From 90e4f13f700a4384858210944f0eb537f30b013d Mon Sep 17 00:00:00 2001 From: tomas Date: Mon, 24 Aug 2026 16:31:50 +0000 Subject: [PATCH] chore(deps): Bump sqlparse to 0.6.0 to clear pip-audit findings sqlparse 0.5.5 is affected by four advisories, all fixed only in 0.6.0: PYSEC-2026-3696 codegen escaping breakout in the python/php output filters PYSEC-2026-3697 quadratic group_comments (comment-only statements) PYSEC-2026-3698 ReDoS in the dollar-quoted literal lexer PYSEC-2026-3699 TokenList.__init__ flattens the subtree per group sqlparse is a direct dependency, so this bumps its constraint in place rather than adding an entry to the transitive security-constraint block. Nothing else caps it below 0.6.0 (google-cloud-spanner asks for >=0.4.4), so the lock moves sqlparse alone. Also drops two ignore-vulns entries that no longer match any pinned version: PYSEC-2023-121 (zstd) and CVE-2026-0994 (protobuf). The pyarrow entries stay - they still apply to pyarrow 16.1.0 on Python 3.10/3.11. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01QSHPq7nj9cJD8XVPesADtA --- .github/workflows/ci.yml | 8 -------- poetry.lock | 12 ++++++------ pyproject.toml | 2 +- 3 files changed, 7 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2fa0ace..0a125b6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -462,12 +462,6 @@ jobs: inputs: /tmp/requirements-prod.txt require-hashes: true disable-pip: true - # PYSEC-2023-121 (CVE-2022-4899 / GHSA-5c9c-6x87-f9vm) - # * incorrectly flags zstd versions >= 1.5.4.0 as vulnerable to CVE-2022-4899 - # * see https://github.com/pypa/advisory-database/blob/main/vulns/zstd/PYSEC-2023-121.yaml (our version ranges are outside of reported versions) - # CVE-2026-0994 (protobuf DoS via nested Any messages in ParseDict) - # * no fix version available yet - # * low risk: only affects json_format.ParseDict() with untrusted input # PYSEC-2024-161 (pyarrow deserialization vulnerability) # * false positive: only affects Arrow R package, not PyArrow # * see CVE description: "This vulnerability only affects the arrow R package, not other Apache Arrow implementations" @@ -477,8 +471,6 @@ jobs: # * this repo uses PyArrow through pandas parquet IO and Arrow table construction, not IPC file pre-buffering # * databricks-sqlalchemy 1.x caps pyarrow<17, but upgrading requires SQLAlchemy 2.x (which is not possible for some Python versions) ignore-vulns: &ignore-vulns | - PYSEC-2023-121 - CVE-2026-0994 PYSEC-2024-161 PYSEC-2026-113 diff --git a/poetry.lock b/poetry.lock index 7befdd1..518e59c 100644 --- a/poetry.lock +++ b/poetry.lock @@ -6564,19 +6564,19 @@ tracing = ["opentelemetry-api (>=1.1.0)", "opentelemetry-instrumentation (>=0.20 [[package]] name = "sqlparse" -version = "0.5.5" +version = "0.6.0" description = "A non-validating SQL parser." optional = false -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["main"] files = [ - {file = "sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba"}, - {file = "sqlparse-0.5.5.tar.gz", hash = "sha256:e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa93ff28e"}, + {file = "sqlparse-0.6.0-py3-none-any.whl", hash = "sha256:b861c0288ce2fa56209a9a6412d2e066ac664b3873b89c26c9d8415e8e32996f"}, + {file = "sqlparse-0.6.0.tar.gz", hash = "sha256:113c35c75365ab9cc9c7231d68c6428fb11c085fc8e9eb1ad659b7ddbf6cd2b9"}, ] [package.extras] dev = ["build"] -doc = ["sphinx"] +doc = ["furo", "sphinx"] [[package]] name = "stack-data" @@ -7449,4 +7449,4 @@ server = ["deepnote-python-lsp-server", "jupyter-resource-usage", "jupyter-serve [metadata] lock-version = "2.1" python-versions = ">=3.10.0,<3.14" -content-hash = "3566e573e09e177f019327ea8df4779daf3f7f3e404f0b5de82eb8453b110ee1" +content-hash = "3eaf18ec7cc32937e0851f09b8e9c70bd4cb7638a2f6adde2a557a231d982adc" diff --git a/pyproject.toml b/pyproject.toml index 98eae57..f34a483 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -82,7 +82,7 @@ dependencies = [ # SQL templating "jinja2>=3.1.6,<4", - "sqlparse>=0.4.4,<0.6", + "sqlparse>=0.6.0,<0.7", "pymysql>=1.1.1,<1.2", "pymongo>=4.6.3,<4.10; python_version < '3.13'", "pymongo>=4.9.0,<5; python_version>='3.13'",