Skip to content

build(deps-dev): bump org.liquibase:liquibase-maven-plugin from 5.0.3 to 5.0.4 in /samples/java/liquibase - #4782

Open
dependabot[bot] wants to merge 1 commit into
postgresql-dialectfrom
dependabot/maven/samples/java/liquibase/org.liquibase-liquibase-maven-plugin-5.0.4
Open

build(deps-dev): bump org.liquibase:liquibase-maven-plugin from 5.0.3 to 5.0.4 in /samples/java/liquibase#4782
dependabot[bot] wants to merge 1 commit into
postgresql-dialectfrom
dependabot/maven/samples/java/liquibase/org.liquibase-liquibase-maven-plugin-5.0.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps org.liquibase:liquibase-maven-plugin from 5.0.3 to 5.0.4.

Release notes

Sourced from org.liquibase:liquibase-maven-plugin's releases.

Liquibase v5.0.4

Liquibase Community 5.0.4 Release Notes

Liquibase Community v5.0.4 is a security-focused release: credentials are now redacted from error messages and logs, new opt-in lockdown flags let you restrict changelog features that execute code, and more than thirty fixes land across Oracle, PostgreSQL, MySQL and MariaDB, diff-changelog, and embedded use. Thanks to the twenty-three contributors who made their first contribution in this release!

Latest release: v5.0.4, August 20, 2026

Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly

Roadmap: Liquibase Community (view)

Thank you to every contributor who filed an issue, reviewed code, or submitted a fix.

New Contributors

What's in this release

Security

Release signing key rotated: The Liquibase release signing key was rotated following the revocation of the old key. GPG verification requires Liquibase Community 5.0.4 or later. Past releases are safe and untampered.

(#7737, #7738, #7740, #7756, #7739, #7746) by @​v-petrovych Database credentials are now redacted from error messages, logs, and stored parameters. If you pass a JDBC URL with embedded credentials (such as jdbc:postgresql://user:password@host/db) and the connection fails, the password no longer appears in the resulting error message or in log output. This covers unrecognized-driver errors and mistyped offline: URLs, and the URL sanitizer now handles PostgreSQL, SQL Server, and third-party JDBC drivers rather than only a few specific databases. Credential-bearing values captured from CLI arguments, liquibase.properties defaults files, and Maven plugin parameters are now masked before being stored internally. The init start-h2 example server also now prints ***** instead of the real password in its connection information banner. If you relied on copying the password from that output, use the value you configured instead (the default is letmein).

(#7741, #7742, #7743, #7764) by @​v-petrovych Passwords are cleared from memory once Liquibase is done with them. The CLI, the Maven plugin, and the Ant tasks now release password values as soon as the operation that needed them finishes. For Ant, clearing happens when the build finishes, so a shared <database> definition keeps working across multiple tasks in one build. This shortens the window in which a heap dump or memory inspection of a long-running JVM could expose your credentials. If you call Liquibase programmatically, CommandScope.execute() does not clear credentials automatically (so reusing one scope for several executions keeps working), and you can opt in by calling the now-public clearCredentialArguments() after your last execution.

(#7747, #7748, #7768, #7767, #7766, #7765, #7750) by @​v-petrovych New opt-in lockdown flags for changelog features that can execute code or reach outside your project. Several changelog features are intentionally powerful under Liquibase's standard trust model of team-authored, team-reviewed changelogs. If you run changelogs from less-trusted sources, you can now disable each of these features individually. Every flag defaults to true, so nothing changes unless you set it. When a flag is set to false, the offending element is rejected with a clear error that names the flag, before any of its code runs.

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-maven-plugin's changelog.

Liquibase Community 5.0.4 is a minor patch release

See the Liquibase Community 5.0.4 Release Notes for the complete set of release information.

New Features

Bug Fixes

... (truncated)

Commits
  • 2c25134 Update changelog.txt for 5.0.4 (#7920)
  • 15a0885 [TECHOPS-1048] Gate DigiCert KeyLocker signing behind dry_run, drop from inst...
  • c7a01d5 chore(deps): bump the github-actions group with 5 updates (#7917)
  • 83e6a89 chore(deps): bump the test-deps group with 2 updates (#7916)
  • 59a7617 fix: emit valid timestamp with time zone syntax (#7808)
  • 0f1129f fix: scope per-database service cleanup so parallel Maven reactor builds no l...
  • e5ec227 fix: drop throwable from ChangeSet SEVERE log to prevent double-reporting (#7...
  • 56c9dca chore(deps): bump org.apache.maven:apache-maven from 3.9.5 to 3.9.16 (#7914)
  • 5568a48 chore(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.2.0 to 3.3.4 ...
  • e3cc406 Fix the SonarCloud quality gate: suppress false-positive S3077 on two safely-...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 24, 2026
@olavloite

olavloite commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/maven/samples/java/liquibase/org.liquibase-liquibase-maven-plugin-5.0.4 branch from 649efcc to 3411db2 Compare September 3, 2026 07:28
@olavloite

olavloite commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
build(deps-dev): bump org.liquibase:liquibase-maven-plugin
0b2074c 
Bumps [org.liquibase:liquibase-maven-plugin](https://github.com/liquibase/liquibase) from 5.0.3 to 5.0.4.
- [Release notes](https://github.com/liquibase/liquibase/releases)
- [Changelog](https://github.com/liquibase/liquibase/blob/main/changelog.txt)
- [Commits](liquibase/liquibase@v5.0.3...v5.0.4)

---
updated-dependencies:
- dependency-name: org.liquibase:liquibase-maven-plugin
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/samples/java/liquibase/org.liquibase-liquibase-maven-plugin-5.0.4 branch from 3411db2 to 0b2074c Compare September 3, 2026 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@olavloite olavloite olavloite approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@olavloite