django.git/django/db/models/sql, branch 5.1.14

[5.1.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:53:17Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

[5.1.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:31:32Z

Thanks Eyal Gabay (EyalSec) for the report. Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.

[5.1.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

2024-08-06T06:51:22Z

Thanks Eyal (eyalgabay) for the report.

[5.1.x] Fixed #35643 -- Fixed a crash when ordering a QuerySet by a reference containing "__".

2024-08-02T19:22:05Z

Regression in b0ad41198b3e333f57351e3fce5a1fb47f23f376. Refs #34013. The initial logic did not consider that annotation aliases can include lookup or transform separators. Thanks Gert Van Gool for the report and Mariusz Felisiak for the review. Backport of a16f13a8661297eda12c4177bb01fa2e5b5ccc56 from main.

Refs #35356 -- Clarified select related with masked field logic.

2024-04-23T16:17:17Z

By always including related objects in the select mask via adjusting the defer logic (_get_defer_select_mask()), it becomes possible for select_related_descend() to treat forward and reverse relationships indistinctively. This work also simplifies and adds comments to select_related_descend() to make it easier to understand.

Fixed #35356 -- Deferred self-referential foreign key fields adequately.

2024-04-23T16:17:17Z

While refs #34612 surfaced issues with reverse one-to-one fields deferrals, it missed that switching to storing remote fields would break self-referential relationships. This change switches to storing related objects in the select mask instead of remote fields to prevent collisions when dealing with self-referential relationships that might have a different directional mask. Despite fixing #21204 introduced a crash under some self-referential deferral conditions, it was simply not working even before that as it aggregated the sets of deferred fields by model. Thanks Joshua van Besouw for the report and Mariusz Felisiak for the review.

Fixed #35294 -- Fixed TEXT format of QuerySet.explain() for long plans.

2024-03-15T05:58:14Z

co-authored-by: Gordon co-authored-by: Simon Charette

Fixed #35241 -- Cached model's full parent list.

2024-02-26T04:38:31Z

co-authored-by: Keryn Knight co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith co-authored-by: Paolo Melchiorre

Fixed #35099 -- Prevented mutating queryset when combining with & and | operators.

2024-02-07T11:36:30Z

Thanks Alan for the report. Co-authored-by: Mariusz Felisiak

Fixed #35135 -- Made FilteredRelation raise ValueError on querysets as rhs.

2024-01-29T19:29:49Z

Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.