$ the-wire · showcase
DJANGO PATCHES CRITICAL QUERY ORDERING BUG AFFECTING UNIONS
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
2 people shipped this
Django fixed a regression in combined queries that broke ordering on union, intersection, and difference operations, potentially causing incorrect result sets in production.
The fix [1] addresses ticket #37097, a regression introduced in commit 087bb9e8f that drove traffic into an existing error path. When using union(), intersect(), or difference() operations with explicit order_by() calls, Django was failing to properly clear ordering on the inner combined queries, leading to unexpected result behavior. The team also removed redundant compilation-time order clearing on Oracle [2], which was handling the same issue inefficiently. In parallel, Django shipped a security-focused update [3] adding CSP nonce support to error pages, admin templates, and registration forms. All explicit script, link, and style elements in these templates now use the {% csp_nonce %} tag when available, hardening Django's default templates against inline script injection attacks.
Action items
- → Review any code using union/intersect/difference with order_by and test result ordering django/django [immediate]
- → Update to latest Django patch to get CSP nonce support in admin and error pages django/django [plan]
References
