What liquibase/liquibase shipped
Written by FoxPlug from the repository's own releases; not affiliated with Liquibase. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/liquibase/liquibase; Liquibase did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 19, 2026
What shipped
- Changeset application and its DATABASECHANGELOG update now commit atomically for update and rollback, so a failure no longer leaves the two out of step. Pull request #8021
- An opt-in PostgreSQL session or advisory lock service was added, so the changelog lock is no longer left as a LOCKED row when a process dies mid-update. Pull request #7795
- NormalizePath now checks the classpath prefix before resolving configuration, fixing slow no-op runs reported since 4.30. Pull request #8043
- SQL run through the JdbcExecutor query and update paths is now logged at liquibase.sql.logLevel. Pull request #8049
- Schema snapshots now preserve REAL expression defaults instead of failing on PostgreSQL real columns that JDBC exposes as float4. Pull request #8039
- The Snowflake setColumnRemarks view check is now scoped to the target schema instead of running a broad SHOW VIEWS LIKE query. Pull request #7982
- The version check now guards against a null version. Pull request #8053
Why it matters
This week fixes several failures that hit people running updates and snapshots in real environments: a transactional gap between a changeset and its DATABASECHANGELOG row, a lock row that stays locked after a process dies, slow no-op runs, and snapshot failures on PostgreSQL real columns. It also adds an opt-in PostgreSQL lock option and improves SQL logging so runs are easier to follow.
Changelog entry
- Commit a changeset and its DATABASECHANGELOG update atomically for update and rollback. Pull request #8021
- Add an opt-in PostgreSQL session (advisory) lock service. Pull request #7795
- Check the classpath: prefix before resolving configuration in normalizePath to fix slow no-op runs. Pull request #8043
- Log SQL run through JdbcExecutor query and update paths at liquibase.sql.logLevel. Pull request #8049
- Preserve REAL expression defaults in schema snapshots. Pull request #8039
- Scope the setColumnRemarks view check to the target schema on Snowflake. Pull request #7982
- Guard against a null version in the version check. Pull request #8053
This week: changesets and their DATABASECHANGELOG updates now commit atomically, an opt-in PostgreSQL advisory lock service, faster no-op runs, SQL logged at liquibase.sql.logLevel, and PostgreSQL REAL default snapshot fixes.
This week in Liquibase: a changeset and its DATABASECHANGELOG update now commit atomically for update and rollback, so a mid-update failure no longer leaves them out of step. An opt-in PostgreSQL session lock service avoids the LOCKED row left behind when a process dies. Slow no-op runs since 4.30 are fixed, SQL through the JdbcExecutor query and update paths is logged at liquibase.sql.logLevel, PostgreSQL REAL expression defaults are preserved in snapshots, and the Snowflake column remarks view check is scoped to the target schema.
Week of October 5, 2026
What shipped
- Fixed a changelog lock bug where concurrent updates could leave each other's locks set, by resetting only the finishing database's LockService. Pull request #7957
- Fixed updateCount and updateSql to acquire the changelog lock lazily after the fast-check, so a stale or held lock no longer blocks startup when nothing is pending. Pull request #7905
- Fixed loadData so a CSV file starting with a comment or blank line no longer misparses that line as the header, which had caused column-count mismatch failures on every data row. Pull request #7919
- Fixed a false negative in columnExists on H2 when catalogName is set. Pull request #8024
- Added support for sequence startValue and incrementBy on Firebird. Pull request #7922
- Fixed the release dry run and changed it to publish to Nexus instead of Maven Central. Pull request #8029
- Added a PR gate failure when the release approval gate can be bypassed. Pull request #8033
- Documented cloudflare-r2 as a pinned grouped role in the release README. Pull request #8032
Why it matters
This week brought several correctness fixes for everyday migration runs. Concurrent updates no longer leave stale changelog locks behind, and updateCount and updateSql no longer block on the lock when nothing is pending. CSV loading with leading comments or blank lines now reads the header correctly, and H2 users get an accurate columnExists result.
Changelog entry
- Fixed concurrent updates leaving each other's changelog locks set by resetting only the finishing database's LockService. Pull request #7957
- UpdateCount and updateSql now acquire the changelog lock lazily after the fast-check instead of blocking startup on a held lock. Pull request #7905
- Fixed loadData misreading a leading comment or blank line in a CSV file as the header, which caused column-count mismatch errors. Pull request #7919
- Fixed columnExists returning false on H2 when catalogName is set. Pull request #8024
- Firebird now supports sequence startValue and incrementBy. Pull request #7922
- Fixed the release dry run and made it publish to Nexus instead of Maven Central. Pull request #8029
- Added a PR gate that fails when the release approval gate can be bypassed. Pull request #8033
- Documented cloudflare-r2 as a pinned grouped role in the release README. Pull request #8032
This week: changelog lock fixes for concurrent updates and for updateCount/updateSql, CSV loadData header parsing with comments or blank lines, H2 columnExists with catalogName, and Firebird sequence startValue and incrementBy.
