build(deps): bump sqlparse from 0.5.4 to 0.6.0

[dependabot]

Bumps sqlparse from 0.5.4 to 0.6.0.

Changelog

Sourced from sqlparse's changelog.

Release 0.6.0 (Aug 13, 2026)

Notable Changes

• Drop support for Python 3.8 and 3.9. Python 3.10+ is now required.
• IMPORTANT: Fixes a potential denial of service attack (DOS) in the lexer, which consumed CPU quadratically on statements containing many unclosed dollar-quoted literals or multiline comments (CVE-2026-59893). See the security advisory for details: GHSA-prg7-hcfm-mfcr The vulnerability was discovered by EQSTLab, min8282 and 7thpark. Thanks for reporting!
• IMPORTANT: Fixes a potential denial of service attack (DOS) when grouping deeply nested or very wide statements. Building a token group re-read the whole group on every step, so a small statement could keep a worker busy for a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).
• IMPORTANT: Fixes a potential denial of service attack (DOS) in format(sql, reindent=True), which consumed CPU quadratically on long lists of tuples. See the security advisory for details: GHSA-cfqr-cjx5-5jcm
• IMPORTANT: Fixes a potential denial of service attack (DOS) on statements that consist only of comments (CVE-2026-71491). See the security advisory for details: GHSA-f2ff-p2ww-7p4p The vulnerability was discovered by @​sanktjodel. Thanks for reporting!
• IMPORTANT: Backslashes are now escaped in the python and php output formats. Without escaping, SQL containing a backslash could break out of the generated string literal (CVE-2026-59894). See the security advisory for details: GHSA-3496-9g83-7v6x The vulnerability was discovered by @​7thParkk. Thanks for reporting!

Enhancements

• Modernize type annotations in top-level API functions using PEP 585 and PEP 604 syntax.
• END FOR and END CASE are now recognized as keywords.

Bug Fixes

• Statement splitting was rewritten on a stack-based architecture. This fixes splitting of statements with nested BEGIN ... END blocks (issue845).
• Fix function grouping being skipped in CREATE TABLE ... AS SELECT statements when the as keyword is lowercase (pr867 by Osamaali313).
• Recognize ROW_FORMAT as a keyword so that ALTER TABLE ... ROW_FORMAT=... no longer merges the table name and the option into a single identifier (issue773, pr860 by apoorvdarshan).
• Recognize MATERIALIZED as a keyword so it is parsed and formatted consistently in CREATE MATERIALIZED VIEW statements (issue752, pr854 by

... (truncated)

Commits

• 2f40da9 Update version number.
• 5753f15 Align the changelog entries for this release with previous ones
• b9588d9 Unify the benchmark scripts on a shared harness
• 519e416 Pair comment/dollar-quote delimiters at the lexer position
• a51df6d Measure reindent offsets backwards to avoid quadratic CPU use
• 73d9ccd Update CHANGELOG
• d1d8060 Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-qu...
• ef2012a Fix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)
• 26112dd Update Changelog.
• 53ff44b Escape backslashes in output formatters.
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.