django http://cgit.adnoto.dev/django.git/atom?h=main 2026-03-13T00:01:02Z 2026-03-13T00:01:02Z Simon Charette charette.s@gmail.com 2025-11-22T18:32:34Z urn:sha1:1a8fd5cf75bf855852f6bc2f75c3da9f7b145669 The lack of ability of the get_placeholder call chain to return SQL and parameters separated so they can be mogrified by the backend at execution time forced implementations to dangerously interpolate potentially user controlled values. The get_placeholder_sql name was chosen due to its proximity to the previous method, but other options such as Field.as_sql were considered but ultimately rejected due to its different input signature compared to Expression.as_sql that might have lead to confusion. There is a lot of overlap between what Field.get_db_prep_value and get_placeholder_sql do but folding the latter in the former would require changing its return signature to return expression which is a way more invasive change than what is proposed here. Given we always call get_db_prep_value it might still be an avenue worth exploring in the future to offer a publicly documented interface to allow field to take an active part in the compilation chain. Thanks Jacob for the review. 2025-12-31T15:41:55Z Simon Charette charette.s@gmail.com 2025-12-23T06:25:56Z urn:sha1:d6ae2ed868e43671afc4d433c3d8f4d27f7eb555 Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491. The UNNEST strategy is affected by the same problem bulk_update has wrt/ to silent data truncation due to its usage of db_type which always returns a parametrized subtype. 2025-12-04T16:37:22Z Tim Graham timograham@gmail.com 2025-12-03T23:06:53Z urn:sha1:17d644c8e257c2ea5cc738fb7a9c47989e29bf09 This is also applicable on CockroachDB. 2025-12-02T12:21:07Z Jacob Walls jacobtylerwalls@gmail.com 2025-11-17T22:09:54Z urn:sha1:5b90ca1e7591fa36fccf2d6dad67cf1477e6293e Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. 2025-11-20T22:22:46Z Chris Wesseling chris@maykinmedia.nl 2025-11-20T14:01:14Z urn:sha1:5834643f43a767fe19f2c6d10217b204e7584ec8 2025-10-16T18:59:02Z Jacob Walls jacobtylerwalls@gmail.com 2025-10-16T14:33:54Z urn:sha1:d980d68609448a4c85763fa34e471ff80540888b Added ignores relating to https://github.com/PyCQA/isort/issues/2352. 2025-07-10T16:33:00Z Simon Charette charette.s@gmail.com 2025-07-10T16:33:00Z urn:sha1:0fe218842e0e396e3ab3982bd21227968a9e7fd8 Regression in 764af7a3d6c0b543dcf659a2c327f214da768fe4. 2025-04-04T19:33:04Z Simon Charette charette.s@gmail.com 2025-04-03T15:15:27Z urn:sha1:764af7a3d6c0b543dcf659a2c327f214da768fe4 Swapped to an allow list instead of a deny list for field types to determine if the UNNEST optimization can be enabled to avoid further surprises with other types that would require further specialization to adapt. Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491. Thanks Joshua Goodwin for the report and Sarah Boyce for the test. 2025-01-20T13:15:32Z Simon Charette charette.s@gmail.com 2025-01-17T18:41:22Z urn:sha1:22fc151bb86a553d84c62d7effd289356e9b6c6c The array fields opt-out heuristic failed to account for sized arrays. Note that we keep relying on db_type as opposed to performing an ArrayField instance check against the column's field as there could be other implementations of model fields that use Postgres arrays to store the optimization must be disabled for all of them. Refs #35936. Thanks Claude Paroz for the report and test. 2024-12-11T12:56:18Z Simon Charette charette.s@gmail.com 2024-11-17T05:30:00Z urn:sha1:a16eedcf9c69d8a11d94cac1811018c5b996d491 This should make bulk_create significantly faster on Postgres when provided only literal values. Thanks James Sewell for writing about this technique, Tom Forbes for validating the performance benefits, David Sanders and Mariusz Felisiak for the review.