0.1.2

Warning

Broken in default Django projects — upgrade to 0.1.3. With the standard CsrfViewMiddleware active (any conventionally configured project), every MCP POST is rejected with 403 CSRF cookie not set. 0.1.3 makes the view csrf_exempt (ADR-0018).

django-stateless-mcp 0.1.2

Fixed

• A single GET request could permanently peg a worker at 100% CPU. The
  view routed every method into the SDK's transport, whose GET handler opens
  an SSE listen stream and waits for client disconnect by polling the ASGI
  receive callable. The bridge's synthesized receive replayed the request
  body forever without ever yielding, so the disconnect listener became a hot
  spin that starved the worker's event loop — one anonymous GET per worker
  was a full denial of service. Two fixes, either sufficient: the view now
  serves POST only (a stateless exchange is one request and one response;
  GET/DELETE session machinery has nothing to attach to) and answers other
  methods with 405 Method Not Allowed; and the synthesized receive now
  follows the ASGI contract — the buffered body once, then http.disconnect.