Bump the dev-dependencies group with 4 updates

[dependabot]

Bumps the dev-dependencies group with 4 updates: gradle-wrapper, software.amazon.awssdk:bom, org.liquibase:liquibase-core and io.micrometer:micrometer-core.

Updates gradle-wrapper from 9.7.0 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 92f0512 update fixed issues for 9.7.1 (#38892)
• 820ee75 update fixed issues for 9.7.1
• 82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
• ef11a72 Fix annotation parameter ordering issue
• bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
• 336e129 Update signing configuration (#38874)
• 4bdf0da Update signing configuration
• cd9b92c List issues resolved in 9.7.1 (#38839)
• 5f4e381 List issues resolved in 9.7.1
• 1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
• Additional commits viewable in compare view

Updates software.amazon.awssdk:bom from 2.53.2 to 2.54.3

Updates org.liquibase:liquibase-core from 5.0.3 to 5.0.4

Release notes

Sourced from org.liquibase:liquibase-core's releases.

Liquibase v5.0.4

Liquibase Community 5.0.4 Release Notes

Liquibase Community v5.0.4 is a security-focused release: credentials are now redacted from error messages and logs, new opt-in lockdown flags let you restrict changelog features that execute code, and more than thirty fixes land across Oracle, PostgreSQL, MySQL and MariaDB, diff-changelog, and embedded use. Thanks to the twenty-three contributors who made their first contribution in this release!

Latest release: v5.0.4, August 20, 2026

Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly

Roadmap: Liquibase Community (view)

Thank you to every contributor who filed an issue, reviewed code, or submitted a fix.

New Contributors

• @​v-petrovych made their first contribution in #7729
• @​mgustimz made their first contribution in #7696
• @​Khromushkin made their first contribution in #7759
• @​officialasishkumar made their first contribution in #7705
• @​jstastny made their first contribution in #7566
• @​pranithreddym made their first contribution in #7708
• @​edu1006 made their first contribution in #7847
• @​profiluefter made their first contribution in #7560
• @​Devansh-ops made their first contribution in #7834
• @​singhvishalkr made their first contribution in #7725
• @​Akshatsharma2205 made their first contribution in #7798
• @​renechoi made their first contribution in #7869
• @​om7057 made their first contribution in #7825
• @​yosimasu made their first contribution in #7831
• @​makssent made their first contribution in #7850
• @​felhag made their first contribution in #7803
• @​hutiefang76 made their first contribution in #7835
• @​sakshichitnis27 made their first contribution in #7866
• @​seonwooj0810 made their first contribution in #7812
• @​kamilkrzywanski made their first contribution in #7848
• @​fudianchn made their first contribution in #7881
• @​ET-TOUNANI made their first contribution in #7801
• @​pwielgolaski made their first contribution in #7909

What's in this release

Security

Release signing key rotated: The Liquibase release signing key was rotated following the revocation of the old key. GPG verification requires Liquibase Community 5.0.4 or later. Past releases are safe and untampered.

(#7737, #7738, #7740, #7756, #7739, #7746) by @​v-petrovych Database credentials are now redacted from error messages, logs, and stored parameters. If you pass a JDBC URL with embedded credentials (such as jdbc:postgresql://user:password@host/db) and the connection fails, the password no longer appears in the resulting error message or in log output. This covers unrecognized-driver errors and mistyped offline: URLs, and the URL sanitizer now handles PostgreSQL, SQL Server, and third-party JDBC drivers rather than only a few specific databases. Credential-bearing values captured from CLI arguments, liquibase.properties defaults files, and Maven plugin parameters are now masked before being stored internally. The init start-h2 example server also now prints ***** instead of the real password in its connection information banner. If you relied on copying the password from that output, use the value you configured instead (the default is letmein).

(#7741, #7742, #7743, #7764) by @​v-petrovych Passwords are cleared from memory once Liquibase is done with them. The CLI, the Maven plugin, and the Ant tasks now release password values as soon as the operation that needed them finishes. For Ant, clearing happens when the build finishes, so a shared <database> definition keeps working across multiple tasks in one build. This shortens the window in which a heap dump or memory inspection of a long-running JVM could expose your credentials. If you call Liquibase programmatically, CommandScope.execute() does not clear credentials automatically (so reusing one scope for several executions keeps working), and you can opt in by calling the now-public clearCredentialArguments() after your last execution.

(#7747, #7748, #7768, #7767, #7766, #7765, #7750) by @​v-petrovych New opt-in lockdown flags for changelog features that can execute code or reach outside your project. Several changelog features are intentionally powerful under Liquibase's standard trust model of team-authored, team-reviewed changelogs. If you run changelogs from less-trusted sources, you can now disable each of these features individually. Every flag defaults to true, so nothing changes unless you set it. When a flag is set to false, the offending element is rejected with a clear error that names the flag, before any of its code runs.

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase Community 5.0.4 is a minor patch release

See the Liquibase Community 5.0.4 Release Notes for the complete set of release information.

