django.git/django/db/models/sql/query.py, branch 5.1.10

[5.1.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

2024-08-06T06:51:22Z

Thanks Eyal (eyalgabay) for the report.

Refs #35356 -- Clarified select related with masked field logic.

2024-04-23T16:17:17Z

By always including related objects in the select mask via adjusting the defer logic (_get_defer_select_mask()), it becomes possible for select_related_descend() to treat forward and reverse relationships indistinctively. This work also simplifies and adds comments to select_related_descend() to make it easier to understand.

Fixed #35356 -- Deferred self-referential foreign key fields adequately.

2024-04-23T16:17:17Z

While refs #34612 surfaced issues with reverse one-to-one fields deferrals, it missed that switching to storing remote fields would break self-referential relationships. This change switches to storing related objects in the select mask instead of remote fields to prevent collisions when dealing with self-referential relationships that might have a different directional mask. Despite fixing #21204 introduced a crash under some self-referential deferral conditions, it was simply not working even before that as it aggregated the sets of deferred fields by model. Thanks Joshua van Besouw for the report and Mariusz Felisiak for the review.

Fixed #35099 -- Prevented mutating queryset when combining with & and | operators.

2024-02-07T11:36:30Z

Thanks Alan for the report. Co-authored-by: Mariusz Felisiak

Fixed #35135 -- Made FilteredRelation raise ValueError on querysets as rhs.

2024-01-29T19:29:49Z

Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.

Applied Black's 2024 stable style.

2024-01-26T11:45:07Z

https://github.com/psf/black/releases/tag/24.1.0

Refs #35102 -- Optimized replace_expressions()/relabelling aliases by adding early return.

2024-01-15T04:56:38Z

This avoids costly hashing. Thanks Anthony Shaw for the report. Co-Authored-By: Simon Charette

Fixed #35050 -- Fixed prefixing field names in FilteredRelation().

2023-12-23T16:35:13Z

Thanks Mark Zorn for the report. Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.

Fixed #35042 -- Fixed a count() crash on combined queries.

2023-12-16T19:19:24Z

Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Thanks Marcin for the report.

Refs #34717 -- Avoided computing aggregate refs twice.

2023-11-18T14:41:25Z