PackageTrack

Maven Central · #927 by repository stars

org.liquibase:liquibase-core

5.0.4liquibase/liquibase ↗

Liquibase is a tool for managing and executing database changes.

Release timeline

144 releases since 2007
20072026

One column per quarter.

Releases

  1. 5.0.420 Aug 2026
    Release notes

    Liquibase Community 5.0.4 Release Notes

    Liquibase Community v5.0.4 is a security-focused release: credentials are now redacted from error messages and logs, new opt-in lockdown flags let you restrict changelog features that execute code, and more than thirty fixes land across Oracle, PostgreSQL, MySQL and MariaDB, diff-changelog, and embedded use. Thanks to the twenty-three contributors who made their first contribution in this release!

    Latest release: v5.0.4, August 20, 2026

    Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly

    Roadmap: https://github.com/orgs/liquibase/projects/3/views/9?layout=board

    Thank you to every contributor who filed an issue, reviewed code, or submitted a fix.

    New Contributors

    What's in this release

    Security

    Release signing key rotated: The Liquibase release signing key was rotated following the revocation of the old key. GPG verification requires Liquibase Community 5.0.4 or later. Past releases are safe and untampered.

    (#7737, #7738, #7740, #7756, #7739, #7746) by @v-petrovych Database credentials are now redacted from error messages, logs, and stored parameters. If you pass a JDBC URL with embedded credentials (such as jdbc:postgresql://user:password@host/db) and the connection fails, the password no longer appears in the resulting error message or in log output. This covers unrecognized-driver errors and mistyped offline: URLs, and the URL sanitizer now handles PostgreSQL, SQL Server, and third-party JDBC drivers rather than only a few specific databases. Credential-bearing values captured from CLI arguments, liquibase.properties defaults files, and Maven plugin parameters are now masked before being stored internally. The init start-h2 example server also now prints ***** instead of the real password in its connection information banner. If you relied on copying the password from that output, use the value you configured instead (the default is letmein).

    (#7741, #7742, #7743, #7764) by @v-petrovych Passwords are cleared from memory once Liquibase is done with them. The CLI, the Maven plugin, and the Ant tasks now release password values as soon as the operation that needed them finishes. For Ant, clearing happens when the build finishes, so a shared <database> definition keeps working across multiple tasks in one build. This shortens the window in which a heap dump or memory inspection of a long-running JVM could expose your credentials. If you call Liquibase programmatically, CommandScope.execute() does not clear credentials automatically (so reusing one scope for several executions keeps working), and you can opt in by calling the now-public clearCredentialArguments() after your last execution.

    (#7747, #7748, #7768, #7767, #7766, #7765, #7750) by @v-petrovych New opt-in lockdown flags for changelog features that can execute code or reach outside your project. Several changelog features are intentionally powerful under Liquibase's standard trust model of team-authored, team-reviewed changelogs. If you run changelogs from less-trusted sources, you can now disable each of these features individually. Every flag defaults to true, so nothing changes unless you set it. When a flag is set to false, the offending element is rejected with a clear error that names the flag, before any of its code runs.

    • Set liquibase.allowExecuteCommand=false to reject the executeCommand change, which runs OS shell commands.
    • Set liquibase.allowCustomChange=false to reject both customChange and customPrecondition, which load and run Java classes named in the changelog.
    • Set liquibase.allowSqlPrecondition=false to reject the sqlCheck precondition, which executes raw SQL during precondition evaluation.
    • Set liquibase.allowIncludeAllClasses=false to reject the resourceFilter and resourceComparator attributes of includeAll, which also load Java classes by name.
    • Set liquibase.allowExternalChangelogPaths=false to reject classpath: and absolute filesystem paths in include, includeAll, and sqlFile. Paths using relativeToChangelogFile="true" are always allowed, and the default keeps Spring Boot's classpath:db/changelog/... pattern working unchanged.
    • Set liquibase.allowParentDirectoryReferences=false to enforce strict path containment, rejecting .. path segments and symlinks that resolve outside your configured search path. The default of true preserves existing layouts that reference files one level up. A future major release plans to flip this default to false, so consider testing with the strict setting now.

    (#7729) by @v-petrovych Changelog XML no longer accepts DOCTYPE declarations under secure parsing. With liquibase.secureParsing=true (the default), an XML changelog that carries a <!DOCTYPE ...> preamble is now rejected, closing an avenue for XML entity tricks to read files through the changelog parser. Liquibase changelogs validate against XSD, not DTD, so standard changelogs are unaffected. If a third-party changelog fails with a DOCTYPE error, remove the DOCTYPE preamble from the file.

    (#7892) by @SvampX Fixed a reflected cross-site scripting vulnerability in the status servlet. The embedded status page previously wrote the request URL and logged messages into its HTML without escaping, so a crafted link could inject script into the page. The log-level links are now relative, and log messages and stack traces are HTML-escaped, which also fixes messages containing markup being rendered instead of displayed as text. The same change fixes several cases where Liquibase reported a NullPointerException instead of a meaningful error.

    ##Notable improvements

    (#7650) by @filipelautert with @Copilot Opt in to strict context matching with the new nocontexts pseudo-context. Changesets that declare a context expression have always run even when no --contexts value is supplied at runtime, which many users find surprising. You can now write context="!nocontexts AND mycontext" to make a changeset run only when a runtime context is actually provided, or context="nocontexts OR fallback" to target runs where no contexts were given. Existing changelogs are unaffected unless they use nocontexts as a real context name, which is now a reserved word.

    (#7759, #7827) by @Khromushkin and @KushnirykOleh PostgreSQL: partitioned tables keep their PARTITION BY clause. generate-changelog and diff-changelog silently dropped the partition strategy from declaratively partitioned tables, so applying the generated changelog produced a plain, non-partitioned copy of the source table. The partition definition is now captured in a new partitionBy attribute on createTable (for example partitionBy="RANGE (created_at)"), carried through diffs, and applied on update. You can also write the attribute in handwritten changelogs. The catalog query behind this is skipped on Amazon Redshift and other engines older than PostgreSQL 10, which do not have the needed system tables.

    (#7841) by @SvampX Configure the reference connection separately in diff and diff-changelog. Two-connection commands previously resolved every configuration setting identically for the target and reference connections. Configuration settings that opt in can now be given a different value for the reference connection through a <namespace>.reference.<suffix> sibling key. When the sibling key is unset, the reference connection inherits the primary value, so existing setups behave exactly as before. This primarily enables database extensions to support different authentication methods for the target and reference databases. See Use different authentication for the reference database for the documentation.

    (#7522) by @Vampire New no-argument listUnexpectedChangeSets() method. When embedding Liquibase in Java, the Liquibase class now offers listUnexpectedChangeSets() with no arguments, consistent with methods like validate() and update().

    (#7850) by @makssent Firebird: RedDatabase servers are now recognized. RedDatabase, a Firebird-compatible fork, reports its own product name, so Liquibase treated it as an unsupported database and generated generic SQL that the server rejected when creating the tracking tables. Liquibase now detects RedDatabase as Firebird, so update and other commands work out of the box. Existing changelogs with dbms="firebird" apply as-is.

    (#7847) by @edu1006 Extension authors: LockService methods can now throw any LiquibaseException. The throws clauses of LockService.init(), destroy(), and forceReleaseLock() were widened from DatabaseException to LiquibaseException, so custom lock services can propagate typed exceptions without wrapping them. The change is binary compatible and existing implementations compile unchanged. Only callers that catch exactly DatabaseException from these methods need to widen their catch block.

    (#7900) by @SvampX The CLI banner now points to Liquibase Secure. The two informational lines in the startup banner now read "Taking Liquibase to production?" with a link to liquibase.com/liquibase-secure, replacing the documentation and training links.

    Fixes

    (#7876, #7877, #7909) by @filipelautert and @pwielgolaski Running Liquibase concurrently in one Java process is now reliable. Several long-standing thread-safety problems are fixed. Threads that never inherited Liquibase's initialization state, such as pool threads created before Liquibase started, could fail with "not a subtype" service-loading errors. Parallel command executions shared internal command state and configuration values, so one execution could pick up another's arguments. And multi-module Maven builds run in parallel with -T could read a sibling module's changelog state or fail with Cannot execute commands against an offline database. Multithreaded embedders, parallel executions, and parallel Maven reactors now each keep their own state.

    (#7825) by @om7057 Log context data is cleaned up per thread. When embedding Liquibase in a multithreaded application, structured logging data added by one thread could be wiped when another thread exited a shared scope, leaving stale values permanently attached to the logging context. Each thread now tracks and cleans up its own entries.

