diff --git a/.github/scripts/release/get-release-tag-context.sh b/.github/scripts/release/get-release-tag-context.sh
index ff478019..9ab87e50 100755
--- a/.github/scripts/release/get-release-tag-context.sh
+++ b/.github/scripts/release/get-release-tag-context.sh
@@ -39,7 +39,7 @@ workflow_push_paths() {
 }
 
 main() {
-  local version release_type message tag_type previous_tag="" file_version changed="false" diff_output
+  local version release_type message tag_type previous_tag="" file_version changed="false" diff_output versioned="false"
   local -a patterns=() files=()
 
   if [[ ! "$TAG_NAME" =~ ^$TAG_PREFIX-([0-9]{8})$ ]]; then
@@ -81,7 +81,12 @@ main() {
     if [[ -n "$diff_output" ]]; then
       mapfile -t files <<< "$diff_output"
     fi
+    for pattern in "${patterns[@]}"; do
+      [[ "$pattern" == .version.* ]] && versioned="true"
+    done
     for file in "${files[@]}"; do
+      # a versioned package ships through its root .version.* file: its ci changes alone don't make a release
+      [[ "$versioned" == "true" && "$file" == .github/* ]] && continue
       for pattern in "${patterns[@]}"; do
         # unquoted pattern: glob match where * also spans /, so ** behaves like the workflow filter
         # shellcheck disable=SC2053
diff --git a/.github/scripts/release/release-new.sh b/.github/scripts/release/release-new.sh
index f50dd9bb..d604a12b 100755
--- a/.github/scripts/release/release-new.sh
+++ b/.github/scripts/release/release-new.sh
@@ -120,9 +120,65 @@ check_tags() {
     fail "release_number $RELEASE_NUMBER must be greater than latest release tag $latest."
   else
     info "previous release tag is $latest"
+    PREVIOUS_TAG="$latest"
   fi
 }
 
+# prints VERSION-RELEASE of a root .version.<package> file at a commit
+package_version() {
+  local content
+  content="$(git show "$1:$2")"
+  echo "$(sed -n 's/^VERSION=//p' <<< "$content")-$(sed -n 's/^RELEASE=//p' <<< "$content")"
+}
+
+# packages with a fixed version: "<root version file> <content pathspecs...>"; the version file must go up
+# when the content changed since the previous release tag, else the build would reuse a released version
+VERSIONED_PACKAGES=(
+  ".version.stream-connectors-lib modules/centreon-stream-connectors-lib packaging/connectors-lib"
+  ".version.lua-base64 dependencies/lua-base64"
+  ".version.lua-cffi dependencies/lua-cffi"
+  ".version.lua-lsqlite3 dependencies/lua-lsqlite3"
+  ".version.lua-openssl dependencies/lua-openssl"
+  ".version.lua-sql-mysql dependencies/lua-sql-mysql"
+  ".version.lua-tz dependencies/lua-tz"
+)
+
+check_version_bumps() {
+  local package version_file content_paths changed previous_version new_version missing=() unchecked=()
+  local -a content
+  [[ -n "${PREVIOUS_TAG:-}" ]] || return 0
+  git fetch --quiet --depth=1 "$REMOTE" "+refs/tags/$PREVIOUS_TAG:refs/tags/$PREVIOUS_TAG" \
+    || fail "cannot fetch $PREVIOUS_TAG."
+
+  for package in "${VERSIONED_PACKAGES[@]}"; do
+    read -r version_file content_paths <<< "$package"
+    read -ra content <<< "$content_paths"
+    git cat-file -e "$RELEASE_SHA:$version_file" 2> /dev/null || fail "$version_file does not exist on $RELEASE_BRANCH."
+    if ! git cat-file -e "refs/tags/$PREVIOUS_TAG:$version_file" 2> /dev/null; then
+      unchecked+=("$version_file")
+      continue
+    fi
+    changed="$(git -c core.quotePath=false diff --no-renames --name-only "refs/tags/$PREVIOUS_TAG" "$RELEASE_SHA" -- "${content[@]}")" \
+      || fail "cannot diff $PREVIOUS_TAG and $RELEASE_BRANCH."
+    [[ -n "$changed" ]] || continue
+    previous_version="$(package_version "refs/tags/$PREVIOUS_TAG" "$version_file")"
+    new_version="$(package_version "$RELEASE_SHA" "$version_file")"
+    # the version must go up: a forward-ported hotfix rebuilt under an older version would be refused or shadowed
+    if [[ "$new_version" == "$previous_version" ]] \
+      || [[ "$(printf '%s\n%s\n' "$previous_version" "$new_version" | sort -V | tail -n 1)" != "$new_version" ]]; then
+      missing+=("$version_file $previous_version -> $new_version ($(echo "$changed" | head -n 3 | paste -sd ' ' -))")
+    fi
+  done
+
+  if (( ${#unchecked[@]} > 0 )); then
+    warn "not checked, no version file in $PREVIOUS_TAG: ${unchecked[*]}"
+  fi
+  if (( ${#missing[@]} > 0 )); then
+    fail "content changed since $PREVIOUS_TAG without a higher version: ${missing[*]}"
+  fi
+  info "versions are bumped for every changed package"
+}
+
 create_tag() {
   info "tagging $RELEASE_SHA ($RELEASE_BRANCH) with $RELEASE_TAG: \"$RELEASE_TYPE $RELEASE_TAG\""
   run git -c user.name="Centreon" -c user.email="release@centreon.com" \
@@ -189,6 +245,7 @@ main() {
   check_branch
   check_versions
   check_tags
+  check_version_bumps
 
