django.git/django/db/models/sql/query.py, branch 6.0rc1

[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:17:15Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:10:58Z

Thanks Eyal Gabay (EyalSec) for the report.

Fixed #36431 -- Returned tuples for multi-column ForeignObject in values()/values_list().

2025-08-29T19:33:44Z

Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH

Refs #36152 -- Suppressed duplicate warning when using "%" in alias via values().

2025-08-29T17:45:08Z

Fixed #36210, Refs #36181 -- Allowed Subquery usage in further lookups against composite pks.

2025-08-07T12:28:44Z

Follow-up to 8561100425876bde3be4b2a22324655f74ff9609. Co-authored-by: Simon Charette

Refs #36500 -- Corrected rewrapped long lines fixed via a script.

2025-07-23T23:17:55Z

Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #36152 -- Deprecated use of "%" in column aliases.

2025-06-20T06:25:22Z

Unintentional support existed only on SQLite and Oracle.

Fixed #36442 -- Cloned FilteredRelation before rename_prefix_from_q.

2025-06-12T06:36:54Z

Fixed #36392 -- Raised ValueError when subquery referencing composite pk selects too many columns.

2025-05-16T06:19:38Z