summaryrefslogtreecommitdiff
path: root/django/db
AgeCommit message (Collapse)Author
2025-10-01Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), ↵Mariusz Felisiak
and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.
2025-09-30Fixed #36614 -- Deprecated QuerySet.values_list(flat=True) without a field.Adam Johnson
Thanks to Jacob Walls and Simon Charette for their input. co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-09-29Skipped NOT NULL constraints on PostgreSQL 18+.Mariusz Felisiak
Thanks Simon Charette for the implementation idea.
2025-09-29Fixed #36277 -- Fixed DatabaseFeatures.supports_virtual_generated_columns on ↵arsalan64
PostgreSQL 18+.
2025-09-25Refs #36605 -- Optimized QuerySet.in_bulk() for the empty id_list case.Adam Johnson
Now that the setup is a bit more expensive, it makes sense to return earlier for the empty case.
2025-09-25Fixed #36605 -- Added support for QuerySet.in_bulk() after .values() or ↵John Parton
.values_list(). co-authored-by: Adam Johnson <me@adamj.eu> co-authored-by: Simon Charette <charette.s@gmail.com>
2025-09-23Fixed #36616 -- Added DatabaseOperations.adapt_durationfield_value().Tim Graham
2025-09-23Fixed #36264 -- Excluded proxy neighbors of parents from deletion collection ↵saJaeHyukc
when keep_parents=True. Signed-off-by: saJaeHyukc <wogur981208@gmail.com>
2025-09-22Fixed #35453 -- Made ManyToManyField.concrete False.Ryan P Kilby
ManyToManyField was already excluded from fields, concrete_fields, and local_concrete_fields in Options.
2025-09-22Fixed #36480 -- Made values() resolving error mention unselected aliases.Shubham Singh
Follow-up to cb13792938f2c887134eb6b5164d89f8d8f9f1bd. Refs #34437.
2025-09-22Fixed #36612 -- Fixed a KeyTextTransform crash on MySQL against annotations.Simon Charette
MySQL only supports the ->> when used directly against columns, this can be inferred by the presence of lhs.output_field.model as model bounds fields are directly tied to columns. Purposely don't systematically switch to using JSON_QUOTE(JSON_EXTRACT(...)) as there might be functional indices out there that rely on the SQL remaining stable between versions. Thanks Jacob Tavener for the report.
2025-09-19Refs #36438 -- Simplified retrieval of GeneratedField base fields in ↵Clifford Gama
migrations autodetector. This was creating an unusable Q object solely to call referenced_base_fields on it.
2025-09-19Fixed #36369 -- Cleared additional cached properties in apps.clear_cache().Senthil Kumar
Thanks Clifford Gama for the report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-09-19Refs #36152, #35667 -- Used skip_file_prefixes in alias deprecation warning.Jacob Walls
Follow-up to 8ede411a81b40ca53362e6788601193c7e56a0cf.
2025-09-19Fixed #36584, Refs #36149 -- Allowed subquery values against tuple in lookup ↵사재혁
via ForeignObject.
2025-09-17Refs #27222 -- Restored Model.save()'s refreshing of db_returning fields ↵Simon Charette
even if a value is set. The logic could likely be adjusted to assign the pre_save value in most cases to avoid the database transit but it could break in subtle ways so it's not worth the complexity it would require. Regression in 94680437a45a71c70ca8bd2e68b72aa1e2eff337. Co-authored-by: Tim Graham <timograham@gmail.com>
2025-09-16Fixed #36606 -- Optimized QuerySet.values_list(flat=True) without fields.Adam Johnson
2025-09-16Fixed #36426 -- Added support for further iterables in ↵blingblin-g
prefetch_related_objects(). Thanks Sarah Boyce for the review.
2025-09-16Refs #27222 -- Deduplicated db_returning fields in Model.save().Jacob Walls
Follow-up to 94680437a45a71c70ca8bd2e68b72aa1e2eff337.
2025-09-16Fixed #36580 -- Fixed constraint validation crash when condition uses a ↵SaJH
ForeignObject. Follow-up to e44e8327d3d88d86895735c0e427102063ff5b55. Refs #36222.
2025-09-14Fixed #27222 -- Refreshed model field values assigned expressions on save().Simon Charette
Removed the can_return_columns_from_insert skip gates on existing field_defaults tests to confirm the expected number of queries are performed and that returning field overrides are respected.
2025-09-14Refs #27222 -- Refreshed GeneratedFields values on save() initiated update.Simon Charette
This required implementing UPDATE RETURNING machinery that heavily borrows from the INSERT one.
