Skip to content

build(deps): bump org.liquibase:liquibase-core from 5.0.2 to 5.0.3#8625

Merged
pethers merged 1 commit into
masterfrom
dependabot/maven/org.liquibase-liquibase-core-5.0.3
May 15, 2026
Merged

build(deps): bump org.liquibase:liquibase-core from 5.0.2 to 5.0.3#8625
pethers merged 1 commit into
masterfrom
dependabot/maven/org.liquibase-liquibase-core-5.0.3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 15, 2026 •
edited
Loading

Bumps org.liquibase:liquibase-core from 5.0.2 to 5.0.3.

Release notes

Sourced from org.liquibase:liquibase-core's releases.

Liquibase v5.0.3

Liquibase Community 5.0.3 Release Notes

Liquibase Community v5.0.3 is a focused release: two security fixes, a handful of database-specific bug fixes across Oracle, PostgreSQL, and MSSQL, and a thread safety improvement for teams running Liquibase in multitenant environments. Thanks to the ten community contributors who made it happen!

Latest release: v5.0.3, May 15, 2026: https://www.liquibase.com/download-community
Nightly builds: Updated automatically after each successful test run on main: https://github.com/liquibase/liquibase/releases/tag/nightly
Next planned release: August 20, 2026
Roadmap: Liquibase Community (view)

Thank you to every contributor who filed an issue, reviewed code, or submitted a fix. Your work makes each Liquibase Community release stronger than the last.

What's in this release

Security

(#7689) by @​abrackxInput sanitization for generate-changelog: Closes two reported vulnerabilities.

Thanks to @​FORIMOC, @​Yuremin, and @​invoke1442 for the reports.

Notable improvements

(#7647) by @​harsh-kaushal PostgreSQL: Sequence discovery is more accurate: The sequence metadata query now uses a LEFT JOIN instead of NOT IN, improving handling of SERIAL and IDENTITY columns in complex ownership scenarios. Note: columns decoupled from their sequence after creation may still appear as autoIncrement="true" in generated changelogs. A follow-up fix is tracked separately.

(#1944) by @​MatrixDai MSSQL: systranschemas excluded from diff output: This system view was being flagged as a missing or unexpected table during diff. It's now correctly treated as a system object and filtered out.

(#7674) by @​andrewcedgar perf: cache ranChangeSets lookup in SqlChangeLogParser.generateId: Performance improvements in SqlChangeLogParser by building the lookup once per Database as a Map<changeLog, interimId> and reuse it for every subsequent file. Total work becomes O(M+N) and the per-file cost returns to ~O(1).

(#7674) by @​andrewcedgar Fixed a performance regression that caused SQL changelog parsing to slow significantly on large projects

SQL changelog parsing became significantly slower starting in 4.32.0. On projects with thousands of SQL changelog files and a large DATABASECHANGELOG history, parse time could increase from roughly 3 minutes to over 15 minutes compared to 4.31.1. This is a performance-only fix, your changelogs will parse and execute exactly as before, just faster.

Users with large SQL changelog sets should see parse times return to pre-4.32.0 levels after upgrading.

New parameter: --diff-column-default-value-constraint-name: Set to false to ignore auto-generated constraint names on column defaults during diff. Prevents false diffs in SQL Server environments where default value constraints are named differently across databases. Default: true.

Fixes

(#7660) by @​sayaliM0412 Default branch is now main: Development snapshots are now published as main-SNAPSHOT; contributors should target main for new pull requests.

(#1964, #7680) by @​MatrixDai and @​wwillard7800 Improved handling of MSSQL view definitions across two fixes: false positive diffs from inconsistent SQL Server version formatting are resolved, and schema qualifiers are now correctly preserved in generated changelogs.

  • (#1964) In Microsoft SQL Server, Liquibase incorrectly reported views as changed when comparing two databases, even when the view definitions were identical. This occurred because different SQL Server versions format view definitions differently (with or without schema prefixes and brackets). Liquibase now normalizes view definitions before comparing them, eliminating false positives in diff output.
  • (#7680) Continued improvement from the initial #1964: generate-changelog now correctly preserves schema qualifiers in MSSQL view definitions. View definitions are now normalized only during comparison, so diffs remain accurate and generated changelogs retain the original [schema].[view] qualifier.

