django.git/tests/aggregation, branch main

Fixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.

2026-04-18T06:53:21Z

Fixed #36890 -- Supported StringAgg(distinct=True) on SQLite with the default delimiter.

2026-02-10T21:47:44Z

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed #36751 -- Fixed empty filtered aggregation crash over annotated queryset.

2025-11-24T11:14:38Z

Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage.

Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:11:45Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #36405 -- Fixed Aggregate.order_by using OuterRef.

2025-05-23T14:15:59Z

co-authored-by: Simon Charette

Fixed #36404 -- Fixed Aggregate.filter using OuterRef.

2025-05-23T13:17:20Z

Regression in a76035e925ff4e6d8676c65cb135c74b993b1039. Thank you to Simon Charette for the review. co-authored-by: Simon Charette

Refs #35444 -- Adjusted multi-args distinct aggregate test ordering expectations.

2025-05-23T09:19:31Z

Unless an explicit order_by is specified for the test the ordering of the aggregation results is undefined.

Fixed #34262 -- Added support for AnyValue for SQLite, MySQL, Oracle, and Postgresql 16+.

2025-05-20T08:01:42Z

Thanks Simon Charette for the guidance and review. Thanks Tim Schilling for the documentation review. Thanks David Wobrock for investigation and solution proposals.