summaryrefslogtreecommitdiff
path: root/tests/queries
AgeCommit message (Collapse)Author
2025-11-05[6.0.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion. Backport of 3c3f46357718166069948625354b8315a8505262 from main.
2025-11-05[6.0.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of 98e642c69181c942d60a10ca0085d48c6b3068bb from main.
2025-10-01[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-17Refs #27222 -- Restored Model.save()'s refreshing of db_returning fields ↵Simon Charette
even if a value is set. The logic could likely be adjusted to assign the pre_save value in most cases to avoid the database transit but it could break in subtle ways so it's not worth the complexity it would require. Regression in 94680437a45a71c70ca8bd2e68b72aa1e2eff337. Co-authored-by: Tim Graham <timograham@gmail.com>
2025-09-16Refs #27222 -- Deduplicated db_returning fields in Model.save().Jacob Walls
Follow-up to 94680437a45a71c70ca8bd2e68b72aa1e2eff337.
2025-08-04Fixed #34871, #36518 -- Implemented unresolved lookups expression replacement.Simon Charette
This allows the proper resolving of lookups when performing constraint validation involving Q and Case objects. Thanks Andrew Roberts for the report and Sarah for the tests and review.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-06-10Refs #36419 -- Fixed BulkUpdateTests.test_json_field_sql_null() crash on Oracle.Mariusz Felisiak
Follow up to c1fa3fdd040718356e5a3b9a0fe699d73f47a940.
2025-06-06Fixed #36419 -- Ensured for_save was propagated when resolving expressions.Clifford Gama
The for_save flag wasn't properly propagated when resolving expressions, which prevented get_db_prep_save() from being called in some cases. This affected fields like JSONField where None would be saved as JSON null instead of SQL NULL. Regression in 00c690efbc0b10f67924687f24a7b30397bf47d9. Thanks to David Sanders and Simon Charette for reviews. Co-authored-by: Adam Johnson <me@adamj.eu>
2025-05-19Fixed #36388 -- Made QuerySet.union() return self when called with no arguments.Colleen Dunlap
Regression in 9cb8baa0c4fa2c10789c5c8b65f4465932d4d172. Thank you to Antoine Humeau for the report and Simon Charette for the review.
2025-05-08Refs #36143 -- Tested bulk_batch_size limit for bulk_update and bulk_create.Sage Abdullah
2025-04-11Fixed #36288 -- Addressed improper handling of duplicates in values_list().Simon Charette
Now that selected aliases are stored in sql.Query.selected: dict[str, Any] the values_list() method must ensures that duplicate field name references are assigned unique aliases. Refs #28900. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Thanks Claude for the report.
2025-02-11Fixed #36149 -- Allowed subquery values against tuple exact and in lookups.Simon Charette
Non-tuple exact and in lookups have specialized logic for subqueries that can be adapted to properly assign select mask if unspecified and ensure the number of involved members are matching on both side of the operator.
2025-01-14Refs #36075 -- Adjusted pk_fields usage in bulk_update eligibility checks.Simon Charette
Regression in bf7b17d16d3978b2e1cee4a0f7ce8840bd1a8dc4. Thanks Sage Abdullah for the report.
2024-11-08Fixed #35011, Refs #28900 -- Added tests for QuerySet.union() with multiple ↵Jacob Rief
models and DateTimeField annotations. Ticket was resolved by 65ad4ade74dc9208b9d686a451cd6045df0c9c3a as part of #28900.
2024-10-30Fixed #35856 -- Added QuerySet.explain() support for MEMORY/SERIALIZE option ↵Anthony Joseph
on PostgreSQL 17+.
2024-10-14Fixed #35744 -- Relabelled external aliases of combined queries.Simon Charette
Just like normal queries, combined queries' outer references might fully resolve before their reference is assigned its final alias. Refs #29338. Thanks Antony_K for the report and example, and thanks Mariusz Felisiak for the review.
2024-09-02Fixed #35712 -- Prevented Q.check() from leaving the connection in an ↵Alex Fischer
unusable state. Co-authored-by: Simon Charette <charette.s@gmail.com>
2024-08-26Added supports_select_union skips in queries and aggregation tests.Tim Graham
2024-07-19Fixed #35559 -- Avoided unnecessary query on sliced union of empty queries.Simon Charette
While refs #34125 focused on the SQL correctness of slicing of union of potentially empty queries it missed an optimization opportunity to avoid performing a query at all when all queries are empty. Thanks Lucidiot for the report.
2024-07-03Fixed #28900 -- Propagated all selected fields to combinator queries.Simon Charette
Previously, only the selected column aliases would be propagated and annotations were ignored.
2024-07-03Refs #28900 -- Made SELECT respect the order specified by values(*selected).Simon Charette
Previously the order was always extra_fields + model_fields + annotations with respective local ordering inferred from the insertion order of *selected. This commits introduces a new `Query.selected` propery that keeps tracks of the global select order as specified by on values assignment. This is crucial feature to allow the combination of queries mixing annotations and table references. It also allows the removal of the re-ordering shenanigans perform by ValuesListIterable in order to re-map the tuples returned from the database backend to the order specified by values_list() as they'll be in the right order at query compilation time. Refs #28553 as the initially reported issue that was only partially fixed for annotations by d6b6e5d0fd4e6b6d0183b4cf6e4bd4f9afc7bf67. Thanks Mariusz Felisiak and Sarah Boyce for review.
