chango.git/tests/aggregation/tests.py, branch devmain

Fixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.

2026-04-18T06:53:21Z

Fixed #36890 -- Supported StringAgg(distinct=True) on SQLite with the default delimiter.

2026-02-10T21:47:44Z

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:11:45Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #36405 -- Fixed Aggregate.order_by using OuterRef.

2025-05-23T14:15:59Z

co-authored-by: Simon Charette

Refs #35444 -- Adjusted multi-args distinct aggregate test ordering expectations.

2025-05-23T09:19:31Z

Unless an explicit order_by is specified for the test the ordering of the aggregation results is undefined.

Fixed #34262 -- Added support for AnyValue for SQLite, MySQL, Oracle, and Postgresql 16+.

2025-05-20T08:01:42Z

Thanks Simon Charette for the guidance and review. Thanks Tim Schilling for the documentation review. Thanks David Wobrock for investigation and solution proposals.

Fixed #36292 -- Fixed crash when aggregating over a group mixing transforms and references.

2025-04-03T15:51:26Z

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900 Thanks Patrick Altman for the report.

Fixed #35444 -- Added generic support for Aggregate.order_by.

2025-03-03T10:37:00Z

This moves the behaviors of `order_by` used in Postgres aggregates into the `Aggregate` class. This allows for creating aggregate functions that support this behavior across all database engines. This is shown by moving the `StringAgg` class into the shared `aggregates` module and adding support for all databases. The Postgres `StringAgg` class is now a thin wrapper on the new shared `StringAgg` class. Thank you Simon Charette for the review.