summaryrefslogtreecommitdiff
path: root/django/db
AgeCommit message (Collapse)Author
2025-12-02[6.0.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-11-24[6.0.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-20[6.0.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-18[6.0.x] Fixed #36141 -- Checked for applied replaced migrations recursively.Georgi Yanchev
Regression in 64b1ac7292c72d3551b2ad70b2a78c8fe4af3249. Backport of b07298a73a8d444b3618aad8005055bee5ead8cb from main.
2025-11-13[6.0.x] Fixed #36730 -- Fixed constraint validation crash for excluded FK ↵Adam Johnson
attnames. Regression in e44e8327d3d88d86895735c0e427102063ff5b55. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of abfa4619fb818ff694c22e962a280673e085239e from main
2025-11-05[6.0.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion. Backport of 3c3f46357718166069948625354b8315a8505262 from main.
2025-11-05[6.0.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of 98e642c69181c942d60a10ca0085d48c6b3068bb from main.
2025-11-04[6.0.x] Fixed #36704 -- Fixed system check error for proxy model with a ↵Hal Blackburn
composite pk. Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.
2025-10-29[6.0.x] Fixed #36596 -- Made parallel test runner respect django_test_skips ↵Mariusz Felisiak
and django_test_expected_failures. Backport of 9ba3f74a46d15f9f2f45ad4ef8cdd245a888e58e from main.
2025-10-16[6.0.x] Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352. Backport of d980d68609448a4c85763fa34e471ff80540888b from main.
2025-10-15[6.0.x] Fixed 36622 -- Prevented LazyObject FileField storages from ↵Clifford Gama
evaluating at boot time. Co-authored-by: Fabien MICHEL <fmichel@adista.fr> Backport of 6862d46dd96d71d80d6d2fa9873a93d811b39562 from main.
2025-10-14[6.0.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-13[6.0.x] Fixed #36611, Refs #36580 -- Added system check for multicolumn ↵Sarah Boyce
ForeignObject in Meta.indexes/constraints/unique_together. ForeignObjects with multiple `from_fields` are not supported in these options. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 5b51e6f759f2ba993219347435149173c756c478 from main.
2025-10-13[6.0.x] Fixed #36660 -- Fixed a regression in descending Index local field ↵Simon Charette
checks. Regression in 8638d8bf74c1a58302c97d4436ad2eb08438145b. Refs #36273. Thanks Federico Bond for the report. Backport of edde2891c355103ba455f3fea95cff962e40962c from main.
2025-10-11[6.0.x] Fixed #36646 -- Added compatibility for oracledb 3.4.0.Simon Charette
The Database.Binary, Date, and Timestamp attributes were changed from aliases to bytes, datetime.date, and datetime.datetime to factory functions in oracle/python-oracledb@869a887819cdac7fcd610f9d9d463ade49ea7 which made their usage inadequate for isinstance checks. Thanks John Wagenleitner for the report and Natalia for the triage. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of 315dbe675df338ae66c8fa43274a76ecbed7ef67 from main
2025-10-01[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-23[6.0.x] Fixed #36264 -- Excluded proxy neighbors of parents from deletion ↵saJaeHyukc
collection when keep_parents=True. Signed-off-by: saJaeHyukc <wogur981208@gmail.com> Backport of 748551fea0b4e37231203a063356572a47e09efb from main.
2025-09-22[6.0.x] Fixed #35453 -- Made ManyToManyField.concrete False.Ryan P Kilby
ManyToManyField was already excluded from fields, concrete_fields, and local_concrete_fields in Options. Backport of f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2 from main
2025-09-22[6.0.x] Fixed #36612 -- Fixed a KeyTextTransform crash on MySQL against ↵Simon Charette
annotations. MySQL only supports the ->> when used directly against columns, this can be inferred by the presence of lhs.output_field.model as model bounds fields are directly tied to columns. Purposely don't systematically switch to using JSON_QUOTE(JSON_EXTRACT(...)) as there might be functional indices out there that rely on the SQL remaining stable between versions. Thanks Jacob Tavener for the report. Backport of af84cfba5970fda8306860b650937701c7c03c6f from main.
2025-09-17Refs #27222 -- Restored Model.save()'s refreshing of db_returning fields ↵Simon Charette
even if a value is set. The logic could likely be adjusted to assign the pre_save value in most cases to avoid the database transit but it could break in subtle ways so it's not worth the complexity it would require. Regression in 94680437a45a71c70ca8bd2e68b72aa1e2eff337. Co-authored-by: Tim Graham <timograham@gmail.com>
2025-09-16Fixed #36606 -- Optimized QuerySet.values_list(flat=True) without fields.Adam Johnson
2025-09-16Fixed #36426 -- Added support for further iterables in ↵blingblin-g
prefetch_related_objects(). Thanks Sarah Boyce for the review.
