From 2a79c7935ee896c7143a45d29da7e6bdd9f0fa2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Wirtel?= Date: Thu, 24 Sep 2026 07:51:33 +0200 Subject: [PATCH] fix(deps): upgrade sqlparse to 0.6.0 for security fixes Resolves multiple high/medium severity Dependabot alerts: quadratic CPU consumption during tuple list reindentation and comment grouping, ReDoS on dollar-quoted SQL literals, unbounded value materialization in TokenList.__init__ before depth/token caps trigger, and SQL string breakout via unescaped backslashes in generated Python/PHP snippets. GHSA-cfqr-cjx5-5jcm, GHSA-prg7-hcfm-mfcr, GHSA-pwgv-4x5q-6m9f, GHSA-f2ff-p2ww-7p4p, GHSA-3496-9g83-7v6x Co-Authored-By: Claude Sonnet 5 --- requirements/dev.txt | 2 +- requirements/main.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/dev.txt b/requirements/dev.txt index 993a357..635bafe 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -189,7 +189,7 @@ soupsieve==2.8.3 # via # -c requirements/main.txt # beautifulsoup4 -sqlparse==0.5.5 +sqlparse==0.6.0 # via # -c requirements/main.txt # django diff --git a/requirements/main.txt b/requirements/main.txt index f1b76e7..1ac1124 100644 --- a/requirements/main.txt +++ b/requirements/main.txt @@ -157,7 +157,7 @@ six==1.17.0 # via python-dateutil soupsieve==2.8.3 # via beautifulsoup4 -sqlparse==0.5.5 +sqlparse==0.6.0 # via django static3==0.7.0 # via dj-static