djust 1.3.0rc8

Derived --primary-text, --brand-text, --info-text, --success-text and --warning-text colours, so a fill read as text meets AA in every preset and mode (#2885). primary and the status colours are fills (a *_foreground label sits on them), so many presets left them unreadable as text, for example a bright orange link on white. Like --destructive-text (#3320), each is the fill's hue and saturation at the lightness that reaches 4.5:1 on the page, a card and the fill's own 10% and 15% washes, and the fill itself when it already reads. The fills (--primary, --success, ...) and their labels are byte-identical in the generated CSS of all 68 presets. ThemeTokens.primary_text ... in Python, --primary-text ... in the theme CSS, text-primary-text in Tailwind, the gallery editor's live preview and the inspector. 26 regression cases in python/djust/tests/test_theming_derived_text_2885.py.

ImageLightbox, FileTree, ResizablePanel and AnimatedNumber now ship the interactions their docstrings describe (#2985, batch 2). Each rendered a dj-hook that no shipped script answered; components/static/djust_components/image-lightbox.js, file-tree.js, resizable-panel.js and animated-number.js now do, and the catalogue page of each includes its script. The lightbox takes focus, traps Tab, locks page scroll, closes on Escape, steps on the arrow keys or a swipe, announces the new image and gives focus back; each of those presses the component's own Close, Previous or Next control, so it sends no event of its own. FileTree expands and collapses folders on the page, remembering each choice by the folder's name path so a re-render that inserts, removes or reorders rows leaves every folder (and the reader's keyboard focus) where it was, and follows the WAI-ARIA tree keyboard pattern, with Enter on a file firing the row's own event; a 10,000-row tree stays responsive. ResizablePanel resizes by pointer drag or keyboard as an ARIA window splitter (mirrored in a right-to-left context), clamped to min_size and max_size, and announces the size as a bubbling dj-resize event. AnimatedNumber counts up and always ends on the exact text the server rendered. No markup changes: a byte comparison of 564 renders across the component class, template tag and Rust handler against the previous release is identical. The scripts register in window.DjustHooks and only when neither hook registry already holds that name, so an app's own hook is never replaced. 12 components from the issue remain.

ActivityFeed, Terminal and Tour now ship the interactions their docstrings describe (#2985, batch 3). Each rendered a dj-hook that no shipped script answered; components/static/djust_components/activity-feed.js, terminal.js and tour.js now do, and the catalogue page of each includes its script. A streaming ActivityFeed puts pushed events at the top, keeps max_items rows, announces new activity and follows the WAI-ARIA feed keyboard pattern. Terminal appends streamed lines with the same ANSI colour and bold the server renders (flat spans built with the DOM API, bounded work per line), follows the newest line until the reader scrolls up, and gains an optional max_lines. Tour dims the page around the target with a cut-out and ring, places the popover beside it, follows scrolling and resizing, falls back to a centred popover when the target is missing, traps focus and returns it, lets a field in the spotlight keep focus, and answers the arrow keys and Escape by pressing its own buttons; it stays aligned inside a transformed ancestor. Markup changes are additive only: data-max-items on a streaming feed and data-line-numbers / data-max-lines on a terminal, on the component class, template tag and Rust handler alike; a byte comparison of 945 renders against the previous release is identical once those attributes are removed. The scripts register in window.DjustHooks and only when neither hook registry already holds that name, so an app's own hook is never replaced. 9 components from the issue remain.

