2026
- 2026-08-091.8.2 — Invite-only login pages and Edge MojoSec enrollment
Hosted login pages now honor disabled registration, and MojoSec Edge nodes can enroll with the documented app-owned log path.
- 2026-08-091.9.0 — GitHub-driven WebApp deploys, branded auth, and actionable MojoSec incidents
WebApp releases now deploy and prove convergence across the active Edge fleet directly from GitHub, with durable status and safe rollback. Hosted auth gains four responsive branded presets, while MojoSec incidents now carry validated source attribution and rich centrally scrubbed evidence.
- 2026-08-091.8.1 — Restarting nodes catch themselves up
A node whose job engine restarts — which every deploy causes — now reconciles itself the moment it comes back, instead of depending on a broadcast it may have been offline for or waiting out the ten-minute sweep. Built on a new engine startup-hook point any app can register on. Also adds a scoped pu…
- 2026-08-091.8.0 — Fleet-wide jobs actually reach the fleet, and web app releases can be published
Three fixes, all found publishing a real web app end to end for the first time. Two of them made the release plane unusable: no release could ever pass verification, and presigned uploads rejected any client that sent a Content-Type. The third is worse and older — work published to every runner on a…
- 2026-08-091.7.1 — Standard host integrity, and vhost naming without ceremony
Adds a standard AL2023 host-integrity profile — file-integrity monitoring, RPM verification, and exact trusted-change evidence — for nodes that opt in. Fixes two edge bugs: static assets under a declared app route 404ing, and renewed certificates silently not reaching nodes. Also removes the reserve…
- 2026-08-091.7.0 — MojoSec host sensor, and nodes that fetch their own releases
Adds MojoSec — a settings-free host sensor for dedicated EC2 nodes that turns journald, nginx and file-integrity signals into bounded batches for the incident system. Edge nodes now fetch promoted web app releases from S3 themselves, verified per file. Also fixes a bug that made every edge converge…
- 2026-08-081.6.0 — Vhost kinds, blocklists as data, packaged node plane
Vhosts are typed — api, site, site_api, redirect — each with its own template and knobs. IP and user-agent blocklists become rows you can watch before enforcing. The node-side tooling ships in the package. Contains two breaking changes: the vhost kind values, and the edge log location.
- 2026-08-071.5.0 — Fleet code deploy
A webhook on the deploy branch rolls the fleet: one canary node first, the rest released only once it proves the release, migrations behind a Postgres advisory lock. Adds `EDGE_CONVERGE_ENABLED` so the edge app can be installed for the deploy plane alone.
- 2026-08-071.4.0 — Redis index ownership, and file upload hardening
Closes a case where a test checkout could flush a Redis index another suite was using — including on a remote Redis, where the ownership guard was checking the wrong server entirely. Also hardens the file upload lifecycle and scopes record attachments.
- 2026-08-061.3.0 — The edge app, and per-checkout test isolation
Adds `mojo.apps.edge` — nginx vhosts as structured rows with a node-side installer that validates against the real config before an atomic swap — and `testit.testenv`, which derives a database, Redis index and port from the checkout path so two working copies can run their suites concurrently. Minor…
- 2026-05-061.2.0 — The 1.2 line — 71 releases, May to August 2026
One entry covering the whole 1.2 series rather than 71 separate ones. Predominantly security and hardening work across accounts, auth, DNS and files. Per-release detail through 1.2.64 lives in `CHANGELOG.md` in the repository; recorded release history starts properly at 1.3.0.