2025-09-05Fixed #36564 -- Changed DEFAULT_AUTO_FIELD from AutoField to BigAutoField.Tim Graham
2025-09-04Fixed #36481 -- Fixed QuerySet.update concrete fields check.Ryan P Kilby
FieldError is now emitted for invalid update calls involving reverse relations, where previously they failed with AttributeError.
2025-09-03Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in ↵Jake Howard
column aliases. Thanks Eyal Gabay (EyalSec) for the report.
2025-08-29Fixed #36431 -- Returned tuples for multi-column ForeignObject in ↵SaJH
values()/values_list(). Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-29Refs #36152 -- Suppressed duplicate warning when using "%" in alias via ↵Jacob Walls
values().
2025-08-28Refs #27222 -- Adapted RETURNING handling to be usable for UPDATE queries.Simon Charette
Renamed existing methods and abstractions used for INSERT … RETURNING to be generic enough to be used in the context of UPDATEs as well. This also consolidates SQL compliant implementations on BaseDatabaseOperations.
2025-08-28Refs #27222 -- Implemented ↵Simon Charette
BaseDatabaseOperations.return_insert_columns()/fetch_returned_insert_rows().
2025-08-23Refs #470 -- Adjusted Field.db_returning to be backend agnostic.Simon Charette
Determining if a field is db_returning based on the default connection feature availability prevents the usage of RETURNING for db_default fields in setups where non-default backends do support RETURNING. Whether or not the field should be attempted to be returned is already checked at the compiler level which is backend aware.
2025-08-21Refs #36430, #36416, #34378 -- Simplified batch size calculation in ↵Jacob Walls
QuerySet.in_bulk().
2025-08-21Fixed #36430 -- Removed artificially low limit on single field bulk ↵Jacob Walls
operations on SQLite.
2025-08-15Refs #36490 -- Simplified QuerySet._batched_insert returning fields handling.Simon Charette
Whether or not returning_fields should be specified to _insert is not a function of each batches so the conditional can be moved outside of the loop.
2025-08-15Fixed #36490 -- Avoided unnecessary transaction in bulk_create.Simon Charette
When dealing with an heterogeneous set of object with regards to primary key assignment that fits in a single batch there's no need to wrap the single INSERT statement in a transaction.
2025-08-12Remove unused OneToOneField from DatabaseWrapper.data_types.Tim Graham
OneToOneField uses the type of the related field.
2025-08-11Refs #36210 -- Corrected output_field comparison in ↵Jacob Walls
Subquery.resolve_expression(). Regression in fd569dd45bf0746378faf7f65172497f21ed27f0.
2025-08-07Fixed #36210, Refs #36181 -- Allowed Subquery usage in further lookups ↵Jacob Walls
against composite pks. Follow-up to 8561100425876bde3be4b2a22324655f74ff9609. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-08-05Fixed #36530 -- Extended fields.E347 to check for ManyToManyField involving ↵jkhall81
CompositePrimaryKey on either side. Thanks to Jacob Walls for the report.
2025-08-04Fixed #35972 -- Fixed lookup crashes after subquery annotations.Jacob Walls
2025-08-04Fixed #34871, #36518 -- Implemented unresolved lookups expression replacement.Simon Charette
This allows the proper resolving of lookups when performing constraint validation involving Q and Case objects. Thanks Andrew Roberts for the report and Sarah for the tests and review.
2025-07-29Fixed #36531 -- Added forkserver support to parallel test runner.Mariusz Felisiak
2025-07-28Fixed #36522 -- Added support for filtering composite pks using a tuple of ↵Simon Charette
expressions. Thanks Jacob Walls for the report, and Sarah Boyce and Mariusz Felisiak for reviews.
2025-07-25Refs #36438 -- Made FieldOperation.references_field() detect references in ↵Clifford Gama
GeneratedField.expression. Thanks to Simon Charette for the suggestion and review.
2025-07-25Fixed #36438 -- Made MigrationAutodetector remove generated fields before ↵Clifford Gama
their base fields. Thanks to Colton Saska for the report and to Simon Charette for the review.
2025-07-23Refs #36500 -- Corrected rewrapped long lines fixed via a script.Mike Edmunds
Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-07-23Removed double spaces after periods and within phrases.Sarah Boyce
2025-07-22Fixed #36282 -- Used prefetched values in ForwardManyToOneDescriptor from ↵Take Weiland
indirect ancestors. When looking for cached values in ManyRelatedManager and ForwardManyToOneDescriptor walk up the whole chain of ancestors (as long as they are cached) to find the prefetched relation.
2025-07-10Fixed #36502 -- Restored UNNEST strategy for foreign key bulk inserts on ↵Simon Charette
PostgreSQL. Regression in 764af7a3d6c0b543dcf659a2c327f214da768fe4.
generated by cgit v1.3 (git 2.53.0) at 2026-09-05 07:37:20 +0000