# What changed in sqlparse

> 35 changes in sqlparse 0.5 to 0.6 from its official release notes, upgrade guides and advisories: 2 breaking, 12 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/sqlparse/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## sqlparse 0.6

### Breaking changes

- Support for Python 3.8 and 3.9 is dropped; Python 3.10 or newer is required. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)

### Security

- Fixes a denial-of-service issue affecting statements that consist only of comments. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Fixes quadratic CPU consumption on statements containing many unclosed dollar-quoted literals or multiline comments. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Backslashes are now escaped in this output format so SQL containing a backslash cannot break out of the generated string literal. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (0.6.0) — [security advisory](https://github.com/advisories/GHSA-3496-9G83-7V6X), [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) (0.6.0) — [security advisory](https://github.com/advisories/GHSA-PRG7-HCFM-MFCR)
- sqlparse: Quadratic O(n²) DoS in group_comments (0.6.0) — [security advisory](https://github.com/advisories/GHSA-F2FF-P2WW-7P4P)
- sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption (0.6.0) — [security advisory](https://github.com/advisories/GHSA-CFQR-CJX5-5JCM), [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (0.6.0) — [security advisory](https://github.com/advisories/GHSA-PWGV-4X5Q-6M9F)
- Fixes excessive CPU use when grouping deeply nested or very wide statements. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)

### Tooling

- Type annotations on top-level API functions now use PEP 585 and PEP 604 syntax. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)

### Fixes and other changes

- A keyword followed by a float literal without a leading zero is no longer reclassified as an identifier, so bounds such as .03 and .06 parse as numbers. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- These SQL constructs are now recognized as keywords. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Function grouping is no longer skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Fixes name extraction for names with more than two dotted parts. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Recognizing MATERIALIZED as a keyword makes CREATE MATERIALIZED VIEW statements parse and format consistently. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Recognizing ROW_FORMAT as a keyword prevents the table name and option from merging into one identifier in ALTER TABLE statements. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)
- Fixes a late-binding closure bug in TokenList.token_not_matching. (0.6.0) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026)

## sqlparse 0.5

### Breaking changes

- Grouping limits now raise SQLParseError instead of silently returning None, allowing developers to handle the error. (0.5.5) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-055-dec-19-2025)

### Security

- A configurable grouping-depth limit adds protection against denial of service attacks and can be adjusted or disabled by setting it to None. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- A configurable token-processing limit adds protection against denial of service attacks and can be adjusted or disabled by setting it to None. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- sqlparse: formatting list of tuples leads to denial of service (0.5.4) — [security advisory](https://github.com/advisories/GHSA-27JP-WM6Q-GP25)

### New APIs and options

- The CLI adds --in-place for editing SQL files in place. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)

### Tooling

- A py.typed marker enables PEP 561 compliance and type checking with mypy and other tools. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- The CLI can now be used as a pre-commit hook to automatically format SQL files and accepts multiple files. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- Top-level API functions now have type annotations, enabling type checking with mypy and other tools. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)

### Fixes and other changes

- Splitting of BEGIN TRANSACTION statements is fixed. (0.5.5) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-055-dec-19-2025)
- ATTACH is now recognized as a PostgreSQL keyword. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- DETACH is now recognized as a PostgreSQL keyword. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- INTERSECT is now recognized among close keywords in a WHERE clause. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- sqlparse now supports Python 3.14. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- REGEXP BINARY is now supported as a comparison operator. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- Splitting statements with nested BEGIN ... END blocks is fixed. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-060-aug-13-2026), [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- Fixed splitting statements with IF EXISTS or IF NOT EXISTS inside BEGIN...END blocks. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)
- Fixed strip_comments not removing all comments when the input contains only comments. (0.5.4) — [release notes](https://github.com/andialbrecht/sqlparse/blob/60cdc649726bf1bc4f1b336050560b336da715ec/CHANGELOG#release-054-nov-28-2025)