[pull] main from django:main

django/db/models/sql/query.py

@@ -2269,8 +2269,21 @@ def add_fields(self, field_names, allow_m2m=True):
                     join_info.joins,
                     join_info.path,
                 )
-                for target in targets:
-                    cols.append(join_info.transform_function(target, final_alias))
+                if len(targets) > 1:
+                    transformed_targets = [
+                        join_info.transform_function(target, final_alias)
+                        for target in targets
+                    ]
+                    cols.append(
+                        ColPairs(
+                            final_alias if self.alias_cols else None,
+                            [col.target for col in transformed_targets],
+                            [col.output_field for col in transformed_targets],
+                            join_info.final_field,
+                        )
+                    )
+                else:
+                    cols.append(join_info.transform_function(targets[0], final_alias))
             if cols:
                 self.set_select(cols)
         except MultiJoin:

docs/lint.py

@@ -96,7 +96,7 @@ def is_multiline_block_to_exclude(line):
                     continue
             except IndexError:
                 # End of file
-                continue
+                pass
             if len(set(line.strip())) == 1 and len(line) == len(lines[lno - 1]):
                 continue  # Ignore heading underline
             if lno in table_rows:

docs/releases/1.8.11.txt

@@ -5,4 +5,5 @@ Django 1.8.11 release notes
 *March 5, 2016*
 
 Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release
-where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).
+where ``utils.http.is_safe_url()`` crashes on bytestring URLs
+(:ticket:`26308`).

docs/releases/1.9.4.txt

@@ -5,4 +5,5 @@ Django 1.9.4 release notes
 *March 5, 2016*
 
 Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release
-where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).
+where ``utils.http.is_safe_url()`` crashes on bytestring URLs
+(:ticket:`26308`).

docs/releases/5.2.6.txt

@@ -10,4 +10,6 @@ Django 5.2.6 fixes a security issue with severity "high" and several bugs in
 Bugfixes
 ========
 
-* ...
+* Fixed a bug where using ``QuerySet.values()`` or ``values_list()`` with a
+  ``ForeignObject`` composed of multiple fields returned incorrect results
+  instead of tuples of the referenced fields (:ticket:`36431`).

tests/composite_pk/test_values.py

@@ -3,7 +3,7 @@
 
 from django.test import TestCase
 
-from .models import Post, Tenant, User
+from .models import Comment, Post, Tenant, User
 
 
 class CompositePKValuesTests(TestCase):
@@ -210,3 +210,17 @@ def test_values(self):
                     {"pk": self.user_3.pk, "id": self.user_3.id},
                 ),
             )
+
+    def test_foreign_object_values(self):
+        Comment.objects.create(id=1, user=self.user_1, integer=42)
+        testcases = {
+            "all": Comment.objects.all(),
+            "exclude_user_email": Comment.objects.exclude(user__email__endswith="net"),
+        }
+        for name, queryset in testcases.items():
+            with self.subTest(name=name):
+                values = list(queryset.values("user", "integer"))
+                self.assertEqual(
+                    values[0]["user"], (self.user_1.tenant_id, self.user_1.id)
+                )
+                self.assertEqual(values[0]["integer"], 42)