Skip to content

Update sqlparse to 0.4.4#137

Closed
pyup-bot wants to merge 1 commit intomasterfrom
pyup-update-sqlparse-0.4.3-to-0.4.4
Closed

Update sqlparse to 0.4.4#137
pyup-bot wants to merge 1 commit intomasterfrom
pyup-update-sqlparse-0.4.3-to-0.4.4

Conversation

@pyup-bot
Copy link
Collaborator

This PR updates sqlparse from 0.4.3 to 0.4.4.

Changelog

0.4.4

----------------------------

Notable Changes

* IMPORTANT: This release fixes a security vulnerability in the
parser where a regular expression vulnerable to ReDOS (Regular
Expression Denial of Service) was used. See the security advisory
for details: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
The vulnerability was discovered by erik-krogh from GitHub
Security Lab (GHSL). Thanks for reporting!

Bug Fixes

* Revert a change from 0.4.0 that changed IN to be a comparison (issue694).
The primary expectation is that IN is treated as a keyword and not as a
comparison operator. That also follows the definition of reserved keywords
for the major SQL syntax definitions.
* Fix regular expressions for string parsing.

Other

* sqlparse now uses pyproject.toml instead of setup.cfg (issue685).
Links

@pyup-bot
Copy link
Collaborator Author

Closing this in favor of #161

@pyup-bot pyup-bot closed this Apr 13, 2024
@laowantong laowantong deleted the pyup-update-sqlparse-0.4.3-to-0.4.4 branch April 13, 2024 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant