Allow sqlparse 0.6.x

sqlparse 0.6.0 (2026-08-13) fixes several denial-of-service issues
(CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping bug
(CVE-2026-59894). Its only other notable change is dropping Python 3.8/3.9,
which pgcli no longer supports either. The <0.6 cap prevented users from
installing the fixed release; widen it to <0.7.

The full test suite gives identical results on sqlparse 0.5.4 and 0.6.0
(2612 passed, 117 skipped, 1 xfailed, 1 xpassed).

Author: pouwerkerk

AUTHORS

@@ -153,6 +153,7 @@ Contributors:
     * Tommi Kyntölä (kynde)
     * Diego
     * Chris (ChrisJr404)
+    * Pieter Ouwerkerk (pouwerkerk)
 
 Creator:
 --------

changelog.rst

@@ -7,6 +7,10 @@ Bug fixes:
 * Fix ``TypeError: cannot use a string pattern on a bytes-like object`` when
   completion metadata comes back as bytes (e.g. ``SQL_ASCII`` client encoding).
 * Suggest columns, not datatypes, after a column literally named ``type`` in a ``SELECT`` list.
+* Allow ``sqlparse`` 0.6.x. sqlparse 0.6.0 fixes several denial-of-service
+  issues (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491) and a string-escaping
+  bug (CVE-2026-59894); the previous ``<0.6`` cap prevented users from
+  installing the fixed release.
 
 Features:
 ---------

pyproject.toml

@@ -32,7 +32,7 @@ dependencies = [
     "prompt_toolkit>=2.0.6,<4.0.0",
     "psycopg >= 3.0.14; sys_platform != 'win32'",
     "psycopg-binary >= 3.0.14; sys_platform == 'win32'",
-    "sqlparse >=0.3.0,<0.6",
+    "sqlparse >=0.3.0,<0.7",
     "configobj >= 5.0.6",
     "cli_helpers[styles] >= 2.4.0",
     # setproctitle is used to mask the password when running `ps` in command line.