CVS commit: pkgsrc/databases/py-sqlparse

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Nov 10 13:16:29 UTC 2026

Modified Files:
        pkgsrc/databases/py-sqlparse: Makefile distinfo

Log Message:
py-sqlparse: updated to 0.6.1

End of Maintenance

Version 0.6.1 marks the final release of sqlparse.

After many years of maintaining this project, I have decided to end its
active development and maintenance. The increasing volume of security reports,
particularly those generated through automated vulnerability research, has made
the workload unsustainable for me as a sole volunteer maintainer.

No further releases, including security fixes, are planned.
The source code and existing releases will remain available.

I would like to thank everyone who has contributed to sqlparse over the years.

Notable Changes

* IMPORTANT: Dollar signs are now escaped in the `php` output format. PHP
  interpolates `$var`, `${expr}` and `{$expr}` inside double-quoted strings,
  so SQL text containing them could inject PHP code into the generated
  snippet (CVE-2026-112307, pr937 by cve-zh00). See the security advisory
  for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-xmww-55xg-h3vc
  The vulnerability was discovered by @iRevivalx, @Gares95, @manus-pi,
  @president-xd, @arpitjain099 and @Tan-JunWei. Thanks for reporting!
* IMPORTANT: Fixes a potential denial of service attack (DOS) in `format()`,
  which consumed CPU quadratically on statements containing many quotes
  that are never closed. This affected `format()` with default options and
  the `sqlformat` command. See the security advisory for details:
  https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3r5h-5jcg-gmgg
  The vulnerability was discovered by @LinFeng-1219 and @president-xd.
  Thanks for reporting!

Bug Fixes

* Fix `IndexError` and `ValueError` in `format()` on some malformed
  statements, e.g. `( as )` with `reindent=True` or a `CASE` without its
  own `END` with `reindent_aligned=True`. Grouping no longer moves the
  brackets of a parenthesis or the `CASE`/`END` keywords into an inner
  group.
* `sqlformat` no longer empties the file given with `--in-place` or
  `--outfile` when formatting fails, e.g. because a statement exceeds the
  grouping limits. The output file is now only written after formatting
  succeeded, and the error is reported like other CLI errors.


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/databases/py-sqlparse/Makefile
cvs rdiff -u -r1.25 -r1.26 pkgsrc/databases/py-sqlparse/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/databases/py-sqlparse/Makefile
diff -u pkgsrc/databases/py-sqlparse/Makefile:1.30 pkgsrc/databases/py-sqlparse/Makefile:1.31
--- pkgsrc/databases/py-sqlparse/Makefile:1.30  Wed Sep  2 19:27:46 2026
+++ pkgsrc/databases/py-sqlparse/Makefile       Tue Nov 10 13:16:29 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2026/09/02 19:27:46 adam Exp $
+# $NetBSD: Makefile,v 1.31 2026/11/10 13:16:29 adam Exp $
 
-DISTNAME=      sqlparse-0.6.0
+DISTNAME=      sqlparse-0.6.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    databases python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=s/sqlparse/}

Index: pkgsrc/databases/py-sqlparse/distinfo
diff -u pkgsrc/databases/py-sqlparse/distinfo:1.25 pkgsrc/databases/py-sqlparse/distinfo:1.26
--- pkgsrc/databases/py-sqlparse/distinfo:1.25  Wed Sep  2 19:27:46 2026
+++ pkgsrc/databases/py-sqlparse/distinfo       Tue Nov 10 13:16:29 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.25 2026/09/02 19:27:46 adam Exp $
+$NetBSD: distinfo,v 1.26 2026/11/10 13:16:29 adam Exp $
 
-BLAKE2s (sqlparse-0.6.0.tar.gz) = 5d162168d6ddf492506cc37e86ca91044de51d7ad6baa126cb33b0493841fdb6
-SHA512 (sqlparse-0.6.0.tar.gz) = 39e57d16a3fdb125d26cfa5c1e0e020e105282d74fa404aea9a3d3685751c1b3c4231c148e61acf1c90cf2bd4b5c74c32ff2b9ac8a8f5b69249590d162d18c1a
-Size (sqlparse-0.6.0.tar.gz) = 178477 bytes
+BLAKE2s (sqlparse-0.6.1.tar.gz) = 1210302e9b0ad5f94718fad07e21572c68251ecc493107134c4dc970734de180
+SHA512 (sqlparse-0.6.1.tar.gz) = e5a5b959703fc5215523a24595da8813365acd4f7ee269145e4f8dc35b3edcee59098ca347a88e4eb0b87573d6032a590df04be96a4488fdef152d4c3b74af54
+Size (sqlparse-0.6.1.tar.gz) = 182236 bytes