---
title: "1.11.0 — Rich MojoSec evidence and explicit all-tier tests"
description: "Django-MOJO 1.11.0 restores trusted SSH and sudo attribution on current Amazon Linux, expands protected web and session evidence, and raises bounded package-change journal limits for large wheels. Test consumers must replace --full with --all to run opt-in tiers."
date: "2026-08-10"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-11-0/"
---

Django-MOJO 1.11.0 restores trusted SSH and sudo attribution on current Amazon Linux, expands protected web and session evidence, and raises bounded package-change journal limits for large wheels. Test consumers must replace --full with --all to run opt-in tiers.

### Breaking

- Replace `bin/run_tests --full` with `bin/run_tests --all` when slow and extended opt-in tiers are required. The hidden `--full` compatibility spelling now runs only the default tier.

### Added

- MojoSec web evidence now includes request and response bytes, request IDs, ports, protocol and TLS context, user-agent and referrer details, and upstream timing and byte measurements.
- Aggregated web incidents now expose an explicitly labeled last-occurrence sample while protected receipts retain bounded raw evidence.

### Changed

- Local PAM service sessions are reported as informational service activity with producer, user, unit, boot, and audit context rather than being labeled as remote host logins.
- Mechanically derived package-change journals support large wheels under a 65,536-path and 20 MiB safety envelope; caller-declared changes remain capped at 4,096 paths.

### Fixed

- MojoSec now accepts the trusted `sshd-session` and invoking-user sudo records emitted by current Amazon Linux, restores SSH source-IP, user, and TTY attribution, and uses the portable `who` form supported on deployed hosts.

### Security

- Public incident metadata centrally validates and scrubs user agents, referrers, paths, numeric retry chains, Unicode controls, and malformed structured values while keeping raw bounded evidence protected.
- SSH, sudo, and PAM provenance now rejects contradictory audit identities and mismatched producer fields.