load services using ServiceLocator if allInstances is empty

[yairogen]

Impact

• [x ] Bug fix (non-breaking change which fixes expected existing functionality)
• Enhancement/New feature (adds functionality without impacting existing logic)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

fixes issue #5142

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

100.0% Coverage
0.0% Duplication

[yairogen]

@filipelautert what do we need to do pass CodeQL?
how can we test this in our side?
if it works - when is the next planned release?

[filipelautert]

For anyone wanting to check, you can download the artifacts from here -> https://github.com/liquibase/liquibase/suites/17784962704/artifacts/1019195915

Or you can declare a new repository https://maven.pkg.github.com/liquibase/liquibase and use org.liquibase:liquibase-core:5143-copy-SNAPSHOT as the dependency, as below:

<dependency>
  <groupId>org.liquibase</groupId>
  <artifactId>liquibase-core</artifactId>
  <version>5143-copy-SNAPSHOT</version>
</dependency>

(I created this copy pr to get CodeQL running and to have the maven repo) .

For this you'll need a GitHub access token; see https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-gradle-registry#using-a-published-package)

@yairogen If it works fine please let me know and we can get it merged. We may have a release in ~1-2 weeks time.

[yairogen]

@filipelautert code ql failed.
Are you sure snapshot is available to test via the snapshot version and repo you provided?

[filipelautert]

@yairogen codeql passed here - #5144 . Currently it has a token problem when running for contributed PR's, but if a member opens the pr it works fine :/

And for the package, the instructions are from here: https://github.com/liquibase/liquibase/packages/1783578?version=5143-copy-SNAPSHOT

[npreisner]

Hi @filipelautert
Fix was tested and it works. We think it can be merged as is.
We would really appreciate if the release could be ready ASAP.
As per our security team - can you please validate there are no new vulnerabilities (CVE) introduced in the next release since that was our initial reason for upgrade (i.e. our current 3/x version has quite a few CVE issues).

regards,
Natan

[yairogen]

@filipelautert thanks for the merge. when can we expect official release?