DashboardGrid, MentionsInput, CursorsOverlay and CollabSelection now ship the interactions their docstrings describe (#2985, batch 4). Each rendered a dj-hook that no shipped script answered; components/static/djust_components/dashboard-grid.js, mentions-input.js, cursors-overlay.js and collab-selection.js now do, and the catalogue page of each includes its script. DashboardGrid: drag a panel by its header to move it and its bottom handle to resize it (also by touch, and in right-to-left or scaled grids), with the arrow keys on a focused panel (Space/Enter grabs, arrows move, Shift+arrows resize, Enter drops, Escape cancels); a dashed cell previews the drop and the server stays the authority, receiving {id, col, row} through move_event and {id, width, height} through resize_event in whole grid units (untrusted: the docstring has handlers that validate and clamp them). MentionsInput: typing @ offers the people in users, filtered by the start of any word of their name, as a proper combobox; Enter or Tab or a click inserts @Name, and Enter submits {text, mentions: [ids]} (the ids of the people still mentioned, with the plain input event's value, field, key and code kept; untrusted). CursorsOverlay: keeps name labels inside the overlay and off each other, announces people appearing and disappearing, and eases cursors unless the user prefers reduced motion; it stays presentational, fed by the app's presence data. CollabSelection gains an optional target selector: with it the selections' start/end offsets index the text of that element, the ranges are highlighted in the page's text with the CSS Custom Highlight API (no page node is touched) and each name is placed above its range and follows scrolling and edits; without it the component shows each selection's text where it is rendered, as before. Dashboard coordinates are bounded on every render path to 48 columns and 100 rows. Hook notifications preserve component and embedded-view routing; mention tokens remain distinct when names repeat, and composition-confirming Enter does not submit. CollabSelection skips script/style text and falls back when highlight styles cannot be installed. The scripts register in window.DjustHooks and only when neither hook registry already holds that name, so an app's own hook is never replaced. Components from the issue still without a script: the five of batch 5, and the optional resize_event of ResizablePanel and toggle_event of FileTree.

ImageCropper now ships its interaction, and a validating cropper for the server (#2985, batch 5). The component rendered a dj-hook that no shipped script answered. components/static/djust_components/image-cropper.js keeps a crop box in the image's natural pixels and lets the reader move it (drag, or the arrow keys: Shift for ten times the step), resize it (eight handles, or Alt with the arrows), draw a new one on the image, lock its shape (aspect_ratio "16/9", "4:3" or "1.5") and keep it above min_width / min_height (an image smaller than that is selected whole). It follows the image through window resizes, resets when the server shows another image, uses pointer events with capture (touch drags do not scroll the page), announces every change and the sent box in image pixels, and sends only {x, y, width, height} as whole numbers to crop_event: the image is never uploaded and no pixel is read. New djust.components.cropping: crop_box validates the numbers (the browser's claim: non-numbers, bools, NaN/infinity, huge ints, non-positive sizes and boxes outside the image are refused, a box that sticks out is clamped, fractions rounded) and crop_image (Pillow, imported on demand) refuses an image over max_pixels from its header before decoding, applies the EXIF orientation first (the browser shows the image upright; a box taken from the screen applied to the raw pixels crops another region), strips metadata and keeps the format. The overlay that dimmed the inside of the box is hidden (the selection's own shadow dims the outside). Markup changes are additive only (the selection becomes a labelled, focusable group with eight handles, a status region, and a new alt kwarg that defaults to the old text), on the component class, template tag and Rust handler alike; a byte comparison of 7,260 renders against the previous release is identical once those are removed. The script registers in window.DjustHooks and only when neither hook registry already holds that name. 1 component from the issue remains.

ImageUploadPreview now ships its interaction on djust's upload pipeline (#2985, batch 5). The component rendered a dj-hook that no shipped script answered and never sent a file anywhere. With the new upload kwarg (the allow_upload() slot name) its input carries dj-upload and its drop zone dj-upload-drop, so chunking, progress events, cancellation and every server-side check are UploadMixin's; components/static/djust_components/image-upload-preview.js adds a thumbnail per chosen or dropped image from a browser object URL (revoked on remove, replace, when the server's own previews take over, and on teardown), a progress bar fed by djust:upload:progress with Cancel (window.djust.uploads.cancelUpload), Remove, UX-only pre-checks for type (accept), size (new max_size) and count (max, the server's previews included) that keep a refused file from being sent and say why, a refused-by-the-server state, drag and drop that becomes the same change event the picker produces, and polite announcements. The file input is now visually hidden rather than display: none, so the picker is reachable by keyboard. The event kwarg now means something: when the app names one it is sent once a selection has finished uploading, with {count} (untrusted). Markup changes are additive only (data-upload, data-max-size, data-notify, dj-upload, dj-upload-drop and two empty elements the hook fills), on the component class, template tag and Rust handler alike; a byte comparison of 7,683 renders against the previous release is identical once those are removed. The script registers in window.DjustHooks and only when neither hook registry already holds that name. 3 components from the issue remain.

