Upgrade dependency hazelcast from 3.12.5 to 5.3.7

[iarwen]

Upgrade dependency hazelcast from 3.12.5 to 5.3.7, tested with 3 nodes on k8s.

[guusdk]

Thank you for taking the time to implement and test this upgrade. It is much appreciated!

The change generally looks good, but I've left a number of remarks (most of them are pretty minor).

Apart from these remarks: should we provide documentation on how to upgrade from one version to another version? Is there something that administrators need to be aware of?

[iarwen]

Any other discussion for this PR? still wait for your suggestions @guusdk @akrherz.

[guusdk]

@iarwen thanks for your changes!

I have the following remaining concerns:

• I've unresolved two discussions, for you to create a new PR for the related changes.
• Why did you update to 5.3.7 and not the latest release? Can we upgrade to the latest release?
• Do we need explicit instructions/documentations for people to upgrade from an old version to a new version of the plugin. Do we need to revise the existing plugin documentation?

I've also pinged @GregDThomas to see if they're interested in reviewing this, given that they have a lot of experience with the plugin.

[GregDThomas]

I agree with @guusdk's comments, added a couple of my own in the area of the config.

[iarwen]

@iarwen thanks for your changes!

I have the following remaining concerns:

• I've unresolved two discussions, for you to create a new PR for the related changes.
• Why did you update to 5.3.7 and not the latest release? Can we upgrade to the latest release?
• Do we need explicit instructions/documentations for people to upgrade from an old version to a new version of the plugin. Do we need to revise the existing plugin documentation?

I've also pinged @GregDThomas to see if they're interested in reviewing this, given that they have a lot of experience with the plugin.

• Updated the unresolved discussions and marked as resolved, bugfix PR had created Fix memory usage status #95.
• The latest version 5.4.0 need the minimum supported Java version is 17. https://github.com/hazelcast/hazelcast/releases/tag/v5.4.0, that not match the minimum version of openfire.
• The existing plugin documentation looks good and enough except some link to the 3.12.5 document, if user use their old config file hazelcast-local-config.xml and use this 5.3.7 version to start up cluster, will occur some warning and information, but will not prevent the cluster startup. The logs looks like:
  2024.06.28 13:44:23 WARN [PluginMonitorTask-2]: com.hazelcast.cp.CPSubsystem - [10.42.0.165]:5701 [openfire-cluster-by-hazelcast] [5.3.7] CP Subsystem is not enabled. CP data structures will operate in UNSAFE mode! Please note that UNSAFE mode will not provide strong consistency guarantees.

I had updated the readme.html file.

[GregDThomas]

One trivial comment, but happy that my changes are dealt with.

[arelkar]

Hi @GregDThomas @guusdk @iarwen,
What are your plans to merge this PR and release openfire-hazelcast plugin 3.x.x version? Can you share tentative timelines?

There are bunch of CVEs reported for hazelcast, looking forward to new version.
https://mvnrepository.com/artifact/com.hazelcast/hazelcast/3.12.5
Eg: https://nvd.nist.gov/vuln/detail/CVE-2023-33264

Appreciate your response. Thank you.