1.11.0 — Rich MojoSec evidence and explicit all-tier tests

2026-08-10

Django-MOJO 1.11.0 restores trusted SSH and sudo attribution on current Amazon Linux, expands protected web and session evidence, and raises bounded package-change journal limits for large wheels. Test consumers must replace --full with --all to run opt-in tiers.

Breaking

• Replace bin/run_tests --full with bin/run_tests --all when slow and extended opt-in tiers are required. The hidden --full compatibility spelling now runs only the default tier.

Added

• MojoSec web evidence now includes request and response bytes, request IDs, ports, protocol and TLS context, user-agent and referrer details, and upstream timing and byte measurements.
• Aggregated web incidents now expose an explicitly labeled last-occurrence sample while protected receipts retain bounded raw evidence.

Changed

• Local PAM service sessions are reported as informational service activity with producer, user, unit, boot, and audit context rather than being labeled as remote host logins.
• Mechanically derived package-change journals support large wheels under a 65,536-path and 20 MiB safety envelope; caller-declared changes remain capped at 4,096 paths.

Fixed

• MojoSec now accepts the trusted sshd-session and invoking-user sudo records emitted by current Amazon Linux, restores SSH source-IP, user, and TTY attribution, and uses the portable who form supported on deployed hosts.

Security

• Public incident metadata centrally validates and scrubs user agents, referrers, paths, numeric retry chains, Unicode controls, and malformed structured values while keeping raw bounded evidence protected.
• SSH, sudo, and PAM provenance now rejects contradictory audit identities and mismatched producer fields.