    (#7869) by @renechoi Checksums are always calculated for the requested checksum version. A changeset cached its first generated checksum and returned it for every later request, even when a different checksum version was asked for, so the returned checksum could carry the wrong version number with no error or log message. Requesting a checksum for a specific version now recalculates when the cached value was built for a different version.

    (#7896) by @hutiefang76 An update after a rollback in the same process is no longer skipped. Liquibase caches a successful up-to-date check for the lifetime of the Java process. After a rollback, that stale cached result could make the next update report the database as already up to date and skip the rolled-back changesets. The cache is now invalidated whenever a rollback command finishes.

    (#7886) by @om7057 No more spurious "could not release lock" messages from update commands. Commands such as update-count, update-sql, and update-to-tag attempted to release the changelog lock even though the command pipeline had acquired it, so the lock was released twice and Liquibase printed a "could not release lock" message. The lock is now released only by the code that acquired it.

    (#7704) by @officialasishkumar includeAll no longer fails when older tracking data lacks a stored changelog path. When tracking data was written by an older Liquibase version or an extension that does not record a separate stored changelog path (reported with the MongoDB extension when using logicalFilePath), comparing file paths failed with a NullPointerException. Liquibase now falls back to the changelog path when the stored path is missing.

    (#7696) by @mgustimz dbms-filtered changelog properties resolve correctly with user-provided changelog parameters. When embedding Liquibase and passing your own ChangeLogParameters through CommandScope, the database filter was never set, so properties restricted to other databases via dbms matched incorrectly and the fallback property without a dbms filter was skipped. The filter is now set from the actual database.

    (#7697) by @mgustimz No more NullPointerException when a JDBC driver returns no URL. Some drivers, such as the IBM Informix 15.0.1.0 driver, return null from DatabaseMetaData.getURL(). Database detection then crashed with a NullPointerException, even when connecting to unrelated databases. A null URL is now handled safely.

    (#7643) by @filipelautert Sequence attributes are validated as integers by the XSD. The startValue, incrementBy, maxValue, minValue, and cacheSize attributes on sequence changes accepted any string during XML validation and then failed at runtime with NumberFormatException. They now validate as integers or ${property} expressions, so mistakes are caught early with a clear validation error naming the attribute.

    (#7798) by @Akshatsharma2205 Grouped context expressions with commas are evaluated correctly. A context expression such as (a,b,c) AND a was split on every comma into invalid fragments, so an unrelated runtime context like b could incorrectly match. Commas inside parentheses are no longer treated as top-level separators, while top-level comma lists behave as before.

    (#7831) by @yosimasu --output-default-schema and --output-default-catalog are honored by SQL output commands. Setting either flag to false on update-sql, rollback-sql, changelog-sync-sql, future-rollback-sql, and the other SQL output commands had no effect, and generated SQL always qualified objects in the default schema. The flags now work as documented, so objects in the default schema are left unqualified when you set them to false.

    (#7835) by @hutiefang76 Formatted SQL preconditions display your custom failure messages. In formatted SQL changelogs, the onFailMessage and onErrorMessage attributes were recognized but never applied, so precondition failures always showed the generated default message. Your custom messages now appear, including messages containing spaces and apostrophes.

    (#7866) by @sakshichitnis27 The database URL can come from --driver-properties-file. As documented, JDBC connection properties including url can be supplied through --driver-properties-file, but commands still failed with Invalid argument '--url': missing required argument unless a URL was also configured elsewhere. A url in the driver properties file now satisfies the requirement. An explicitly configured URL still takes precedence.

    (#7812) by @seonwooj0810 JDBC statements are closed during snapshots. Result sets obtained from database metadata calls during snapshot operations were closed without closing the statement that produced them, leaking JDBC statements until the connection closed. Users of connection pools saw leak warnings. Both are now closed together.

    (#7848) by @kamilkrzywanski Liquibase starts even when an extension has a missing optional dependency. On newer JDKs, a single extension service referencing a missing class (for example the liquibase-hibernate Spring integration without Spring on the classpath) could abort service discovery entirely and stop Liquibase from starting. The broken provider is now logged and skipped, and the remaining services load normally.

    (#7845) by @SvampX Extensions with the same priority no longer silently replace each other. When two configuration value modifiers or table-name generators declared the same order value, only one was kept and the rest were silently discarded. With a secrets-manager extension this could mean a vault reference reached the database as a literal string, with no error. Same-order plugins now coexist and all run, in a deterministic order.

    (#7882) by @fudianchn customChange parameters with acronym names work again. Since 4.29.0, param elements whose name is an uppercase acronym such as URL or GET were silently dropped instead of being passed to the matching setURL-style setter. Acronym property names are now resolved following the JavaBeans convention, restoring the earlier behavior. Regular camelCase parameters are unaffected.

    (#7566) by @jstastny loadUpdateData handles text values with spaces and braces quietly. When a value destined for a large text column looked like a file path but contained spaces, Liquibase logged a misleading warning with a full stack trace even though the value was inserted correctly as a string, and values containing { or } failed with an IllegalArgumentException. The warning is now a debug-level message and such values load cleanly.

    (#7884) by @wwillard7800 The deprecated AWS extension warning goes to stderr. The startup warning about deprecated standalone AWS extensions was printed to standard output, where it could pollute captured command output. It now goes to standard error, following the usual convention for diagnostics.

    (#7910) by @wwillard7800 Changeset failures are reported once, not twice. A failing changeset was logged with its full stack trace and then rethrown and reported again, so the same error appeared twice, and under quiet logging configurations the stack trace still flooded the console. The failure is now reported once, with the full stack trace still available at verbose log levels.

    (#7801, #7898) by @ET-TOUNANI and @filipelautert diff-changelog orders new columns before the foreign keys that need them. In some cases, reported on SQL Server, the generated changelog placed an addForeignKeyConstraint change before the addColumn change that creates the referenced column, so applying it failed. Column additions on existing tables now stay ahead of dependent foreign keys, while columns belonging to tables the same changelog creates correctly remain inside their createTable.

    (#7881) by @fudianchn diff-changelog no longer fails when a changed index backs a primary key or unique constraint. Comparing databases whose primary key or unique constraint column order differs crashed with ClassCastException: Index cannot be cast to PrimaryKey. The comparison now completes, and the generated changelog still drops and recreates the constraint using each database's own constraint name.

    (#7897) by @filipelautert Offline diff-changelog no longer duplicates primary key changes. When comparing offline snapshots of tables whose composite primary key differs only in column order, the generated changelog contained the dropPrimaryKey and addPrimaryKey pair twice. Offline comparisons now produce the same changesets as online ones.

    (#7834) by @Devansh-ops Oracle: q-quoted string literals no longer break statement splitting. Oracle q and nq alternative-quoted literals containing embedded quotes or backslashes confused statement parsing in sqlFile changes, so standalone / delimiters were absorbed and multiple statements were sent to the database as a single statement. These literals are now recognized as single tokens, and statements split correctly.

    (#7641) by @filipelautert Oracle: the current date-time function now uses the session time zone. Liquibase generated SYSTIMESTAMP for the current date-time function, which returns the time in the database server's operating system time zone. It now generates CURRENT_TIMESTAMP, which respects the session time zone, matching what changelog authors expect. If you relied on the operating system time zone behavior, generated timestamps will change.

    (#7808) by @marchof Oracle: TIMESTAMP WITH TIME ZONE columns are captured correctly again. A regression caused snapshots to miss the time zone qualifier on Oracle columns reported as TIMESTAMP(6) WITH TIME ZONE(13), so generated changelogs lost the time zone information and could emit invalid syntax. The qualifier is now detected and emitted correctly.

    (#7645) by @filipelautert Oracle: the primaryKeyExists precondition respects the primary key name. Checking for a primary key by name on Oracle matched any primary key on the table, so the precondition passed even when the named key did not exist. The name is now checked.

    (#7803) by @felhag PostgreSQL: defaultSchemaName applies to changesets with runInTransaction="false". Liquibase set the default schema using SET LOCAL SEARCH_PATH, which only lasts for the current transaction, so changesets running outside a transaction ignored the configured default schema. LOCAL is now used only when the changeset runs inside a transaction.

    (#7705) by @officialasishkumar MySQL: timestamp definitions keep their column attributes. Native timestamp column definitions that included attributes such as NOT NULL, DEFAULT CURRENT_TIMESTAMP, or ON UPDATE CURRENT_TIMESTAMP had those attributes dropped during type normalization. They are now preserved, while plain timestamp and precision-only forms continue to normalize as before.