This week in Liquibase: concurrent updates no longer leave each other's changelog locks set, and updateCount and updateSql now acquire the changelog lock lazily after the fast-check so a stale lock does not block startup when nothing is pending. CSV loading now skips leading comment and blank lines before reading the header, fixing column-count mismatch failures. columnExists returns correctly on H2 when catalogName is set, and Firebird now supports sequence startValue and incrementBy. Release tooling also got fixes: the dry run publishes to Nexus, and a PR gate fails when the release approval gate can be bypassed.
Week of September 21, 2026
What shipped
- OSS released assets now publish to Cloudflare R2 instead of the legacy S3 bucket liquibaseorg-origin. Pull request #8005
- OSS released assets now route to their own dedicated R2 bucket instead of a shared prefix. Pull request #8018
- Javadocs publishing now writes to Cloudflare R2 directly rather than relying on lazy copy-on-read from S3. Pull request #8004
- S3 sync step removed from javadocs workflow since R2 is now the primary target. Pull request #8017
- Stopped writing XSD schema files to the legacy S3 bucket as part of decommissioning efforts. Pull request #8006
- Dispatched dry-run releases can now pass the green-SHA gate without blocking on themselves. Pull request #8015
- Ubuntu security patches now applied during Docker image build time for the noble-based image. Pull request #8007
- Added Grype ignore rule for zlib CVE-2026-85091 where no fix version exists. Pull request #8013
- Fixed Docker security scanning rule to match Grype's actual empty fix-state field instead of not-fixed. Pull request #8014
- Removed outdated documentation claiming dry-run releases produce ECR images. Pull request #8009
Why it matters
This week consolidated artifact storage by migrating from legacy S3 buckets to Cloudflare R2, removing intermediate copy steps so that javadocs and release assets serve directly from their final destination. The changes also fix release workflow dispatch gates and improve Docker image security scanning rules.
Changelog entry
- OSS released assets now publish to Cloudflare R2 bucket instead of S3 Pull request #8005
- OSS released assets use their own dedicated R2 bucket for proper access scoping Pull request #8018
- Javadocs now publish directly to Cloudflare R2 without S3 intermediate storage Pull request #8004
- Removed XSD publishing to legacy liquibaseorg-origin S3 bucket Pull request #8006
- Dispatched dry-run releases can now pass CI gates Pull request #8015
- Ubuntu security patches applied during Docker build time Pull request #8007
- Docker security scanning rule corrected for empty Grype fix states Pull request #8014
Release infrastructure now publishes javadocs and OSS assets directly to Cloudflare R2. Removed legacy S3 sync steps and fixed dry-run release gates. Docker security scanning rules now match Grype behavior.
This week's infrastructure improvements streamline how Liquibase publishes its artifacts. We've migrated javadocs and OSS release assets to Cloudflare R2, eliminating legacy S3 bucket dependencies and removing unnecessary copy-on-read bridges. We also fixed release workflow gates to unblock dispatched dry runs and improved Docker security scanning to correctly identify unfixed vulnerabilities.
Week of September 14, 2026
What shipped
- Release creation now builds from a pinned commit instead of an operator-supplied run ID, establishing a verifiable link between released bytes and the version being released. Pull request #7990
- Fixed the release gate workflow that was incorrectly counting its own runs, preventing accurate validation of release readiness. Pull request #8000
- Package cleanup now removes branch-named SNAPSHOT versions in addition to commit-shaped ones, eliminating installable fork-built artifacts from public registries. Pull request #7989
- Stopped automatic creation of nightly pre-releases on every push to the repository. Pull request #8001
- Fixed the automated Jira ticket creation workflow to trigger on merge commits from community PRs instead of pull request close events. Pull request #8003
- Updated the Alpine container image to patch 9 high-severity CVEs in libcrypto3 and libssl3. Pull request #7999
- Removed an unreachable dispatch-only workflow that held inherited secrets without any review or trigger mechanism. Pull request #7966
Why it matters
This week's changes harden the release and build infrastructure by establishing traceable commits for releases, fixing gate logic that was blocking releases, cleaning up stale artifacts from public registries, and removing security risks from orphaned workflows. These improvements make the release process more reliable and secure.
Changelog entry
- Release creation now pins to a specific commit for reproducibility and traceability Pull request #7990
- Fixed release gate workflow self-counting logic Pull request #8000
- Package cleanup expanded to remove branch-named SNAPSHOT versions Pull request #7989
- Disabled automatic nightly pre-release creation on every push Pull request #8001
- Fixed Jira ticket automation to trigger on merge commits from community PRs Pull request #8003
- Updated Alpine image to patch high-severity OpenSSL CVEs Pull request #7999
- Removed unreachable
fossa_ai.ymlworkflow Pull request #7966
Release infrastructure hardening: pinned commits for releases, fixed validation gates, cleaned up orphaned artifacts, and removed unreachable workflows holding inherited secrets.
This week we strengthened Liquibase's release and build infrastructure with several critical improvements: releases now build from pinned commits instead of operator-supplied IDs, establishing full traceability; the release validation gate was fixed to avoid counting its own runs; package cleanup now removes all branch-named SNAPSHOT versions from public registries; and we removed an unreachable workflow that held inherited secrets. These changes make our release process more reliable and secure.