---
title: "1.39.0 — MojoSec defaults, protected health evidence and safer upgrade boundaries"
description: "Installs receipt-backed MojoSec ignore and scanner-block defaults, adds protected health snapshots and diagnostics, and strengthens firewall target and shared-ACME upgrade safety. Existing operator security policies remain preserved."
date: "2026-10-20"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-39-0/"
---

Installs receipt-backed MojoSec ignore and scanner-block defaults, adds protected health snapshots and diagnostics, and strengthens firewall target and shared-ACME upgrade safety. Existing operator security policies remain preserved.

### Breaking

- New firewall blocks refuse non-global, protected, trusted-proxy and actively whitelisted IPv4 targets.
- Stale Fleet configuration publication revisions return HTTP 409.
- Shared ACME remains disabled until a qualified operator cutover; existing participant state requires qualification before mutations resume.

### Added

- Protected five-minute health snapshots through REST and Assistant/MCP, with independently expiring source observations and paginated failed/expired job evidence.
- Read-only fleet health, selected-node diagnostics and monitoring coverage with separate platform, AWS and jobs permissions.
- Opt-in tenant-specific list requirements and project-defined realtime/chat subscription checks. Invalid configured subscription handlers fail closed; unset handlers preserve existing behavior.
- Protected shared-validation configuration, approved hub profiles, write-only credentials, named recipient keys and per-node loaded-identity verification.

### Changed

- MojoSec installs create-only governed defaults after schema-ready migration and during ingestion. Existing operator categories and edited or disabled defaults remain preserved.
- Receipt-proven routine activity and redirected/refused probes avoid incident noise. Failures and unproven operations remain visible; host incidents bundle by installation and web incidents by source address.
- Packaged Admin updated to portal-mojo 0.2.19.

### Fixed

- Diagnostic deadlines cover DNS, connections, TLS and complete transfers. Missing metrics and incomplete source coverage remain explicit.
- Health publication fences stale collectors and retains independent source failures and resource-role obligations.
- Shared-validation contention refuses before mutation and preserves diagnostics until admission succeeds.
- Bounded DNS regression expectations support Python 3.13 mapped-IPv6 formatting.

### Security

- MojoSec scanner blocking requires three fresh trusted receipts across three distinct sensitive paths within ten minutes. The one-hour checked block revalidates evidence when its queued job executes.
- Firewall sets exclude unsafe addresses while preserving stored operator intent. Malformed protection settings refuse new blocks while permitting removals.

### Upgrade notes

- Apply normal database migrations. DNSMan migration leaves shared validation in owner-only compatibility mode without creating trust or binding legacy owners.
- Shared ACME activation requires a separately authorized cutover with a qualified published artifact, quiesced writers/launch sources and retained root recovery floors. Protected consumer selectors must be pinned before publication.
- Preview legacy visibility replacement with mojosec_rules --repair-visibility. Applying requires its matching revision; historical evidence is retained. Disable defaults to preserve overrides.
- Health snapshots require installation/environment identity and existing cron/job infrastructure. Missing, stale or denied evidence remains unknown; reads perform no remediation.