From f5a991391dc064f1881366603f92870e85470d24 Mon Sep 17 00:00:00 2001 From: Pieter Ouwerkerk Date: Mon, 17 Aug 2026 18:20:17 -0700 Subject: [PATCH] Allow sqlparse 0.6.x sqlparse 0.6.0 (2026-08-13) fixes several denial-of-service issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping bug (CVE-2026-59894). Its only other notable change is dropping Python 3.8/3.9, which pgcli no longer supports either. The <0.6 cap prevented users from installing the fixed release; widen it to <0.7. The full test suite gives identical results on sqlparse 0.5.4 and 0.6.0 (2612 passed, 117 skipped, 1 xfailed, 1 xpassed). --- AUTHORS | 1 + changelog.rst | 4 ++++ pyproject.toml | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/AUTHORS b/AUTHORS index c8a2d4d34..db49b9eb4 100644 --- a/AUTHORS +++ b/AUTHORS @@ -153,6 +153,7 @@ Contributors: * Tommi Kyntölä (kynde) * Diego * Chris (ChrisJr404) + * Pieter Ouwerkerk (pouwerkerk) Creator: -------- diff --git a/changelog.rst b/changelog.rst index 6e4c47c36..6fb1da130 100644 --- a/changelog.rst +++ b/changelog.rst @@ -7,6 +7,10 @@ Bug fixes: * Fix ``TypeError: cannot use a string pattern on a bytes-like object`` when completion metadata comes back as bytes (e.g. ``SQL_ASCII`` client encoding). * Suggest columns, not datatypes, after a column literally named ``type`` in a ``SELECT`` list. +* Allow ``sqlparse`` 0.6.x. sqlparse 0.6.0 fixes several denial-of-service + issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping + bug (CVE-2026-59894); the previous ``<0.6`` cap prevented users from + installing the fixed release. Features: --------- diff --git a/pyproject.toml b/pyproject.toml index e9fa9b8dd..452617496 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,7 +32,7 @@ dependencies = [ "prompt_toolkit>=2.0.6,<4.0.0", "psycopg >= 3.0.14; sys_platform != 'win32'", "psycopg-binary >= 3.0.14; sys_platform == 'win32'", - "sqlparse >=0.3.0,<0.6", + "sqlparse >=0.3.0,<0.7", "configobj >= 5.0.6", "cli_helpers[styles] >= 2.4.0", # setproctitle is used to mask the password when running `ps` in command line.