---
title: "1.28.0 — Push verification and realtime disconnect fixes"
description: "Fixes server-enforced WebSocket disconnection and makes push verification truthful. Includes stricter push-test input and authentication requirements."
date: "2026-09-14"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-28-0/"
---

Fixes server-enforced WebSocket disconnection and makes push verification truthful. Includes stricter push-test input and authentication requirements.

### Breaking
- Push-test messages must be nonblank strings of at most 1,000 characters; config-test device tokens must be strings of at most 4,096 characters.
- Caller-device push tests reject API keys and key-backed sessions. Push diagnostics return safe error codes instead of raw provider details.

### Added
- Administrators can check readiness and send a real test push to one registered device.

### Fixed
- FCM checks validate with the provider; simulations and invalid-token rejections no longer count as successful verification.

### Security
- `disconnect_user()` now sends the server control command that closes current WebSockets, without relying on the client to cooperate.

### Upgrade notes
- Confirm push receipt on the device; provider acceptance is not delivery confirmation. Check the device before retrying an unknown outcome.
- Realtime disconnect remains best-effort through Redis and does not prevent a new connection from authenticating. No migrations.