Distributed cache runtime 5.7.5

This release contains the exact reviewed JAR and 18 original evidence files retained by Security release gate run 36815272664. No release-time rebuild was performed.

Source: a9aea56. Signed tag v5.7.5 points to this exact CI head. The merged main tree is identical to the reviewed source tree (1ebcb081cc575a6e785af2c37e9af3b61df03022).

• JAR: hazelcast-5.7.5.jar, 23,852,246 bytes, SHA256 0f536a9c7bcd00f2369586fb6ca1606f7e45f3225e24795d10d38397051c8715.
• Embedded Jackson core/databind metadata: 2.22.3 and 3.2.3. Other dependency changes are outside this patch.
• GeneratedBuildProperties runtime/cluster protocol remains 5.7.3; full commit and abbreviated revision bind the JAR to the source above.
• Official focused CI evidence: 510 tests across 40 named suites; 0 failures, 0 errors, 0 skipped tests.
• Retained Trivy 0.74.0 source, JAR and SBOM scans reported 0 Critical/High findings for their respective scanned boundaries on 2026-10-01; the source secret scan reported 0 findings. The exact PR-head CodeQL analyses completed successfully and their SARIF results contained no security-severity >=7 findings or unresolved result-rule metadata. These are artifact/source-scoped results, not a claim of complete product QA or absence of every CVE.

All SHA256 files are published byte-for-byte without rewriting their path entries. To validate the original layout, place hazelcast-5.7.5.jar under dist/ and every other attached file under evidence/. The original paths recorded in the evidence remain unchanged.

Publication scope is GitHub release assets consumed by the Engine installer. No new OCI/GHCR carrier image is published by this release.