CVS commit: pkgsrc/databases/py-sqlparse

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Sep  2 19:27:46 UTC 2026

Modified Files:
        pkgsrc/databases/py-sqlparse: Makefile distinfo

Log Message:
py-sqlparse: updated to 0.6.0

0.6.0 (Aug 13, 2026)

Notable Changes

* Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
* IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer,
  which consumed CPU quadratically on statements containing many unclosed
  dollar-quoted literals or multiline comments (CVE-2026-59893). See the
  security advisory for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr
  The vulnerability was discovered by EQSTLab, min8282 and 7thpark.
  Thanks for reporting!
* IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping
  deeply nested or very wide statements. Building a token group re-read the
  whole group on every step, so a small statement could keep a worker busy
  for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
* IMPORTANT: Fixes a potential denial of service attack (DOS) in
  `format(sql, reindent=True)`, which consumed CPU quadratically on long
  lists of tuples. See the security advisory for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm
* IMPORTANT: Fixes a potential denial of service attack (DOS) on statements
  that consist only of comments (CVE-2026-71491). See the security advisory
  for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p
  The vulnerability was discovered by @sanktjodel. Thanks for reporting!
* IMPORTANT: Backslashes are now escaped in the `python` and `php` output
  formats. Without escaping, SQL containing a backslash could break out of
  the generated string literal (CVE-2026-59894). See the security advisory
  for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x
  The vulnerability was discovered by @7thParkk. Thanks for reporting!

Enhancements

* Modernize type annotations in top-level API functions using PEP 585 and
  PEP 604 syntax.
* `END FOR` and `END CASE` are now recognized as keywords.

Bug Fixes

* Statement splitting was rewritten on a stack-based architecture. This fixes
  splitting of statements with nested BEGIN ... END blocks (issue845).
* Fix function grouping being skipped in `CREATE TABLE ... AS SELECT`
  statements when the `as` keyword is lowercase (pr867 by Osamaali313).
* Recognize `ROW_FORMAT` as a keyword so that `ALTER TABLE ... ROW_FORMAT=...`
  no longer merges the table name and the option into a single identifier
  (issue773, pr860 by apoorvdarshan).
* Recognize `MATERIALIZED` as a keyword so it is parsed and formatted
  consistently in `CREATE MATERIALIZED VIEW` statements (issue752, pr854 by
  gaoflow).
* Fix `get_real_name` for names with more than two dotted parts (issue332,
  pr865 by chuenchen309).
* Keep a keyword such as `BETWEEN` from being reclassified as an identifier
  when it is followed by a float literal written without a leading zero, so
  that `x BETWEEN .03 AND .06` parses its bounds as numbers (issue601, pr868
  by deepakganesh78).
* Fix a late-binding closure bug in `TokenList.token_not_matching`.


To generate a diff of this commit:
cvs rdiff -u -r1.29 -r1.30 pkgsrc/databases/py-sqlparse/Makefile
cvs rdiff -u -r1.24 -r1.25 pkgsrc/databases/py-sqlparse/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/databases/py-sqlparse/Makefile
diff -u pkgsrc/databases/py-sqlparse/Makefile:1.29 pkgsrc/databases/py-sqlparse/Makefile:1.30
--- pkgsrc/databases/py-sqlparse/Makefile:1.29  Sun Dec 21 21:50:38 2025
+++ pkgsrc/databases/py-sqlparse/Makefile       Wed Sep  2 19:27:46 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.29 2025/12/21 21:50:38 adam Exp $
+# $NetBSD: Makefile,v 1.30 2026/09/02 19:27:46 adam Exp $
 
-DISTNAME=      sqlparse-0.5.5
+DISTNAME=      sqlparse-0.6.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    databases python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=s/sqlparse/}
@@ -10,16 +10,14 @@ HOMEPAGE=   https://github.com/andialbrech
 COMMENT=       Non-validating SQL parser
 LICENSE=       modified-bsd
 
-TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling-[0-9]*:../../devel/py-hatchling
-TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov-[0-9]*:../../devel/py-test-cov
+TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling>=0:../../devel/py-hatchling
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov>=0:../../devel/py-test-cov
 
 USE_LANGUAGES= # none
 
-REPLACE_PYTHON+=       sqlparse/cli.py
+PY_RENAME_BINARIES=    sqlformat
 
-post-install:
-       cd ${DESTDIR}${PREFIX}/bin && \
-       ${MV} sqlformat sqlformat-${PYVERSSUFFIX} || ${TRUE}
+REPLACE_PYTHON+=       sqlparse/cli.py
 
 .include "../../lang/python/application.mk"
 .include "../../lang/python/wheel.mk"

Index: pkgsrc/databases/py-sqlparse/distinfo
diff -u pkgsrc/databases/py-sqlparse/distinfo:1.24 pkgsrc/databases/py-sqlparse/distinfo:1.25
--- pkgsrc/databases/py-sqlparse/distinfo:1.24  Sun Dec 21 21:50:38 2025
+++ pkgsrc/databases/py-sqlparse/distinfo       Wed Sep  2 19:27:46 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.24 2025/12/21 21:50:38 adam Exp $
+$NetBSD: distinfo,v 1.25 2026/09/02 19:27:46 adam Exp $
 
-BLAKE2s (sqlparse-0.5.5.tar.gz) = 217d5e979255c77a3e372e97784d1da20e94fe9506978bd120d224a24f55d3e9
-SHA512 (sqlparse-0.5.5.tar.gz) = 1c06211f7a3fbdde9f618885eaec03b7c28e2d8262ef02adab2095e5995aca5500c5b92398bdfbf79d20e2017542abb2358e105ba8a87afdce5834b73524b1cd
-Size (sqlparse-0.5.5.tar.gz) = 120815 bytes
+BLAKE2s (sqlparse-0.6.0.tar.gz) = 5d162168d6ddf492506cc37e86ca91044de51d7ad6baa126cb33b0493841fdb6
+SHA512 (sqlparse-0.6.0.tar.gz) = 39e57d16a3fdb125d26cfa5c1e0e020e105282d74fa404aea9a3d3685751c1b3c4231c148e61acf1c90cf2bd4b5c74c32ff2b9ac8a8f5b69249590d162d18c1a
+Size (sqlparse-0.6.0.tar.gz) = 178477 bytes