Before you upgrade, read the upgrade guide.
It also ships every change listed under 1.3.0rc12 below. 1.3.0rc12 was tagged but never published to PyPI: its release's security audit blocked it on the Twisted and undici advisories that this release fixes.
Security
- Apps served by daphne should upgrade Twisted to 26.10.0rc1 or later (CVE-2026-115877 / GHSA-q7qq-6mhp-9rc4). Twisted 26.4.0's
twisted.web.http.HTTPChannelaccepts a bare CR or LF inside a header value, which allows HTTP request smuggling behind a front end that treats the bare character as a line end. daphne parses HTTP with that class. djust's published dependencies (channels[daphne], which allowstwisted[tls]>=22.4) still resolve to 26.4.0, because installers skip pre-releases. If you serve with daphne, runpip install "twisted[tls]>=26.10.0rc1"or serve with uvicorn, as djust's docs and scaffolds already do. djust's ownuv.locknow pins 26.10.0rc1 through a[tool.uv]constraint until 26.10.0 final is out. Four more Twisted 26.4.0 advisories (CVE-2026-115774, -115775, -115776 and -115778) are intwisted.mail,twisted.wordsandtwisted.conch, which djust never imports, so they are allowlisted in the releasepip-auditgate until the final is locked. - The JS test toolchain's
undiciis now 8.12.3 (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, GHSA-xjj6-f33q-929c). 8.11.2 was inside the affected8.0.0 - 8.12.1range of all three: unbounded memory in the EventSource parser (high), a Subresource Integrity bypass through non-lowercase algorithm tokens, and an unhandled error on excessive content-encodings.undicireaches the lockfile only throughjsdom, whose^8.11.2range already allows the fix, so onlypackage-lock.jsonchanges. It is a development dependency only: nothing in the published package changes. It was the finding failing the 1.3.0rc12 release audit'snpm auditgate.