MapPicker now ships its interaction and a vendored Leaflet (#2985, batch 5). The component rendered a dj-hook that no shipped script answered. components/static/djust_components/map-picker.js now builds the map, puts a marker where the reader clicks, taps or (with the arrow keys and Enter) chooses, and sends {lat, lng} (finite numbers, latitude clamped, longitude wrapped, six decimals; the handler must still validate them) to pick_event. Leaflet 1.9.4 (BSD-2-Clause) is vendored under ADR-040 (leaflet in the components djust_assets.json, SBOM entry, license file, Subresource Integrity), loaded on demand once per page, and its marker images are passed as explicit URLs so hashed static names work. Tiles and attribution are kwargs (tile_url, attribution, attribution_url, max_zoom, plus label for the accessible name): the default is OpenStreetMap's standard tile layer with its attribution, which is for light use only (production apps should set their own tile server; viewers' IP addresses reach the tile provider); tile_url="" makes no tile request; no API key is stored or shipped. The attribution is built as text, a map whose tiles cannot load still picks and says so, the keyboard moves the marker and announces every move, and the server stays in charge of position and zoom. Markup changes are additive only (new data- attributes and an optional aria-label), on the component class, template tag and Rust handler alike; a byte comparison of 9,075 renders against the previous release is identical once those attributes are removed. The script registers in window.DjustHooks and only when neither hook registry already holds that name. 4 components from the issue remain.

SignaturePad now ships its interaction, and a safe decoder for what it sends (#2985, batch 5). The component rendered a dj-hook that no shipped script answered. components/static/djust_components/signature-pad.js draws on the native canvas with pointer events (mouse, touch and pen with pressure; the page does not scroll while drawing), keeps the strokes as points so Clear, Undo (last stroke) and a resize or pixel-ratio change redraw faithfully, renders sharply on high-DPI screens, follows its container's width, and exports the PNG at the pad's own size (at most twice, never the screen's). Save with nothing drawn sends nothing and says so; otherwise {signature: "data:image/png;base64,..."} goes to save_event (and the hidden form field), never longer than the new max_bytes (default 200 KB): the signature is re-rendered at a lower resolution until it fits and refused when it cannot, and when the server answers "Message too large" (the default WebSocket limit is 64 KiB) it is sent once more at a size that fits. "Type instead" is the keyboard alternative: a text field whose name is drawn in a script font (typed=False turns it off). New djust.components.signature.decode_signature_data_url validates the value without decoding pixels (exact prefix, strict base64, size caps checked before decoding, PNG magic bytes, every chunk and CRC, dimensions and pixel count within limits, an image stream that inflates to exactly what its header promises) and returns the original bytes with their size; the handler must use it because the value is the browser's claim. Markup changes are additive only (data-max-bytes, role/aria-label on the canvas, the typed field, Undo and mode buttons, a status region), on the component class, template tag and Rust handler alike; a byte comparison of 7,542 renders against the previous release is identical once those are removed. The script registers in window.DjustHooks and only when neither hook registry already holds that name. 2 components from the issue remain.

VoiceInput now implements its shipped hook using browser speech recognition, with a visible vendor-service disclosure, explicit user activation, bounded listening sessions, final-transcript events, accessible feedback, unsupported-browser handling, and cleanup on focus loss/navigation/removal. Transcript cleaning preserves Unicode characters and removes invalid surrogates; notifications retain component and embedded-view routing. Existing custom VoiceInput hooks keep precedence.

ResizablePanel(resize_event=...) and FileTree(toggle_event=...) send what the reader did to the server (#2985). Both are optional and additive. With resize_event, when a drag or key press on a ResizablePanel's handle ends the hook sends that event with {"size": <whole pixels>} (the panel's own dj-resize CustomEvent still fires); render the remembered size back as initial_size. With toggle_event, expanding or collapsing a FileTree folder (by click or keyboard, never by a server re-render) sends it with {"path": ["src", "utils"], "expanded": true}, the folder's name and its parents' names from the root down, so the server can remember which folders a user opened and render them with expanded; the page follows the server again once the two agree. Both payloads come from the browser and are untrusted: the docstrings show handlers that clamp the size and look the path up in the rendered tree. The only markup change is a data-resize-event / data-toggle-event attribute on the component's root when the kwarg is set: a comparison of 864 renders (hostile text, junk data, boundary values, all three render paths) against the previous release is identical without it.