(#7603) by @​filipelautert DATABASECHANGELOGLOCK hanging on multithreaded services: A failed cleanup left recycled threads in pooled environments in an incorrect locked state, causing unexpected errors during subsequent operations. Liquibase now correctly cleans up lock state after a command finishes, even if an error occurs during cleanup. This prevents unexpected lock errors on subsequent operations in environments that reuse threads, such as connection pools.

(#7488) by @​MalloD12 PostgreSQL with PgBouncer: fixed leaks in transaction pooling mode:

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase Community 5.0.3 is a minor patch release

See the Liquibase Community 5.0.3 Release Notes for the complete set of release information.

New Features

Bug Fixes

Security, Driver and Other Updates

... (truncated)

Commits
  • 4d815ea Guard SqlChangeLogParser.generateId against null DB connection (#7719)
  • 8d0930a Update changelog.txt for 5.0.3 (#7720)
  • 1873538 fix(ci): skip release-docker on dry-run (#7716)
  • b15d1bc fix(docker-scan): wrap downloaded artifact in expected subdir [TECHOPS-408]
  • ed1f6d7 feat(docker-scan): persist main HEAD scan to scan-results branch [TECHOPS-408...
  • 4467344 TECHOPS-432: add docker/.trivyignore to suppress SNAPSHOT-version false posit...
  • 99b99cf TECHOPS-431: add build-qa-docker.yml for community + alpine QA images (#7713)
  • 02e9e1b TECHOPS-427: bump LPM_VERSION 0.3.3 → 0.3.4 to clear 5 Go stdlib HIGH CVEs (#...
  • dda3db6 fix(DAT-22091): retarget docker-release.yml checkout from master to main (#7710)
  • ff5c1e9 fix(TECHOPS-417): propagate contents: write to nested docker workflows (#7709)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies java Pull requests that update Java code labels May 15, 2026
Copilot AI review requested due to automatic review settings May 15, 2026 18:18
@dependabot dependabot Bot requested a review from pethers as a code owner May 15, 2026 18:18
Copilot AI reviewed May 15, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 56f2313.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

parent-pom/pom.xml

PackageVersionLicenseIssue Type
org.liquibase:liquibase-core5.0.3NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/org.liquibase:liquibase-core 5.0.3 UnknownUnknown

Scanned Files

  • parent-pom/pom.xml

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026

📚 Javadoc Generated

The Javadoc documentation has been generated for this PR. Download the javadoc artifact from the workflow run to view the complete API documentation with UML diagrams.

@dependabot
build(deps): bump org.liquibase:liquibase-core from 5.0.2 to 5.0.3
56f2313 
Bumps [org.liquibase:liquibase-core](https://github.com/liquibase/liquibase) from 5.0.2 to 5.0.3.
- [Release notes](https://github.com/liquibase/liquibase/releases)
- [Changelog](https://github.com/liquibase/liquibase/blob/main/changelog.txt)
- [Commits](liquibase/liquibase@v5.0.2...v5.0.3)

---
updated-dependencies:
- dependency-name: org.liquibase:liquibase-core
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/maven/org.liquibase-liquibase-core-5.0.3 branch from a8024d1 to 56f2313 Compare May 15, 2026 18:51
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 15, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026

📚 Javadoc Generated

The Javadoc documentation has been generated for this PR. Download the javadoc artifact from the workflow run to view the complete API documentation with UML diagrams.

@pethers pethers merged commit b473a24 into master May 15, 2026
9 checks passed
@pethers pethers deleted the dependabot/maven/org.liquibase-liquibase-core-5.0.3 branch May 15, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@pethers pethers pethers approved these changes

Assignees

No one assigned

Labels

dependencies java Pull requests that update Java code size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pethers