    (#7708) by @pranithreddym MySQL: boolean columns map to TINYINT(1) instead of BIT(1). The MySQL driver reports TINYINT(1) columns as BIT, so snapshots wrote BIT(1) into changelogs, fresh deployments created the wrong column type, and every later generate-changelog reported a spurious diff. Boolean types on MySQL now always emit TINYINT(1), the canonical MySQL boolean representation. Use the explicit bit type if you genuinely need BIT(n). MariaDB behavior is unchanged. See What support does Liquibase have for MySQL? for the full type-handling history.

    (#7725) by @singhvishalkr MySQL/MariaDB: enum columns with DEFAULT NULL no longer produce defaultValue="null". Running generate-changelog on an enum column with DEFAULT NULL emitted the literal string "null" as the default value. The driver's "NULL" string is now treated as an actual null, matching the existing Oracle and DB2 handling, so no defaultValue attribute is emitted.

    (#7560) by @profiluefter MySQL/MariaDB: the reserved keyword lists are up to date. Reserved words missing from the lists, such as PARALLEL and, on MariaDB, OFFSET, were not quoted in generated SQL, causing errors when object names collided with them. The lists now match the current MySQL and MariaDB documentation, including per-version differences, and words that are not actually reserved are no longer quoted unnecessarily.

    Security, driver and other updates

    PR Description
    #7718 chore(deps): Bump org.slf4j:slf4j-jdk14 from 2.0.17 to 2.0.18
    #7732 chore(deps): Bump targetMavenVersion from 3.9.15 to 3.9.16
    #7734 chore(deps): Bump test-deps group with 4 updates
    #7731 chore(deps-dev): Bump maven-enforcer-plugin from 3.6.2 to 3.6.3
    #7773 chore(deps): Bump build-tools group with 3 updates
    #7772 chore(deps-dev): Bump production-deps group with 2 updates
    #7762 chore(deps): Bump github-actions group with 7 updates
    #7787 chore(deps): Bump github-actions group with 2 updates
    #7790 chore(deps): Bump spring.version from 7.0.7 to 7.0.8
    #7802 chore(deps-dev): Bump build-tools group with 5 updates
    #7797 chore(deps): Bump alpine from 3.23 to 3.24 in /docker
    #7792 Update LPM to v0.3.5
    #7818 chore(deps): Bump junit-jupiter.version from 6.1.0 to 6.1.1
    #7817 chore(deps): Bump test-deps group with 4 updates
    #7819 chore(deps): Bump github-actions group with 8 updates
    #7805 chore(deps-dev): Bump org.apache.ant:ant-antunit from 1.4.1 to 1.5.0
    #7837 chore(deps): Bump junit-jupiter.version from 6.1.1 to 6.1.2
    #7839 chore(deps): Bump test-deps group with 4 updates
    #7844 chore(deps): Bump github-actions group with 11 updates
    #7849 chore(deps): Bump build-tools group with 3 updates
    #7867 chore(deps): Bump flatten-maven-plugin from 1.7.3 to 1.8.0
    #7865 chore(deps-dev): Bump maven-bundle-plugin from 6.0.2 to 6.1.0
    #7855 chore(deps): Bump github-actions group with 6 updates
    #7853

    Note truncated.

    Open source →
    Additional notes

    Liquibase v5.0.4 Latest

    Latest

    Compare

    Choose a tag to compare

    Open source →
  2. 5.0.315 May 2026
    Release notes

    Liquibase Community 5.0.3 Release Notes

    Liquibase Community v5.0.3 is a focused release: two security fixes, a handful of database-specific bug fixes across Oracle, PostgreSQL, and MSSQL, and a thread safety improvement for teams running Liquibase in multitenant environments. Thanks to the ten community contributors who made it happen!

    Latest release: v5.0.3, May 15, 2026: https://www.liquibase.com/download-community
    Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly
    Next planned release: August 20, 2026
    Roadmap: https://github.com/orgs/liquibase/projects/3/views/9?layout=board

    Thank you to every contributor who filed an issue, reviewed code, or submitted a fix. Your work makes each Liquibase Community release stronger than the last.

    What's in this release

    Security

    (#7689) by @abrackxInput sanitization for generate-changelog: Closes two reported vulnerabilities.

    Thanks to @FORIMOC, @Yuremin, and @invoke1442 for the reports.

    Notable improvements

    (#7647) by @harsh-kaushal PostgreSQL: Sequence discovery is more accurate: The sequence metadata query now uses a LEFT JOIN instead of NOT IN, improving handling of SERIAL and IDENTITY columns in complex ownership scenarios. Note: columns decoupled from their sequence after creation may still appear as autoIncrement="true" in generated changelogs. A follow-up fix is tracked separately.

    (#1944) by @MatrixDai MSSQL: systranschemas excluded from diff output: This system view was being flagged as a missing or unexpected table during diff. It's now correctly treated as a system object and filtered out.

    (#7674) by @andrewcedgar perf: cache ranChangeSets lookup in SqlChangeLogParser.generateId: Performance improvements in SqlChangeLogParser by building the lookup once per Database as a Map<changeLog, interimId> and reuse it for every subsequent file. Total work becomes O(M+N) and the per-file cost returns to ~O(1).

    (#7674) by @andrewcedgar Fixed a performance regression that caused SQL changelog parsing to slow significantly on large projects

    SQL changelog parsing became significantly slower starting in 4.32.0. On projects with thousands of SQL changelog files and a large DATABASECHANGELOG history, parse time could increase from roughly 3 minutes to over 15 minutes compared to 4.31.1. This is a performance-only fix, your changelogs will parse and execute exactly as before, just faster.

    Users with large SQL changelog sets should see parse times return to pre-4.32.0 levels after upgrading.

    New parameter: --diff-column-default-value-constraint-name: Set to false to ignore auto-generated constraint names on column defaults during diff. Prevents false diffs in SQL Server environments where default value constraints are named differently across databases. Default: true.

    Fixes

    (#7660) by @sayaliM0412 Default branch is now main: Development snapshots are now published as main-SNAPSHOT; contributors should target main for new pull requests.

    (#1964, #7680) by @MatrixDai and @wwillard7800 Improved handling of MSSQL view definitions across two fixes: false positive diffs from inconsistent SQL Server version formatting are resolved, and schema qualifiers are now correctly preserved in generated changelogs.

    • (#1964) In Microsoft SQL Server, Liquibase incorrectly reported views as changed when comparing two databases, even when the view definitions were identical. This occurred because different SQL Server versions format view definitions differently (with or without schema prefixes and brackets). Liquibase now normalizes view definitions before comparing them, eliminating false positives in diff output.
    • (#7680) Continued improvement from the initial #1964: generate-changelog now correctly preserves schema qualifiers in MSSQL view definitions. View definitions are now normalized only during comparison, so diffs remain accurate and generated changelogs retain the original [schema].[view] qualifier.

    (#7603) by @filipelautert DATABASECHANGELOGLOCK hanging on multithreaded services: A failed cleanup left recycled threads in pooled environments in an incorrect locked state, causing unexpected errors during subsequent operations. Liquibase now correctly cleans up lock state after a command finishes, even if an error occurs during cleanup. This prevents unexpected lock errors on subsequent operations in environments that reuse threads, such as connection pools.

    (#7488) by @MalloD12 PostgreSQL with PgBouncer: fixed leaks in transaction pooling mode:
    When using Liquibase with PostgreSQL behind PgBouncer in transaction pooling mode, database schema settings applied by Liquibase could leak into other applications sharing the same connection pool, causing unexpected behavior. Liquibase now properly scopes these settings to individual transactions, preventing any interference with other services.

    (#7659) by @filipelautert Oracle: Columns that begin with “int” caused errors in diff-changelog commands: Columns with names that start with “int”, like internalPhoneNumber and integration_type, were causing diff-changelog to report inaccurately. Fixed with exact matching on int and integer only.

    (#7542) by @marchof Oracle: FLOAT column precision is back in snapshots: For Oracle databases, float column precision was incorrectly ignored during diff operations due to a regression introduced in a previous release. This could result in inaccurate diff output or generated changelogs missing float precision changes.

    (#7646) by @filipelautert Improved logging support: When using Liquibase as an embedded library (such as in a Spring Boot application), some log messages generated during startup bypassed your application's configured logging framework and were handled by Java's built-in logging instead. This could result in missing log output or unexpected warnings, particularly for users on Log4j 2.25+. All Liquibase log output now routes through your configured logging framework from the start.

