Django ORM 6.1

Apply the Django 6.1 prompt first. These rules extend that baseline for Django 6.1.1 ORM queries, relationships, field fetching, writes, transactions, and migrations.

Safe query construction

• Use Value(user_value) for literal expression arguments; bare strings passed to Func are interpreted as field references. Resolve F() paths, lookup names, and ordering expressions from a server-owned registry.
• Rebuild filter arguments from an allowlist instead of unpacking request dictionaries into Q(), filter(), exclude(), or get(). Keep connector choices, annotation aliases, and FilteredRelation definitions in trusted code.
• Keep Func and Aggregate templates, function, arg_joiner, extra, extra_context, and output_field definitions trusted; these configure SQL generation and are not bound values. Return SQL and parameters separately from custom as_sql() implementations.
• Keep placeholders unquoted in raw(), RawSQL, and cursor SQL; use params for values. Reapply tenant and permission predicates inside raw SQL because QuerySet.raw() ignores preceding filters and does not enforce read-only execution.
• Put row limits in raw SQL itself; RawQuerySet indexing and slicing happen outside the database. Include needed fields explicitly so omitted columns cannot trigger unexpected deferred queries.
• Validate and convert values to the column's intended type in MySQL/MariaDB raw SQL and custom get_prep_value() implementations; coercion can turn a comparison into an unintended match.
• Review raw references to mixed-case annotation and join