What's Included

What's new

Liquibase Secure 5.0.1 update addresses reported CVEs in third-party libraries, improves propagation of exit codes on Windows, and resolves path-handling issues when JAVA_HOME contains spaces.

Security Updates

As part of our regular maintenance cycle, several third-party dependencies have been updated to remediate reported security vulnerabilities. These vulnerabilities are not exploitable within Liquibase’s implementation. Updating identified dependencies maintains compliance with security scanning tools and aligns with industry best practices for dependency management.

CVEs and impacted libraries

Breaking changes

There are breaking changes in the Liquibase Secure 5.0 major release that users should be aware of. These include the installation and download changes, where Liquibase Community and Liquibase Secure are separate distributions. Liquibase Secure now requires Java 17 and later, and these drivers are not included in the Secure installation.

Breaking change: Installation & download updates

With Liquibase 5.0, we introduced separate distribution channels for Liquibase Community and Liquibase Secure.

The installer locations for Liquibase Secure have changed. To continue using your Secure license and features, you need to update to the new distribution source for your deployment method.

What You Need to Do

Review the table below to identify your deployment method and follow the migration guide link:

Important: Previous distribution sources now point to Liquibase Community and will not apply Secure licenses or enable commercial features.

Verification

After updating, run liquibase --version to confirm you see:

Liquibase Secure Version: 5.0.1

Liquibase Secure license issued to [Your Organization]...

Breaking change: Technology Updates

Support for Java 8 and Java 11 has been deprecated. Liquibase Secure now requires Java 17 and later, providing improved performance, stability, and long-term support.

Breaking change: Driver not included

The MySQL driver is not included in the Liquibase Secure download. If you are a MySQL user, obtain the driver here. We recommend using the platform-independent version.

Windows Platform Improvements

• Fixed exit code propagation for Windows installers and GitHub Actions - commands now correctly report success/failure status

• Resolved path handling when JAVA_HOME contains spaces, fixing liquibase -v command execution in Windows/GitBash environments

Changelog

Updates and Bugfixes

• Resolve CVEs by @abrackx

• [DAT-20975] Handle spaces in the Java version check by @wwillard7800

• [DAT-20879] Exit with error code after running Liquibase by @wwillard7800

Additional Resources

The OWASP Security Scan is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. These false positives appear in the OWASP report in 5.0.1.

• OWASP Dependency Check Report