Output of ls should not be parsed, it doesn't cause a problem in our use, but it should be avoided in all applications as a general principle.
Code: https://github.com/advania/pass/blob/master/db/migrate.sh#L30
Likely solution:
for file in *.sql;
do
something $file
done