v1.2.1

A bug-fix release for 1.2. The code is identical to 1.2.1rc2; see the 1.2.1rc2 and 1.2.1rc1 sections below for every change since 1.2.0. There are no API removals, and no default or wire-format changes. 1.1.5 carries the security fix for the 1.1 line.

Security

• This release and 1.1.5 include a fix for GHSA-vq5h-rg2r-wfm5 (React component props); see the advisory for details.

Behaviour changes to check when upgrading

• Whitespace between inline siblings now renders in LiveView pages, as it already did on plain Django pages (#2999).
• A class-level component's State counts towards is_dirty / changed_fields, so switching a component tab marks the view dirty (#2912).
• reset_form is an @event_handler and can be called from the client (#2974).
• A form field's callable initial is called, as Django does, and a form's own self.initial wins over the field's (#3062).
• A resumable-upload request for an upload that no longer exists is answered not_found instead of resumed (#2972).
• The tenant_redis presence backend now uses Redis rather than falling back to memory (#2973).
• djust_theming.E001 is a Warning instead of an Error; its id is unchanged (#3028).
• dj-offline-show elements stay hidden on pages that include the directive CSS but never load the djust client (#3051).
• CodeBlock's Copy button now works (#3008). Apps that patched its markup should drop the workaround.

What's Changed

• chore(release): 1.2.0 by @johnrtipton in #2980
• ci(release): gate publishing on the pre-release security audit by @johnrtipton in #2989
• fix(security): remove the pickle-backed SerializerCache and stop skipping B301/B102/B324 by @johnrtipton in #2992
• docs: release notes for djust 1.2 and 1.1.4 by @johnrtipton in #2994
• test: clear Engine.get_default when tests reset template engines (#2991) by @johnrtipton in #2995
• fix(vdom): keep the space between inline siblings (A B) (#2999) by @johnrtipton in #3009
• ci: bump actions/setup-node from 6 to 7 by @dependabot[bot] in #2902
• docs(roadmap): plan 1.2.1 as 13 non-breaking drain buckets; list 1.3 items by @johnrtipton in #3015
• deps: bump uuid from 1.26.0 to 1.26.1 by @dependabot[bot] in #2904
• deps: bump smallvec from 1.16.0 to 1.16.1 by @dependabot[bot] in #2906
• deps: bump the vitest group across 1 directory with 3 updates by @dependabot[bot] in #2907
• deps: bump magic-string from 1.2.3 to 1.4.1 by @dependabot[bot] in #2908
• deps: bump happy-dom from 20.14.0 to 20.14.5 by @dependabot[bot] in #2909
• fix(components): CodeBlock copy, theme-paired labels, star contrast, hook warnings (v1.2.1-12) by @johnrtipton in #3016
• fix(csrf): socket-rendered {% csrf_token %} matches the browser cookie; inject into the real (#2998, #2987) by @johnrtipton in #3017
• fix(templates): serialise React component props as encoded JSON by @johnrtipton in #3021
• docs(readme): simplify the README to what a newcomer needs by @johnrtipton in #3022
• test(js): ignore undici setTypeOfService EINVAL in vitest's unhandled-error filter by @johnrtipton in #3029
• fix(template): detect dj-root/dj-view on any element and however it is written (#2981, #2892) by @johnrtipton in #3023
• docs(retro): v1.2.1-3 retro + mark bucket shipped by @johnrtipton in #3033
• fix(websocket): server-originated turns and tick lifecycle (v1.2.1-2: #3000, #2945, #3001, #2955, #2963) by @johnrtipton in #3035
• docs(retro): v1.2.1-2 retro + mark bucket shipped by @johnrtipton in #3037
• fix: runtime and client batch (v1.2.1-5, -6, -10, -11): listen() in mount, component skip_render, cancel_async_all, presence heartbeat, page-loading bar, drafts, snapshot keys, stream limit, resumable uploads, PWA sync, generate_sw by @johnrtipton in #3039
• docs(retro): v1.2.1-5/-6/-10/-11 runtime and client batch retro; mark the batch's rows shipped by @johnrtipton in #3040
• fix: security hygiene + scaffolding/CLI/config batch (v1.2.1-4, v1.2.1-13) + autobahn note by @johnrtipton in #3047
• docs(retro): v1.2.1-4/-13 security hygiene + scaffolding batch retro; mark the batch's rows shipped (#3047) by @johnrtipton in #3049
• fix: state and rendering batch (v1.2.1-7, -8, -9): dirty tracking, snapshot components, reset_form, decoded SetText, pre/code paths, verbatim in blocks, live_tags in root templates by @johnrtipton in #3042
• docs(retro): v1.2.1-7/-8/-9 state and rendering batch retro; mark the batch's rows shipped (#3042) by @johnrtipton in #3050
• fix: runtime and client follow-ups batch (v1.2.1-15): failed-mount tick, theming E001 severity, live-nav title, HTTP _skip_render, offline body classes, restore hardening, render-scoped bench by @johnrtipton in #3052
• docs(retro): v1.2.1-15 runtime and client follow-ups retro; mark the batch's rows shipped (#3052) by @johnrtipton in #3055
• fix: template and rendering follow-ups (v1.2.1-14): body close, masker, T018 literals, inclusion tags, form tags, bridged live_tags, root parity, raw-text serialization by @johnrtipton in #3053
• docs(retro): v1.2.1-14 template and rendering follow-ups retro; mark the bucket's rows shipped (#3053) by @johnrtipton in #3056
• fix(pwa): offline indicator and banner show when offline; indicator text and class follow the network state (#3051) by @johnrtipton in #3057
• docs(retro): #3051 offline indicator retro; close Action Tracker #361 and strike the ROADMAP row (#3057) by @johnrtipton in #3058
• chore(release): 1.2.1rc1 by @johnrtipton in #3060
• fix(forms): call a callable field initial at mount and in reset_form by @johnrtipton in #3062
• chore(release): 1.2.1rc2 by @johnrtipton in #3064

Full Changelog: v1.2.0...v1.2.1