Resize keyboard notifications settle for 250 ms; bounded outstanding echoes preserve newer gestures and the reset target, while unrelated server changes take over. No-op resize/toggle requests do not notify. Both optional hooks preserve component and embedded-view routing, and the FileTree example validates boolean expansion state.

Terminal takes auto_scroll (#2985). auto_scroll=False makes a streaming Terminal leave the scroll position alone instead of following the newest line (the default, True, is the behaviour before). The only markup change is an added data-auto-scroll="false" when it is off: the default markup is byte-identical, on the component class, the template tag and the Rust handler alike. LogViewer already had the option.

SortableList, SortableGrid, JsonViewer and LogViewer now ship the interactions their docstrings describe (#2985). Each rendered a dj-hook that no shipped script answered; components/static/djust_components/sortable-list.js, sortable-grid.js, json-viewer.js and log-viewer.js now do, and the catalogue page of each includes its script. Sortable lists and grids reorder by mouse drag or keyboard (Space grabs, arrows move, Enter drops, Escape cancels, each step announced in a live region) and send {order: [...]} through move_event; their items gain a data-key so the server's re-render moves the nodes the client already moved (a list whose ids are empty, missing or repeated cannot be keyed, so it stays inert and logs one console warning). JsonViewer expands and collapses on click, Enter, Space and the arrow keys, and its Copy button copies the formatted JSON. LogViewer follows the newest line until the reader scrolls up, appends lines pushed to stream_event, and honours max_lines, show_line_numbers and filter_level through new data-* attributes. The scripts register in window.DjustHooks and only when neither hook registry already holds that name, so an app's own hook is never replaced. The other 16 components from the issue are unchanged.

@push_handler: an explicit marker for a method only server push may call (#3002). push_to_view(..., handler="name") reaches a marked method under any name, and a browser event naming it is refused in every event_security mode (strict, warn and open) on the WebSocket, SSE, HTTP POST and HTTP API transports, with the same response as a method that does not exist. The marker is inherited by method name, so an unmarked override of a marked method stays push-only; the new system check djust.V021 reports such an override (Info), or one that adds @event_handler (Warning). It is not an event handler: djust.V004 no longer suggests @event_handler for it, djust.T019 reports a template binding to it in every mode, and LiveViewTestClient.send_event refuses it while the new send_push helper delivers it. It cannot be combined with @event_handler, @server_function, or the decorators server push does not enforce (@permission_required, @rate_limit, @debounce, @throttle, @cache, @optimistic, @client_state): each is a TypeError. Existing handle_* push targets and @event_handler methods are unchanged. 41 regression cases in python/djust/tests/test_push_handler_marker_3002.py.

Add experimental, opt-in djust.clocks process-local RoomClock and SharedPoll: one step per tenant-scoped room, presence-bound start/idle stop and restoration, bounded late-beat handling, shared worker pool, error backoff, scoped doorbells, stats, variable intervals and pause/resume. Distributed ownership/fencing remains deferred (ADR-042, #3005).

connected() and disconnected() are real LiveView hooks (#3007). connected() runs once per live (WebSocket or SSE) mount, after mount() (or a state restore) and handle_params() and before the first render, so state it sets is in the first frame; raising fails the mount like mount() does. disconnected() runs once for each view that reached connected(), when its live mount ends: the socket or stream closes, or a live_redirect, a second mount frame, an unmount frame or a revoked authorization releases the view. Both are regular methods (not async def) and run on a worker thread (the ORM works), disconnected() under the tenant the view mounted with, and an exception in disconnected() is logged without stopping the teardown. The HTTP render and the HTTP POST fallback never call them, disconnected() is not called if the process dies, and views a template embeds with {% live_render %} do not get them. A member that already carries either name but is not a no-argument regular method (an async def, a method that needs arguments, a property, a state attribute) is skipped with one warning per class and never fails a mount; a regular no-argument method of that name is now called. There is no ordering between the connections of one user: a reconnect can run connected() of the new view before disconnected() of the old one, so key claims by connection. Both are listed in djust.schema.LIFECYCLE_METHODS again, and the LiveView API reference states the lifecycle contract, including what is not guaranteed. 25 regression cases in python/djust/tests/test_lifecycle_contract_3007.py.

