Bump org.liquibase:liquibase-core from 5.0.3 to 5.0.4

[dependabot]

Bumps org.liquibase:liquibase-core from 5.0.3 to 5.0.4.

Release notes

Sourced from org.liquibase:liquibase-core's releases.

Liquibase v5.0.4

Liquibase Community 5.0.4 Release Notes

Liquibase Community v5.0.4 is a security-focused release: credentials are now redacted from error messages and logs, new opt-in lockdown flags let you restrict changelog features that execute code, and more than thirty fixes land across Oracle, PostgreSQL, MySQL and MariaDB, diff-changelog, and embedded use. Thanks to the twenty-three contributors who made their first contribution in this release!

Latest release: v5.0.4, August 20, 2026

Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly

Roadmap: Liquibase Community (view)

Thank you to every contributor who filed an issue, reviewed code, or submitted a fix.

New Contributors

• @​v-petrovych made their first contribution in #7729
• @​mgustimz made their first contribution in #7696
• @​Khromushkin made their first contribution in #7759
• @​officialasishkumar made their first contribution in #7705
• @​jstastny made their first contribution in #7566
• @​pranithreddym made their first contribution in #7708
• @​edu1006 made their first contribution in #7847
• @​profiluefter made their first contribution in #7560
• @​Devansh-ops made their first contribution in #7834
• @​singhvishalkr made their first contribution in #7725
• @​Akshatsharma2205 made their first contribution in #7798
• @​renechoi made their first contribution in #7869
• @​om7057 made their first contribution in #7825
• @​yosimasu made their first contribution in #7831
• @​makssent made their first contribution in #7850
• @​felhag made their first contribution in #7803
• @​hutiefang76 made their first contribution in #7835
• @​sakshichitnis27 made their first contribution in #7866
• @​seonwooj0810 made their first contribution in #7812
• @​kamilkrzywanski made their first contribution in #7848
• @​fudianchn made their first contribution in #7881
• @​ET-TOUNANI made their first contribution in #7801
• @​pwielgolaski made their first contribution in #7909

What's in this release

Security

Release signing key rotated: The Liquibase release signing key was rotated following the revocation of the old key. GPG verification requires Liquibase Community 5.0.4 or later. Past releases are safe and untampered.

(#7737, #7738, #7740, #7756, #7739, #7746) by @​v-petrovych Database credentials are now redacted from error messages, logs, and stored parameters. If you pass a JDBC URL with embedded credentials (such as jdbc:postgresql://user:password@host/db) and the connection fails, the password no longer appears in the resulting error message or in log output. This covers unrecognized-driver errors and mistyped offline: URLs, and the URL sanitizer now handles PostgreSQL, SQL Server, and third-party JDBC drivers rather than only a few specific databases. Credential-bearing values captured from CLI arguments, liquibase.properties defaults files, and Maven plugin parameters are now masked before being stored internally. The init start-h2 example server also now prints ***** instead of the real password in its connection information banner. If you relied on copying the password from that output, use the value you configured instead (the default is letmein).

(#7741, #7742, #7743, #7764) by @​v-petrovych Passwords are cleared from memory once Liquibase is done with them. The CLI, the Maven plugin, and the Ant tasks now release password values as soon as the operation that needed them finishes. For Ant, clearing happens when the build finishes, so a shared <database> definition keeps working across multiple tasks in one build. This shortens the window in which a heap dump or memory inspection of a long-running JVM could expose your credentials. If you call Liquibase programmatically, CommandScope.execute() does not clear credentials automatically (so reusing one scope for several executions keeps working), and you can opt in by calling the now-public clearCredentialArguments() after your last execution.

(#7747, #7748, #7768, #7767, #7766, #7765, #7750) by @​v-petrovych New opt-in lockdown flags for changelog features that can execute code or reach outside your project. Several changelog features are intentionally powerful under Liquibase's standard trust model of team-authored, team-reviewed changelogs. If you run changelogs from less-trusted sources, you can now disable each of these features individually. Every flag defaults to true, so nothing changes unless you set it. When a flag is set to false, the offending element is rejected with a clear error that names the flag, before any of its code runs.

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase Community 5.0.4 is a minor patch release

See the Liquibase Community 5.0.4 Release Notes for the complete set of release information.

New Features

• Add nocontexts pseudo-context to allow opt-in strict context matching by @​filipelautert with @​Copilot in liquibase/liquibase#7650
• feat: Provide a listUnexpectedChangeSets() to be consistent with other methods in that class by @​Vampire in liquibase/liquibase#7522
• INT-2211: reference-scoped configuration for two-connection commands by @​SvampX in liquibase/liquibase#7841
• Detect Firebird-compatible RedDatabase servers as Firebird by @​makssent in liquibase/liquibase#7850

