---
title: "1.11.4 — Quieter MojoSec signals and terminal delivery"
description: "django-mojo 1.11.4 reduces noisy MojoSec alerts, makes receiver failures terminal and recoverable, fixes AL2023 integrity baselining, hardens system-event trust and admin password recovery, and accepts valid Next.js release paths."
date: "2026-08-11"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-11-4/"
---

django-mojo 1.11.4 reduces noisy MojoSec alerts, makes receiver failures terminal and recoverable, fixes AL2023 integrity baselining, hardens system-event trust and admin password recovery, and accepts valid Next.js release paths.

### Added

- Added the immutable `al2023-web-v2` MojoSec integrity profile, which baselines cloud-init through its canonical instance tree without following the mutable alias.
- WebApp release bundles now accept `!` and `~` in relative paths produced by Next.js static exports.

### Changed

- Routine trusted local `systemd-user` PAM lifecycle activity stays measurable on the host without creating fleet incident Events by default.
- Repeated web server errors now aggregate by failure shape across clients, while probes and denied requests remain per actor and the latest-occurrence evidence retains client attribution.
- System service and out-of-memory incidents now require kernel- or PID 1-owned journal evidence and report the failed unit and failure kind.
- MojoSec receipt replay now recovers stale queued handlers and terminalizes exhausted, pruned, or permanently unstorable evidence instead of retrying forever.

### Fixed

- Incomplete integrity scans now emit one overflow signal instead of re-reporting every partial file difference on every interval.
- MojoSec safely carries unusual filesystem path bytes without poisoning the receiver.
- Admin portal branding now includes the Mojo favicon.

### Security

- Non-superuser administrators can no longer issue temporary passwords or reset links for superusers.
- Exact local PAM noise classification fails open for every malformed or near-match event, preserving real authentication and privilege evidence.

### Upgrade notes

- Run the normal Django migrations; this release adds terminal MojoSec receipt states.
- MojoSec upgrades its private sensor state to SQLite schema v3. The migration is transactional, but a pre-v3 sensor cannot reopen the migrated store in place after a downgrade.