django.git/django/db/models/sql/compiler.py, branch 4.2.29

[4.2.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T13:26:22Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews. Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.

[4.2.x] Fixed #34580 -- Avoided unnecessary computation of selected expressions in SQLCompiler.

2023-05-22T05:57:05Z

Performance regression in 278881e37619278789942513916acafaa88d26f3. Co-authored-by: David Smith Backport of 98f6ada0e2058d67d91fb6c16482411ec2ca0967 from main

[4.2.x] Fixed #34368 -- Made subquery raise NotSupportedError when referencing outer window expression.

2023-02-27T08:46:30Z

Regression in f387d024fc75569d2a4a338bfda76cc2f328f627. Co-authored-by: Jannis Vajen Backport of c67ea79aa981ae82595d89f8018a41fcd842e7c9 from main

[4.2.x] Fixed #34372 -- Fixed queryset crash on order by aggregation using OrderBy.

2023-02-27T06:10:45Z

Regression in 278881e37619278789942513916acafaa88d26f3 caused by a lack of expression copying when an OrderBy expression is explicitly provided. Thanks Jannis Vajen for the report and regression test. Backport of b15f162f252610e3b510ade465549769ab4356cf from main

[4.2.x] Fixed #34346 -- Ordered selected expressions by position.

2023-02-20T05:22:18Z

Used the same approach as for #34176 by using selected expressions position to prevent ambiguous aliases in collisions. Thanks henribru for the report. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406. Backport of 278881e37619278789942513916acafaa88d26f3 from main

[4.2.x] Fixed #34227 -- Fixed QuerySet.select_related() with multi-level FilteredRelation.

2023-01-24T09:52:01Z

Backport of d3c93cdc597e0efc2815111c04dd5a427432ed37 from main

[4.2.x] Fixed #34267 -- Fixed sliced QuerySet.union() crash.

2023-01-20T08:25:26Z

Regression in 3d734c09ff0138441dfe0a59010435871d17950f. Thanks Raphaël Stefanini for the report. Backport of cc8aa6bf9c127a493e6dd005012b9e6397b3f319 from main

Fixed #34176 -- Fixed grouping by ambiguous aliases.

2023-01-09T09:52:51Z

Regression in b7b28c7c189615543218e81319473888bc46d831. Refs #31377. Thanks Shai Berger for the report and reviews. test_aggregation_subquery_annotation_values_collision() has been updated as queries that are explicitly grouped by a subquery should always be grouped by it and not its outer columns even if its alias collides with referenced table columns. This was not possible to accomplish at the time 10866a10 landed because we didn't have compiler level handling of colliding aliases.

Simplified SQLCompiler.get_group_by() a bit.

2023-01-04T07:32:27Z

Fixed #34226 -- Fixed QuerySet.select_related() with multiple FilteredRelations to the OneToOneField.

2022-12-27T05:39:38Z