Lazy and batched views are independently live over SSE, and views of one class keep their own saved state (#3252). Over WebSocket each view a mount names with a target_id was already a view of its own; an SSE session hosted one view, so a dj-lazy container never hydrated over it and an event from inside one either did nothing or, through sendEvent's fourth argument being a keepalive flag, could lose its address. An SSE session now hosts the page view plus views mounted beside it: a mount POST that names a target_id adds one with its own runtime, state, saves, authorization and teardown, its frames carry the target_id, unmount releases one, a navigation and the end of the stream release them all, a frame for an address with nothing mounted is refused with code: "view_unavailable", mount and unmount frames count against the session's rate limit (rate_limited), and the client mounts them again after a reconnect. A dj-hook pushEvent now works over SSE (it used to need the WebSocket), addressed to the view it sits in. Without a stream (a browser with no EventSource) a lazy view's hydration reports view_unavailable instead of leaving a container that looks live. State isolation, on every transport: an explicit view's persist="server" envelope is stored under the view's own address (two views of one class used to restore whichever saved last; the page view's key is unchanged), and a view beside the page view mints, refreshes and revokes no navigation snapshot, so it can no longer replace or revoke the page view's. Still open on #3252: lazy views over the page-POST fallback, a non-sticky child's state between HTTP requests, events sent from code with no element, hydrating the destination's lazy containers after live_redirect, a shared render lock, and a refused login-required lazy view redirecting the whole page. Covered in python/djust/tests/test_sse_view_slots_3252.py, python/djust/tests/test_multi_view_state_isolation_3252.py, tests/js/sse_view_slots_3252.test.js and tests/playwright/test_multi_view_sse_http.py.

AI discovery INFO checks (#3448). Add djust.I001 agent discovery hints, djust.I002 for LiveView projects without theming, and djust.I003 for fresh cached X101–X104 UI findings even when components are enabled. Missing/stale caches are silent.

Behavior change: Agent-run manage.py check --fail-level INFO now fails unless I001 is silenced; unsilenced I002/I003 can also fail this threshold. I002 also prints on runserver/migrate for LiveView projects without djust.theming. Use SILENCED_SYSTEM_CHECKS or DJUST_CONFIG["suppress_checks"] per ID; DJUST_AI_HINTS=0 silences I001 only.

AI capability discovery (#3448). Add djust_ai inventory, suggest, and manifest, exposed through djust ai, plus MCP list_ui_components and get_ui_component. The shared catalog supplies component purposes, keywords, props, and examples. Suggest/manifest run in-process; inventory uses configured settings or a validated nearby manage.py entry point.

UI component audit rules X101–X105 under djust_audit --ast (#3448). Warn on hand-built looping tables (data_table, data_grid, infinite_scroll), long or generated reactive selects (combobox, rich_select), overlay panels (sheet, modal), class-switched messages (server_toast_container, toast_container, page_alert), and linked CSS color literals outside theme tokens (theme tokens or a preset). Template findings support same-line {# djust: noqa X101 #} comments; CSS uses /* djust: noqa X105 */. --ast-no-ui opts out of UI rules, while --ast-no-ui-cache disables the default atomic UI summary cache at .djust/audit-ui.json. The writer creates a self-ignoring .djust/.gitignore only when it creates .djust/; write failures do not fail the audit. 101 regression test functions in python/tests/test_audit_ui_3448.py (170 collected cases including parametrization).

Behavior change: Projects running djust_audit --ast --strict in CI will now fail on X1xx warnings. Migrate by adding --ast-no-ui, or fix findings / add specific same-line noqa comments. Disabling cache writes does not disable the warnings.

The djust admin change list filters and sorts only on declared fields. ModelListView.apply_filter accepts the field names in the ModelAdmin's list_filter (get_list_filter()), and sort_by accepts the sortable list_display columns and the fields named in ordering (get_ordering()), as Django's admin does. The queryset applies the same check to the stored filters and ordering, so any other name (another lookup, a path through a relation, an expression) is ignored and logged at debug level. The filter list on the page now comes from get_list_filter() as well. A custom change-list template that filters or sorts on other fields must declare them in list_filter, list_display or ordering. The auth admin's social accounts list sorts only on its own columns.