    (#7500) by @MalloD12 diff-changelog uses the right constraint name in DROP statements: When databases have differently named constraints, generated DROP statements now use the target database's name rather than the reference database's, so changelogs actually apply cleanly. Covers foreign keys, indexes, primary keys, and unique constraints.

    Security, driver and other updates

    PR Description
    #7699 chore(deps-dev): Bump net.snowflake:snowflake-jdbc from 4.1.0 to 4.2.0
    #7695 chore(deps): Bump test-deps group with 2 updates
    #7691 chore(deps-dev): Bump org.xerial:sqlite-jdbc from 3.53.0.0 to 3.53.1.0
    #7692 fix(TECHOPS-365): Pin Docker base image to temurin:21-jre-noble
    #7688 chore(deps-dev): Bump production-deps group with 2 updates
    #7677 chore(deps): Bump eclipse-temurin from 21-jre-noble to 25-jre-noble in /docker
    #7664 chore(deps): Bump production-deps group with 6 updates
    #7658 chore(deps): Bump production-deps group with 8 updates
    #7681 chore(deps-dev): Bump build-tools group with 3 updates
    #7635 chore(deps-dev): Bump build-tools group with 4 updates
    #7678 chore(deps): Bump github-actions group with 5 updates
    #7657 chore(deps): Bump github-actions group with 10 updates
    #7579 chore(deps): Bump github-actions group with 3 updates
    #7670 chore(deps): Bump org.testcontainers:testcontainers-bom from 2.0.4 to 2.0.5
    #7621 chore(deps): Bump org.testcontainers:testcontainers-bom from 2.0.3 to 2.0.4
    #7671 chore(deps): Bump org.projectlombok:lombok from 1.18.44 to 1.18.46
    #7606 chore(deps): Bump org.projectlombok:lombok from 1.18.42 to 1.18.44
    #7672 chore(deps): Bump commons-io:commons-io from 2.21.0 to 2.22.0
    #7662 chore(deps): Bump targetMavenVersion from 3.9.14 to 3.9.15
    #7613 chore(deps): Bump targetMavenVersion from 3.9.13 to 3.9.14
    #7601 chore(deps): Bump targetMavenVersion from 3.9.12 to 3.9.13
    #7656 chore(deps): Bump ant.version from 1.10.15 to 1.10.17
    #7652 chore(deps): Bump jakarta.servlet:jakarta.servlet-api from 5.0.0 to 6.0.0
    #7636 chore(deps): Bump javax.servlet:javax.servlet-api from 3.1.0 to 4.0.1
    #7614 chore(deps): Bump spring.version from 7.0.5 to 7.0.6
    #7626 chore(deps-dev): Bump test-deps group with 2 updates
    #7608 chore(deps-dev): Bump org.mockito:mockito-core from 5.22.0 to 5.23.0
    #7576 chore(deps-dev): Bump org.mockito:mockito-core from 5.21.0 to 5.22.0
    #7578 chore(deps): Bump org.yaml:snakeyaml from 2.5 to 2.6
    #7577 chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.0.2
    #7586 chore(deps): Bump build-tools group with 2 updates
    #7628 DAT-22652: Pin GitHub Actions to commit SHAs for supply chain security
    #7610 chore(deps): Upgrade testcontainers to 2.0.3

    Docker Images

    The following Docker images were published for this release:

    • liquibase/liquibase:5.0.3
    • liquibase/liquibase:5.0
    • liquibase/liquibase:latest
    • liquibase/liquibase:5.0.3-alpine
    • liquibase/liquibase:5.0-alpine
    • liquibase/liquibase:alpine
    Open source →
    Additional notes

    Liquibase v5.0.3

    Compare

    Choose a tag to compare

    Open source →
  3. 5.0.25 Mar 2026
    Release notes

    5.0.2 Liquibase Community Release Notes

    Liquibase Community v5.0.2 is here, with contributions from developers around the globe. This release includes a range of bug fixes across multiple database platforms along with several quality-of-life enhancements, with 19 contributors coming together to continue improving Liquibase for the entire community.

    At Liquibase, we believe great database change management starts with a community that can rely on a predictable and transparent release process. To support this commitment, and starting with version 5.0.2, we are providing two clear ways for the community to access updates and improvements:

    • Main Branch Builds on GitHub
      – Main branch builds are continuously published on GitHub, offering early access to the latest improvements and fixes as they are developed. These builds enable the community to test upcoming capabilities and provide feedback ahead of the next official release. Learn more on our GitHub README

    • Quarterly Community Releases
      – Liquibase Community updates are released on a quarterly cadence (every second month of each calendar quarter) providing stable, production-ready versions that allow teams to plan upgrades and maintenance with confidence. These releases are available through all standard distribution channels, including GitHub, Maven Central, package managers, container registries, and other official Liquibase Community distribution locations.

    Together, these options ensure that teams can choose the path that best fits their needs - whether prioritizing stability through scheduled releases or engaging early with the latest innovations in Liquibase.

    A huge thank you to every contributor who filed an issue, submitted a pull request, or helped review code. You are the engine that drives Liquibase forward.

    What’s in this release

    Notable improvements

    (#7451) by @MalloD12 New: Added the ALLOW_INHERIT_LOGICAL_FILE_PATH global configuration property, which controls whether included changelogs inherit the logicalFilePath of their parent changelog when no explicit logicalFilePath is set.

    (#6627 and #7390) by @mkarg Improved: Custom change classes that cannot be found on the classpath no longer automatically fail the entire changelog. Liquibase now honors failOnError: false at the changeset level when the failure is caused by a missing custom change class. Additionally, a failing precondition with onFail="MARK_RAN" is now respected when the custom change class is not on the classpath.

    (#7479) Improved Cassandra compatibility: Refactoring to enable third-party extensions like liquibase-cassandra to provide database-specific implementations and laying the groundwork for a future fix for CQL incompatibility errors.

    Liquibase Community 5.0.2 moves more community repositories to the Functional Source License (FSL). See our FSL blog for details.

    Performance improvements

    (#7439) Performance fix for analytics: @tati-qalified identified and resolved a performance degradation introduced with the analytics implementation. If you noticed Liquibase running slower since analytics was added, this is the fix you've been waiting for.

    (#7539) Build improvements: Groovy source compilation has been moved to the module level in liquibase-extension-testing, removing redundant build steps from the root configuration.

    Drivers and Dependencies

    (7528) Updated bundled JDBC driver versions: MSSQL to v13.2.1.jre11 and Firebird to v6.0.3

    (#7469) Dependency cleanup: Explicit exclusions added to liquibase-core pom.xml to fix duplicated commons-text dependency.

    Fixes

    (#7489) by @MalloD12 Resolved an issue where the maven-update command logged duplicate messages when using the Java API. Summary output now defaults to LOG instead of ALL, which previously caused messages to be written to both the console and the log simultaneously. This behavior can still be overridden by explicitly setting the showSummaryOutput argument.

    (#7395) by @Parthiee Invalid or empty changelog file paths are now caught and rejected during serialization

    Liquibase now validates that changelog file paths are properly defined and non-empty when serializing changelog configurations. Previously, incomplete or missing paths could pass through silently, resulting in invalid configurations.

    (#7378) Defensive null check: Improved stability Fixed 16 null pointer exceptions across analytics, database connections, commands, changelog processing, and schema operations, reducing the risk of unexpected crashes in edge cases. All changes were validated against 5,805 passing tests. (#7378)

    (#7501) by @HorbatenkoYehor Resolved a SQL syntax error that caused setColumnRemarks to fail on Snowflake during validation.

    The error occurred when columnParentType was not explicitly set, preventing Liquibase from correctly determining whether the target object was a table or view.

    (#7452) by @peteraisher Comments on a column or table, e.g. using Hibernate's @Comment annotation, were successfully detected by the database implementation, but no diff was generated when a comment was changed.

    This change adds a check for changed comments on a column or table, allowing the existing functionality for creating diff commands to work as expected by @peteraisher

    (#7483) by @Folgerjun Snapshots were truncated if the generated snapshot size exceeded the buffer size.

    This resulted in a truncated and invalid YAML/JSON file with missing closing braces or incomplete strings.

    (#7464) by @filipelautert renameColumn now respects columnDataType on MariaDB/MySQL

    Previously, if columnDataType was specified on a renameColumn change targeting MariaDB or MySQL, the type change was silently discarded when the database supported RENAME COLUMN syntax. The column was renamed correctly, but the data type was not updated. The fix ensures that when columnDataType is provided, Liquibase uses CHANGE syntax regardless of database version, so both the rename and the type change are applied as expected.

