 2 from the same path. The final compatibility pass moves the product and CI target to Java 25 LTS, upgrades Netty and Lettuce together onto the 4.2-native line, replaces JLine's Jansi provider with the Java FFM provider, and migrates Protobuf serializers to the stable `Message` API so generated classes from both the previous V3 hierarchy and Protobuf Java 4 remain supported. Java gRPC remains at 1.83.1, while the Python runtime uses 1.83.0 because gRPC patch releases are language-specific and 1.83.1 is not published on PyPI. Aircompressor remains at the current reviewed 2.0.3 release. The standalone command-line test fixtures now pin stable Maven plugin releases and use the intended compiler release setting so their build output is reproducible. Hibernate ORM 5.6 has no patched release and is end-of-life, so the distribution test was migrated to the current stable 7.4 line instead of suppressing the alert or deleting coverage. LZ4 Java 1.11.2 was accepted only after matching its Maven Central publication to the upstream security release, signed tag history, and verified commits. Development and test scope reduces production reachability, but it does not make vulnerable code safe to execute in CI or release builds.
+The Jackson updates address the High-severity findings reported against the original shaded runtime by the Trivy Java vulnerability database on 2026-07-22, including `GHSA-r7wm-3cxj-wff9`, `CVE-2026-54512`, and `CVE-2026-54513`. The 2026-08-07 full-source review also covers Netty, gRPC Java, Aircompressor, MINA, Tomcat, PostgreSQL JDBC, Hibernate ORM, LZ4 Java, and Spring advisories tracked by GitHub and the respective upstream security notices. The 2026-08-23 maintenance pass additionally updates the shared dependency-management boundary for Apache HTTP Core/Client, Commons Configuration, OpenTelemetry, Log4j, Bouncy Castle, ZooKeeper, Wire, Micrometer, RabbitMQ, Plexus Utils, Logback, and Vert.x. The obsolete Log4j 1 bridge was removed from the Elasticsearch 7 tests, the legacy MySQL connector coordinate was replaced with `com.mysql:mysql-connector-j`, and the unused Hadoop `jsonschema2pojo-core` transitive was excluded at its direct introducing dependency. The sole Commons Lang 2 test call was migrated to the already managed Commons Lang 3 API before excluding Commons Lang 2 from the same path. The final compatibility pass moves the product, fixtures, and CI target to Java 25 LTS, upgrades Netty and Lettuce together onto the 4.2-native line, replaces JLine's Jansi provider with the Java FFM provider, and migrates Protobuf serializers to the stable `Message` API so generated classes from both the previous V3 hierarchy and Protobuf Java 4 remain supported. Java gRPC remains at 1.83.1, while the Python runtime uses 1.83.0 because gRPC patch releases are language-specific and 1.83.1 is not published on PyPI. Parquet 1.18.0 still compiles against Aircompressor 2.0.3's byte-array API; Aircompressor v3 is not binary-compatible because it moved to a separate artifact, package, and MemorySegment API. The standalone command-line test fixtures now pin stable Maven plugin releases and use Java 25 so their build output matches the product runtime. Hibernate ORM 5.6 has no patched release and is end-of-life, so the distribution test was migrated to the current stable 7.4 line instead of suppressing the alert or deleting coverage. LZ4 Java 1.11.2 was accepted only after matching its Maven Central publication to the upstream security release, signed tag history, and verified commits. Development and test scope reduces production reachability, but it does not make vulnerable code safe to execute in CI or release builds.
 
 Debezium was migrated from the end-of-life 1.9 line to 3.6.1.Final. The CDC implementation now uses the current schema-history SPI and configuration keys (`schema.history.internal`, `topic.prefix`, and the `*.include.list` / `*.exclude.list` family). PostgreSQL snapshot mode `NEVER` maps to the current `NO_DATA` mode, while custom snapshotters use the current Debezium snapshotter SPI and custom-name setting. This is a runtime migration, not an alert suppression.
 
@@ -95,14 +93,14 @@ The standalone release gates `scripts/check-xml-parser-hardening` and `scripts/c
 
 The reviewed core JAR build invokes Maven and the pinned JDK; it does not compile the repository's C source companions or package the optional Python extension. The gate records hashes for the tracked C headers, C sources, and prebuilt native resources, then requires the native bytes embedded in the JAR to match the tracked resources exactly. It also rejects Python extension resources in the core JAR. Python 3.14.7 is pinned only for evidence validation in CI. A C compiler therefore is not a hidden input to this artifact build, and the verifier Python is not a deployed runtime component.
 
-The opt-in `spring-5` compatibility profile has been removed because Spring Boot 2.7 and Spring Framework 5.3 are end-of-life. The maintained compatibility matrix starts at Spring Boot 3 / Spring Framework 6 and also covers Spring Boot 4 / Spring Framework 7. XML schema names such as `hazelcast-spring-5.7.xsd` identify the Hazelcast schema version and are unrelated to the removed Spring Framework 5 dependency line.
+All Spring Boot 3 / Spring Framework 6 compatibility profiles and the `hazelcast-spring-boot3` artifact have been removed. The maintained runtime is Spring Boot 4 / Spring Framework 7 only. XML schema names such as `hazelcast-spring-5.7.xsd` identify the Hazelcast schema version and are unrelated to a Spring Framework dependency line.
 
