[TECHOPS-1304] Apply Alpine security patches at build time (#7999)

The alpine image ships libcrypto3/libssl3 3.5.7-r0, which carries 9 HIGH
CVEs (CVE-2026-14456, -14457, -18798, -54874, -63072, -63073, -63075,
-63076, -75803). All are fixed in 3.5.8-r0, which has been in the v3.24
package index for months.

No base image swap fixes this. Every candidate still ships 3.5.7-r0:

  alpine:3.24 / 3.24.1 / latest   3.5.7-r0  (3.24.1 is newest; no 3.25)
  alpine:edge                     3.5.7-r0
  eclipse-temurin:21-jre-alpine   3.5.7-r0

The fix exists only in the index, so `apk upgrade` is the sole route.
This stays inside the pinned 3.24 release and is not a dist-upgrade.

Docker's current best practices no longer advise against this, and
hadolint deleted both DL3005 (apt-get upgrade) and DL3017 (apk upgrade)
in 2023 and 2021 respectively, on the grounds that base images are
rebuilt too infrequently to deliver security updates on their own.

Verified locally on linux/amd64:

  before   9 HIGH (1 openssl + 8 lpm stdlib)
  after    8 HIGH (openssl row gone entirely)
  with lpm 0.3.7 (PR #7998)   0 HIGH

Image still runs: Liquibase 5.0.4, JRE 21.0.12, bash 5.3.9,
libcrypto3/libssl3 at 3.5.8-r0. Size 84.5 MB -> 87.2 MB.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Update changelog.txt for 5.0.4 (#7920)

* Update changelog.txt for 5.0.4

* * Fixed release notes url
* Removed 2 meaningless changes

Guard SqlChangeLogParser.generateId against null DB connection (#7719)

The buildInterimIdIndex path added in #7674 queries DATABASECHANGELOG
during changelog parsing. The inner try/catch wraps only
DatabaseException, missing the IllegalArgumentException thrown by
PreparedStatementFactory when database.getConnection() returns null
(offline mode, e.g. changelog-scope `checks run` against H2 generated
SQL with no --url).

Widen the inner catch from DatabaseException to Exception so the
fall-back-to-"raw" path triggers for any failure surfaced by the
history-service lookup. The "retries on transient failure" semantics
(via computeIfAbsent's no-cache-on-throw behavior) still apply for
both DatabaseException and IllegalArgumentException.

Test: SqlChangeLogParserTest gains "generateId falls back to 'raw'
when the index build throws a non-DatabaseException", which fails
on master (IllegalArgumentException escapes generateId) and passes
with this change.

Co-authored-by: Wesley Willard <wwillard@liquibase.com>

Update changelog.txt for 5.0.2 (#7583)

* Update changelog.txt for 5.0.2

* Update changelog.txt

* Fix grammar in clearCheckSums changelog entry

---------

Co-authored-by: rberezen <ruslan.berezenskyi@gmail.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

Update changelog for version 5.0.1 release

Updated version number from 5.0.0 to 5.0.1 in changelog.

Update readme with license information (#7308)

The README.txt in liquibase-dist/src/main/archive/licenses/oss/ was rewritten to clarify that it applies to Liquibase Community and now includes detailed descriptions and copyright information for each third-party library, grouped by license type. It also explains compliance with the GPL Classpath Exception and provides links to relevant source code repositories.

Merge remote-tracking branch 'origin/master' into release

improve error description for OSS

Add checkout step to re-version artifacts job

chore: update changelog for version 4.33.0 release with notable chang…

…es and enhancements + XSD file (#7091)

* chore: update changelog for version 4.33.0 release with notable changes and enhancements + XSD file

* chore: update changelog for version 4.33.0 release with notable changes and enhancements + XSD file