    (#7456) by @MalloD12 "Rows affected" count restored for custom SQL DML statements

    A regression introduced in 4.32.0 caused Liquibase to stop reporting the number of rows affected after each DML statement in the custom SQL changeset output, as was present in 4.31.1 and earlier. This has been resolved, and per-statement row counts are once again displayed during custom SQL execution.

    (#7417) by @MalloD12 Restored compatibility with Quarkus and dependent projects

    Upgrading from Liquibase 4.29.2 to 4.33.0 broke compatibility with Quarkus, which uses Liquibase for database schema migrations. This affected downstream projects such as Keycloak. This has been resolved, and Quarkus integrations should now function correctly across versions without requiring workaround code.

    (#7426) by @mkarg Reserved words used as tablespace names are now quoted correctly on MSSQL and SQL Anywhere

    When a tablespace name matched a reserved word, such as Index, Liquibase failed to quote it in the generated SQL for createIndex operations on MSSQL and SQL Anywhere, producing a syntax error and halting the migration. The fix ensures tablespace names are quoted correctly on both databases, allowing changesets that use reserved words as tablespace names to execute as expected.

    (#7448) by @mkarg Tablespace names containing spaces are now quoted correctly on MSSQL

    Following the fix for reserved-word tablespace names, a related gap was identified where tablespace names containing spaces were not reliably escaped on MSSQL. This has been resolved, ensuring consistent quoting behavior for tablespace names regardless of whether they contain spaces or match reserved Words.

    (#7425) by @mkarg addPrimaryKey now applies the specified constraint name on SQL Anywhere

    When using addPrimaryKey on SQL Anywhere, the constraintName attribute was being ignored in the generated SQL, causing the database to assign a random name to the primary key constraint instead of the one provided. The generated statement now includes the constraint name as expected. This release also adds support for the CLUSTERED and NONCLUSTERED keywords for primary keys on SQL Anywhere.

    (#7430) by @chadlwilson Liquibase no longer crashes on JDK 25 when SnakeYAML or OpenCSV are absent from the classpath

    A change in how JDK 24 and 25 handle missing optional dependencies caused Liquibase to throw a fatal error at startup if SnakeYAML or OpenCSV were not present, even when no YAML or JSON functionality was being used. Optional libraries are now loaded only when actually needed, so missing dependencies no longer cause a startup failure. If SnakeYAML or OpenCSV are absent and you do use functionality that requires them, the error will occur at the point of use rather than at startup. Note that SnakeYAML is still required if OSS analytics are enabled.

    (#7394) by @filipelautert The classpath property in liquibase.properties is now recognized again

    Since version 4.19.0, specifying classpath in liquibase.properties was silently ignored, causing
    "Cannot find database driver" errors when loading external JDBC drivers. Both the short form (classpath) and the official form (liquibase.classpath) are now recognized correctly. Existing
    configurations are unaffected.

    (#6639) by @Xstoudi referencedTableSchemaName is now respected in addColumn foreign key constraints

    When defining a foreign key constraint inside an addColumn change, the referencedTableSchemaName attribute was silently ignored, causing the generated SQL to omit the schema prefix on the referenced table. This could cause the constraint to point to the wrong table when the referenced table exists in a different schema. The schema is now correctly included in the generated SQL. The existing workaround of prefixing the schema directly on referencedTableName continues to work as a fallback.

    (#6929) by @MalloD12 Timestamp timezone column types now map correctly to TIMESTAMP WITH TIME ZONE on Oracle

    Several column type aliases intended to produce timezone-aware timestamp columns were not handled correctly on Oracle, either causing an error during table creation or silently creating a plain TIMESTAMP column without timezone support. These aliases now resolve to TIMESTAMP WITH TIME ZONE as expected.

    DevOps

    (#7537) by @jnewton03 Liquibase no longer throws a fatal error when the log service cannot be loaded in restricted environments

    In environments where classpath service discovery is unavailable or restricted, Liquibase would fail to initialize entirely, throwing an error about being unable to find a log service. Liquibase now falls back to its built-in logger in these cases and continues running normally, making it usable in a wider range of deployment environments.

    Community Spotlight

    This release features contributions from community members spanning four continents. Here are some of the standout contributors:

    Markus KARG (@mkarg) — Pforzheim, Germany

    Head Crashing Informatics · OpenJDK Author · JSR 339/370 Committer · Eclipse Member

    Markus is a seasoned open source veteran whose fingerprints are on some of Java's most foundational projects — Jersey, Jakarta REST, JCommander, and OpenJDK itself. In this release, he tackled database-specific edge cases that only deep expertise can uncover: fixing constraint name handling for SQL Anywhere PRIMARY KEYs (#7425), simplifying MSSQL escaping logic (#7448), and fixing unquoted tablespace names on MSSQL and SQL Anywhere (#7426). Three PRs, three different database platforms — that's range.

    Chad Wilson (@chadlwilson) — GoCD Maintainer

    ThoughtWorks · Primary Maintainer of GoCD

    Chad is the primary maintainer of GoCD, the open source CI/CD server, and a contributor to the JRuby ecosystem. His contribution this release is a forward-looking one: reinstating the ability to run Liquibase without SnakeYaml or OpenCSV on Java 25 by delaying class loading (#7430). This kind of proactive compatibility work ensures Liquibase stays ahead of the JDK curve.

    All Contributors

    Thank you to everyone who made v5.0.2 possible:

    Contributor Contributions
    @MalloD12 12 PRs — checksum fixes, Oracle timezone, Quarkus compat, and more
    @jandroav 9 PRs — release pipeline hardening and CI/CD improvements
    @filipelautert 4 PRs — null safety, MySQL/MariaDB fixes, classpath support, build config
    @mkarg 3 PRs — SQL Anywhere, MSSQL escaping, and tablespace quoting
    @sayaliM0412 3 PRs — CI workflow updates and test matrix improvements
    @tati-qalified 2 PRs — performance fix and test coverage
    @jnewton03 2 PRs — sonar workflow fix and logger service improvement
    @Folgerjun 1 PR — YAML snapshot truncation fix
    @peteraisher 1 PR — column/table comment change detection
    @maximevw 1 PR — checksum compatibility refactoring
    @chadlwilson 1 PR — Java 25 compatibility
    @marwin1991 1 PR — dependency exclusion fix
    @RohanMittal-01 1 PR — PostgreSQL rollback fix
    @Vampire 1 PR — grammar fix in error reporting
    @Xstoudi 1 PR — schema-qualified constraint fix
    @Parthiee 1 PR — empty filePath exception fix
    @HorbatenkoYehor 1 PR — Snowflake quote fix
    @petepickerill 1 PR — branding updates
    @rberezen 1 PR — 5.0 release coordination

    Get Involved

    Every contribution matters — from fixing a typo to refactoring core systems. If Liquibase is part of your workflow and you've ever thought "this could be better," we'd love your help.

    Liquibase v5.0.2 — made possible by 19 contributors across 4 continents. Thank you.

    Open source →
    Additional notes

    Liquibase v5.0.2

    Compare

    Choose a tag to compare

    Open source →
  4. 5.0.13 Oct 2025
    Release notes

    Liquibase Community 5.0.1 is a minor patch release

    See the Liquibase Community 5.0.1 Release Notes for the complete set of release information.

    IMPORTANT

    As of Liquibase 5.0, the Community releases on GitHub no longer include Pro/Secure features and do not support Liquibase Secure license keys. Liquibase Pro and Secure customers should download their releases from liquibase.com/download-secure.

    Additional Information

    License corrections for Maven

    The license block for Maven users has been corrected to use the Functional Source License (FSL).

    Changelog

    -(#7350) Update licensing and documentation for OSS distribution by @filipelautert

    Full Changelog: v5.0.0...v5.0.1

    Open source →
    Additional notes

    Liquibase v5.0.1

    Compare

    Choose a tag to compare

    Open source →
  5. 5.0.030 Sept 2025
    Release notes

    Liquibase Community 5.0 is a major release

    See the Liquibase Community 5.0 Release Notes for the complete set of release information.

    ⚠️ MAJOR CHANGES IN COMMUNITY AND COMMERCIAL DISTRIBUTIONS

    Liquibase is evolving to better serve both open-source contributors and enterprise customers by introducing a clearer separation between its open source Community and the commercial Secure offering. This change is designed to ensure that each distribution is optimized for its respective users: providing open-source Community users with flexibility and control, while delivering scalability, reliability, and governance for Secure enterprise teams. The changes provide Liquibase Secure customers:

    • Developer Productivity. Enable developers with autonomy and guardrails built directly into their daily workflow.
    • Secure Automation. Embed governance, security, and compliance into every change automatically.
    • Change Insights. Deliver audit-ready visibility so every change is trusted, explainable, and observable.

