Bump sqlparse from 0.5.4 to 0.6.0

[dependabot]

Bumps sqlparse from 0.5.4 to 0.6.0.

Changelog

Sourced from sqlparse's changelog.

Release 0.6.0 (Aug 13, 2026)

Notable Changes

• Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
• IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer, which consumed CPU quadratically on statements containing many unclosed dollar-quoted literals or multiline comments (CVE-2026-59893). See the security advisory for details: GHSA-prg7-hcfm-mfcr The vulnerability was discovered by EQSTLab, min8282 and 7thpark. Thanks for reporting!
• IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping deeply nested or very wide statements. Building a token group re-read the whole group on every step, so a small statement could keep a worker busy for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
• IMPORTANT: Fixes a potential denial of service attack (DOS) in format(sql, reindent=True), which consumed CPU quadratically on long lists of tuples. See the security advisory for details: GHSA-cfqr-cjx5-5jcm
• IMPORTANT: Fixes a potential denial of service attack (DOS) on statements that consist only of comments (CVE-2026-71491). See the security advisory for details: GHSA-f2ff-p2ww-7p4p The vulnerability was discovered by @​sanktjodel. Thanks for reporting!
• IMPORTANT: Backslashes are now escaped in the python and php output formats. Without escaping, SQL containing a backslash could break out of the generated string literal (CVE-2026-59894). See the security advisory for details: GHSA-3496-9g83-7v6x The vulnerability was discovered by @​7thParkk. Thanks for reporting!

Enhancements

• Modernize type annotations in top-level API functions using PEP 585 and PEP 604 syntax.
• END FOR and END CASE are now recognized as keywords.

Bug Fixes

• Statement splitting was rewritten on a stack-based architecture. This fixes splitting of statements with nested BEGIN ... END blocks (issue845).
• Fix function grouping being skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase (pr867 by Osamaali313).
• Recognize ROW_FORMAT as a keyword so that ALTER TABLE ... ROW_FORMAT=... no longer merges the table name and the option into a single identifier (issue773, pr860 by apoorvdarshan).
• Recognize MATERIALIZED as a keyword so it is parsed and formatted consistently in CREATE MATERIALIZED VIEW statements (issue752, pr854 by

... (truncated)

Commits

• 2f40da9 Update version number.
• 5753f15 Align the changelog entries for this release with previous ones
• b9588d9 Unify the benchmark scripts on a shared harness
• 519e416 Pair comment/dollar-quote delimiters at the lexer position
• a51df6d Measure reindent offsets backwards to avoid quadratic CPU use
• 73d9ccd Update CHANGELOG
• d1d8060 Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-qu...
• ef2012a Fix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)
• 26112dd Update Changelog.
• 53ff44b Escape backslashes in output formatters.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[millerdev]

🔍 Dependency Analysis Summary

• This PR bumps sqlparse 0.5.4 → 0.6.0 (the Dependabot target), and is bundled with two additional commits on this branch: psycopg2-binary 2.9.10 → 2.9.12, and a version 4.0.0 release that drops Python 3.9 support — required because sqlparse 0.6.0 itself now requires Python 3.10+.
• Overall risk assessment: LOW

📋 Detailed Changelog Review

sqlparse (0.5.4 → 0.6.0)

• Changes: Drops Python 3.8/3.9 support; statement splitting rewritten on a stack-based architecture (fixes nested BEGIN...END handling); adds recognition of END FOR, END CASE, ROW_FORMAT, MATERIALIZED as keywords; fixes CREATE TABLE ... AS SELECT grouping when as is lowercase; modernizes type annotations (PEP 585/604).
• Breaking Changes: Requires Python 3.10+ (this repo already dropped 3.9 in the same branch to accommodate it). No public API removals affecting typical usage.
• Migration Notes: None beyond the Python version floor.

psycopg2-binary (2.9.10 → 2.9.12)

• Changes: Routine patch-level updates (wheel/build updates, expanded platform wheels including riscv64).
• Breaking Changes: None found.
• Migration Notes: None — this is a dev dependency group package used only for the test suite, not shipped to consumers.

⚠️ Impact Assessment

• Breaking Changes Found: No, for django-cte's own code. sqlparse is not imported anywhere in django_cte/ — it's a transitive dependency pulled in via Django (used for SQL formatting in Django's debug pages/admin), so this bump has no direct code impact here.
• Affected Files: pyproject.toml, uv.lock, django_cte/__init__.py, CHANGELOG.md (all already updated in this PR to reflect the Python 3.9 drop and version bump).
• Test Impact: None expected. Note the CI matrix (.github/workflows/tests.yml) still lists explicit exclude entries for python: '3.9' — these are now harmless dead entries since the matrix's python_versions input is generated dynamically from pyproject.toml classifiers (which no longer list 3.9), but could be cleaned up for clarity in a follow-up.
• Configuration Changes: None required by consumers of this package beyond ensuring Python 3.10+ per the new requires-python floor.

🛠️ Recommendations

• Action Required: None blocking — the Python 3.9 drop was already handled correctly in this branch alongside the sqlparse bump.
• Testing Focus: Standard CI run across the supported Python/Django matrix is sufficient; no sqlparse-specific test coverage needed given it's not directly used.
• Follow-up Tasks: Consider a small cleanup PR to remove the now-dead python: '3.9' exclude entries in .github/workflows/tests.yml.
• Merge Recommendation: APPROVE

📚 Useful Links

• sqlparse changelog
• sqlparse 0.5.4...0.6.0 compare