1.11.5 — MojoSec integrity monitor ignores incomplete fast scans for RPM verification

2026-08-12

django-mojo 1.11.5 fixes a MojoSec host-sensor bug where an incomplete fast filesystem scan could raise false package-deletion alerts and corrupt the RPM verification baseline.

Fixed

• MojoSec's tiered integrity monitor no longer treats an incomplete fast filesystem scan as authoritative for RPM package verification. A truncated fast scan (for example when the entry-count limit is hit) previously reported files missing from the partial snapshot as high-severity deletions and overwrote the RPM baseline with that impoverished view. The RPM tier now falls back to the last complete fast baseline for that cycle, so package verification neither invents deletions nor corrupts its baseline.
• A baseline preview run against an incomplete fast scan now reports the RPM tier as incomplete, with a reason, instead of displaying package state derived from a truncated walk.