    The new structure enables Liquibase to more effectively support developers at all stages—from experimentation and community collaboration to mission-critical deployments. Therefore, starting with this Liquibase 5.0 release, only the open source Community distribution is available at the traditional Github, Docker, and Maven access channels.

    If you need the Secure commercial offering, please visit Liquibase.com

    Liquibase Community Licensing Change

    Additionally, Liquibase Community is now licensed under the Functional Source License (FSL). See LICENSE file at the root of the distribution for details. Starting with Liquibase 5.0, contributors will be asked to sign a one-time Contributor License Agreement (CLA). This is handled automatically by CLA Assistant when you open your first pull request.

    Liquibase 5.0 Community Release Notable Changes

    Liquibase Package Manager (LPM) integrated to enable users to install, update, and manage their dependencies

    • The open source Liquibase Community 5.0 ships without extensions, drivers, and many other packages and dependencies. This change provides a much lighter, modular, and customizable Liquibase experience for Community users. Importantly, this flexibility both allows and requires users to manage their Liquibase dependencies for their specific needs.
    • Liquibase Package Manager is now integrated and available for use directly from within the Community CLI experience with a new liquibase lpm command as the preferred method for managing dependencies.
    • Learn more at the LPM README

    Liquibase Community 5.0+ ships with the Functional Source License (FSL)

    • "The Functional Source License (FSL) is a Fair Source license that converts to Apache 2.0 or MIT after two years. It is designed for SaaS companies that value both user freedom and developer sustainability. FSL provides everything a developer needs to use and learn from your software without harmful free-riding."
    • Learn more at https://fsl.software/

    SnowFlake JDBC Driver CVE Fix

    • Liquibase 5.0 patches a vulnerability found in Snowflake JDBC driver (CVE-2025-24789) and resolves issue with logicalfilepath reported in 4.31.0. Note: Neither open source Community nor the commercial Secure products were affected by this CVE.

    Dropped support for Java 8 and Java 11

    • The minimal Java dependency for Liquibase 5.0+ is Java 17. This update enables Liquiabase to build, test, and ship with modern and more secure dependencies.

    ValueDate Checksum bug fix

    • In the last release, an issue was introduced by a change in how valueDate was calculated and incorporated into the checksum calculations. This issue has been fixed by ensuring that rawDatevalue is excluded from checksum calculations.
    • (#7101) fix: prevent rawDateValue from being used for checksum calculations @filipelautert

    Changelog of Community PRs

    🚀 New Features

    🐛 Bug Fixes 🛠

    • (#7187) Fixed: #7186 - Liquibase creates too short VARCHAR and CHAR fields on MS SQL databases using multi-byte encodings, effectively leading to data truncation eventually @mkarg
    • (#7289) INT-1480: add custom string escaping for SnowflakeDatabase by @HorbatenkoYehor
    • (#7306) Renamed GETTING_STARTED.TXT to GETTING_STARTED.txt by @rberezen
    • (#7287) Fix path inconsistency in JAR file resource resolution by @rberezen
    • (#7282) Fix OSS license validation to prevent NPEs and silent failures by @filipelautert
    • (#7269) INT-1392: add get/setArguments and get/setProcedureName methods into … @HorbatenkoYehor
    • (#7274) Fixed errors in tests on Windows 11 + git-bash cygwin @b-gyula
    • (#7264) Back out change to ignore nested objects in TableExistsPreCondition @wwillard7800
    • (#7257) INT-1416: Updated handling of complex UnwrappedLiquibaseSerializables @SvampX
    • (#7233) Comparator resoluition should work in non-flat classloaders @gastaldi
    • (#7227) #7220: Thread-safety issue when running Liquibase in a multithreaded and multitenant environment @galovics
    • (#7231) fix sqlite JDBC URL parsing failure when tracking licenses (DAT-20124) @StevenMassaro
    • (#7187) Fixed: #7186 - Liquibase creates too short VARCHAR and CHAR fields on MS SQL databases using multi-byte encodings, effectively leading to data truncation eventually @mkarg
    • (#7154) Only mark changeset as SKIPPED if all changes are skipped GH issue 7153 @wwillard7800
    • (#7200) Remove duplicate header check for formatted SQL and add log message @wwillard7800
    • (#7208) Handle overwrite flag for formatted SQL correctly in generateChangelog @wwillard7800
    • (#7155) Option to allow snapshot to continue after finding null snapshot ID DAT-20436 @wwillard7800
    • (#7182) Fix OAuth2Secret credential exposure in update-sql command @filipelautert
    • (#7192) Fixes for regressions in DAT-20619, DAT-20620, and DAT-20621 @wwillard7800
    • (#7178) Throw exception if a change type has a namespace and cannot be found @wwillard7800
    • (#7168) Use missing objects instead of changed objects in test DAT-20536 @wwillard7800
    • (#7158) Handle situation that occurs when generateChangeLog is run with diffTypes=data @wwillard7800
    • (#7165) Fix rename column generator test @wwillard7800
    • (#6920) fix: Change the rename column query for mysql v8 and later using rename column to @quangdutran
    • (#7141) Rollback OpenCSV version to 5.10 and address CSV loading issue @filipelautert
    • (#7140) NullPointerException in SpringLiquibase.toString() @tweimer
    • (#7152) fix updateSQL command ignoring endDelimiter for some statements #7148 @ponziani
    • (#7108) Fix the version check for the MySQL FILTER_CONDITION to handle minor version > 0 DAT-20441 @wwillard7800
    • (#7101) fix: prevent rawDateValue from being used for checksum calculations @filipelautert
    • (#7079) feat: add logic to exclude resources from liquibaseHomeUri/internal in resource processing for includeAll @filipelautert

    DevOps

    • (#7084) DAT-20288: fill in details for root's liquibase.build.properties file @sayaliM0412
    • (#7219) DAT-20673 Secure: Create new package locations @jandroav

    🤖 Security, Driver and Other Updates

    44 changes - (#7301) chore(deps): bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 in the production-deps group by dependabot - (#7302) chore(deps-dev): bump the build-tools group with 2 updates by dependabot bot - (#7297) chore(deps-dev): bump the production-deps group with 2 updates by dependabot bot - (#7294) chore(deps-dev): bump org.assertj:assertj-core from 3.27.5 to 3.27.6 in the test-deps group by dependabot bot - (#7291) chore(deps): bump the build-tools group with 3 updates by dependabot bot - (#7292) Remove update-docs-oss-pro-version job @sayaliM0412 - (#7291) chore(deps): bump the build-tools group with 3 updates @dependabot[bot] - (#7284) chore(deps-dev): bump org.postgresql:postgresql from 42.7.7 to 42.7.8 in the build-tools group @dependabot[bot] - (#7283) chore(deps-dev): bump org.assertj:assertj-core from 3.27.4 to 3.27.5 in the test-deps group @dependabot[bot] - (#7281) chore(deps): bump org.projectlombok:lombok from 1.18.40 to 1.18.42 @dependabot[bot] - (#7277) chore(deps): bump the build-tools group with 3 updates @dependabot[bot] - (#7266) chore(deps-dev): bump org.mariadb.jdbc:mariadb-java-client from 3.5.5 to 3.5.6 in the build-tools group @dependabot[bot] - (#7251) chore(deps): bump org.projectlombok:lombok from 1.18.38 to 1.18.40 @dependabot[bot] - (#7252) chore(deps): bump actions/github-script from 7 to 8 in the github-actions group @dependabot[bot] - (#7242) chore(deps): bump the github-actions group across 1 directory with 3 updates @dependabot[bot] - (#7241) chore(deps-dev): bump the build-tools group across 1 directory with 2 updates @dependabot[bot] - (#7236) chore(deps): bump org.yaml:snakeyaml from 2.4 to 2.5 @dependabot[bot] - (#7234) chore(deps): bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.1.0.4751 to 5.2.0.4988 in the build-tools group @dependabot[bot] - (#7223) chore(deps-dev): bump org.firebirdsql.jdbc:jaybird from 5.0.8.java8 to 5.0.9.java8 in the build-tools group @dependabot[bot] - (#7225) chore(deps): bump actions/setup-java from 4 to 5 in the github-actions group @dependabot[bot] - (#7207) chore(deps): bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 in the build-tools group @dependabot[bot] - (#7206) chore(deps): bump actions/checkout from 4 to 5 in the github-actions group @dependabot[bot] - (#7203) chore(deps): bump org.mockito:mockito-core from 4.11.0 to 5.19.0 @dependabot[bot] - (#7198) chore(deps-dev): bump net.snowflake:snowflake-jdbc from 3.25.1 to 3.26.0 in the build-tools group @dependabot[bot] - (#7195) chore(deps): bump org.firebirdsql:firebird-testcontainers-java from 1.5.1 to 1.6.0 @dependabot[bot] - (#7189) chore(deps): bump the github-actions group with 2 updates @dependabot[bot] - (#7188) chore(deps-dev): bump org.mariadb.jdbc:mariadb-java-client from 3.5.4 to 3.5.5 in the build-tools group @dependabot[bot] - (#7185) chore(deps-dev): bump org.assertj:assertj-core from 3.27.3 to 3.27.4 in the test-deps group @dependabot[bot] - (#7160) chore(deps-dev): bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0 in the production-deps group @dependabot[bot] - (#7164) chore(deps-dev): bump the build-tools group across 1 directory with 2 updates @dependabot[bot] - (#7157) chore(deps): bump com.opencsv:opencsv from 5.10 to 5.12.0 @dependabot[bot] - (#7135) chore(deps): bump commons-io:commons-io from 2.19.0 to 2.20.0 @dependabot[bot] - (#7156) chore(deps): bump org.codehaus.mojo:flatten-maven-plugin from 1.7.1 to 1.7.2 in the build-tools group @dependabot[bot] - (#7132) chore(deps): bump the github-actions group with 2 updates @dependabot[bot] - (#7150) chore(deps): bump org.apache.commons:commons-text from 1.13.1 to 1.14.0 in the production-deps group @dependabot[bot] - (#7139) chore(deps-dev): bump the build-tools group across 1 directory with 2 updates @dependabot[bot] - (#7142) chore(deps): bump the test-deps group across 1 directory with 7 updates @dependabot[bot] - (#7127) chore(deps): bump the build-tools group across 1 directory with 3 updates @dependabot[bot] - (#7115) chore(deps): bump the test-deps group with 5 updates @dependabot[bot] - (#7120) chore(deps): bump the production-deps group with 2 updates @dependabot[bot] - (#7121) chore(deps): bump targetMavenVersion from 3.9.10 to 3.9.11 @dependabot[bot] - (#7119) Fix dependabot.yml version syntax error @jnewton03 - (#7117) Add Spring Framework 6.x to dependabot ignore list @jnewton03 - (#7106) Reduce dependabot PR overload through strategic grouping and automation @jnewton03

