Skip to content

chore(deps): bump sqlparse from 0.5.5 to 0.6.0 - #307

Merged
mergify[bot] merged 1 commit into
mainfrom
dependabot/pip/sqlparse-0.6.0
Aug 31, 2026
Merged

chore(deps): bump sqlparse from 0.5.5 to 0.6.0#307
mergify[bot] merged 1 commit into
mainfrom
dependabot/pip/sqlparse-0.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps sqlparse from 0.5.5 to 0.6.0.

Changelog

Sourced from sqlparse's changelog.

Release 0.6.0 (Aug 13, 2026)

Notable Changes

  • Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
  • IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer, which consumed CPU quadratically on statements containing many unclosed dollar-quoted literals or multiline comments (CVE-2026-59893). See the security advisory for details: GHSA-prg7-hcfm-mfcr The vulnerability was discovered by EQSTLab, min8282 and 7thpark. Thanks for reporting!
  • IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping deeply nested or very wide statements. Building a token group re-read the whole group on every step, so a small statement could keep a worker busy for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
  • IMPORTANT: Fixes a potential denial of service attack (DOS) in format(sql, reindent=True), which consumed CPU quadratically on long lists of tuples. See the security advisory for details: GHSA-cfqr-cjx5-5jcm
  • IMPORTANT: Fixes a potential denial of service attack (DOS) on statements that consist only of comments (CVE-2026-71491). See the security advisory for details: GHSA-f2ff-p2ww-7p4p The vulnerability was discovered by @​sanktjodel. Thanks for reporting!
  • IMPORTANT: Backslashes are now escaped in the python and php output formats. Without escaping, SQL containing a backslash could break out of the generated string literal (CVE-2026-59894). See the security advisory for details: GHSA-3496-9g83-7v6x The vulnerability was discovered by @​7thParkk. Thanks for reporting!

Enhancements

  • Modernize type annotations in top-level API functions using PEP 585 and PEP 604 syntax.
  • END FOR and END CASE are now recognized as keywords.

Bug Fixes

  • Statement splitting was rewritten on a stack-based architecture. This fixes splitting of statements with nested BEGIN ... END blocks (issue845).
  • Fix function grouping being skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase (pr867 by Osamaali313).
  • Recognize ROW_FORMAT as a keyword so that ALTER TABLE ... ROW_FORMAT=... no longer merges the table name and the option into a single identifier (issue773, pr860 by apoorvdarshan).
  • Recognize MATERIALIZED as a keyword so it is parsed and formatted consistently in CREATE MATERIALIZED VIEW statements (issue752, pr854 by

... (truncated)

Commits
  • 2f40da9 Update version number.
  • 5753f15 Align the changelog entries for this release with previous ones
  • b9588d9 Unify the benchmark scripts on a shared harness
  • 519e416 Pair comment/dollar-quote delimiters at the lexer position
  • a51df6d Measure reindent offsets backwards to avoid quadratic CPU use
  • 73d9ccd Update CHANGELOG
  • d1d8060 Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-qu...
  • ef2012a Fix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)
  • 26112dd Update Changelog.
  • 53ff44b Escape backslashes in output formatters.
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 31, 2026
@mergify
mergify Bot deployed to Mergify Merge Protections August 31, 2026 07:05 Active
@mergify

mergify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

  • all of:
    • check-success=Test with Python 3.10
    • check-success=Test with Python 3.11
    • check-success=Test with Python 3.12
    • check-success=semgrep

🟢 👀 Review Requirements

  • any of:
    • author = dependabot[bot]
    • #approved-reviews-by>=1

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

  • #changes-requested-reviews-by = 0
  • #review-requested = 0
  • #review-threads-unresolved = 0

🟢 📕 PR description

  • body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

@mergify

mergify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-08-31 07:09 UTC · Rule: dependencies · triggered by merge protections
  • 🚫 Left the queue — 2026-08-31 07:20 UTC · at bceb123c8a62da07b68f5b9465868c60cbd92caa

This pull request spent 11 minutes 31 seconds in the queue, with no time running CI.

Reason

The pull request conflicts with the base branch

The pull request was held in the queue, conflicting with 1 pull request ahead of it. The conflict became a base branch one after #305 merged.

Hint

You should update or rebase your pull request.

If you want to requeue this pull request, you can post a @mergifyio queue comment.

Requeued — the merge queue status continues in this comment ↓.

@mergify

mergify Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

@dependabot[bot] this pull request is now in conflict 😩

@mergify mergify Bot added the conflict label Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlparse-0.6.0 branch from bceb123 to a4766c8 Compare August 31, 2026 07:22
@mergify
mergify Bot deployed to Mergify Merge Protections August 31, 2026 07:23 Active
@mergify mergify Bot removed the dequeued label Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlparse-0.6.0 branch from a4766c8 to 49b8f18 Compare August 31, 2026 07:36
@mergify
mergify Bot deployed to Mergify Merge Protections August 31, 2026 07:36 Active
@mergify mergify Bot removed the conflict label Aug 31, 2026
@mergify

mergify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-08-31 07:47 UTC · Rule: dependencies · triggered by merge protections
  • 🚫 Left the queue — 2026-08-31 08:27 UTC · at 49b8f18e40f11798a01d0f828dfa3bc5b5e2e8fb

This pull request spent 40 minutes 27 seconds in the queue, with no time running CI.

