[5.2.x] Fixed #36181 -- Allowed Subquery usage in __in lookups against composite pks.

Thanks Jacob Walls for the report.

Backport of 8561100425876bde3be4b2a22324655f74ff9609 from main.

django/db/models/fields/tuple_lookups.py

@@ -2,7 +2,13 @@ import itertools
 
 from django.core.exceptions import EmptyResultSet
 from django.db.models import Field
-from django.db.models.expressions import ColPairs, Func, ResolvedOuterRef, Value
+from django.db.models.expressions import (
+    ColPairs,
+    Func,
+    ResolvedOuterRef,
+    Subquery,
+    Value,
+)
 from django.db.models.lookups import (
     Exact,
     GreaterThan,
@@ -290,7 +296,7 @@ class TupleIn(TupleLookupMixin, In):
             )
 
     def check_rhs_is_query(self):
-        if not isinstance(self.rhs, Query):
+        if not isinstance(self.rhs, (Query, Subquery)):
             lhs_str = self.get_lhs_str()
             rhs_cls = self.rhs.__class__.__name__
             raise ValueError(

tests/composite_pk/test_filter.py

@@ -442,6 +442,11 @@ class CompositePKFilterTests(TestCase):
         with self.assertRaisesMessage(ValueError, msg):
             Comment.objects.filter(text__gt=Cast(F("pk"), TextField())).count()
 
+    def test_explicit_subquery(self):
+        subquery = Subquery(User.objects.values("pk"))
+        self.assertEqual(User.objects.filter(pk__in=subquery).count(), 4)
+        self.assertEqual(Comment.objects.filter(user__in=subquery).count(), 5)
+
     def test_filter_case_when(self):
         msg = "When expression does not support composite primary keys."
         with self.assertRaisesMessage(ValueError, msg):