Upgrading sqlparse 0.5 to 0.6
Breaking0.5.5 → 0.6.1Security7Platform1New1Changed1Fixed9Other4
SecurityEscapes dollar signs in the `php` output format to prevent PHP code injection via `$var`, `${expr}` and `{$expr}` (CVE-2026-112307).CVE-2026-112307 ↗
BreakingUpgrade verdict
A platform requirement change and 7 security fixes.
In plain terms
- The library no longer runs on Python 3.8 or 3.9. You need Python 3.10 or newer.
- Generated PHP snippets could let SQL text inject PHP code; dollar signs are now escaped.
- Crafting SQL with many unterminated quotes could make formatting hang; this is now fixed.
- A crafted SQL statement could make the parser use enormous amounts of CPU and hang. This is now fixed.
Must act Top 4 of 8 that need code or config changes
Python requirement changed in 0.6.0: >=3.8 → >=3.10.
What you must change
Security7
Escapes dollar signs in the
php output format to prevent PHP code injection via $var, ${expr} and {$expr} (CVE-2026-112307).phpFixes a potential denial of service in
format() that consumed CPU quadratically on statements with many unclosed quotes.format()sqlformatFixes a potential denial of service in the lexer with many unclosed dollar-quoted literals or multiline comments (CVE-2026-59893).
High · CVSS 7.5Fixes a potential denial of service when grouping deeply nested or very wide statements (CVE-2026-54284).
Fixes a potential denial of service in format(sql, reindent=True) on long lists of tuples.
format()reindentFixes a potential denial of service on statements that consist only of comments (CVE-2026-71491).
Escapes backslashes in the python and php output formats to prevent breaking out of string literals (CVE-2026-59894).
pythonphpPlatform1
Drops support for Python 3.8 and 3.9; Python 3.10+ is now required.