django.git/django/db/models/sql/query.py, branch stable/5.2.x

[5.2.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T13:19:02Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. Backport of 005d60d97c4dfb117503bdb6f2facfcaf9315d84 from main.

[5.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T13:17:34Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.

[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:24:18Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

[5.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:15:55Z

Thanks Eyal Gabay (EyalSec) for the report. Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.

[5.2.x] Fixed #36431 -- Returned tuples for multi-column ForeignObject in values()/values_list().

2025-08-29T19:36:09Z

Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH Backport of bb7a7701b1a0e8fffe14dcebf5d5bac7f176c02a from main

[5.2.x] Fixed #36392 -- Raised ValueError when subquery referencing composite pk selects too many columns.

2025-05-16T06:21:18Z

Backport of 994dc6d8a1bae717baa236b65e11cf91ce181c53 from main.

[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().

2025-04-05T19:38:06Z

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Jeff Iadarola for the report and tests. Co-Authored-By: OutOfFocus4 Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main

[5.2.x] Fixed #36292 -- Fixed crash when aggregating over a group mixing transforms and references.

2025-04-03T16:35:11Z

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900 Thanks Patrick Altman for the report. Backport of 543e17c4405dfdac4f18759fc78b190406d14239 from main

[5.2.x] Fixed #36149 -- Allowed subquery values against tuple exact and in lookups.

2025-02-11T08:16:44Z

Non-tuple exact and in lookups have specialized logic for subqueries that can be adapted to properly assign select mask if unspecified and ensure the number of involved members are matching on both side of the operator. Backport of 41239fe34d64e801212dccaa4585e4802d0fac68 from main.

[5.2.x] Fixed #35677 -- Avoided non-sticky filtering of prefetched many-to-many.

2025-02-06T13:31:32Z

The original queryset._next_is_sticky() call never had the intended effect as no further filtering was applied internally after the pk__in lookup making it a noop. In order to be coherent with how related filters are applied when retrieving objects from a related manager the effects of what calling _next_is_sticky() prior to applying annotations and filters to the queryset provided for prefetching are emulated by allowing the reuse of all pre-existing JOINs. Thanks David Glenck and Thiago Bellini Ribeiro for the detailed reports and tests. Backport of 2598b371a93e21d84b7a2a99b2329535c8c0c138 from main.