django.git/django/db/models/sql/query.py, branch stable/6.0.x

[6.0.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T13:05:34Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. Backport of 005d60d97c4dfb117503bdb6f2facfcaf9315d84 from main.

[6.0.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T13:03:39Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.

[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:17:15Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:10:58Z

Thanks Eyal Gabay (EyalSec) for the report.

Fixed #36431 -- Returned tuples for multi-column ForeignObject in values()/values_list().

2025-08-29T19:33:44Z

Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH

Refs #36152 -- Suppressed duplicate warning when using "%" in alias via values().

2025-08-29T17:45:08Z

Fixed #36210, Refs #36181 -- Allowed Subquery usage in further lookups against composite pks.

2025-08-07T12:28:44Z

Follow-up to 8561100425876bde3be4b2a22324655f74ff9609. Co-authored-by: Simon Charette

Refs #36500 -- Corrected rewrapped long lines fixed via a script.

2025-07-23T23:17:55Z

Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #36152 -- Deprecated use of "%" in column aliases.

2025-06-20T06:25:22Z

Unintentional support existed only on SQLite and Oracle.