1.24.4 — Firewall broker recovery and MojoSec flood controls

2026-09-09

django-mojo 1.24.4 fixes a firewall broker memory ceiling that could make every reconciliation call fail before returning a response, then repeat across thousands of desired objects. Broker-wide failures now stop immediately and enter normal job backoff. The release also adds best-effort MojoSec category-volume alerting and a guarded operator cleanup for retained missing-proof events. No consumer code changes or migrations are required.

Added

• Added receipt-idempotent, hourly MojoSec category-volume alerting with a file-only threshold that defaults to 10,000 occurrences; monitoring failures never change sensor acknowledgements.
• Added a dry-run-first cleanup command for exact missing-proof firewall-broker events. It requires an explicit sensor, UTC interval, and apply ceiling; refuses linked or nonterminal evidence; and retains audit receipts.

Changed

• The firewall broker now derives its address-space limit from its measured post-import footprint plus 256 MiB of growth headroom, under a 768 MiB absolute ceiling, and refuses work when safe headroom cannot be installed.
• Firewall reconciliation now stops on the first broker-wide failure so normal durable exponential backoff starts immediately, while object-local semantic failures still allow valid siblings to reconcile.

Fixed

• Resource-limit and memory-exhaustion failures now return bounded typed JSON instead of empty or malformed broker output.
• Broker timeout, startup, malformed-response, and invalid-response failures now have stable error codes and bounded diagnostics that exclude request contents.

Upgrade notes

• No database migrations are required. Deployments must update the installed root-owned firewall broker on every reconciliation host before evaluating incident cleanup.
• Run the cleanup as a dry run for each affected database and approve an explicit maximum before applying it; verify broker errors have stopped and unrelated sudo evidence remains.