Repository navigation
Rebuild the maintained core JAR with the official Temurin 25.0.5+8 security release. The Maven artifact version is 5.7.6; Hazelcast cluster metadata remains 5.7.3. Application dependency versions and public Java APIs are unchanged. CI verification uses Python 3.14.9 with hash-locked pip 26.2.2 and certifi 2026.10.19.
Signed producer: bd071c12bc11808a5f91e8b5d0308decd79e5af9. Protected PR #18 merged as dd208c94fb1029a3c4c071007790e2490cb5c88a with the same signed source tree. Exact-producer security gate passed 510 tests in 40 suites, with zero failures, errors, or skipped tests. The source, JAR and dependency scans report zero Critical/High findings; the source secret scan reports zero findings. All five required checks passed on the producer, including the four CodeQL languages.
The original 23,852,245-byte hazelcast-5.7.6.jar has SHA-256 825b5fc9526a10549bcb580f2d6c03bf1f5667625661722c0406ea6f796e83f2. Its embedded artifact version, source revision, and four Jackson metadata entries were verified. The CycloneDX 1.6 SBOM contains 15 components and 16 dependency nodes and matches the Maven runtime graph. The attached JAR and evidence are the original CI output, with no release-time rebuild.
This release publishes the GitHub JAR and evidence only. No OCI carrier or downstream Engine/Server deployment is implied. The optional Docker builder retains Ubuntu 24.04 and uses verified same-line JDK binaries because the corresponding upstream OCI tag was not yet available.