Update with Distinct Produces Unintentional Results

[Matt Shirley]

Similar to #32433.

The ORM permits calling update() on a Queryset when a distinct() was applied. This results in unforeseen consequences where a larger data set will be updated than what is expected. Similar to the example provided in #32433:

Comment.objects.order_by('post_id', 'created_at').distinct('post_id').update(deleted=True)

The developer may assume that this will delete only one comment per post_id, however, the distinct() is ignored (as UPDATE has no distinct) which results in the entire table being updated:

UPDATE "post_comment" SET "deleted" = true'

Since delete() already guards against this case, I believe update() should behave consistently to protect the developer from mistakes, even though applying a distinct() before an update() is generally unusual.

[Matt Shirley]

​https://github.com/django/django/pull/19997 (PR)