The djust admin loads rows through the ModelAdmin's get_queryset(). A DjustModelAdmin that scopes rows in get_queryset(request) was honoured by the change list only: bulk actions ran on the selected primary keys through Model.objects, and the change and delete views loaded their object with Model.objects.get(). As in Django's admin, an action now runs on the selected rows that get_queryset(request) holds (other selected keys are ignored), and the change and delete views load their object with the new DjustModelAdmin.get_object(request, object_id), which looks it up in that queryset; a row it leaves out, or a key that names no row, is a 404.

A live view whose mount() raises is no longer left mounted. An exception from mount() (or the state restore, handle_params(), connected() or the first render) used to answer with an error frame and keep the view as the connection's mounted view, so later events still ran its handlers, and it stayed in its channel groups with its presence tracked. Such a mount now ends like a refused one on WebSocket and SSE: a PermissionDenied is answered as the authorization check answers it (code: "permission_denied"; the page view's socket closes with 4403, a lazy or batched view gets view_refused), any other exception keeps its error frame, and in both cases the view is released, its groups are left, its presence is untracked and its tick stops. A view whose object permission is refused after mount() also untracks its presence. The HTTP fallback and the HTTP API already refused such a request.

Live transports enforce or refuse access control that only the HTTP request runs. The WebSocket and SSE mount, events, the HTTP POST event fallback, the API and {% live_render %} children never call a view's setup(), dispatch(), get() or post(), and never run the wrappers the URLconf puts around as_view(). djust replays its own declarations and Django's LoginRequiredMixin, PermissionRequiredMixin and UserPassesTestMixin there, but a custom AccessMixin subclass that checks the user in its own dispatch(), a @method_decorator(...) on dispatch, get or post, an overridden method that checks the user, or a URLconf wrapper such as path("x/", login_required(MyView.as_view())) did not run at all. check_view_auth now:

• replays Django's login_required, staff_member_required, user_passes_test(...) and permission_required(...) applied with @method_decorator, wrapped around as_view() in the URLconf (read from the server's URLconf, not from the URL the client sends) or by an as_view() override, and other packages' decorators built on user_passes_test. The same users are admitted as on the HTTP request; an authenticated user who fails the test gets PermissionDenied, where Django's HTTP response would redirect to the login page. Async test functions are awaited (called directly on the event loop's thread, the check refuses instead of blocking). login_not_required is not access control. A decorator applied only to post is checked for every event on the page (the view's, its components', its embedded views' and uploads), not for the mount;
• refuses a view whose custom AccessMixin subclass defines dispatch(), unless it declares permission_required or check_permissions() (login_required = True alone does not cover it);
• refuses a view whose setup()/dispatch()/get()/post() override, a decorator on one (also under another decorator stacked above @method_decorator, or returned by a project decorator that delegates to it), or a URLconf wrapper checks the user (any attribute of it, such as is_staff, groups or a role) and denies by any means (raises, including PermissionDenied and Http404; calls handle_no_permission() or redirect_to_login(); returns a redirect, an error response or a page of its own such as render(...) or HttpResponse(...); calls get_object_or_404()), unless a declared rule covers it (login_required covers a check that reads only is_authenticated / is_anonymous);
• refuses a view with any other decorator or URLconf wrapper that is neither Django's nor djust's, unless it declares permission_required or check_permissions().

Permitted users of views using Django's login_required, staff_member_required, user_passes_test and permission_required decorators and wrappers, or its three auth mixins, are unaffected. Views whose access check lives in their own setup(), dispatch(), get(), post(), decorators or URLconf wrappers are refused for every user until the rule is declared. The HTTP GET page, which Django's dispatch already gated, is unchanged. System check djust.S012 (an Error) names each refused view defined in the project; djust.V013 (a warning) names overrides that only read the user, which are not refused, refused views that an installed package defines, and URLconf routes whose wrapper does not use functools.wraps (djust cannot read it). djust.S012 no longer reports Django's own decorators on dispatch(), which are replayed. Only djust and djust.* modules are treated as framework code: apps and packages named djust_* are inspected, djust-auth's LoginRequiredLiveViewMixin is read as login_required = True, and djust-tenants' TenantMixin is not reported. LoginRequiredLiveViewMixin in djust.auth now also sets login_required = True. Upgrade note: a view refused this way must declare its rule. A public view that keeps a rate-limit, CSP or logging decorator or URLconf wrapper defines check_permissions() returning True. login_required = False is not a declaration.

