Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 3 updates - #266

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/minor-and-patch-bee6e81a08
Closed

build(deps): bump the minor-and-patch group across 1 directory with 3 updates#266
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/minor-and-patch-bee6e81a08

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 3 updates in the / directory: org.apache.maven.plugins:maven-surefire-plugin, org.apache.maven.plugins:maven-failsafe-plugin and org.liquibase:liquibase-core.

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.6.0 to 3.6.1

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.1

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

  • Clean up deprecated parameters and fix TestNG parallel modes (#3452) (#3519) @​olamy
  • Merge the two timeout extension pages into one. The guide and the example page covered the same things twice. (#3520) @​olamy
  • Drop the Source Xref menu items (#3479) @​slachiewicz

👻 Maintenance

🔧 Build

... (truncated)

Commits
  • 5bf0dcf [maven-release-plugin] prepare release surefire-3.6.1
  • 7f73580 Bump doxiaVersion from 2.1.0 to 2.2.0 (#3542)
  • ab7ce2f Bump org.testng:testng (#3539)
  • ff3b768 Group module path heuristics in ModulePathJpmsArguments (#3541)
  • a343e4d Fix IllegalAccessError when the main module requires JUnit (#3532) (#3538)
  • 907a2e2 Fix groups and excludedGroups being ignored when TestNG is on the classpath (...
  • cc69b3c Use push for PR Automation
  • b119019 Install the JUnit Platform provider for the ITs (#3535)
  • 2cdec2e Don't let runOrder replace JUnit orderers set elsewhere (#3529) (#3530)
  • 1e4f6b9 Use workflow_run for PR check (#3531)
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-failsafe-plugin from 3.6.0 to 3.6.1

Release notes

Sourced from org.apache.maven.plugins:maven-failsafe-plugin's releases.

3.6.1

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

  • Clean up deprecated parameters and fix TestNG parallel modes (#3452) (#3519) @​olamy
  • Merge the two timeout extension pages into one. The guide and the example page covered the same things twice. (#3520) @​olamy
  • Drop the Source Xref menu items (#3479) @​slachiewicz

👻 Maintenance

🔧 Build

... (truncated)

Commits
  • 5bf0dcf [maven-release-plugin] prepare release surefire-3.6.1
  • 7f73580 Bump doxiaVersion from 2.1.0 to 2.2.0 (#3542)
  • ab7ce2f Bump org.testng:testng (#3539)
  • ff3b768 Group module path heuristics in ModulePathJpmsArguments (#3541)
  • a343e4d Fix IllegalAccessError when the main module requires JUnit (#3532) (#3538)
  • 907a2e2 Fix groups and excludedGroups being ignored when TestNG is on the classpath (...
  • cc69b3c Use push for PR Automation
  • b119019 Install the JUnit Platform provider for the ITs (#3535)
  • 2cdec2e Don't let runOrder replace JUnit orderers set elsewhere (#3529) (#3530)
  • 1e4f6b9 Use workflow_run for PR check (#3531)
  • Additional commits viewable in compare view

Updates org.liquibase:liquibase-core from 5.0.3 to 5.0.4

Release notes

Sourced from org.liquibase:liquibase-core's releases.

Liquibase v5.0.4

Liquibase Community 5.0.4 Release Notes

Liquibase Community v5.0.4 is a security-focused release: credentials are now redacted from error messages and logs, new opt-in lockdown flags let you restrict changelog features that execute code, and more than thirty fixes land across Oracle, PostgreSQL, MySQL and MariaDB, diff-changelog, and embedded use. Thanks to the twenty-three contributors who made their first contribution in this release!

Latest release: v5.0.4, August 20, 2026

Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly

Roadmap: Liquibase Community (view)

Thank you to every contributor who filed an issue, reviewed code, or submitted a fix.

New Contributors

What's in this release

Security

Release signing key rotated: The Liquibase release signing key was rotated following the revocation of the old key. GPG verification requires Liquibase Community 5.0.4 or later. Past releases are safe and untampered.

(#7737, #7738, #7740, #7756, #7739, #7746) by @​v-petrovych Database credentials are now redacted from error messages, logs, and stored parameters. If you pass a JDBC URL with embedded credentials (such as jdbc:postgresql://user:password@host/db) and the connection fails, the password no longer appears in the resulting error message or in log output. This covers unrecognized-driver errors and mistyped offline: URLs, and the URL sanitizer now handles PostgreSQL, SQL Server, and third-party JDBC drivers rather than only a few specific databases. Credential-bearing values captured from CLI arguments, liquibase.properties defaults files, and Maven plugin parameters are now masked before being stored internally. The init start-h2 example server also now prints ***** instead of the real password in its connection information banner. If you relied on copying the password from that output, use the value you configured instead (the default is letmein).

(#7741, #7742, #7743, #7764) by @​v-petrovych Passwords are cleared from memory once Liquibase is done with them. The CLI, the Maven plugin, and the Ant tasks now release password values as soon as the operation that needed them finishes. For Ant, clearing happens when the build finishes, so a shared <database> definition keeps working across multiple tasks in one build. This shortens the window in which a heap dump or memory inspection of a long-running JVM could expose your credentials. If you call Liquibase programmatically, CommandScope.execute() does not clear credentials automatically (so reusing one scope for several executions keeps working), and you can opt in by calling the now-public clearCredentialArguments() after your last execution.

(#7747, #7748, #7768, #7767, #7766, #7765, #7750) by @​v-petrovych New opt-in lockdown flags for changelog features that can execute code or reach outside your project. Several changelog features are intentionally powerful under Liquibase's standard trust model of team-authored, team-reviewed changelogs. If you run changelogs from less-trusted sources, you can now disable each of these features individually. Every flag defaults to true, so nothing changes unless you set it. When a flag is set to false, the offending element is rejected with a clear error that names the flag, before any of its code runs.

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase Community 5.0.4 is a minor patch release

See the Liquibase Community 5.0.4 Release Notes for the complete set of release information.

New Features

Bug Fixes

... (truncated)

Commits
  • 2c25134 Update changelog.txt for 5.0.4 (#7920)
  • 15a0885 [TECHOPS-1048] Gate DigiCert KeyLocker signing behind dry_run, drop from inst...
  • c7a01d5 chore(deps): bump the github-actions group with 5 updates (#7917)
  • 83e6a89 chore(deps): bump the test-deps group with 2 updates (#7916)
  • 59a7617 fix: emit valid timestamp with time zone syntax (#7808)
  • 0f1129f fix: scope per-database service cleanup so parallel Maven reactor builds no l...
  • e5ec227 fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting (#7...
  • 56c9dca chore(deps): bump org.apache.maven:apache-maven from 3.9.5 to 3.9.16 (#7914)
  • 5568a48 chore(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.2.0 to 3.3.4 ...
  • e3cc406 Fix the SonarCloud quality gate: suppress false-positive S3077 on two safely-...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 3…
794ef09 
… updates

Bumps the minor-and-patch group with 3 updates in the / directory: [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire), [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) and [org.liquibase:liquibase-core](https://github.com/liquibase/liquibase).


Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1)

Updates `org.liquibase:liquibase-core` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/liquibase/liquibase/releases)
- [Changelog](https://github.com/liquibase/liquibase/blob/main/changelog.txt)
- [Commits](liquibase/liquibase@v5.0.3...v5.0.4)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.liquibase:liquibase-core
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/minor-and-patch-bee6e81a08 branch from 2bd3662 to 794ef09 Compare October 30, 2026 23:43
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 30, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/minor-and-patch-bee6e81a08 branch October 30, 2026 23:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants