[dependabot]

Updates the requirements on sqlparse to permit the latest version.

Changelog

Sourced from sqlparse's changelog.

Release 0.6.1 (Nov 01, 2026)

End of Maintenance

Version 0.6.1 marks the final release of sqlparse.

After many years of maintaining this project, I have decided to end its active development and maintenance. The increasing volume of security reports, particularly those generated through automated vulnerability research, has made the workload unsustainable for me as a sole volunteer maintainer.

No further releases, including security fixes, are planned. The source code and existing releases will remain available.

I would like to thank everyone who has contributed to sqlparse over the years.

Notable Changes

• IMPORTANT: Dollar signs are now escaped in the php output format. PHP interpolates $var, ${expr} and {$expr} inside double-quoted strings, so SQL text containing them could inject PHP code into the generated snippet (CVE-2026-112307, pr937 by cve-zh00). See the security advisory for details: GHSA-xmww-55xg-h3vc The vulnerability was discovered by @​iRevivalx, @​Gares95, @​manus-pi, @​president-xd, @​arpitjain099 and @​Tan-JunWei. Thanks for reporting!
• IMPORTANT: Fixes a potential denial of service attack (DOS) in format(), which consumed CPU quadratically on statements containing many quotes that are never closed. This affected format() with default options and the sqlformat command. See the security advisory for details: GHSA-3r5h-5jcg-gmgg The vulnerability was discovered by @​LinFeng-1219 and @​president-xd. Thanks for reporting!

Bug Fixes

• Fix IndexError and ValueError in format() on some malformed statements, e.g. ( as ) with reindent=True or a CASE without its own END with reindent_aligned=True. Grouping no longer moves the brackets of a parenthesis or the CASE/END keywords into an inner group.
• sqlformat no longer empties the file given with --in-place or --outfile when formatting fails, e.g. because a statement exceeds the grouping limits. The output file is now only written after formatting succeeded, and the error is reported like other CLI errors. Thanks to @​Joejiaojian, @​president-xd, @​hash3liZer and @​eros938 for reporting!

... (truncated)

Commits

• 09dbe1e Release 0.6.1 and announce end of maintenance
• be3b7a6 Fix quadratic format DoS in newline splitting
• 91149df Merge branch 'pr-937'
• 20caed8 Prevent CLI from truncating files on format errors
• 3512a9d Fix formatter crashes on malformed grouped input
• bb3c50a fix: escape dollar signs in PHP output format (CVE-2026-112307)
• 60cdc64 Back to development mode.
• d279be4 Publish fixes.
• 2f40da9 Update version number.
• 5753f15 Align the changelog entries for this release with previous ones
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)