    Full Changelog: v4.33.0...v5.0.0

    Get Certified

    Learn all the Liquibase fundamentals from free online courses by Liquibase experts and see how to apply them in the real world at https://learn.liquibase.com/.

    Read the Documentation

    Please check out and contribute to the continually improving docs, now at https://docs.liquibase.com/.

    Join the Community

    Our community has built a lot. From extensions to integrations, you’ve helped make Liquibase the amazing open source project that it is today. Keep contributing to making it stronger:
    Contribute code
    Make doc updates
    Help by asking and answering questions
    Join our Discord server
    Sign up to provide feedback to the product team
    Thanks to everyone who helps make Liquibase better!

    File Descriptions

    Liquibase CLI -- Includes open source + commercial functionality

    • liquibase-x.y.z.tar.gz -- Archive in tar.gz format
    • liquibase-x.y.z.zip -- Archive in zip format
    • liquibase-windows-x64-installer-x.y.z.exe -- Installer for Windows
      Primary Libraries - For embedding in other software
    • liquibase-core-x.y.z.jar – Base Liquibase library (open source)
    • liquibase-commerical-x.y.z.jar – Additional commercial functionality
    • liquibase-additional-x.y.z.zip – Contains additional, less commonly used files
    • Additional libraries such as liquibase-maven-plugin.jar and liquibase-cdi.jar
    • Javadocs for all the libraries
    • Source archives for all the open source libraries
    • ASC/MD5/SHA1 verification hashes for all files
    Open source →
    Additional notes

    Liquibase v5.0.0

    Compare

    Choose a tag to compare

    Open source →
  6. 4.33.09 Jul 2025
    Release notes

    Liquibase 4.33.0 is a minor release

    Liquibase 4.33.0 delivers important updates across Policy Checks, Change Automation, and other areas of platform enhancement, along with critical bug fixes and improvements to MongoDB, PostgreSQL, and DB2 on Z/OS support. See the Liquibase 4.33.0 Release Notes for the complete set of release information.

    UPDATE

    The bug fix introduced in #7036 flags multiple Formatted SQL headers in one changelog. Removing these multiple Formatted SQL headers from your changelog can lead to checksum errors for previously deployed changelogs. And while there is a workaround by specifying a validCheckSum attribute, in the next release we will introduce a new global argument (--fail-on-multiple-formatted-sql-headers=[true (default) | false]) as a user option to decide when to fail an operation in which multiple formatted SQL headers are detected.

    Notable Changes

    [PRO]

    Change Automation

    • PostgreSQL Composite TYPE Support in Database Inspection. Liquibase Pro now includes support for inspecting PostgreSQL Composite TYPE objects during database inspection operations such as snapshot and diff. This enhancement ensures Composite TYPEs appear in inspection outputs, helping users manage and track changes to complex data structures more effectively. [INT-1249] [INT-135]

    • PostgreSQL Composite TYPE Support in generate-changelog and diff-changelog. Liquibase Pro now includes support for detecting PostgreSQL composite TYPE objects during generate-changelog and diff-changelog operations. This enhancement ensures that composite TYPE definitions—used to group multiple fields into a custom data structure—are captured and modeled alongside other schema elements, helping users manage and track changes more comprehensively. [INT-1251]

    • PostgreSQL Password Escaping Enhancement. Liquibase now escapes special characters in PostgreSQL passwords when using the psql native executor. Previously, if a password included characters requiring percent-encoding (such as @, %, or #), the executor would fail with a psql: error: invalid percent-encoded token message. [DAT-20254]

    • Db2 on Z/OS JCL Executor. Liquibase Pro now includes the ability to submit JCL jobs to the mainframe via Db2 DSNUTILU stored procedure. This enables users to automate more sophisticated procedures by integrating system level activities and database activities in a standard changelog format. This feature is enabled by a runwith:JCL decoration on applicable changesets containing properly formatted JCL.[INT-573, INT-1217]

    • Improved Persistent Spool File Behavior for SQLPlus Executor. The SQLPlus executor ensures that spool files are always retained when --sqlplus-create-spool=true, giving users consistent access to output files. Previously, spool file retention was tied to the --sqlplus-keep-temp setting; now, this setting applies only to temporary SQL files, not spool files. This decoupling improves clarity and gives users more control—if a spool file is created, it will remain unless users opt out by setting --sqlplus-create-spool=false. [DAT-18983]

    Policy Checks

    • MongoChangetypeAttributes Policy Check. Introduced a new quality check named MongoChangetypeAttributes that allows users to enforce specific values or patterns for attributes within MongoDB-specific changetypes. Users can select a single Mongo changetype (e.g., createIndex, dropCollection) and specify expected values or patterns for its attributes. The check triggers if a specified attribute is present but does not match the defined value or regex—ensuring consistent standards across Mongo changesets. This supports validation across key changetypes attributes like adminCommand, createCollection, insertOne, and more, and enhances control and quality enforcement in MongoDB deployment pipelines. [DAT-18275]

    [OSS]

    Important dependency updates

    ⚠️[PRO] and [OSS] Upcoming Change in Distributions

    Liquibase is evolving to better serve both open-source contributors and enterprise customers by introducing a clearer separation between its Open Source (OSS) and PRO offerings. This change is designed to ensure that each distribution is optimized for its respective users—providing open-source users with flexibility and control, while delivering scalability, reliability, and governance for enterprise teams.

    The new structure enables Liquibase to more effectively support developers at all stages—from experimentation and community collaboration to mission-critical deployments. Liquibase 4.32.0 introduced the first general availability (GA) release of independently packaged Pro distributions, along with dedicated distribution channels and key-based access enforcement for Pro capabilities. This marks a significant step toward delivering a curated, enterprise-grade experience for Pro users.

    The OSS distribution and its delivery channels remain unchanged in this phase.

