django.git/tests/annotations, branch main

Refs #36795 -- Removed unnecessary prohibits_dollar_signs_in_column_aliases feature flag.

2026-03-19T16:24:17Z

Now that user provided aliases are systematically quoted there is no need to disallow the usage of the dollar sign on Postgres.

Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

2026-02-03T12:55:04Z

Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.

Fixed #36352 -- Improved error message for fields excluded by prior values()/values_list() calls.

2026-01-16T15:28:14Z

Signed-off-by: JaeHyuck Sa

Added DatabaseFeatures.prohibits_dollar_signs_in_column_aliases.

2025-12-04T16:37:22Z

This is also applicable on CockroachDB.

Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

2025-12-02T12:21:07Z

Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews.

Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:11:45Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Fixed #36480 -- Made values() resolving error mention unselected aliases.

2025-09-22T12:35:53Z

Follow-up to cb13792938f2c887134eb6b5164d89f8d8f9f1bd. Refs #34437.

Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

2025-09-03T11:10:58Z

Thanks Eyal Gabay (EyalSec) for the report.

Refs #36210 -- Added missing limits in Subquery tests.

2025-08-07T12:28:44Z

Refs #36500 -- Shortened some long docstrings and comments.

2025-07-23T23:17:55Z

Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.