Skip to content

Upgrading sqlparse 0.4 to 0.5

Breaking0.4.4 → 0.5.5Security4Platform3New11Changed4Fixed16Other1

Full comparisonBack to sqlparse
BreakingUpgrade verdict

3 platform requirement changes and 4 security fixes.

In plain terms
  • The package can now be installed and used with Python 3.14.
  • The library no longer runs on older Python versions 3.5, 3.6, and 3.7.
  • The library now works on Python 3.12.
  • New safeguards stop maliciously complex SQL from making the parser hang; the limits can be raised or turned off for legitimate large statements.
Must act Top 5 of 7 that need code or config changes

Python requirement changed in 0.5.0: >=3.5 → >=3.8.

What you must change

Security4
Adds configurable limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) to protect against DoS when parsing large tuple lists.
MAX_GROUPING_DEPTHMAX_GROUPING_TOKENS
0.5.4CHANGELOGSummarizedView source
sqlparse: formatting list of tuples leads to denial of service
Moderate
0.5.4GitHub AdvisoryOriginalView source
Introduces more generalized handling of potential denial of service attacks caused by recursion errors on deeply nested statements.
0.5.3CHANGELOGSummarizedView source
Fixes a potential denial of service from recursion errors on deeply nested statements by raising SQLParseError instead.
SQLParseErrorHigh · CVSS 7.5
0.5.0CHANGELOGSummarizedView source
Platform3
Adds support for Python 3.14.
0.5.4CHANGELOGSummarizedView source
Drops support for Python 3.5, 3.6, and 3.7.
0.5.0CHANGELOGSummarizedView source
Adds support for Python 3.12.
0.5.0CHANGELOGSummarizedView source