---
title: "1.11.12 — URL-first WebApps and opt-in MojoSec shadow cases"
description: "django-mojo 1.11.12 makes WebApp onboarding start with the address a person wants, adds external-DNS and day-2 management, and introduces disabled-by-default MojoSec shadow correlation backed by trusted per-VHost evidence. It also updates sqlparse to resolve four dependency security alerts."
date: "2026-08-17"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-11-12/"
---

django-mojo 1.11.12 makes WebApp onboarding start with the address a person wants, adds external-DNS and day-2 management, and introduces disabled-by-default MojoSec shadow correlation backed by trusted per-VHost evidence. It also updates sqlparse to resolve four dependency security alerts.

### Added

- WebApp onboarding now starts with a desired URL, steers unsupported address shapes, verifies externally hosted DNS through delegated certificates, and generates a working GitHub Actions workflow.
- WebApp management now includes live health, deployment history, human-only rollback, deploy-key lifecycle, setup replay, address changes, offline detachment, and transactional deletion.
- MojoSec now supports opt-in per-VHost response classification and bounded shadow cases for web and file-integrity evidence.
- Security administrators can inspect bounded MojoSec case, metrics, and canary-comparison contracts without changing the authoritative receipt, Event, handler, or enforcement path.

### Changed

- User-paced WebApp DNS and certificate waits park for another check instead of exhausting into a terminal failure.
- External domains reuse delegated apex-and-wildcard certificates and normally require only the application CNAME for additional apps.
- The WebApps portal is now a URL-first wizard with a per-application management view.

### Fixed

- WebApp deletion now deactivates its deployment key and removes its site routing atomically.
- Generated deployment workflows now use django-mojo's public composite action instead of referencing a nonexistent Python module.
- A deployment deleted during orchestration now exits as superseded instead of failing.

### Security

- Updated sqlparse to 0.6.0, resolving three denial-of-service parsing issues and one code-generation escaping issue.
- MojoSec shadow evidence is bound to an enabled same-tenant VHost and matching policy version; excessive future timestamps and oversized case pagination fail closed.

### Upgrade notes

- Apply the new edge and incident migrations before enabling MojoSec shadow targets.
- MojoSec shadow correlation remains off until both an explicit static target and per-VHost policy are configured. Upgrading alone does not change Event publication, notifications, handlers, or enforcement.
- External-domain onboarding requires the delegated ACME hub configuration; the portal keeps that path unavailable when the hub is not configured.