2025-09-16Refs #27222 -- Deduplicated db_returning fields in Model.save().Jacob Walls
Follow-up to 94680437a45a71c70ca8bd2e68b72aa1e2eff337.
2025-09-16Fixed #36580 -- Fixed constraint validation crash when condition uses a ↵SaJH
ForeignObject. Follow-up to e44e8327d3d88d86895735c0e427102063ff5b55. Refs #36222.
2025-09-14Fixed #27222 -- Refreshed model field values assigned expressions on save().Simon Charette
Removed the can_return_columns_from_insert skip gates on existing field_defaults tests to confirm the expected number of queries are performed and that returning field overrides are respected.
2025-09-14Refs #27222 -- Refreshed GeneratedFields values on save() initiated update.Simon Charette
This required implementing UPDATE RETURNING machinery that heavily borrows from the INSERT one.
2025-09-05Fixed #36564 -- Changed DEFAULT_AUTO_FIELD from AutoField to BigAutoField.Tim Graham
2025-09-04Fixed #36481 -- Fixed QuerySet.update concrete fields check.Ryan P Kilby
FieldError is now emitted for invalid update calls involving reverse relations, where previously they failed with AttributeError.
2025-09-03Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in ↵Jake Howard
column aliases. Thanks Eyal Gabay (EyalSec) for the report.
2025-08-29Fixed #36431 -- Returned tuples for multi-column ForeignObject in ↵SaJH
values()/values_list(). Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-29Refs #36152 -- Suppressed duplicate warning when using "%" in alias via ↵Jacob Walls
values().
2025-08-28Refs #27222 -- Adapted RETURNING handling to be usable for UPDATE queries.Simon Charette
Renamed existing methods and abstractions used for INSERT … RETURNING to be generic enough to be used in the context of UPDATEs as well. This also consolidates SQL compliant implementations on BaseDatabaseOperations.
2025-08-28Refs #27222 -- Implemented ↵Simon Charette
BaseDatabaseOperations.return_insert_columns()/fetch_returned_insert_rows().
2025-08-23Refs #470 -- Adjusted Field.db_returning to be backend agnostic.Simon Charette
Determining if a field is db_returning based on the default connection feature availability prevents the usage of RETURNING for db_default fields in setups where non-default backends do support RETURNING. Whether or not the field should be attempted to be returned is already checked at the compiler level which is backend aware.
2025-08-21Refs #36430, #36416, #34378 -- Simplified batch size calculation in ↵Jacob Walls
QuerySet.in_bulk().
2025-08-21Fixed #36430 -- Removed artificially low limit on single field bulk ↵Jacob Walls
operations on SQLite.
2025-08-15Refs #36490 -- Simplified QuerySet._batched_insert returning fields handling.Simon Charette
Whether or not returning_fields should be specified to _insert is not a function of each batches so the conditional can be moved outside of the loop.
2025-08-15Fixed #36490 -- Avoided unnecessary transaction in bulk_create.Simon Charette
When dealing with an heterogeneous set of object with regards to primary key assignment that fits in a single batch there's no need to wrap the single INSERT statement in a transaction.
2025-08-12Remove unused OneToOneField from DatabaseWrapper.data_types.Tim Graham
OneToOneField uses the type of the related field.
2025-08-11Refs #36210 -- Corrected output_field comparison in ↵Jacob Walls
Subquery.resolve_expression(). Regression in fd569dd45bf0746378faf7f65172497f21ed27f0.
2025-08-07Fixed #36210, Refs #36181 -- Allowed Subquery usage in further lookups ↵Jacob Walls
against composite pks. Follow-up to 8561100425876bde3be4b2a22324655f74ff9609. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-08-05Fixed #36530 -- Extended fields.E347 to check for ManyToManyField involving ↵jkhall81
CompositePrimaryKey on either side. Thanks to Jacob Walls for the report.
2025-08-04Fixed #35972 -- Fixed lookup crashes after subquery annotations.Jacob Walls
2025-08-04Fixed #34871, #36518 -- Implemented unresolved lookups expression replacement.Simon Charette
This allows the proper resolving of lookups when performing constraint validation involving Q and Case objects. Thanks Andrew Roberts for the report and Sarah for the tests and review.
2025-07-29Fixed #36531 -- Added forkserver support to parallel test runner.Mariusz Felisiak
2025-07-28Fixed #36522 -- Added support for filtering composite pks using a tuple of ↵Simon Charette
expressions. Thanks Jacob Walls for the report, and Sarah Boyce and Mariusz Felisiak for reviews.
2025-07-25Refs #36438 -- Made FieldOperation.references_field() detect references in ↵Clifford Gama
GeneratedField.expression. Thanks to Simon Charette for the suggestion and review.
2025-07-25Fixed #36438 -- Made MigrationAutodetector remove generated fields before ↵Clifford Gama
their base fields. Thanks to Colton Saska for the report and to Simon Charette for the review.
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
generated by cgit v1.3 (git 2.53.0) at 2026-10-16 10:05:47 +0000