django.git/django/db/models/sql/query.py, branch main

Fixed #37047 -- Fixed crash in Query.orderby_issubset_groupby for descending and random order_by strings.

2026-04-19T08:03:11Z

Run this example: ```python User.objects.values("is_staff").annotate(latest=Max("date_joined")).order_by("-latest").count() ``` You should see the following exception: ``` django.core.exceptions.FieldError: Cannot resolve keyword '-latest' into field. ``` Regression in 2ce5cb0f7a4618dfdc5f5c10e53e2e9b9543d298.

Fixed #20024 -- Fixed handling of __in lookups with None in exclude().

2026-04-02T15:24:26Z

Thanks Simon Charette and Tim Graham for reviews, and Jason Hall for a prior iteration.

Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T12:56:04Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795.

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed #36352 -- Improved error message for fields excluded by prior values()/values_list() calls.

2026-01-16T15:28:14Z

Signed-off-by: JaeHyuck Sa

Fixed #36821 -- Treated empty strings as NULL for iexact lookups on Oracle.

2026-01-14T18:31:15Z

Signed-off-by: JaeHyuck Sa

Fixed #26434 -- Removed faulty clearing of ordering field when missing from explicit grouping.

2025-12-15T20:23:51Z

Co-authored-by: Simon Charette

Reverted "Fixed #26434 -- Removed faulty clearing of ordering field when missing from explicit grouping."

2025-10-28T15:40:01Z

This reverts commit ea3a71c2d09f8281d8a50ed20e40e1fb13db5cd9. The implementation was flawed, as self.group_by contains Cols, not aliases.

Fixed #26434 -- Removed faulty clearing of ordering field when missing from explicit grouping.

2025-10-27T19:11:19Z

Co-authored-by: Simon Charette

Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:11:45Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.