django.git/tests/annotations/tests.py, branch stable/5.2.x

[5.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T13:17:34Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.

[5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

2025-12-02T12:27:34Z

Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.

[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:24:18Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

[5.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:15:55Z

Thanks Eyal Gabay (EyalSec) for the report. Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.

[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().

2025-04-05T19:38:06Z

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Jeff Iadarola for the report and tests. Co-Authored-By: OutOfFocus4 Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main

[5.2.x] Fixed #36155 -- Improved error handling when annotate arguments require an alias.

2025-01-30T11:18:08Z

Regression in ed0cbc8d8b314e3b4a0305d0be3cf366d8ee4a74. Backport of c6ace896a2da73356f7c9a655bbe32a0e3ce0435 from main.

Fixed #35586 -- Added support for set-returning database functions.

2024-08-12T13:35:19Z

Aggregation optimization didn't account for not referenced set-returning annotations on Postgres. Co-authored-by: Simon Charette

Refs #28900 -- Made SELECT respect the order specified by values(*selected).

2024-07-03T14:36:25Z

Previously the order was always extra_fields + model_fields + annotations with respective local ordering inferred from the insertion order of *selected. This commits introduces a new `Query.selected` propery that keeps tracks of the global select order as specified by on values assignment. This is crucial feature to allow the combination of queries mixing annotations and table references. It also allows the removal of the re-ordering shenanigans perform by ValuesListIterable in order to re-map the tuples returned from the database backend to the order specified by values_list() as they'll be in the right order at query compilation time. Refs #28553 as the initially reported issue that was only partially fixed for annotations by d6b6e5d0fd4e6b6d0183b4cf6e4bd4f9afc7bf67. Thanks Mariusz Felisiak and Sarah Boyce for review.

Fixed #34437 -- Made values() resolving error mention selected annotations.

2023-03-25T19:22:45Z

While the add_fields() call from set_values() does trigger validation it does so after annotations are masked resulting in them being excluded from the choices of valid options surfaced through a FieldError.

Fixed #34254 -- Fixed return value of Exists() with empty queryset.

2023-01-26T18:54:48Z

Thanks Simon Charette for reviews.