MCP tools keep filesystem paths inside the project. find_handlers_for_template read any absolute path that existed, so it confirmed which files existed anywhere on disk and returned dj-*-shaped strings from them. It now reads an absolute path only when the file resolves (symlinks and .. followed) inside a directory the template loaders serve or inside BASE_DIR, and answers any other absolute path like a missing template. seed_fixtures compared paths with a string prefix, so /app-data passed for a BASE_DIR of /app, and skipped the check when BASE_DIR was unset; it now compares whole path components and refuses to load anything without BASE_DIR. Both use one containment helper.

The live mount checks object permission after handle_params(). The WebSocket and SSE mounts ran has_object_permission() after mount() but before handle_params(), so a view that selects its object from the URL's query parameters in handle_params() was checked against the object mount() chose and then rendered the one the parameters selected. The mount now runs mount(), handle_params(), the object check, and then connected() and the first render: the order the HTTP GET render and url_change navigation already used. A refused mount still sends a permission_denied error frame and closes the WebSocket with 4403.

One @rate_limit budget per handler function, whatever name reaches it. The shared store keyed buckets on the caller and the name the route used (the client-supplied event_name on WebSocket/SSE, the function name on the HTTP API), so a method reachable under two names (an alias attribute, or a second name bound in mount) had a separate budget per name. The bucket is now keyed on the function that actually runs (__func__ of a bound method), accepted only when that function is declared on the owning class (or, for an ADR-031 component, on the class behind the bound proxy); only the exact builtin staticmethod/classmethod wrappers are unwrapped, and membership is compared with is. A handler whose identity cannot be determined this way (a property or other descriptor, a functools.partial, a callable instance, a function from an unrelated class) is refused with a named error rather than given a budget of its own, and two handlers that resolve to one key with different limit settings are refused rather than sharing the first one's settings. Functions made by one factory keep separate budgets. Tests: python/djust/tests/test_ratelimit_post_fallback.py.

@rate_limit now applies on the page-POST fallback. The per-handler @rate_limit was checked on WebSocket/SSE and on the HTTP API, but the page-POST fallback (mixins/request.post), which also runs an @event_handler from the request body, did not consult it, so calls through it did not use the shared per-caller budget that F27 documents as "one budget per handler regardless of transport". The fallback now checks the limit at the same point as the WebSocket path (after the decorator and permission checks, before the handler runs) and answers 429 with code: "rate_limited" in its existing JSON error shape. Both HTTP transports share one implementation, djust.rate_limit.http_handler_rate_check, and one caller-key helper, caller_key_for_request (still behind resolve_client_ip, so DJUST_TRUSTED_PROXY_COUNT still applies); the HTTP API's behaviour is unchanged. Tests: python/djust/tests/test_ratelimit_post_fallback.py.

Development dependency security: Update source-map-js to 1.2.2, fixing CVE-2026-93749 (indexed source-map offsets can block the build/test event loop).

The theme editor's inline preset and design-system data is now escaped for its <script> block. The editor embedded json.dumps output in an inline script with |safe, and json.dumps leaves <, > and & raw, so a registered preset or design-system value containing </script> closed the element. Both blobs now go through escape_json_for_script, the same helper the debug panel uses; the data the page's script reads is unchanged. 3 cases in python/djust/tests/test_theming_editor_json_script.py.

Theming URLs use a shared script-scheme denylist (#3400, #3407, #3418). Data-derived URLs in navigation, breadcrumbs, pagination, avatars and page tags are neutralised to "#" for javascript:, vbscript: and data: schemes, including whitespace and control-character obfuscation. Image sources retain data:image/*; links do not. Other schemes, including sms:, geo: and app deep links, remain unchanged. Developer-supplied button href= and passthrough URL attributes still raise ValueError. Navigation covers dictionary and object items, iterable collections and sidebar sections without mutating caller-owned items. Pagination checks every page, first, last, previous and next URL after formatting.