Skip to content

SECURITY-MAINTENANCE.md

Latest commit

 

History

History
24 lines (16 loc) · 1.29 KB

SECURITY-MAINTENANCE.md

File metadata and controls

24 lines (16 loc) · 1.29 KB
Raw

Security Maintenance

Scope

The PastureStack maintenance delta intentionally preserves the Hazelcast 5.7.0 API and changes only the Jackson versions shaded into the runtime:

Component Upstream 5.7.0 PastureStack runtime
Jackson 2 core and databind 2.21.2 2.21.4
Jackson 3 core, databind, and JR 3.1.2 3.1.4

These updates address the High-severity findings reported against the original shaded runtime by the Trivy Java vulnerability database on 2026-07-22, including GHSA-r7wm-3cxj-wff9, CVE-2026-54512, and CVE-2026-54513.

Required Release Gates

A release is acceptable only when all of the following are true:

  1. The source boundary is the upstream v5.7.0 commit recorded in ORIGIN.md, followed by exactly one PastureStack maintenance commit.
  2. The embedded Maven metadata reports Jackson 2.21.4 and Jackson 3.1.4.
  3. trivy rootfs --scanners vuln --severity CRITICAL,HIGH reports zero Critical and zero High findings for the produced JAR.
  4. The JAR contains the upstream LICENSE and NOTICE material.
  5. The GHCR artifact package is public and can be fetched anonymously by manifest digest and layer digest.

The runtime image is an artifact carrier for deterministic downstream builds; it is not a standalone Hazelcast server image.