diff --git a/AUTHORS b/AUTHORS
index c8a2d4d34..db49b9eb4 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -153,6 +153,7 @@ Contributors:
     * Tommi Kyntölä (kynde)
     * Diego
     * Chris (ChrisJr404)
+    * Pieter Ouwerkerk (pouwerkerk)
 
 Creator:
 --------
diff --git a/changelog.rst b/changelog.rst
index 6e4c47c36..6fb1da130 100644
--- a/changelog.rst
+++ b/changelog.rst
@@ -7,6 +7,10 @@ Bug fixes:
 * Fix ``TypeError: cannot use a string pattern on a bytes-like object`` when
   completion metadata comes back as bytes (e.g. ``SQL_ASCII`` client encoding).
 * Suggest columns, not datatypes, after a column literally named ``type`` in a ``SELECT`` list.
+* Allow ``sqlparse`` 0.6.x. sqlparse 0.6.0 fixes several denial-of-service
+  issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping
+  bug (CVE-2026-59894); the previous ``<0.6`` cap prevented users from
+  installing the fixed release.
 
 Features:
 ---------
diff --git a/pyproject.toml b/pyproject.toml
index e9fa9b8dd..452617496 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,7 +32,7 @@ dependencies = [
     "prompt_toolkit>=2.0.6,<4.0.0",
     "psycopg >= 3.0.14; sys_platform != 'win32'",
     "psycopg-binary >= 3.0.14; sys_platform == 'win32'",
-    "sqlparse >=0.3.0,<0.6",
+    "sqlparse >=0.3.0,<0.7",
     "configobj >= 5.0.6",
     "cli_helpers[styles] >= 2.4.0",
     # setproctitle is used to mask the password when running `ps` in command line.