Require sqlparse>=0.5.5,<0.7.0 to fix CVE-2026-54284, CVE-2026-59893, CVE-2026-59894 and CVE-2026-71491 (parser denial-of-service)
From dbt Core
dbt-core 1.11.14 - August 20, 2026
Dependencies
Require sqlparse>=0.5.5,<0.7.0, sqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893, CVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). (#15988)