---
title: "1.12.0 — Permission-gated graphs and safer fleet convergence"
description: "django-mojo 1.12.0 makes named REST graphs explicit and permission-aware, hardens single-node and fleet deployment finalization, strengthens MojoSec health and RPM ownership checks, and prevents GoDaddy’s recursive DNS cache from breaking automated ACME issuance."
date: "2026-08-18"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-12-0/"
---

django-mojo 1.12.0 makes named REST graphs explicit and permission-aware, hardens single-node and fleet deployment finalization, strengthens MojoSec health and RPM ownership checks, and prevents GoDaddy’s recursive DNS cache from breaking automated ACME issuance.

### Breaking

- Undefined *special* REST graph names now return `400` instead of silently falling back to `default`. Clients using custom graph names must request a graph the model defines; undefined common names (`default`, `basic`, `list`, `simple`, `detail`, `detailed`, and `full`) retain default fallback.
- A model that declares `RestMeta.GRAPHS` without a `default` graph now raises instead of serializing every field when a request resolves to no defined graph. Add a `default` graph before upgrading; a model that declares no `GRAPHS` at all is unaffected.

### Added

- Models can declare per-graph permissions with `RestMeta.GRAPH_PERMISSIONS`; REST and assistant model tools enforce the permission on the graph actually served.
- Deployment state now carries an atomic versioned identity with bounded, no-follow reads and race detection, giving reconciliation durable evidence across restart boundaries.
- MojoSec exposes a closed Audit health contract and structurally verifies installed-file RPM ownership through one bounded isolated transaction.

### Changed

- Single-node deployments finalize after the application restart, while recovery reconciles a surviving deployment identity without replaying a completed release.
- Config-sync restarts enqueue non-blocking systemd transactions, avoiding boot-order deadlocks while leaving start failures visible to normal service health checks.
- Privileged platform deployment evidence is available only through the permission-gated `admin` graph; default and basic responses remain evidence-free.

### Fixed

- GoDaddy-backed ACME DNS-01 issuance waits out GoDaddy’s enforced 600-second TXT TTL after authoritative propagation, so secondary CA validation cannot see the previous cached challenge value.
- MojoSec RPM scans retain the prior authoritative baseline when helper readiness, output bounds, ownership, or the RPM database cookie cannot be proven.

### Upgrade notes

- Clients that send application-specific `?graph=` values must either define those graphs on the model or switch to a common graph name before upgrading.