What liquibase/liquibase shipped
Generated by FoxPlug from public activity — not affiliated with Liquibase.
Week of September 14, 2026
What shipped
- Release creation now builds from a pinned commit instead of an operator-supplied run ID, establishing a verifiable link between released bytes and the version being released. Pull request #7990
- Fixed the release gate workflow that was incorrectly counting its own runs, preventing accurate validation of release readiness. Pull request #8000
- Package cleanup now removes branch-named SNAPSHOT versions in addition to commit-shaped ones, eliminating installable fork-built artifacts from public registries. Pull request #7989
- Stopped automatic creation of nightly pre-releases on every push to the repository. Pull request #8001
- Fixed the automated Jira ticket creation workflow to trigger on merge commits from community PRs instead of pull request close events. Pull request #8003
- Updated the Alpine container image to patch 9 high-severity CVEs in libcrypto3 and libssl3. Pull request #7999
- Removed an unreachable dispatch-only workflow that held inherited secrets without any review or trigger mechanism. Pull request #7966
Why it matters
This week's changes harden the release and build infrastructure by establishing traceable commits for releases, fixing gate logic that was blocking releases, cleaning up stale artifacts from public registries, and removing security risks from orphaned workflows. These improvements make the release process more reliable and secure.
Changelog entry
- Release creation now pins to a specific commit for reproducibility and traceability Pull request #7990
- Fixed release gate workflow self-counting logic Pull request #8000
- Package cleanup expanded to remove branch-named SNAPSHOT versions Pull request #7989
- Disabled automatic nightly pre-release creation on every push Pull request #8001
- Fixed Jira ticket automation to trigger on merge commits from community PRs Pull request #8003
- Updated Alpine image to patch high-severity OpenSSL CVEs Pull request #7999
- Removed unreachable fossa_ai.yml workflow Pull request #7966
Release infrastructure hardening: pinned commits for releases, fixed validation gates, cleaned up orphaned artifacts, and removed unreachable workflows holding inherited secrets.
This week we strengthened Liquibase's release and build infrastructure with several critical improvements: releases now build from pinned commits instead of operator-supplied IDs, establishing full traceability; the release validation gate was fixed to avoid counting its own runs; package cleanup now removes all branch-named SNAPSHOT versions from public registries; and we removed an unreachable workflow that held inherited secrets. These changes make our release process more reliable and secure.