From 150b65dd4f42b87988cac9cb8b3cea6e31ec7d6a Mon Sep 17 00:00:00 2001 From: Diego Date: Wed, 16 Sep 2026 16:38:22 -0300 Subject: [PATCH] Require sqlparse 0.6.0 or newer The current floor is 0.3.0, so an existing environment can satisfy the requirement with any 0.5.x release. All of them carry the advisories that 0.6.0 fixes: three denial-of-service issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping bug (CVE-2026-59894). OSV reports eleven entries for 0.5.3 and none for 0.6.0. Upstream already allows 0.6.x (the cap is <0.7), so this only raises the floor: a fresh install is unaffected, and an upgrade no longer silently keeps a vulnerable sqlparse. --- changelog.rst | 5 +++++ pyproject.toml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changelog.rst b/changelog.rst index 4df5d69dd..a8f276b75 100644 --- a/changelog.rst +++ b/changelog.rst @@ -27,6 +27,11 @@ Features: Bug fixes: ---------- +* Require ``sqlparse`` 0.6.0 or newer. Every 0.5.x release is affected by the + denial-of-service and string-escaping advisories fixed in 0.6.0 + (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491 and CVE-2026-59894), and the + ``>=0.3.0`` floor let an existing installation keep a vulnerable version + across a pgcli upgrade. * Fix special commands being broken while explain mode (F5) is on. Every input was prefixed with ``EXPLAIN (...)`` and sent to the server as SQL, including backslash commands and the bare words ``exit``/``quit``, so ``\q``, ``\d``, diff --git a/pyproject.toml b/pyproject.toml index 1f21e60ea..2de3ceb10 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,7 +31,7 @@ dependencies = [ "prompt_toolkit>=2.0.6,<4.0.0", "psycopg >= 3.0.14; sys_platform != 'win32'", "psycopg-binary >= 3.0.14; sys_platform == 'win32'", - "sqlparse >=0.3.0,<0.7", + "sqlparse >=0.6.0,<0.7", "configobj >= 5.0.6", "cli_helpers[styles] >= 2.4.0", # setproctitle is used to mask the password when running `ps` in command line.