Reason

The pull request conflicts with the base branch

The pull request was held in the queue, conflicting with 1 pull request ahead of it. The conflict became a base branch one after #306 merged.

Hint

You should update or rebase your pull request.

If you want to requeue this pull request, you can post a @mergifyio queue comment.

Requeued — the merge queue status continues in this comment ↓.

@mergify

mergify Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

@dependabot[bot] this pull request is now in conflict 😩

@mergify mergify Bot added the conflict label Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlparse-0.6.0 branch from 49b8f18 to db7ed99 Compare August 31, 2026 08:29
@mergify
mergify Bot deployed to Mergify Merge Protections August 31, 2026 08:29 Active
@mergify

mergify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-08-31 08:36 UTC · Rule: dependencies · triggered by merge protections
  • 🚫 Left the queue — 2026-08-31 08:41 UTC · at db7ed9989cd6df7e100caee27b53ad5888ee5a66

This pull request spent 5 minutes 41 seconds in the queue, with no time running CI.

Reason

The pull request conflicts with the base branch

The pull request was held in the queue, conflicting with 1 pull request ahead of it. The conflict became a base branch one after #309 merged.

Hint

You should update or rebase your pull request.

If you want to requeue this pull request, you can post a @mergifyio queue comment.

Requeued — the merge queue status continues in this comment ↓.

@mergify mergify Bot added the queued label Aug 31, 2026
@mergify mergify Bot added dequeued and removed queued labels Aug 31, 2026
@mergify

mergify Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

@dependabot[bot] this pull request is now in conflict 😩

@mergify mergify Bot added the conflict label Aug 31, 2026
@dependabot
chore(deps): bump sqlparse from 0.5.5 to 0.6.0
e6f63a0 
Bumps [sqlparse](https://github.com/andialbrecht/sqlparse) from 0.5.5 to 0.6.0.
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](andialbrecht/sqlparse@0.5.5...0.6.0)

---
updated-dependencies:
- dependency-name: sqlparse
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlparse-0.6.0 branch from db7ed99 to e6f63a0 Compare August 31, 2026 08:43
@mergify mergify Bot removed the conflict label Aug 31, 2026
@mergify
mergify Bot deployed to Mergify Merge Protections August 31, 2026 08:44 Active
@mergify mergify Bot removed the dequeued label Aug 31, 2026
@mergify

mergify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-08-31 08:45 UTC · Rule: dependencies · triggered by merge protections
  • ✅ Checks skipped · PR is already up-to-date
  • ✅ Merged — 2026-08-31 08:50 UTC · at e6f63a05ac5dded18d948e55e3ba9ec5bbf59eb3 · fast-forward

This pull request spent 5 minutes 35 seconds in the queue, including 17 seconds running CI.

Required conditions to merge

@mergify mergify Bot added the queued label Aug 31, 2026
@mergify
mergify Bot merged commit e6f63a0 into main Aug 31, 2026
6 checks passed
@mergify
mergify Bot deleted the dependabot/pip/sqlparse-0.6.0 branch August 31, 2026 08:50
@mergify mergify Bot removed the queued label Aug 31, 2026
sileht added a commit that referenced this pull request Aug 31, 2026
@sileht @claude
test: pin statement_type values changed by sqlparse 0.6.0
83fb20f 
The bump itself landed in #307. This is the part that PR carried no record
of: sqlparse 0.6.0 lexes MATERIALIZED as a keyword, so the two-keyword
heuristic in `Statement.statement_type` stops at the modifier instead of
reaching the object, and four public values changed meaning.

  CREATE MATERIALIZED VIEW    "CREATE VIEW"  -> "CREATE MATERIALIZED"
  DROP MATERIALIZED VIEW      "DROP VIEW"    -> "DROP MATERIALIZED"
  ALTER MATERIALIZED VIEW     "ALTER VIEW"   -> "ALTER MATERIALIZED"
  REFRESH MATERIALIZED VIEW   "VIEW"         -> "MATERIALIZED"

`Statement` is exported and `diff()`/`diff_files()` return `set[Statement]`,
so a consumer bucketing on those strings is affected. Nothing inside
sql-compare branches on the value except `UnorderedTokenList.STATEMENT_TYPES`,
which matched none of them before or after, so comparison results are
unchanged.

Also pins two cases that predate 0.6.0, because they show the same truncation
already has teeth: `CREATE TEMPORARY TABLE` yields "CREATE TEMPORARY", which
is not in STATEMENT_TYPES, so temporary tables silently lose the column-order
insensitivity that plain CREATE TABLE gets. `CREATE UNLOGGED TABLE` is
included as the contrast - UNLOGGED is not a sqlparse keyword, so it is
skipped and the type still resolves to "CREATE TABLE".

Claude-Session: https://claude.ai/code/session_01XkWQRxh5pfi2Fbuv3Z9wen
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Change-Id: If5b05d1f96310d93905b8f759e12d84f6f1d363f
@sileht sileht mentioned this pull request Aug 31, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants