---
title: "1.36.0 — Bedrock text support and access hardening"
description: "Adds bounded Nova 2 Lite text calls through the guarded LLM facade, configurable chat policies, and bulk presence counting. Hardens credential and storage access, fixes CDN delivery, and introduces stricter chat rule updates."
date: "2026-10-17"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-36-0/"
---

Adds bounded Nova 2 Lite text calls through the guarded LLM facade, configurable chat policies, and bulk presence counting. Hardens credential and storage access, fixes CDN delivery, and introduces stricter chat rule updates.

### Breaking

- Chat rule updates now validate values: `disappearing_ttl` accepts `0` or 3,600–31,536,000 seconds, `max_message_length` accepts 1–4,000, and `rate_limit` accepts 0–100. Invalid values return 400.
- Enabling disappearing messages or shortening their TTL now requires global `manage_chat` by default; deployments can customize this through the room-authority hook.

### Added

- Optional AWS Bedrock Nova 2 Lite text calls through `llm.call()` and `ask()`, with bounded reasoning effort, final-text responses, and guarded usage accounting.
- `count_online()` counts distinct online users using chunked Redis queries.
- Deployment hooks for chat reachability and room administration.
- Configurable CloudFront response headers policy, defaulting to AWS SimpleCORS.

### Changed

- AWS provider failures include scrubbed diagnostic messages in operator logs.

### Fixed

- Private CDN links honor the shorter configured URL lifetime without rounding expiry past that lifetime.
- Public file managers at a bucket root retain S3 delivery instead of receiving unusable unsigned CDN links.
- CDN visibility updates report invalid behaviors and missing signing key groups before submitting them.
- Shared test setup files run under tier presets even when they contain no tests.

### Security

- Per-user API keys cannot manage credentials, change sign-in details, or use admin actions that issue sign-in or key secrets.
- Group keys and member-acting credentials cannot inherit personal global authority for group security controls.
- `admin_compliance` and `admin_verify` join the protected API-key permission floor.
- Group file managers using borrowed credentials must remain within their group's storage folders, including affected descendants and filesystem temporary folders.
- Explicitly requested file managers are authorized before use.
- Chat message edits require active room membership.
- Room administration enforces bans and owner/admin/member role order.
- Chat room ownership remains with the creator.

### Upgrade notes

- No database migrations are added. Existing room rules and file-manager locations are not rewritten.
- Re-run CDN enablement once per provisioned bucket to apply the response headers policy.
- Bedrock requires an explicit static policy route, owner policy activation, and server AWS access to the selected inference profile and destination models.