django.git/django/db/models/query.py, branch stable/5.2.x

[5.2.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on dictionary expansion.

2025-11-05T12:33:29Z

Backport of 3c3f46357718166069948625354b8315a8505262 from main.

[5.2.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in first()/last() when aggregating.

2025-10-14T19:50:26Z

Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.

[5.2.x] Fixed #36416 -- Made QuerySet.in_bulk() account for composite pks in id_list.

2025-06-03T15:46:59Z

Backport of 26313bc21932d0d3af278ab387549d63b1f64575 from main.

[5.2.x] Fixed #36388 -- Made QuerySet.union() return self when called with no arguments.

2025-05-19T08:36:08Z

Regression in 9cb8baa0c4fa2c10789c5c8b65f4465932d4d172. Thank you to Antoine Humeau for the report and Simon Charette for the review. Backport of 802baf5da5b8d8b44990a8214a43b951e7ab8b39 from main.

[5.2.x] Fixed #36373 -- Fixed select_related() crash on foreign object for a composite pk.

2025-05-12T11:34:45Z

Thanks Jacob Walls for the report and Sarah for the in-depth review. Backport of 8be0c0d6901669661fca578f474cd51cd284d35a from main.

[5.2.x] Fixed #36360 -- Fixed QuerySet.update() crash when referring annotations through values().

2025-04-30T09:39:37Z

The issue was only manifesting itself when also filtering againt a related model as that forces the usage of a subquery because SQLUpdateCompiler doesn't support the UPDATE FROM syntax yet. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Gav O'Connor for the detailed report. Backport of 8ef4e0bd423ac3764004c73c3d1098e7a51a2945 from main.

[5.2.x] Fixed #36288 -- Addressed improper handling of duplicates in values_list().

2025-04-11T07:06:53Z

Now that selected aliases are stored in sql.Query.selected: dict[str, Any] the values_list() method must ensures that duplicate field name references are assigned unique aliases. Refs #28900. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Thanks Claude for the report. Backport of 21f8be76d43aa1ee5ae41c1e0a428cfea1f231c1 from main.

[5.2.x] Fixed #36149 -- Allowed subquery values against tuple exact and in lookups.

2025-02-11T08:16:44Z

Non-tuple exact and in lookups have specialized logic for subqueries that can be adapted to properly assign select mask if unspecified and ensure the number of involved members are matching on both side of the operator. Backport of 41239fe34d64e801212dccaa4585e4802d0fac68 from main.

[5.2.x] Fixed #36155 -- Improved error handling when annotate arguments require an alias.

2025-01-30T11:18:08Z

Regression in ed0cbc8d8b314e3b4a0305d0be3cf366d8ee4a74. Backport of c6ace896a2da73356f7c9a655bbe32a0e3ce0435 from main.

[5.2.x] Fixed #36118 -- Accounted for multiple primary keys in bulk_update max_batch_size.

2025-01-29T09:25:00Z

Co-authored-by: Simon Charette Backport of 5a2c1bc07d126ce32efaa157e712a8f3a7457b74 from main.