django.git/django/db/models/sql, branch main

Fixed #37047 -- Fixed crash in Query.orderby_issubset_groupby for descending and random order_by strings.

2026-04-19T08:03:11Z

Run this example: ```python User.objects.values("is_staff").annotate(latest=Max("date_joined")).order_by("-latest").count() ``` You should see the following exception: ``` django.core.exceptions.FieldError: Cannot resolve keyword '-latest' into field. ``` Regression in 2ce5cb0f7a4618dfdc5f5c10e53e2e9b9543d298.

Fixed #20024 -- Fixed handling of __in lookups with None in exclude().

2026-04-02T15:24:26Z

Thanks Simon Charette and Tim Graham for reviews, and Jason Hall for a prior iteration.

Refs #36795 -- Deprecated SQLCompiler.quote_name_unless_alias().

2026-03-19T16:24:17Z

It has been superseded with .quote_name(), which ensures aliases are always quoted.

Fixed #36795 -- Enforced quoting of all database object names.

2026-03-19T16:24:17Z

This ensures all database identifiers are quoted independently of their orign and most importantly that user provided aliases through annotate() and alias() which paves the way for dropping the allow list of characters such aliases can contain. This will require adjustments to raw SQL interfaces such as RawSQL that might make reference to ORM managed annotations as these will now be quoted. The `SQLCompiler.quote_name_unless_alias` method is kept for now as an alias for the newly introduced `.quote_name` method but will be duly deprecated in a follow up commit.

Fixed #36727 -- Deprecated Field.get_placeholder in favor of get_placeholder_sql.

2026-03-13T00:01:02Z

The lack of ability of the get_placeholder call chain to return SQL and parameters separated so they can be mogrified by the backend at execution time forced implementations to dangerously interpolate potentially user controlled values. The get_placeholder_sql name was chosen due to its proximity to the previous method, but other options such as Field.as_sql were considered but ultimately rejected due to its different input signature compared to Expression.as_sql that might have lead to confusion. There is a lot of overlap between what Field.get_db_prep_value and get_placeholder_sql do but folding the latter in the former would require changing its return signature to return expression which is a way more invasive change than what is proposed here. Given we always call get_db_prep_value it might still be an avenue worth exploring in the future to offer a publicly documented interface to allow field to take an active part in the compilation chain. Thanks Jacob for the review.

Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T12:56:04Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795.

Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T12:55:33Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews.

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed #36352 -- Improved error message for fields excluded by prior values()/values_list() calls.

2026-01-16T15:28:14Z

Signed-off-by: JaeHyuck Sa

Fixed #36821 -- Treated empty strings as NULL for iexact lookups on Oracle.

2026-01-14T18:31:15Z

Signed-off-by: JaeHyuck Sa