Bump minimum sqlparse version from 0.5.0 to 0.6.0 (security fixes)

[Paolo Melchiorre]

Django currently requires sqlparse >= 0.5.0. sqlparse 0.6.0 (Aug 13, 2026) fixes several security vulnerabilities, including multiple denial-of-service issues. To ensure every Django install ships with these fixes, the minimum required version should be raised to 0.6.0.

Changelog: ​sqlparse CHANGELOG

Vulnerabilities in 0.6.0 that affect Django's usage of sqlparse

Django uses sqlparse in the database layer (django.db.backends):

• sqlparse.split() and sqlparse.format(..., strip_comments=True) in ​{{{BaseDatabaseOperations.prepare_sql_script}}} (migrations/fixtures SQL).
• sqlparse.format(sql, reindent=True, keyword_case="upper") in ​{{{BaseDatabaseOperations.format_debug_sql}}}.
• sqlparse.parse() in the ​MySQL and ​SQLite introspection backends.

These code paths are exposed to the following 0.6.0 fixes:

• ​CVE-2026-59893 — DoS in the lexer on unclosed dollar-quoted literals or multiline comments (affects split/parse/format).
• ​CVE-2026-54284 — DoS when grouping deeply nested or very wide statements (affects parse used in introspection).
• ​GHSA-cfqr-cjx5-5jcm — DoS in format(sql, reindent=True) on long lists of tuples (directly used by format_debug_sql).
• ​CVE-2026-71491 — DoS on statements consisting only of comments (affects split/format(strip_comments=True) in prepare_sql_script).

A fifth fix, ​CVE-2026-59894 (backslash escaping in the python/php output formatters), does not directly affect Django, as Django does not use those formatters, but is included for defense in depth.

Proposed change

Raise the minimum supported version of sqlparse from 0.5.0 to 0.6.0 in:

• ​pyproject.toml (dependencies)
• ​tests/requirements/py3.txt
• ​tests/requirements/py3-free-threading.txt
• ​docs/internals/contributing/writing-code/unit-tests.txt
• ​docs/releases/6.2.txt (backwards incompatible change note)

There is no Python-version conflict: Django requires >=3.12 and sqlparse 0.6.0 requires >=3.10.

No regression test is added: this is a dependency floor bump with no change to Django's own behavior, so there is no Django code path to regress.

Testing

With sqlparse 0.6.0 installed in a fresh venv, the full test suite (./runtests.py) passes:

Ran 19750 tests in 47.688s
OK (skipped=1402, expected failures=4)

Targeted runs of the sqlparse-dependent suites (backends, migrations, fixtures, queries, schema) also pass with no regressions.

AI assistance

This report was prepared with assistance from an AI tool, used to: analyze the sqlparse 0.6.0 changelog, generate the issue text in english. The findings, and test issue text were reviewed and verified by the reporter.