django.git/django/db/models/sql/compiler.py, branch stable/6.0.x

[6.0.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T13:04:49Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews. Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.

Refs #27222 -- Refreshed GeneratedFields values on save() initiated update.

2025-09-13T22:27:49Z

This required implementing UPDATE RETURNING machinery that heavily borrows from the INSERT one.

Refs #27222 -- Adapted RETURNING handling to be usable for UPDATE queries.

2025-08-28T18:44:21Z

Renamed existing methods and abstractions used for INSERT … RETURNING to be generic enough to be used in the context of UPDATEs as well. This also consolidates SQL compliant implementations on BaseDatabaseOperations.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #36301 -- Fixed select_for_update(of) crash when using values()/values_list().

2025-04-07T20:56:40Z

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a which allowed for annotations to be SELECT'ed before model field references through values()/values_list() and broke assumptions the select_for_update(of) table infererence logic had about model fields always being first. Refs #28900. Thanks OutOfFocus4 for the report and Sarah for the test.

Refs #28909 -- Simplified code using unpacking generalizations.

2025-04-01T01:43:13Z

Refs #36181 -- Removed the obsolete SubqueryConstraint machinery.

2025-02-13T08:29:24Z

Adding proper support for subquery right-hand-sides to TupleIn made it obsolete.

Fixed #36088 -- Avoided unnecessary DEFAULT usage on bulk_create().

2025-02-01T17:43:10Z

When all values of a field with a db_default are DatabaseDefault, which is the case most of the time, there is no point in specifying explicit DEFAULT for all INSERT VALUES as that's what the database will do anyway if not specified. In the case of PostgreSQL doing so can even be harmful as it prevents the usage of the UNNEST strategy and in the case of Oracle, which doesn't support the usage of the DEFAULT keyword, it unnecessarily requires providing literal db defaults. Thanks Lily Foote for the review.

Fixed #36122 -- Raised FieldError when updating with composite reference value.

2025-01-28T12:05:53Z

Thanks Jacob Walls for the report and test.

Fixed #36086 -- Fixed crash when using GeneratedField with non-AutoField pk.

2025-01-13T10:13:29Z

The previous logic was systematically attempting to retrieve last_insert_id even for models without an AutoField primary key when they had a GeneratedField on backends that can't return columns from INSERT. The issue affected MySQL, SQLite < 3.35, and Oracle when the use_returning_into option was disabled and could result in either crashes when the non-auto primary key wasn't an IntegerField subclass or silent misassignment of bogus insert ids (0 or the previous auto primary key insert value) to the first defined generated field value.