Security1.11.14
dbt-core v1.11.14
Updated sqlparse dependency to version 0.6.0 to address multiple parser denial-of-service vulnerabilities (CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, CVE-2026-71491).
dbt-core 1.11.14 - August 20, 2026
Dependencies
- Require
sqlparse>=0.5.5,<0.7.0,sqlparse0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893, CVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). (#15988)
Contributors
securitydependenciesparser
Source: original entry ↗