[Snyk] Security upgrade sqlparse from 0.4.4 to 0.6.0

[paynejd]

Snyk has created this PR to fix 4 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.txt

⚠️ Warning

fhir.resources 7.1.0 requires pydantic, which is not installed.
celery 5.3.0 requires kombu, which is not installed.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Injection

[paynejd]

This upgrade for sqlparse from version 0.4.4 to 0.6.0 introduces significant changes, including dropped support for older Python versions and a behavioral change in a core function.

Breaking Changes:

• Python Version Support: The upgrade path crosses multiple releases that drop support for older Python versions. Version 0.5.0, included in this range, drops support for Python 3.5 and 3.6. Subsequent versions require Python 3.8 or newer. Your environment must be running a compatible Python version.
• sqlparse.split() Behavior: A change introduced in version 0.4.1 (before this upgrade range) altered the behavior of sqlparse.split(). It no longer returns a trailing empty string in certain cases. Code that relies on ignoring the last element from the split result may need to be updated.

Other Notable Changes:

• Security Fixes: This upgrade includes multiple security patches for Regular Expression Denial of Service (ReDoS) vulnerabilities. Version 0.6.0 specifically addresses CVE-2026-59893, which could cause high CPU usage on malformed input.
• Type Annotations: The library now includes type annotations, improving support for static analysis tools like mypy.

Recommendation:
Verify that your project is running on a supported version of Python (3.8+ is recommended). Review any usage of sqlparse.split() to ensure it correctly handles the output without assuming a trailing empty element.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.