    PRO PRs

    🆕New Features

    🐛Bug Fixes 🐛

    Version updates: In the pom.xml for Maven, update postgres to 42.7.7 liquibase/liquibase-pro#2486 by @abrackx

    🔒Security, Driver and Other Updates

    OSS PRs

    🆕New Features

    • (#7059) Java 24 core build support @filipelautert
    • (#7046) feat: add rawDateValue field to store unprocessed date input in ColumnConfig @filipelautert
    • (#7036) Complain and throw an exception when multiple header lines are found in a formatted SQL changelog DAT-20244 @wwillard7800
    • (#6987) Added reportsEnabled property for Maven plugin @wwillard7800 DAT-20185
    • (#7031) Added property for disabling command tests at runtime @wwillard7800
    • (#6840) Comments field from CreateProcedure change renamed to 'comment' @MalloD12
    • (#6916) Added new argument to AbstractFormattedChangeLogParser.handleAdditionalLines method @wwillard7800
    • (#7032) Refactor: last-wins local parameters search in changeLog hierarchy by @boolivar
    • (#7017) Allow showSqlWarnings message to be overridden in JdbcExecutor [DAT-20202] by @wwillard7800
    • (#6990) Add application name to JDBC properties for Snowflake [INT-1318] by @filipelautert
    • (#7071) Pass the database instance in scope when parsing the changelog [DAT-20378]by @wwillard7800
    • (#7063) do not count DBCL queries in rows affected message [DAT-20282] by @StevenMassaro
    • (#7065) Added default implementation of getVisibleUrl to DatabaseConnection to be used when the URL gets displayed by @wwillard7800
    • (#7053) Do not show output file saved message unless exit code is 0 by @wwillard7800
    • (#6995) feat(DEVX-12): Removal of liquibase-cdi and liquibase-cdi-jakarta modules @filipelautert

    🐛Bug Fixes 🐛

    • (#7062) Fix issue in DBMS skip check that caused a regression @wwillard7800
    • (#7048) Do not reset the change set execType when looping through the changes @wwillard7800
    • (#7049) fix: resolve inconsistency in StandardLockService by ensuring table snapshot is validated before processing changes @filipelautert
    • (#6827) Error handling support added to prevent XML changelog format having other than databaseChangeLog tag as the root element @MalloD12
    • (#7001) Restore UniqueConstraintExistsPrecondition logic Github issue 6984 @wwillard7800
    • (#6844) Exclude static fields from changelog serialization @evilbc
    • (#7002) fix: improve URI normalization logic for resource paths inside jars @filipelautert
    • (#6986) only destroy lock service if drop-all succeeds (DAT-13088) @StevenMassaro
    • (#6925) Fix for YAML changelogs with many references to be parsed successfully with snakeyaml @MalloD12
    • (#7056) fix: update snapshot logic to handle null snapshot returns by @filipelautert
    • (#7085) fix: do not snapshot index type for cockroach DB as indexes behave different on this database and we don't know where to find it. by @filipelautert
    • (#7062) Fix issue in DBMS skip check that caused a regression by @wwillard7800
    • (#7069) Handle situation where DBCL presence was not detected due to permissions [DAT-20314] by @wwillard7800

    🔒Security, Driver and Other Updates

    • (#7038) chore(deps-dev): bump org.xerial:sqlite-jdbc from 3.49.1.0 to 3.50.1.0 @dependabot
    • (#6997) - chore(deps): bump org.testcontainers:testcontainers-bom from 1.21.0 to 1.21.1 @dependabot
    • (#7040) chore(deps-dev): bump org.postgresql:postgresql from 42.7.5 to 42.7.7 in /liquibase-dist @dependabot
    • (#7082) - chore(deps): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.0 by @dependabot
    • (#7068) - chore(deps): bump org.junit.jupiter:junit-jupiter from 5.12.2 to 5.13.2 by @dependabot
    • (#7067) - chore(deps): bump org.junit.platform:junit-platform-suite from 1.11.4 to 1.13.2 by @dependabot
    • (#7066) - chore(deps): bump junit-jupiter.version from 5.12.2 to 5.13.2 by @dependabot
    • (#7064) chore(deps-dev): bump com.microsoft.sqlserver:mssql-jdbc from 12.10.0.jre8 to 12.10.1.jre8 by @dependabot
    • (#7073) chore(deps-dev): bump org.xerial:sqlite-jdbc from 3.50.1.0 to 3.50.2.0 by @dependabot
    • (#7061) - chore(deps): bump com.opencsv:opencsv from 5.11 to 5.11.2 by @dependabot
    • (#7060) - chore(deps): bump org.codehaus.mojo:flatten-maven-plugin from 1.7.0 to 1.7.1 by @dependabot
    • (#7072) - chore(deps): bump org.testcontainers:testcontainers-bom from 1.21.1 to 1.21.3 by @dependabot
    • (#7026) - chore(deps): bump targetMavenVersion from 3.9.9 to 3.9.10 by @dependabot
    • (#7075) chore(deps-dev): bump org.mariadb.jdbc:mariadb-java-client from 3.5.3 to 3.5.4 by @dependabot
    • (

    Note truncated.

    Open source →
    Additional notes

    Liquibase v4.33.0

    Compare

    Choose a tag to compare

    Open source →
  7. 4.32.021 May 2025
    Release notes

    Liquibase v4.32.0

    Compare

    Choose a tag to compare

    Open source →
  8. 4.31.117 Feb 2025
    Release notes

    v4.31.1

    Compare

    Choose a tag to compare

    Open source →
  9. 4.31.016 Jan 2025
    Release notes

    Liquibase v4.31.0

    Compare

    Choose a tag to compare

    Open source →
  10. 4.30.05 Nov 2024

    Nothing published for this version

  11. 4.29.24 Sept 2024

    Nothing published for this version

  12. 4.29.131 Jul 2024

    Nothing published for this version

  13. 4.29.025 Jul 2024

    Nothing published for this version

  14. 4.28.021 May 2024

    Nothing published for this version

  15. 4.27.027 Mar 2024

    Nothing published for this version

  16. 4.26.07 Feb 2024

    Nothing published for this version

  17. 4.25.118 Dec 2023

    Nothing published for this version

  18. 4.25.014 Nov 2023

    Nothing published for this version

  19. 4.24.03 Oct 2023

    Nothing published for this version

  20. 4.23.211 Sept 2023

    Nothing published for this version

  21. 4.23.110 Aug 2023

    Nothing published for this version

  22. 4.23.026 Jun 2023

    Nothing published for this version

  23. 4.22.011 May 2023

    Nothing published for this version

  24. 4.21.114 Apr 2023

    Nothing published for this version

  25. 4.21.012 Apr 2023

    Nothing published for this version

  26. 4.20.08 Mar 2023

    Nothing published for this version

  27. 4.19.11 Mar 2023

    Nothing published for this version

  28. 4.19.017 Jan 2023

    Nothing published for this version

  29. 4.18.06 Dec 2022

    Nothing published for this version

  30. 4.17.22 Nov 2022

    Nothing published for this version

  31. 4.17.124 Oct 2022

    Nothing published for this version

  32. 4.17.010 Oct 2022

    Nothing published for this version

  33. 4.16.114 Sept 2022

    Nothing published for this version

  34. 4.16.09 Sept 2022

    Nothing published for this version

  35. 4.15.05 Aug 2022

    Nothing published for this version

  36. 4.14.025 Jul 2022

    Nothing published for this version

  37. 4.13.011 Jul 2022

    Nothing published for this version

  38. 4.12.017 Jun 2022

    Nothing published for this version

  39. 4.11.024 May 2022

    Nothing published for this version

  40. 4.10.05 May 2022

    Nothing published for this version

  41. 4.9.129 Mar 2022

    Nothing published for this version

  42. 4.9.017 Mar 2022

    Nothing published for this version

  43. 4.8.022 Feb 2022

    Nothing published for this version

  44. 4.7.121 Jan 2022

    Nothing published for this version

  45. 4.7.010 Jan 2022

    Nothing published for this version

  46. 4.6.22 Dec 2021

    Nothing published for this version

  47. 4.6.14 Nov 2021

    Nothing published for this version

  48. 4.6.04 Nov 2021

    Nothing published for this version

  49. 4.5.027 Sept 2021

    Nothing published for this version

  50. 4.4.35 Aug 2021

    Nothing published for this version

  51. 4.4.222 Jul 2021

    Nothing published for this version

  52. 4.4.19 Jul 2021

    Nothing published for this version

  53. 4.4.09 Jun 2021

    Nothing published for this version

  54. 4.3.529 Apr 2021

    Nothing published for this version

  55. 4.3.419 Apr 2021

    Nothing published for this version

  56. 4.3.312 Apr 2021

    Nothing published for this version

  57. 4.3.223 Mar 2021

    Nothing published for this version

  58. 4.3.112 Feb 2021

    Nothing published for this version

  59. 4.3.09 Feb 2021

    Nothing published for this version

  60. 4.2.29 Dec 2020

    Nothing published for this version