---
title: "1.11.11 — Enrolled MojoSec nodes can deploy again, and deploy stderr is privileged"
description: "django-mojo 1.11.11 unblocks every enrolled MojoSec fleet: 1.11.9 and 1.11.10 could not complete a deploy at all, because the packaged post-deploy program declared a MojoSec control-state file in its own trusted-change journal — a path that journal rejects by design — aborting before MojoSec's obser…"
date: "2026-08-17"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-11-11/"
---

django-mojo 1.11.11 unblocks every enrolled MojoSec fleet: 1.11.9 and 1.11.10 could not complete a deploy at all, because the packaged post-deploy program declared a MojoSec control-state file in its own trusted-change journal — a path that journal rejects by design — aborting before MojoSec's observe-and-report convergence could run. It also moves the deploy stderr tail added in 1.11.10 up to the security permission tier, where it belongs.

### Fixed

- An enrolled MojoSec node could not complete any deploy on 1.11.9 or 1.11.10: the packaged post-deploy program declared a MojoSec control-state file in its own trusted-change journal, which the journal rejects by design, aborting the deploy before MojoSec's observe-and-report convergence could run.

### Changed

- A caller-declared trusted-change path under `/etc/mojosec`, `/var/lib/mojosec` or `/run/mojosec` is now ignored with a warning instead of failing the deploy. Those trees are still never journaled, and producer-derived paths still fail closed.

### Security

- The deploy stderr tail in node evidence was readable one permission tier too low, by a role that cannot deploy. Per-line redaction is not airtight — an unlabelled secret, a `-p secret` flag, or URL credentials inside a traceback line survive it. It now requires `view_platform_security`, `manage_platform` or `admin`.
- No REST graph can serve raw node evidence, including unmapped graph names that previously fell through to whole-model serialization.

### Upgrade notes

- Enrolled nodes on 1.11.9 or 1.11.10 take this release on the first attempt: the installed script body installs the new wheel, refreshes the trusted-change validator from it before convergence, and the refreshed validator ignores the old body's declaration. No manual intervention and no ordering requirement.
- Callers reading the deploy stderr tail need one of the three permissions above; at bare `view_platform` the key is absent. It was always optional — a node with no captured stderr never carried it.