New Features

• Add nocontexts pseudo-context to allow opt-in strict context matching by @​filipelautert with @​Copilot in liquibase/liquibase#7650
• feat: Provide a listUnexpectedChangeSets() to be consistent with other methods in that class by @​Vampire in liquibase/liquibase#7522
• INT-2211: reference-scoped configuration for two-connection commands by @​SvampX in liquibase/liquibase#7841
• Detect Firebird-compatible RedDatabase servers as Firebird by @​makssent in liquibase/liquibase#7850

Bug Fixes

• Fix #7602: Set database filter when user-provided ChangeLogParameters is passed by @​mgustimz in liquibase/liquibase#7696
• fix(postgres): preserve PARTITION BY in diff-changelog (#6885) by @​Khromushkin in liquibase/liquibase#7759
• Fix Redshift snapshot failure: skip pg_partitioned_table enrichment on pre-PG10 servers by @​KushnirykOleh in liquibase/liquibase#7827
• fix(mysql): preserve timestamp column attributes in native types by @​officialasishkumar in liquibase/liquibase#7705
• fix: use CURRENT_TIMESTAMP instead of SYSTIMESTAMP for Oracle by @​filipelautert in liquibase/liquibase#7641
• fix: reduce misleading WARN log when CLOB value contains spaces by @​jstastny in liquibase/liquibase#7566
• Fix MySQL TINYINT(1) snapshotted as BIT(1) causing spurious diffs by @​pranithreddym in liquibase/liquibase#7708
• Fix #7623: Handle null URL in isCorrectDatabaseImplementation by @​mgustimz in liquibase/liquibase#7697
• fix: use integerExp type for numeric sequence attributes in XSD by @​filipelautert in liquibase/liquibase#7643
• fix(changelog): fall back when stored changelog path is missing by @​officialasishkumar in liquibase/liquibase#7704
• Fix primaryKeyExists precondition ignoring PK name on Oracle by @​filipelautert in liquibase/liquibase#7645
• INT-2215: don't silently drop same-order value modifiers / table-name generators by @​SvampX in liquibase/liquibase#7845
• fix: Update list of reserved keywords for MySQL and MariaDB by @​profiluefter in liquibase/liquibase#7560
• Fix Oracle statement splitting for q-quoted string literals by @​Devansh-ops in liquibase/liquibase#7834
• Treat 'NULL' default value as null for MySQL/MariaDB enum columns by @​singhvishalkr in liquibase/liquibase#7725
• Fix grouped context expression parsing by @​Akshatsharma2205 in liquibase/liquibase#7798
• fix the ChangeSet checksum cache to recalculate when a different checksum version is requested by @​renechoi in liquibase/liquibase#7869
• fix: share a single root scope across threads by @​filipelautert in liquibase/liquibase#7877
• fix: give each command execution its own CommandStep instances by @​filipelautert in liquibase/liquibase#7876
• Refactor: track MDC scope entries per-thread by @​om7057 in liquibase/liquibase#7825
• Fix --output-default-schema/--output-default-catalog being ignored by update-sql and other SQL output commands by @​yosimasu in liquibase/liquibase#7831
• Route deprecated-AWS-extension warning to System.err by @​wwillard7800 in liquibase/liquibase#7884
• fix: default-schema-name not working when runInTransaction is false by @​felhag in liquibase/liquibase#7803
• Fix formatted SQL precondition messages by @​hutiefang76 in liquibase/liquibase#7835
• Fix URL loading from driver properties file by @​sakshichitnis27 in liquibase/liquibase#7866
• fix(snapshot): close owning Statement in ResultSetCache.extract to prevent JDBC Statement leak by @​seonwooj0810 in liquibase/liquibase#7812
• Fix service discovery aborting when a provider fails to load by @​kamilkrzywanski in liquibase/liquibase#7848
• Fix ClassCastException in diff-changelog when a PK/UC backing index is delegated by @​fudianchn in liquibase/liquibase#7881
• fix: preserve addColumn before foreign key in diff changelog output by @​ET-TOUNANI in liquibase/liquibase#7801
• Fix uppercase acronym parameters being dropped in customChange by @​fudianchn in liquibase/liquibase#7882
• Fix: don't release the changelog lock in AbstractUpdateCommandStep unless it was acquired there by @​om7057 in liquibase/liquibase#7886
• fix: do not hoist a foreign key column ahead of its own table by @​filipelautert in liquibase/liquibase#7898
• fix: carry the index relation down to its columns by @​filipelautert in liquibase/liquibase#7897
• Fix fast check cache after rollback by @​hutiefang76 in liquibase/liquibase#7896
• fix: ship commons-text and commons-collections4 in the distribution again by @​filipelautert in liquibase/liquibase#7907
• fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting by @​wwillard7800 in liquibase/liquibase#7910
• fix: scope per-database service cleanup so parallel Maven reactor builds no longer corrupt each other's state by @​pwielgolaski in liquibase/liquibase#7909

... (truncated)

Commits

• 2c25134 Update changelog.txt for 5.0.4 (#7920)
• 15a0885 [TECHOPS-1048] Gate DigiCert KeyLocker signing behind dry_run, drop from inst...
• c7a01d5 chore(deps): bump the github-actions group with 5 updates (#7917)
• 83e6a89 chore(deps): bump the test-deps group with 2 updates (#7916)
• 59a7617 fix: emit valid timestamp with time zone syntax (#7808)
• 0f1129f fix: scope per-database service cleanup so parallel Maven reactor builds no l...
• e5ec227 fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting (#7...
• 56c9dca chore(deps): bump org.apache.maven:apache-maven from 3.9.5 to 3.9.16 (#7914)
• 5568a48 chore(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.2.0 to 3.3.4 ...
• e3cc406 Fix the SonarCloud quality gate: suppress false-positive S3077 on two safely-...
• Additional commits viewable in compare view

Updates io.micrometer:micrometer-core from 1.17.0 to 1.17.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions