pypi / sqlparse

sqlparse

What changed in sqlparse 0.5 to 0.6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

2 breaking12 security1 new APIs and options4 tooling16 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

sqlparse 0.618 changes

Support for Python 3.8 and 3.9 is dropped; Python 3.10 or newer is required.
0.6.0release notes

Fixes a denial-of-service issue affecting statements that consist only of comments.
0.6.0release notes
Fixes quadratic CPU consumption on statements containing many unclosed dollar-quoted literals or multiline comments.
0.6.0release notes
Backslashes are now escaped in this output format so SQL containing a backslash cannot break out of the generated string literal.
0.6.0release notes
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
0.6.0security advisory release notes
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
0.6.0security advisory
sqlparse: Quadratic O(n²) DoS in group_comments
0.6.0security advisory
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
0.6.0security advisory release notes
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
0.6.0security advisory
Fixes excessive CPU use when grouping deeply nested or very wide statements.
0.6.0release notes

Type annotations on top-level API functions now use PEP 585 and PEP 604 syntax.
0.6.0release notes

A keyword followed by a float literal without a leading zero is no longer reclassified as an identifier, so bounds such as .03 and .06 parse as numbers.
0.6.0release notes
These SQL constructs are now recognized as keywords.
0.6.0release notes
Function grouping is no longer skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase.
0.6.0release notes
Fixes name extraction for names with more than two dotted parts.
0.6.0release notes
Recognizing MATERIALIZED as a keyword makes CREATE MATERIALIZED VIEW statements parse and format consistently.
0.6.0release notes
Recognizing ROW_FORMAT as a keyword prevents the table name and option from merging into one identifier in ALTER TABLE statements.
0.6.0release notes
Fixes a late-binding closure bug in TokenList.token_not_matching.
0.6.0release notes

Grouping limits now raise SQLParseError instead of silently returning None, allowing developers to handle the error.
0.5.5release notes

A configurable grouping-depth limit adds protection against denial of service attacks and can be adjusted or disabled by setting it to None.
0.5.4release notes
A configurable token-processing limit adds protection against denial of service attacks and can be adjusted or disabled by setting it to None.
0.5.4release notes
sqlparse: formatting list of tuples leads to denial of service
0.5.4security advisory

A py.typed marker enables PEP 561 compliance and type checking with mypy and other tools.
0.5.4release notes
The CLI can now be used as a pre-commit hook to automatically format SQL files and accepts multiple files.
0.5.4release notes
Top-level API functions now have type annotations, enabling type checking with mypy and other tools.
0.5.4release notes

Splitting of BEGIN TRANSACTION statements is fixed.
0.5.5release notes
ATTACH is now recognized as a PostgreSQL keyword.
0.5.4release notes
DETACH is now recognized as a PostgreSQL keyword.
0.5.4release notes
INTERSECT is now recognized among close keywords in a WHERE clause.
0.5.4release notes
sqlparse now supports Python 3.14.
0.5.4release notes
REGEXP BINARY is now supported as a comparison operator.
0.5.4release notes
Splitting statements with nested BEGIN ... END blocks is fixed.
0.5.4release notes release notes
Fixed splitting statements with IF EXISTS or IF NOT EXISTS inside BEGIN...END blocks.
0.5.4release notes
Fixed strip_comments not removing all comments when the input contains only comments.
0.5.4release notes