v1.0.0rc15

Fixed

• @permission_required event handlers no longer raise SynchronousOnlyOperation (#1648). Sibling of #1638: the per-event handler-permission check (_validate_event_security) called check_handler_permission synchronously from an async def. For a handler decorated with @permission_required, that calls user.has_perms(), which under Django's default ModelBackend queries the DB for a non-superuser — raising SynchronousOnlyOperation in the event loop (and, unlike the object-permission path, with no fail-closed catch, so it propagated). The call is now wrapped in sync_to_async, mirroring #1638 and the mount path.
• live_redirect to a different view now mounts the correct target (#1647). The client's resolveViewPath() falls back to the current container's dj-view — the source view — when window.djust._routeMap is empty, which is the default for apps using plain Django path() URLconfs (no live_session()). The server trusted that client-supplied class in the live_redirect_mount frame, instantiated the source view against the destination URL's request, and raised "Failed to load view. Please refresh the page." handle_live_redirect_mount now resolves the destination view server-side from the URL via Django's URL dispatcher and overrides the client-supplied view when the URL maps to a djust LiveView (falling back to the client value otherwise, so live_session() route maps are unaffected). live_session() is no longer a hidden prerequisite for live_redirect across plain path() URLconfs.

What's Changed

• fix(websocket): resolve live_redirect target view from URL, not client (#1647) by @johnrtipton in #1656
• fix(auth): wrap per-event check_handler_permission in sync_to_async (#1648) by @johnrtipton in #1657
• test(infra): empirical-canary for assert_http_ws_djid_parity (#1654) by @johnrtipton in #1658
• test/refactor: strengthen drain guards — predicate, caller-count, deploy test (#1655) by @johnrtipton in #1659

Full Changelog: v1.0.0rc14...v1.0.0rc15