dbt-core v1.11.14
Updated sqlparse dependency to version 0.6.0 to address multiple parser denial-of-service vulnerabilities (CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, CVE-2026-71491).
dbt-core 1.11.14 - August 20, 2026
Dependencies
- Require
sqlparse>=0.5.5,<0.7.0,sqlparse0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893, CVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). (#15988)
Contributors
Source: original entry ↗
More from dbt
Follow dbt to get its new changes in your feed and email digest.
dbt v1.11.16
This patch release fixes wildcard FQN selectors to match nested models at any subfolder depth, includes semantic_manifest.json in artifact uploads, and validates tarball package download security.
v2.0.8
dbt 2.0.8 lowers the minimum Python version to 3.10, fixes TableNotFound errors during analyze operations on MapReduce, restores catalog.json writing for dbt build, and adds test helpers for integration testing.
dbt v1.13.0b1
dbt-core 1.13.0-b1 introduces state management bundling, v2 parser delegation, user login commands, OpenTelemetry instrumentation, and numerous bug fixes including improvements to partial parsing, selector resolution, and plugin compatibility.