Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-sqlparse for openSUSE:Factory
checked in at 2026-08-19 17:55:07
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-sqlparse (Old)
and /work/SRC/openSUSE:Factory/.python-sqlparse.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-sqlparse"
Wed Aug 19 17:55:07 2026 rev:24 rq:1371681 version:0.6.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-sqlparse/python-sqlparse.changes
2026-07-08 17:32:45.253554513 +0200
+++
/work/SRC/openSUSE:Factory/.python-sqlparse.new.1258/python-sqlparse.changes
2026-08-19 17:55:11.634259074 +0200
@@ -1,0 +2,63 @@
+Tue Aug 18 07:43:22 UTC 2026 - Daniel Garcia <[email protected]>
+
+- update to 0.6.0 (bsc#1275459, bsc#1275460, bsc#1275461, bsc#1275466):
+ ## Notable Changes
+ * Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
+ * IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer,
+ which consumed CPU quadratically on statements containing many unclosed
+ dollar-quoted literals or multiline comments (CVE-2026-59893). See the
+ security advisory for details:
+
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr
+ The vulnerability was discovered by EQSTLab, min8282 and 7thpark.
+ Thanks for reporting!
+ * IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping
+ deeply nested or very wide statements. Building a token group re-read the
+ whole group on every step, so a small statement could keep a worker busy
+ for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
+ * IMPORTANT: Fixes a potential denial of service attack (DOS) in
+ `format(sql, reindent=True)`, which consumed CPU quadratically on long
+ lists of tuples. See the security advisory for details:
+
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm
+ * IMPORTANT: Fixes a potential denial of service attack (DOS) on statements
+ that consist only of comments (CVE-2026-71491). See the security advisory
+ for details:
+
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p
+ The vulnerability was discovered by @sanktjodel. Thanks for reporting!
+ * IMPORTANT: Backslashes are now escaped in the `python` and `php` output
+ formats. Without escaping, SQL containing a backslash could break out of
+ the generated string literal (CVE-2026-59894). See the security advisory
+ for details:
+
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x
+ The vulnerability was discovered by @7thParkk. Thanks for reporting!
+
+ ## Enhancements
+ * Modernize type annotations in top-level API functions using PEP 585 and
+ PEP 604 syntax.
+ * `END FOR` and `END CASE` are now recognized as keywords.
+
+ ## Bug Fixes
+ * Statement splitting was rewritten on a stack-based architecture. This fixes
+ splitting of statements with nested BEGIN ... END blocks (issue845).
+ * Fix function grouping being skipped in `CREATE TABLE ... AS SELECT`
+ statements when the `as` keyword is lowercase (pr867 by Osamaali313).
+ * Recognize `ROW_FORMAT` as a keyword so that `ALTER TABLE ...
ROW_FORMAT=...`
+ no longer merges the table name and the option into a single identifier
+ (issue773, pr860 by apoorvdarshan).
+ * Recognize `MATERIALIZED` as a keyword so it is parsed and formatted
+ consistently in `CREATE MATERIALIZED VIEW` statements (issue752, pr854 by
+ gaoflow).
+ * Fix `get_real_name` for names with more than two dotted parts (issue332,
+ pr865 by chuenchen309).
+ * Keep a keyword such as `BETWEEN` from being reclassified as an identifier
+ when it is followed by a float literal written without a leading zero, so
+ that `x BETWEEN .03 AND .06` parses its bounds as numbers (issue601, pr868
+ by deepakganesh78).
+ * Fix a late-binding closure bug in `TokenList.token_not_matching`.
+
+ ## Other
+ * Migrate project dependencies and environment management from `pixi` to
`uv`.
+ * Replace `flake8` with `ruff` for code checking and linting.
+ * The README is now written in Markdown and the documentation uses an
+ updated theme.
+
+-------------------------------------------------------------------
Old:
----
sqlparse-0.5.5.tar.gz
New:
----
sqlparse-0.6.0.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-sqlparse.spec ++++++
--- /var/tmp/diff_new_pack.GRex3H/_old 2026-08-19 17:55:12.815301742 +0200
+++ /var/tmp/diff_new_pack.GRex3H/_new 2026-08-19 17:55:12.816301778 +0200
@@ -23,7 +23,7 @@
%endif
%{?sle15_python_module_pythons}
Name: python-sqlparse
-Version: 0.5.5
+Version: 0.6.0
Release: 0
Summary: Non-validating SQL parser
License: BSD-3-Clause
@@ -76,7 +76,7 @@
%pytest
%files %{python_files}
-%doc AUTHORS README.rst
+%doc AUTHORS README.md
%license LICENSE
%python_alternative %{_bindir}/sqlformat
%{python_sitelib}/sqlparse
++++++ sqlparse-0.5.5.tar.gz -> sqlparse-0.6.0.tar.gz ++++++
++++ 9231 lines of diff (skipped)
