Change Intelligence is coming.

Get a First Look

Liquibase Secure 5.2.2 Release notes

Liquibase Secure 5.2.2 is a maintenance release that adds command-line flexibility and sharpens the speed and accuracy of schema comparison.

Download Liquibase Secure 5.2.2

What's new

Command line argument flexibility

You can now pass any command-line argument on either side of the command name, and set any command argument through a matchingLIQUIBASE_<ARG>environment variable, so a command no longer fails with an "Unexpected argument" error just because a flag sits on the wrong side of the command

Snapshot performance improvements

Large-schemasnapshotandgenerate-changelogruns are significantly faster. On large Oracle schemas,generate-changelogdrops from over an hour to five to ten minutes. This release also corrects several Microsoft SQL Server and multi-schema accuracy issues. Finally, defaults-file validation is more precise, so thePotentially ignored key(s)warning lists only keys that truly failed to bind.

Security vulnerability report

This release includes updates to internal platform components and third-party dependencies to address known security vulnerabilities and strengthen the overall platform security posture of Liquibase Secure. These updates help organizations maintain secure deployment environments, improve compliance readiness, and reduce operational risk associated with outdated software components.

CVE Summary

Updated the PostgreSQL JDBC driver (pgjdbc) from 42.7.11 to 42.7.13, resolving CVE-2026-54291.

Liquibase Secure also includes VEX (Vulnerability Exploitability eXchange) files with every release to communicate Liquibase's official assessment of reported CVEs. Refer to the VEX file included with the 5.2.2 release (files ending in .vex.json) for the complete list of vulnerability assessments and exploitability status. For more information about VEX files and how to interpret their status values, see the VEX documentation.

Full list of changes

  • Command-line arguments

    : Liquibase Secure now accepts any command-line argument in either position, before or after the command, and lets you set any command argument through a matching LIQUIBASE_ environment variable, so your commands no longer fail with an "Unexpected argument" error just because a flag sits on the wrong side of the command. See Working with Command Parameters and What are Liquibase environment variables?. [SECURE-445, SECURE-469]

  • Performance Improvements

    : Large-schema snapshot and generate-changelog commands are much faster. These commands could run much slower than expected on large schemas, especially Oracle schemas with many stored package bodies. We fixed several performance issues affecting check-constraint lookups, SQL formatting, and package body loading, cutting generate-changelog time on large Oracle schemas from over an hour to five to ten minutes. This issue was present in Liquibase Secure 5.2.1. [SECURE-570]

  • Changelog fixes

    : Fixed a regression where generate-changelog against Microsoft SQL Server placed the createIndex changeset for an indexed view before its createView changeset, producing a changelog that failed to deploy on a fresh database. [SECURE-513]

  • Computes column fixes

    : Fixed a regression (introduced in 5.2.1) where diff against Microsoft SQL Server falsely reported changed computed columns when a same-named computed column existed in another schema, causing spurious drift results even when the database was unchanged. [SECURE-512]

  • Drift & diff fixes

    : Resolved an issue where drift and diff commands could report false check-constraint changes on multi-schema databases with cross-schema foreign keys. This was most noticeable in reset workflows that snapshot immediately after a rollback, where unrelated schemas' check constraints could be misreported or dropped from the snapshot. Drift results for these environments are now accurate and consistent between runs. [SECURE-506]

  • Validationa and rollback improvements

    : Improved the accuracy of defaults file validation during update rollback handling so the Potentially ignored key(s) warning only reports keys that truly failed to bind, instead of also listing valid, correctly applied keys like contexts and labelFilter. This issue was present in Liquibase Secure 5.1.1. [SECURE-225]