2024-05-02Refs #34007, Refs #35359 -- Added Q.referenced_based_fields property.David Sanders
Thank you to Mariusz Felisiak and Natalia Bidart for the reviews.
2024-03-15Fixed #35294 -- Fixed TEXT format of QuerySet.explain() for long plans.Adam Johnson
co-authored-by: Gordon <gordon.wrigley@gmail.com> co-authored-by: Simon Charette <charette.s@gmail.com>
2024-02-07Fixed #35099 -- Prevented mutating queryset when combining with & and | ↵Hisham Mahmood
operators. Thanks Alan for the report. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2023-12-16Refs #34013 -- Registered instance lookups as documented in tests.Simon Charette
2023-12-12Fixed #34013 -- Added QuerySet.order_by() support for annotation transforms.Simon Charette
Thanks Eugene Morozov and Ben Nace for the reports.
2023-12-06Refs #34986 -- Avoided implementation-specific unpickleable types.Nick Pope
The implementation of some core types differ between CPython and PyPy and this may affect the way that pickling works such that errors are raised in differing locations in the interpreter or not at all. Use our own custom non-pickleable type instead to avoid these quirks.
2023-09-26Fixed #34873 -- Added QuerySet.explain() support for GENERIC_PLAN option on ↵Mariusz Felisiak
PostgreSQL 16+.
2023-09-20Fixed #34851 -- Dropped support for PostgreSQL 12 and PostGIS 2.5.Mariusz Felisiak
2023-08-23Fixed #34744 -- Prevented recreation of migration for constraints with a ↵David Sanders
dict_keys. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2023-08-10Fixed non-deterministic order in SubqueryTests.test_slice_subquery_and_query.Mariusz Felisiak
Slice on unordered subquery may be non-deterministic in some databases.
2023-06-14Refs #32143 -- Removed superflous constraints on excluded query.Simon Charette
The outer query reference is not necessary when alias can be reused and can even be harmful by confusing query planers. Refs #34597.
2023-03-24Fixed #28553 -- Fixed annotation mismatch with ↵David Wobrock
QuerySet.values()/values_list() on compound queries. Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2023-02-21Refs #31445 -- Added test for nesting QuerySet.union().Mariusz Felisiak
This was fixed in MySQL 8.0.31.
2023-01-20Fixed #34267 -- Fixed sliced QuerySet.union() crash.Francesco Panico
Regression in 3d734c09ff0138441dfe0a59010435871d17950f. Thanks Raphaël Stefanini for the report.
2023-01-17Refs #31486 -- Removed ability to pass unsaved model instances to related ↵Mariusz Felisiak
filters. Per deprecation timeline.
2022-12-21Removed unnecessary commas in tests.Mariusz Felisiak
2022-12-02Refs #33308 -- Avoided passing None to RawSQL's params.Florian Apolloner
Passing None to params causes errors in determining the data type on psycopg3.
2022-11-23Refs #33050 -- Added test for QuerySet.count() on combined queries with ↵Mariusz Felisiak
select_related(). Thanks Simon Charette for noticing this. Fixed in 70499b25c708557fb9ee2264686cd172f4b2354e.
2022-11-15Fixed #34123 -- Fixed combinator order by alias when using select_related().Simon Charette
Regression in c58a8acd413ccc992dd30afd98ed900897e1f719. Thanks to Shai Berger for the report and tests. Co-Authored-By: David Sanders <shang.xiao.sanders@gmail.com>
2022-11-07Refs #33374 -- Adjusted full match condition handling.Simon Charette
Adjusting WhereNode.as_sql() to raise an exception when encoutering a full match just like with empty matches ensures that all case are explicitly handled.
2022-10-31Fixed #16211 -- Added logical NOT support to F expressions.David Wobrock
2022-10-29Fixed #34125 -- Fixed sliced QuerySet.union() crash on a single non-empty ↵Simon Charette
queryset. The bug existed since sliced query union was added but was elevated to query union slices by moving the .exists() optimization to the compiler in 3d734c09ff0138441dfe0a59010435871d17950f. Thanks Stefan Hammer for the report.
2022-10-08Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to ↵Gregor Gärtner
assertQuerySetEqual(). Co-Authored-By: Michael Howitz <mh@gocept.com>
2022-10-07Replaced assertQuerysetEqual() to assertSequenceEqual()/assertCountEqual() ↵Mariusz Felisiak
where appropriate. Follow up to 3f7b3275627385f8f7531fca01cdda50d4ec6b6e.
2022-10-05Fixed #33768 -- Fixed ordering compound queries by nulls_first/nulls_last on ↵Simon Charette
MySQL. Columns of the left outer most select statement in a combined query can be referenced by alias just like by index. This removes combined query ordering by column index and avoids an unnecessary usage of RawSQL which causes issues for backends that specialize the treatment of null ordering.
2022-10-04Fixed #34012 -- Made QuerySet.order_by() apply transforms on related fields ↵David Sanders
for models with Meta.ordering. This makes QuerySet.order_by() no longer ignore trailing transforms for models with Meta.ordering. As a consequence, FieldError is raised in such cases for non-existent fields. Thanks to Klaas van Schelven for the report and Mariusz Felisiak for the review and advice.
2022-09-22Refs #34012 -- Added test for ordering by transform of related fields.Mariusz Felisiak
generated by cgit v1.3 (git 2.53.0) at 2026-07-10 15:45:27 +0000