Skip to content

fix: drop unmentioned related columns from values()/values_list()#1669

Merged
collerek merged 1 commit into
masterfrom
fix-issue-800-values-list-fields-leak
May 8, 2026
Merged

fix: drop unmentioned related columns from values()/values_list()#1669
collerek merged 1 commit into
masterfrom
fix-issue-800-values-list-fields-leak

Conversation

@collerek
Copy link
Copy Markdown
Collaborator

@collerek collerek commented May 8, 2026

Fixes #800.

values() / values_list() were leaking columns of related models that got pulled into the query by a filter (e.g. filter(project__id=...)) or a bare select_related() but were never named in fields(). The flat-projection result included every column of the joined model on top of what the caller actually requested.

The fix adds ExcludableItems.with_projection_exclusions(source_model, select_related), called from QuerySet.values(). When fields() was used, it walks each select_related path and adds an implicit exclude for any segment (and its m2m through model) the user never referenced. Regular ORM-load queries (get, all, etc.) are unchanged - they still load all columns of unmentioned related models so Pydantic construction does not lose mandatory fields.

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 8, 2026

Merging this PR will degrade performance by 29.25%

⚡ 3 improved benchmarks
❌ 1 regressed benchmark
✅ 94 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Mode Benchmark BASE HEAD Efficiency
WallTime test_creating_individually_with_related_models[40] 354.2 ms 277.9 ms +27.42%
WallTime test_get_or_create_when_create[10] 119 ms 99.6 ms +19.56%
WallTime test_saving_models_individually_with_related_models[20] 176.3 ms 140.7 ms +25.36%
WallTime test_saving_models_individually_with_related_models[40] 248.5 ms 351.3 ms -29.25%

Comparing fix-issue-800-values-list-fields-leak (e5d975e) with master (5c86ce1)

Open in CodSpeed

@collerek collerek merged commit 001578d into master May 8, 2026
10 of 11 checks passed
@collerek collerek deleted the fix-issue-800-values-list-fields-leak branch May 8, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Using fields parameter or method without flatten=True does not seem to work on values and values_list

1 participant