Closing sqlparse

[andialbrecht]

After more than 17 years, I've decided to stop maintaining sqlparse. Version 0.6.1 is the last release. The code and all published releases stay available, but there won't be any more bug fixes, new features or security updates.

Over time, sqlparse ended up being used by a lot of projects, Django among them. I hardly use it myself these days, but I still wanted to keep it going.

For a long time I had a rhythm that worked for me as a volunteer: about every six months I'd set aside a week or two of my spare time, go through the issues, merge pull requests, fix bugs and put out a release. I liked doing that, and it worked for many years.

That doesn't work anymore. For the past six months, security advisories have been coming in several times a week. 0.6.0 fixed a whole batch of them, and the next ones arrived almost immediately. Some of these reports point to real problems that need fixing. Others are ordinary bugs filed as advisories, duplicates, or things that had already been fixed. And some show a technical weakness without making a convincing case that it matters for security in practice. sqlparse was never meant to be a security boundary, and it was never designed to process arbitrary, possibly hostile input within guaranteed resource limits. If your application handles untrusted SQL, it needs its own threat model and its own safeguards.

I do take security seriously, and I think it's a good thing that AI makes vulnerability research easier, just as it does for development. But each advisory still has to be checked, compared with earlier reports, assessed and answered, and sometimes fixed and released. AI helps me with the investigation, but the responsibility and most of the work remain with me. Finding potential vulnerabilities has become cheap, but dealing with them properly still takes real time and care.

I used to decide for myself when to work on sqlparse and what to work on. Now the advisories increasingly dictate my priorities, and what I used to enjoy has turned into an obligation that never really stops. Even if I fixed every open report, that wouldn't change much, because the next batch could arrive the following week. I don't want to suggest a level of support I can't actually provide.

The flood of advisories over the past months made the decision easier, but it isn't the only reason. After all these years, it's also simply a personal decision about how I want to spend my time.

The repository and the PyPI project stay under my control. For a package this widely used, protecting the supply chain is part of the job. I have no plans to transfer ownership or grant commit or publishing access.

Thanks to everyone who used sqlparse, reported bugs or contributed over the years. Maintaining it was a pleasure, and a lot of that was thanks to you.

[tim-schilling]

Just want to say thank you for all your efforts over the years!

[jezdez]

Thank you for your efforts over the years!

[fallen]

Thanks a lot!

[amirreza-sf80]

17 years of work!
thanks you 🙌

[simodalla]

Thank you for your hard work!

[MartinPaulEve]

Thank you for your effort and commitment to this project!