djust release notes.

The first stable release of the 1.2 line.

1 security

A maintenance release for the 1.1 line with the fixes from 1.2.0.

1 security · 5 changed · 6 fixed

Security-only patch release on the 1.1 maintenance branch, closing an authorization bypass on the HTTP POST event transport.

1 security · 1 fixed

Security-only patch release on the 1.1 maintenance branch, closing one XSS class 1.1.1 left open: a template binding carried a safety grant it had not earned.

1 security

Security-only patch release on the 1.1 maintenance branch.

6 security · 1 changed

LIVEVIEW_CONFIG['virtual_keyed_ops'] — a Python switch for the [dj-virtual] keyed splice ops (#2017, ADR-026 iteration 3).

1 added · 2 changed · 6 fixed · 5 security

sanitize_for_log now carries a CodeQL-recognized CR/LF barrier (#2465/#2466 — py/log-injection).

8 security · 3 added · 1 changed · 5 fixed

Gated the OpenAPI schema endpoint against unauthenticated API-surface enumeration (F29 — CWE-200/CWE-651).

23 security · 1 added

Stable release consolidating 1.0.6rc1–rc3.

1 added · 1 changed · 3 fixed · 3 security

New system check djust.V012 — warns when a sticky-child template declares its own dj-view (nested duplicate binding) (#1803).

1 added · 14 fixed

auto_navigate — opt-in automatic SPA link interception (#1734, ADR-021 Stage 2).

3 added · 5 security · 3 fixed

dj-navigate keeps aria-current="page" in sync across SPA navigation (#1756).

1 added · 3 fixed

Demo dogfood + playwright regression guard for the v1.0.2 navigation arc (#1742).

2 added · 4 changed · 1 performance · 1 security · 8 fixed · 1 documentation

New static guard scripts/check-cross-iife-refs.mjs — retires the whole #1676 cross-IIFE ReferenceError class (#1706).

5 added · 5 changed · 7 fixed

First stable release.

Stable release.

Stable promotion of 0.9.6rc3.

Stable promotion of 0.9.5rc4.

{% if %} blocks now emit dj-if boundary markers — Foundation 1 of #1358.

3 added · 12 fixed · 3 changed

CodeQL workflow now cancels superseded analyses on rapid PR pushes (#1340).

1 changed · 10 fixed

markdown and nh3 moved from optional extras to core dependencies.

1 fixed

Polish release on top of 0.9.0.

2 added · 2 fixed

The "Time Travel" release — the biggest release since 0.3.0, two years of work compressed into the v0.7 → v0.9 arc.

12 added · 3 changed · 7 fixed · 2 security

DataTableMixin.get_table_context() post-mount missing show_stats key (closes #1118)

1 fixed · 1 changed

Process canonicalizations from the v0.8.5 → v0.8.6 retro arc folded into CLAUDE.md (closes #1100, #1101, #1103, #1104, #1106, #1108, #1109)

1 changed · 1 added · 4 fixed · 4 added · 2 fixed

WizardMixin.wizard_rendered_fields opt-in skips field_html rendering for fields not in the list (closes #1097)

3 added · 1 changed · 2 fixed

Inheritance resolution doubled filter-arg quotes — |date:"M d, Y" rendered as "Apr 25, 2026" (closes #1081)

1 fixed · 1 added · 1 changed

make docs-lint — sweep docs/

1 added · 1 fixed

{% theme_css_link %} cache-busting helper tag (v0.8.2 drain — Group T, closes #1012)

3 added · 2 fixed · 1 security · 2 changed · 2 added

@action decorator — React 19 Server Actions equivalent (v0.8.0)

2 added

Check-authoring guide + PR review checklist additions (v0.7.4, closes #1017, #1018, #1019, #1020)

1 documentation · 1 fixed

djust_theming.W001 contrast-checks the active preset only by default (v0.7.3, #1005)

1 changed · 2 fixed

Inline radio buttons via data-dj-inline attribute (v0.7.2, #991)

1 added · 1 documentation · 2 fixed

FORCE_SCRIPT_NAME / sub-path mount support for the in-browser HTTP API client (v0.7.1, #987, closes Action Tracker #123)

1 added

Streaming Markdown {% djust_markdown %} (v0.7.0)

5 added

Time-Travel Debugging (v0.6.1)

3 added

CSS @starting-style guide section (v0.6.0)

1 documentation · 1 changed · 2 added · 1 changed · 4 security

Resumable uploads across WebSocket disconnects (v0.5.7 — closes #821)

8 added · 7 fixed · 4 fixed

Dropped Python 3.9 support

1 breaking changes · 2 added · 7 fixed · 7 security · 1 changed

PresenceMixin + NotificationMixin — side-effect replay on WS state restoration (#893, #894)

2 fixed · 1 added

Runtime layout switching — self.set_layout(path) (v0.6.0)

1 added

WebSocket per-message compression toggle — DJUST_WS_COMPRESSION (v0.6.0)

4 added · 1 changed · 16 fixed · 1 changed · 1 added · 3 changed

Transport-conditional API returns — api_response() convention + @event_handler(expose_api=True, serialize=...) override (v0.5.1 P2 follow-up to ADR-008)

1 added

Bootstrap 4 CSS framework adapter

4 added · 1 fixed

AI observability module: djust.observability

10 added · 3 fixed · 2 changed

Remove double updateHooks()/bindModelElements() scanning

4 changed

{% csrf_token %} no longer renders poisoned CSRF_TOKEN_NOT_PROVIDED placeholder (#696)

6 fixed · 2 changed · 3 added

Derived context vars synced when parent instance attr mutated in-place (#703)

2 fixed · 1 added · 2 documentation · 3 changed · 17 fixed · 3 added

JS Commands — client-side DOM commands chainable from templates, views, hooks, and JavaScript

10 added · 4 security · 7 fixed

Fix 25 CodeQL code-scanning alerts in client.js and debug-panel.js

1 security · 1 removed · 30 added · 8 fixed

Tick auto-refresh causes VDOM version mismatch, silently drops user events

4 fixed · 1 added

FormMixin: serialization, event handling, and ModelForm support

3 fixed · 7 changed

model.id now returns the native type, not a string

1 breaking changes · 10 fixed · 1 deprecated · 7 added

djust-deploy CLI

1 added · 3 fixed

Stable release — promotes 0.3.3rc1 through 0.3.3rc3.

4 added · 8 fixed

#382: {% elif %} inside HTML attribute values propagates in_tag_context

1 fixed

TypeScript definitions (djust.d.ts)

12 added · 1 deprecated · 8 fixed · 1 security

3.8x faster rendering for large pages

1 changed

dj-confirm attribute

2 added · 5 fixed · 1 security

Stale Closure Args on VDOM-Patched Elements

14 fixed · 9 added · 1 deprecated · 3 changed

WebSocket Event Security Hardening

1 security · 2 documentation · 4 added

Template and/or/in Operators

1 added · 5 fixed · 1 changed

Nested Block Inheritance

1 fixed

Tag Handler Registry

5 added · 1 fixed · 4 performance

{% url %} Tag Support

7 added · 1 changed · 3 fixed · 1 security

Context Processor Support

1 added · 1 fixed

Initial public release - LiveView reactive server-side rendering - Rust-powered VDOM engine (10-100x faster than Django templates) - WebSocket support for real-time updates - 40+…

8 added

Bug fixes and stability improvements

1 fixed