 ## Required Release Gates
 
 A release is acceptable only when all of the following are true:
 
 1. The upstream `v5.7.0` boundary recorded in [ORIGIN.md](ORIGIN.md) is an ancestor of the candidate, and every later commit remains on the linear PastureStack maintenance line.
-2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.2, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.14 is downloaded only from Maven Central and is verified against the committed SHA-256 before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 3.5.16 and 4.1.1, and Spring Framework 6.2.19 and 7.0.9. It also verifies that Jansi, the removed Spring 5 profile, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
+2. Every reactor POM and command-line test fixture resolves the maintained artifact at 5.7.3-pasturestack.2, while generated cluster runtime metadata resolves to numeric version 5.7.3. Maven Wrapper 3.9.16 is downloaded only from Maven Central; its ZIP and tar.gz distributions are verified against separate committed SHA-256 values before execution. The source version gate requires Java 25, Ubuntu 24.04 LTS cloud test images, Checkstyle 14.0.0, Avro 1.12.2, Jackson 2.22.2 and 3.2.2, Janino 3.1.12, Parquet 1.18.0, JLine 4.3.1 with FFM, Protobuf Java 4.36.0 and Python 7.36.0, Netty 4.2.17.Final, Lettuce 7.7.0.RELEASE, Kafka 4.3.1, Confluent Platform 8.3.1, gRPC Java 1.83.1 and Python 1.83.0, Aircompressor 2.0.3, Hadoop 3.5.0, Maven Compiler Plugin 3.15.0, Maven JAR Plugin 3.5.1, Maven Install Plugin 3.1.4, Maven Dependency Plugin 3.11.0, an in-process Kotlin Maven compiler, MINA 2.2.9, Tomcat 11.0.25, PostgreSQL JDBC 42.7.13, Hibernate ORM 7.4.5.Final, LZ4 Java 1.11.2, Apache HTTP Core 5.4.3, Apache HTTP Client 5.6.4, Elasticsearch Java API Client 9.5.1, Commons Configuration 2.15.1, OpenTelemetry 1.65.0, Log4j 2.26.1, Debezium 3.6.1.Final, Bouncy Castle 1.85, ZooKeeper 3.9.5, Wire 6.4.6, Micrometer 1.17.1, RabbitMQ client 5.35.0, Plexus Utils 4.1.0, Logback 1.6.3, Vert.x 5.1.6, Spring Boot 4.1.1, and Spring Framework 7.0.9. It also verifies that Jansi, all Spring Boot 3 / Spring Framework 6 compatibility profiles and artifacts, legacy Debezium configuration keys, Elasticsearch HLRC, embedded Schema Registry server, Hadoop MiniDFSCluster, Jetty, and dependency-owned JUnit platform settings are absent from their governed outputs.
 3. Maven's resolved dependency graph contains those reviewed versions, no older duplicate of the same artifacts, no Elasticsearch HLRC/server/Lucene legacy graph in the Elasticsearch connector, and no `org.eclipse.jetty` graph in the Kafka, SQL, Hadoop distribution, Azure, or S3 modules.
 4. The produced file is `hazelcast-5.7.3-pasturestack.2.jar`; its embedded core Maven metadata reports 5.7.3-pasturestack.2, its generated cluster runtime metadata reports numeric version 5.7.3, and its embedded Jackson metadata reports Jackson 2.22.2 and Jackson 3.2.2. The full source commit and abbreviated revision embedded in `GeneratedBuildProperties` must match the OCI revision supplied to the build; unresolved placeholders are rejected during packaging.
 5. Relevant core, Spring, database, and distribution integration tests pass on Java 25 LTS. The focused source-boundary suite must retain its expected suite and test counts so an accidentally undiscovered test cannot appear successful.

hazelcast-archunit-rules/src/main/java/com/hazelcast/test/archunit/CompletableFutureUsageCondition.java

@@ -24,8 +24,6 @@
 import com.tngtech.archunit.lang.ArchCondition;
 import com.tngtech.archunit.lang.ConditionEvents;
 
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
@@ -56,13 +54,6 @@ public class CompletableFutureUsageCondition extends ArchCondition<JavaClass> {
             .collect(toSet());
 
     private static final Set<String> SYNC_AND_ASYNC_METHODS = collectSyncAndAsyncCounterpartMethods();
-    //TODO Remove Java 8 compatibility code after JDK upgrade
-    static {
-        Collection<String> excludedSyncMethodsForJava8Compatibility
-                = Arrays.asList("exceptionally");
-        SYNC_AND_ASYNC_METHODS.removeAll(excludedSyncMethodsForJava8Compatibility);
-    }
-
     CompletableFutureUsageCondition() {
         super("use only CompletableFuture async methods with explicit executor service");
     }