chango.git/django/db/models/sql/query.py, branch devmain

Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.

2026-06-10T14:17:34Z

Refs #37097 -- Removed compilation-time order clearing on combined queries on Oracle.

2026-05-18T21:06:14Z

Thanks Simon Charette, JaeHyuck Sa, and Shai Berger for reviews.

Fixed #37097 -- Made Query.clear_ordering() clear ordering on combined queries also.

2026-05-18T21:06:14Z

Thanks Shai Berger for the report. Regression in 087bb9e8f3478d53f12b1737af865992af17c5f2. (That commit drove more traffic into an error that would have been reachable only with an explicit order_by() after each union().) Co-authored-by: Simon Charette Co-authored-by: siddus

Fixed #37047 -- Fixed crash in Query.orderby_issubset_groupby for descending and random order_by strings.

2026-04-19T08:03:11Z

Run this example: ```python User.objects.values("is_staff").annotate(latest=Max("date_joined")).order_by("-latest").count() ``` You should see the following exception: ``` django.core.exceptions.FieldError: Cannot resolve keyword '-latest' into field. ``` Regression in 2ce5cb0f7a4618dfdc5f5c10e53e2e9b9543d298.

Fixed #20024 -- Fixed handling of __in lookups with None in exclude().

2026-04-02T15:24:26Z

Thanks Simon Charette and Tim Graham for reviews, and Jason Hall for a prior iteration.

Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T12:56:04Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795.

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed #36352 -- Improved error message for fields excluded by prior values()/values_list() calls.

2026-01-16T15:28:14Z

Signed-off-by: JaeHyuck Sa

Fixed #36821 -- Treated empty strings as NULL for iexact lookups on Oracle.

2026-01-14T18:31:15Z

Signed-off-by: JaeHyuck Sa

Fixed #26434 -- Removed faulty clearing of ordering field when missing from explicit grouping.

2025-12-15T20:23:51Z

Co-authored-by: Simon Charette