2026
- 2026-09-061.24.0 — Safe registration attribution across Bouncer
django-mojo 1.24.0 preserves schema-declared registration attribution through Bouncer and login/register navigation while keeping credentials, navigation controls, undeclared parameters, and non-registration destinations excluded. It also applies one bounded value policy to hosted forwarding and reg…
- 2026-09-051.23.0 — API-first Admin Security and verified fleet firewall state
django-mojo 1.23.0 adds a dedicated Admin Security workspace and exact-host firewall verification without breaking established REST administration. Authorized users and validated per-user API keys retain their existing global permissions, group credentials get exact-group read access, legacy rules k…
- 2026-09-031.22.0 — Fail-closed LLM safety and capture-only registration fields
django-mojo 1.22.0 adds a fail-closed, policy-driven LLM safety boundary with durable incident recovery, and adds capture-only, accessible hosted registration fields. LLM-enabled deployments must configure and activate the safety policy before upgrading.
- 2026-08-311.21.2 — Chat hardening and cards, truthful SMS auth failures, non-root job engine
django-mojo 1.21.2 hardens chat (join-time history cutoff on every non-channel room kind, banned members locked out of read state, a cross-tenant message-id oracle closed, idempotent sends and reactions) and adds the card message kind with a server-side send service; makes every SMS-sending auth end…
- 2026-08-281.21.1 — Working job requeue, honest SMS failures, test messaging isolation
django-mojo 1.21.1 repairs the operator recovery for stranded background jobs — it previously published where no worker looks and reported success — makes phone-verification send failures honest (retryable when the provider is unavailable, explicit when the number cannot receive texts, no more raw s…
- 2026-08-281.21.0 — Confirmation pages, honest email sends, and commit-safe job publishing
django-mojo 1.21.0 makes emailed account links safe to open — verification, email-change and deactivation links now land on a confirmation page and change nothing until the person presses the button — makes email endpoints report send failures honestly instead of claiming success, publishes backgrou…
- 2026-08-261.20.1 — Reliable last-login state after JWT authentication
django-mojo 1.20.1 makes successful JWT authentication persist the user’s last-login timestamp reliably, while failed token minting no longer records login-success state.
- 2026-08-261.20.0 — Unlimited-by-default ApiKeys with bounded abuse monitoring
django-mojo 1.20.0 lets ordinary ApiKey traffic fan out without inheriting consumer rate limits, while preserving explicit and strict hard ceilings and adding bounded per-key threshold and concentration signals for operator review.
- 2026-08-251.19.2 — Faster repeated secret decryption and non-pooled test projects
django-mojo 1.19.2 removes repeated PBKDF2 work from hot secret-decryption paths and aligns generated test projects with the default non-pooled PostgreSQL behavior.
- 2026-08-251.19.1 — Emergency rollback of automatic PostgreSQL pooling
django-mojo 1.19.1 stops automatically enabling psycopg connection pools in PostgreSQL deployments after the default caused process-local pool exhaustion in long-running ASGI, realtime, and job workers.
- 2026-08-241.19.0 — Bounded PostgreSQL pooling and complete transactional email templates
django-mojo 1.19.0 uses bounded, health-checked psycopg 3 pools for PostgreSQL under ASGI, completes the built-in transactional account email templates, and treats paid database/cache redundancy as an explicit availability choice.
- 2026-08-241.18.3 — Actionable deployment failures and fleet rollout guidance
django-mojo 1.18.3 makes deployment failures identify the exact fixed phase and whether rollback or publication recovery completed, prevents jobs CLI status from misreporting deployed jobman workers, and documents the correct upgrade path for existing fleets.
- 2026-08-241.18.2 — Live runner channels and bounded deployment diagnostics
django-mojo 1.18.2 lets enforced publishers address live explicit runner IDs without naming workarounds, makes the typed deployment timeout effective for one-shot units, and returns a small useful journal excerpt when a deployment fails.
- 2026-08-241.18.1 — Legacy deploy adoption and consumer test tiers
django-mojo now lets existing application-user updater shims enter the typed deployment transaction without project edits, while consumer projects gain configurable test presets, package scaffolding, optional isolation enforcement, and tier-aware GitHub Actions.
- 2026-08-231.18.0 — Typed KISS deployments and reliable delegated ACME
django-mojo replaces the policy-heavy deployment path with a small typed transaction that checks Django, nginx, and real service health, while preserving migrations, mixed node roles, and mechanical rollback. Delegated ACME issuance also stops deadlocking behind incompatible hub and client timeouts,…
- 2026-08-231.17.1 — Command-free MojoSec and faster test runs
MojoSec can start reliably on standard Amazon Linux 2023 hosts without Python RPM bindings or package-manager commands, while the test runner gains faster, safer tiered execution and several shutdown and test-path fixes.
- 2026-08-231.17.0 — Role-aware fleets, content-node monitoring, fleet-once cron
A fleet with more than one kind of node can now be deployed entirely through the framework: a project declares which nginx, cron and systemd files each node role owns, and every box converges exactly its own set. MojoSec gains a content-serving profile whose tenant directories are genuinely watched…
- 2026-08-221.16.2 — Exact brownfield ingress and role-aware nodes
django-mojo lets brownfield AWS fleets bind NLBs to an exact pre-existing security group, explicitly control target-group client-address preservation, and declare which nodes run framework ASGI. Provisioning proves the ingress boundary and non-request nodes revoke request service before they can be…
- 2026-08-221.16.1 — UTF-8-safe TLS lineage convergence
Repository vhosts with ordinary UTF-8 comments now deploy without losing an issued Certbot lineage, while malformed UTF-8 and Unicode-confusable server names remain fail-closed.
- 2026-08-221.16.0 — Parallel Admin v2 and safe certificate convergence
django-mojo adds a parallel Admin v2 workspace across operations, apps, infrastructure, domains, access, settings, and Assistant while keeping the existing Admin available. Node deployment also preserves only a validated matching Certbot lineage, so repository vhost updates no longer replace a trust…