   create_tag
   create_github_release
diff --git a/.github/workflows/lua-base64.yml b/.github/workflows/lua-base64.yml
index a30166b5..41351247 100644
--- a/.github/workflows/lua-base64.yml
+++ b/.github/workflows/lua-base64.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-base64.yml'
+      - '.version.lua-base64'
       - 'dependencies/lua-base64/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-base64.yml'
+      - '.version.lua-base64'
       - 'dependencies/lua-base64/**'
 
 jobs:
@@ -80,6 +82,19 @@ jobs:
           cp base64-src/base64.lua dependencies/lua-base64/lbase64/base64.lua
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-base64)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-base64)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-base64 must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -87,8 +102,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: all
-          version: "1.5.3"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-base64-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/lua-cffi.yml b/.github/workflows/lua-cffi.yml
index a33549d3..4629e674 100644
--- a/.github/workflows/lua-cffi.yml
+++ b/.github/workflows/lua-cffi.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-cffi.yml'
+      - '.version.lua-cffi'
       - 'dependencies/lua-cffi/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-cffi.yml'
+      - '.version.lua-cffi'
       - 'dependencies/lua-cffi/**'
 
 jobs:
@@ -106,6 +108,19 @@ jobs:
           mv cffi-lua-src/build/cffi.so dependencies/lua-cffi/lua-cffi/
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-cffi)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-cffi)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-cffi must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -113,8 +128,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.2.4"
-          release: "2"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-cffi-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/lua-lsqlite3.yml b/.github/workflows/lua-lsqlite3.yml
index c88f2576..bdfa7213 100644
--- a/.github/workflows/lua-lsqlite3.yml
+++ b/.github/workflows/lua-lsqlite3.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-lsqlite3.yml'
+      - '.version.lua-lsqlite3'
       - 'dependencies/lua-lsqlite3/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-lsqlite3.yml'
+      - '.version.lua-lsqlite3'
       - 'dependencies/lua-lsqlite3/**'
 
 jobs:
@@ -98,6 +100,19 @@ jobs:
           gcc -O2 -fPIC -shared -o lsqlite3.so lsqlite3.c -DLSQLITE_VERSION='"${LSQLITE3_VERSION}"' $(pkg-config --cflags lua${LUA_VERSION}) $(pkg-config --cflags --libs sqlite3)
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-lsqlite3)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-lsqlite3)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-lsqlite3 must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -105,8 +120,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.9.7"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-lsqlite3-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/lua-openssl.yml b/.github/workflows/lua-openssl.yml
index 15b3d7ee..0d988086 100644
--- a/.github/workflows/lua-openssl.yml
+++ b/.github/workflows/lua-openssl.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-openssl.yml'
+      - '.version.lua-openssl'
       - 'dependencies/lua-openssl/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-openssl.yml'
+      - '.version.lua-openssl'
       - 'dependencies/lua-openssl/**'
 
 jobs:
@@ -111,6 +113,19 @@ jobs:
           cp lua-openssl-src/build/openssl.so dependencies/lua-openssl/lua-openssl/
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-openssl)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-openssl)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-openssl must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -118,8 +133,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.11.1"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-openssl-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/lua-sql-mysql.yml b/.github/workflows/lua-sql-mysql.yml
index b346aef8..c36cf31d 100644
--- a/.github/workflows/lua-sql-mysql.yml
+++ b/.github/workflows/lua-sql-mysql.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-sql-mysql.yml'
+      - '.version.lua-sql-mysql'
       - 'dependencies/lua-sql-mysql/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-sql-mysql.yml'
+      - '.version.lua-sql-mysql'
       - 'dependencies/lua-sql-mysql/**'
 