Bug Fixes

• Fix #7602: Set database filter when user-provided ChangeLogParameters is passed by @​mgustimz in liquibase/liquibase#7696
• fix(postgres): preserve PARTITION BY in diff-changelog (#6885) by @​Khromushkin in liquibase/liquibase#7759
• Fix Redshift snapshot failure: skip pg_partitioned_table enrichment on pre-PG10 servers by @​KushnirykOleh in liquibase/liquibase#7827
• fix(mysql): preserve timestamp column attributes in native types by @​officialasishkumar in liquibase/liquibase#7705
• fix: use CURRENT_TIMESTAMP instead of SYSTIMESTAMP for Oracle by @​filipelautert in liquibase/liquibase#7641
• fix: reduce misleading WARN log when CLOB value contains spaces by @​jstastny in liquibase/liquibase#7566
• Fix MySQL TINYINT(1) snapshotted as BIT(1) causing spurious diffs by @​pranithreddym in liquibase/liquibase#7708
• Fix #7623: Handle null URL in isCorrectDatabaseImplementation by @​mgustimz in liquibase/liquibase#7697
• fix: use integerExp type for numeric sequence attributes in XSD by @​filipelautert in liquibase/liquibase#7643
• fix(changelog): fall back when stored changelog path is missing by @​officialasishkumar in liquibase/liquibase#7704
• Fix primaryKeyExists precondition ignoring PK name on Oracle by @​filipelautert in liquibase/liquibase#7645
• INT-2215: don't silently drop same-order value modifiers / table-name generators by @​SvampX in liquibase/liquibase#7845
• fix: Update list of reserved keywords for MySQL and MariaDB by @​profiluefter in liquibase/liquibase#7560
• Fix Oracle statement splitting for q-quoted string literals by @​Devansh-ops in liquibase/liquibase#7834
• Treat 'NULL' default value as null for MySQL/MariaDB enum columns by @​singhvishalkr in liquibase/liquibase#7725
• Fix grouped context expression parsing by @​Akshatsharma2205 in liquibase/liquibase#7798
• fix the ChangeSet checksum cache to recalculate when a different checksum version is requested by @​renechoi in liquibase/liquibase#7869
• fix: share a single root scope across threads by @​filipelautert in liquibase/liquibase#7877
• fix: give each command execution its own CommandStep instances by @​filipelautert in liquibase/liquibase#7876
• Refactor: track MDC scope entries per-thread by @​om7057 in liquibase/liquibase#7825
• Fix --output-default-schema/--output-default-catalog being ignored by update-sql and other SQL output commands by @​yosimasu in liquibase/liquibase#7831
• Route deprecated-AWS-extension warning to System.err by @​wwillard7800 in liquibase/liquibase#7884
• fix: default-schema-name not working when runInTransaction is false by @​felhag in liquibase/liquibase#7803
• Fix formatted SQL precondition messages by @​hutiefang76 in liquibase/liquibase#7835
• Fix URL loading from driver properties file by @​sakshichitnis27 in liquibase/liquibase#7866
• fix(snapshot): close owning Statement in ResultSetCache.extract to prevent JDBC Statement leak by @​seonwooj0810 in liquibase/liquibase#7812
• Fix service discovery aborting when a provider fails to load by @​kamilkrzywanski in liquibase/liquibase#7848
• Fix ClassCastException in diff-changelog when a PK/UC backing index is delegated by @​fudianchn in liquibase/liquibase#7881
• fix: preserve addColumn before foreign key in diff changelog output by @​ET-TOUNANI in liquibase/liquibase#7801
• Fix uppercase acronym parameters being dropped in customChange by @​fudianchn in liquibase/liquibase#7882
• Fix: don't release the changelog lock in AbstractUpdateCommandStep unless it was acquired there by @​om7057 in liquibase/liquibase#7886
• fix: do not hoist a foreign key column ahead of its own table by @​filipelautert in liquibase/liquibase#7898
• fix: carry the index relation down to its columns by @​filipelautert in liquibase/liquibase#7897
• Fix fast check cache after rollback by @​hutiefang76 in liquibase/liquibase#7896
• fix: ship commons-text and commons-collections4 in the distribution again by @​filipelautert in liquibase/liquibase#7907
• fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting by @​wwillard7800 in liquibase/liquibase#7910
• fix: scope per-database service cleanup so parallel Maven reactor builds no longer corrupt each other's state by @​pwielgolaski in liquibase/liquibase#7909

... (truncated)

Commits

• 2c25134 Update changelog.txt for 5.0.4 (#7920)
• 15a0885 [TECHOPS-1048] Gate DigiCert KeyLocker signing behind dry_run, drop from inst...
• c7a01d5 chore(deps): bump the github-actions group with 5 updates (#7917)
• 83e6a89 chore(deps): bump the test-deps group with 2 updates (#7916)
• 59a7617 fix: emit valid timestamp with time zone syntax (#7808)
• 0f1129f fix: scope per-database service cleanup so parallel Maven reactor builds no l...
• e5ec227 fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting (#7...
• 56c9dca chore(deps): bump org.apache.maven:apache-maven from 3.9.5 to 3.9.16 (#7914)
• 5568a48 chore(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.2.0 to 3.3.4 ...
• e3cc406 Fix the SonarCloud quality gate: suppress false-positive S3077 on two safely-...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)