id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37284	Bump minimum sqlparse version from 0.5.0 to 0.6.0 (security fixes)	Paolo Melchiorre	Paolo Melchiorre	"Django currently requires {{{sqlparse >= 0.5.0}}}. sqlparse 0.6.0 (Aug 13, 2026) fixes several security vulnerabilities, including multiple denial-of-service issues. To ensure every Django install ships with these fixes, the minimum required version should be raised to {{{0.6.0}}}.

Changelog: [https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG sqlparse CHANGELOG]

=== Vulnerabilities in 0.6.0 that affect Django's usage of sqlparse ===

Django uses sqlparse in the database layer ({{{django.db.backends}}}):

 * {{{sqlparse.split()}}} and {{{sqlparse.format(..., strip_comments=True)}}} in [https://github.com/django/django/blob/main/django/db/backends/base/operations.py {{{BaseDatabaseOperations.prepare_sql_script}}}] (migrations/fixtures SQL).
 * {{{sqlparse.format(sql, reindent=True, keyword_case=""upper"")}}} in [https://github.com/django/django/blob/main/django/db/backends/base/operations.py#L875 {{{BaseDatabaseOperations.format_debug_sql}}}].
 * {{{sqlparse.parse()}}} in the [https://github.com/django/django/blob/main/django/db/backends/mysql/introspection.py MySQL] and [https://github.com/django/django/blob/main/django/db/backends/sqlite3/introspection.py SQLite] introspection backends.

These code paths are exposed to the following 0.6.0 fixes:

 * [https://nvd.nist.gov/vuln/detail/CVE-2026-59893 CVE-2026-59893] — DoS in the lexer on unclosed dollar-quoted literals or multiline comments (affects {{{split}}}/{{{parse}}}/{{{format}}}).
 * [https://nvd.nist.gov/vuln/detail/CVE-2026-54284 CVE-2026-54284] — DoS when grouping deeply nested or very wide statements (affects {{{parse}}} used in introspection).
 * [https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm GHSA-cfqr-cjx5-5jcm] — DoS in {{{format(sql, reindent=True)}}} on long lists of tuples (directly used by {{{format_debug_sql}}}).
 * [https://nvd.nist.gov/vuln/detail/CVE-2026-71491 CVE-2026-71491] — DoS on statements consisting only of comments (affects {{{split}}}/{{{format(strip_comments=True)}}} in {{{prepare_sql_script}}}).

A fifth fix, [https://nvd.nist.gov/vuln/detail/CVE-2026-59894 CVE-2026-59894] (backslash escaping in the {{{python}}}/{{{php}}} output formatters), does not directly affect Django, as Django does not use those formatters, but is included for defense in depth.

=== Proposed change ===

Raise the minimum supported version of sqlparse from {{{0.5.0}}} to {{{0.6.0}}} in:

 * [https://github.com/django/django/blob/main/pyproject.toml pyproject.toml] ({{{dependencies}}})
 * [https://github.com/django/django/blob/main/tests/requirements/py3.txt tests/requirements/py3.txt]
 * [https://github.com/django/django/blob/main/tests/requirements/py3-free-threading.txt tests/requirements/py3-free-threading.txt]
 * [https://github.com/django/django/blob/main/docs/internals/contributing/writing-code/unit-tests.txt docs/internals/contributing/writing-code/unit-tests.txt]
 * [https://github.com/django/django/blob/main/docs/releases/6.2.txt docs/releases/6.2.txt] (backwards incompatible change note)

There is no Python-version conflict: Django requires {{{>=3.12}}} and sqlparse 0.6.0 requires {{{>=3.10}}}.

No regression test is added: this is a dependency floor bump with no change to Django's own behavior, so there is no Django code path to regress.

=== Testing ===

With sqlparse 0.6.0 installed in a fresh venv, the full test suite ({{{./runtests.py}}}) passes:

{{{
Ran 19750 tests in 47.688s
OK (skipped=1402, expected failures=4)
}}}

Targeted runs of the sqlparse-dependent suites ({{{backends}}}, {{{migrations}}}, {{{fixtures}}}, {{{queries}}}, {{{schema}}}) also pass with no regressions.

=== AI assistance ===

This report was prepared with assistance from an AI tool, used to: analyze the sqlparse 0.6.0 changelog, generate the issue text in english. The findings, and test issue text were reviewed and verified by the reporter."	Cleanup/optimization	assigned	Database layer (models, ORM)	dev	Normal		sqlparse	Paolo Melchiorre	Unreviewed	0	0	0	0	0	0