 jobs:
@@ -92,6 +94,19 @@ jobs:
           sed -i "s/@mysql_version@/${MYSQL_VERSION}/g" dependencies/lua-sql-mysql/packaging/lua-sql-mysql.yaml
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-sql-mysql)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-sql-mysql)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-sql-mysql must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -99,8 +114,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: rpm
           arch: amd64
-          version: "2.7.0"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-rpm-lua-sql-mysql-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/lua-tz.yml b/.github/workflows/lua-tz.yml
index feeeb9d4..3011e1b3 100644
--- a/.github/workflows/lua-tz.yml
+++ b/.github/workflows/lua-tz.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-tz.yml'
+      - '.version.lua-tz'
       - 'dependencies/lua-tz/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-tz.yml'
+      - '.version.lua-tz'
       - 'dependencies/lua-tz/**'
 
 jobs:
@@ -78,6 +80,19 @@ jobs:
         run: cp -r luatz-src/luatz dependencies/lua-tz/lua-tz
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-tz)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-tz)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-tz must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
@@ -85,8 +100,8 @@ jobs:
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: all
-          version: "0.5"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-tz-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}
diff --git a/.github/workflows/stream-connectors-lib.yml b/.github/workflows/stream-connectors-lib.yml
index 51cecc57..904d3fd6 100644
--- a/.github/workflows/stream-connectors-lib.yml
+++ b/.github/workflows/stream-connectors-lib.yml
@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/stream-connectors-lib.yml'
+      - '.version.stream-connectors-lib'
       - 'packaging/connectors-lib/**'
       - 'modules/centreon-stream-connectors-lib/**'
   push:
@@ -19,6 +20,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/stream-connectors-lib.yml'
+      - '.version.stream-connectors-lib'
       - 'packaging/connectors-lib/**'
       - 'modules/centreon-stream-connectors-lib/**'
 
@@ -69,13 +71,26 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.stream-connectors-lib)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.stream-connectors-lib)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.stream-connectors-lib must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "packaging/connectors-lib/*.yaml"
           distrib: ${{ matrix.distrib }}
-          version: "3.8.1" # previous version:"3.8.0"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           package_extension: ${{ matrix.package_extension }}
           arch: all
           commit_hash: ${{ github.sha }}
diff --git a/.github/workflows/stream-connectors.yml b/.github/workflows/stream-connectors.yml
index 6f2c901e..51276ceb 100644
--- a/.github/workflows/stream-connectors.yml
+++ b/.github/workflows/stream-connectors.yml
@@ -186,7 +186,7 @@ jobs:
 
       - name: Export package version
         id: package-version
-        run: echo "package_version=`date '+%Y%m%d'`" >> $GITHUB_OUTPUT
+        run: echo "package_version=$(tr -d '[:space:]' < .version.stream-connectors)" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Package
diff --git a/.version.lua-base64 b/.version.lua-base64
new file mode 100644
index 00000000..804a5b7e
--- /dev/null
+++ b/.version.lua-base64
@@ -0,0 +1,2 @@
+VERSION=1.5.3
+RELEASE=1
diff --git a/.version.lua-cffi b/.version.lua-cffi
new file mode 100644
index 00000000..25144734
--- /dev/null
+++ b/.version.lua-cffi
@@ -0,0 +1,2 @@
+VERSION=0.2.4
+RELEASE=3
diff --git a/.version.lua-lsqlite3 b/.version.lua-lsqlite3
new file mode 100644
index 00000000..832a6053
--- /dev/null
+++ b/.version.lua-lsqlite3
@@ -0,0 +1,2 @@
+VERSION=0.9.7
+RELEASE=1
diff --git a/.version.lua-openssl b/.version.lua-openssl
new file mode 100644
index 00000000..61fd0cb4
--- /dev/null
+++ b/.version.lua-openssl
@@ -0,0 +1,2 @@
+VERSION=0.11.1
+RELEASE=1
diff --git a/.version.lua-sql-mysql b/.version.lua-sql-mysql
new file mode 100644
index 00000000..b1127366
--- /dev/null
+++ b/.version.lua-sql-mysql
@@ -0,0 +1,2 @@
+VERSION=2.7.0
+RELEASE=1
diff --git a/.version.lua-tz b/.version.lua-tz
new file mode 100644
index 00000000..df5fe55d
--- /dev/null
+++ b/.version.lua-tz
@@ -0,0 +1,2 @@
+VERSION=0.5
+RELEASE=1
diff --git a/.version.stream-connectors-lib b/.version.stream-connectors-lib
new file mode 100644
index 00000000..4fd7e2d8
--- /dev/null
+++ b/.version.stream-connectors-lib
@@ -0,0 +1,2 @@
+VERSION=3.8.2
+RELEASE=1