django.git/django/db/backends/postgresql/operations.py, branch 4.2.29

[4.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

2025-12-02T12:44:19Z

Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.

[4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL.

2023-09-22T04:07:19Z

Thanks Alex Vandiver for the report. Regression in 09ffc5c1212d4ced58b708cbbf3dfbfb77b782ca. Backport of 779cd28acb1f7eb06f629c0ea4ded99b5ebb670a from main.

Fixed #33308 -- Added support for psycopg version 3.

2022-12-15T05:17:57Z

Thanks Simon Charette, Tim Graham, and Adam Johnson for reviews. Co-authored-by: Florian Apolloner Co-authored-by: Mariusz Felisiak

Refs #33308 -- Added DatabaseOperations.compose_sql() on PostgreSQL.

2022-12-12T09:36:45Z

Refs #33308 -- Moved psycopg2 imports to the psycopg_any module.

2022-12-12T07:36:17Z

Refs #33308 -- Used get_db_prep_value() to adapt JSONFields.

2022-11-15T12:02:36Z

Fixed #33872 -- Deprecated django.contrib.postgres.fields.CIText/CICharField/CIEmailField/CITextField.

2022-08-03T09:42:51Z

Refs CVE-2022-34265 -- Properly escaped Extract() and Trunc() parameters.

2022-07-06T05:40:07Z

Co-authored-by: Mariusz Felisiak

Removed unneeded code in explain_query_prefix()

2022-04-14T04:46:42Z

Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) against SQL injection on PostgreSQL.

2022-04-11T06:59:58Z