v1.3.0

Security

• GHSA-gg2v-v5mp-jx42 (Low): a model held in a container was written in full by pprint and json_script, and its mapping was iterable from a template. Published for the fix shipped in 1.3.0rc17 (the "A model held in a container prints as its text…" and "A model is not a mapping to a template" entries in that section). Affected: >= 1.3.0rc1, < 1.3.0rc17. Upgrade to 1.3.0rc17 or later; the fix is in the compiled extension.

What's Changed

• chore(release): 1.2.1 by @johnrtipton in #3065
• ADRs 034-038: component conventions — explicit exposure, typed event contracts, form lifecycle, component bindings by @johnrtipton in #2944
• feat(auth): pluggable account backends and a shared account page kit (ADR-039) by @johnrtipton in #3067
• feat(adr-038): explicit exposure — all gates closed, every decision recorded by @johnrtipton in #2954
• chore(release): 1.3.0rc1 by @johnrtipton in #3069
• fix: keep context-processor values out of the state normalizer (#3061); A102 accepts ALLAUTH_TRUSTED_CLIENT_IP_HEADER (#3068) by @johnrtipton in #3070
• docs(retro): v1.3.0-1 render context and accounts check retro (#3070) by @johnrtipton in #3073
• fix(accounts): allauth pages keep the layout's head; phone flash gutter; A102 accepts an adapter get_client_ip by @johnrtipton in #3076
• perf: resolve handler discovery once per class, not on every render (#3075) by @johnrtipton in #3077
• fix: presence import race (#3079), in-memory state backend TTL never applied (#3080), per-event psutil probe by @johnrtipton in #3083
• docs(retro): v1.3.0-2 thread race + memory growth retro; mark the bucket's rows shipped (#3083) by @johnrtipton in #3085
• perf(rust): release the GIL in RustLiveView.render_with_diff (#3074 1/7) by @johnrtipton in #3087
• perf: opt-in pinned session worker pool, LIVEVIEW_CONFIG["worker_threads"] (#3074 2/7) by @johnrtipton in #3091
• feat: scoped server push, push_to_view(..., scope=) and LiveView.push_scope (#3004, #3074 3/7) by @johnrtipton in #3096
• perf: move per-frame work off the event loop when the worker pool is on (#3074 4/7) by @johnrtipton in #3100
• perf: djust.layers.InMemoryChannelLayer with a rate-limited expiry sweep (#3074 5/7) by @johnrtipton in #3101
• ci: free-threaded cp314t wheels and a blocking 3.14t job with the GIL asserted off (#3074 6/7) by @johnrtipton in #3102
• docs: guide — scaling a djust process across cores (#3074 7/7) by @johnrtipton in #3105
• docs(retro): v1.3.0-3 multi-core rendering bucket retro (#3074) by @johnrtipton in #3106
• docs: replace the dead Discord invite with a permanent one by @johnrtipton in #3111
• chore(release): 1.3.0rc2 by @johnrtipton in #3110
• fix: presence broadcasts respect push_scope (#3095) by @johnrtipton in #3115
• security: component alias routing (#3078) and test-client handler authorization (#3094) by @johnrtipton in #3117
• docs(adr-039): status — shipped in 1.3.0rc1, follow-ups in rc2 by @johnrtipton in #3120
• fix: bound HTTP request threads under overload with PooledHTTP (#3114) by @johnrtipton in #3118
• fix: CodeQL code-scanning alerts; exclude guarded py/cyclic-import by @johnrtipton in #3124
• perf: less work on the event loop per frame (#3095) by @johnrtipton in #3123
• ADRs 034–037: component-scoped events, Django-native forms, typed event parameters, shared contract checks by @johnrtipton in #3122
• chore: release 1.3.0rc3 by @johnrtipton in #3131
• fix: CodeQL follow-up — log-injection, unused global, empty except by @johnrtipton in #3133
• chore: merge the v1.3.0rc3 release commit back into main by @johnrtipton in #3135
• ADR-037 D2: executable documentation fixtures, drift check, generators and catalogue entry by @johnrtipton in #3134
• feat: vendored third-party assets with SRI, manifests and a scanner-readable SBOM (ADR-040) by @johnrtipton in #3136
• ADR-037 D3: final acceptance, retire the remaining **kwargs rules, statuses by @johnrtipton in #3138
• fix: djust admin pages render, mount over WebSocket, and sign in (#3139, #3140, #3142) by @johnrtipton in #3153
• fix: ADR-040 asset-check follow-ups (#3143, #3144, #3145, #3146) by @johnrtipton in #3152
• fix: system-check accuracy drain (#3093 S009 alias resolution, #2984 remove unread config keys) by @johnrtipton in #3158
• test: drain group D — event-driven WS frame collection, hot-reload watcher off under pytest, snapshot payload compare, pinned SSE (#3130, #3099, #3092, #3097, #3137) by @johnrtipton in #3156
• fix: drain B — theme example template, release tag target, dead checks module (#3141, #3148, #3149) by @johnrtipton in #3160
• fix: navigation and state-snapshot drain (#3155, #2960, #3098, #2966) by @johnrtipton in #3163
• fix: drain group I — runtime hardening (#3157, #3116, #3034, #3003, #3063, #3071) by @johnrtipton in #3167
• fix: ADR-035/036/037 review follow-ups (#3103, #3125, #3126, #3127, #3104 partial) by @johnrtipton in #3159
• fix: component styles, djust preset AA, presence/markdown docs (#3025, #2993, #2996, #3109) by @johnrtipton in #3161
• feat: several asyncio event loops per process on free-threaded Python, opt-in (#3128) by @johnrtipton in #3162
• docs: multi-loop follow-up — room tasks stop under the lock too; snake row done (#3128) by @johnrtipton in #3168
• perf(audio): render {% djust_audio %} natively and build the manifest once per view by @johnrtipton in #3175
• fix: snapshot class namespaces before walking them on free-threaded CPython (#3151) by @johnrtipton in #3176
• docs: ROADMAP v1.3.0-8 row and RETRO entry for #3151 by @johnrtipton in #3182
• fix(tests): git fixtures must not write into the real .git/config (#3179) by @johnrtipton in #3180
• docs: ROADMAP v1.3.0-9 row and RETRO entry for the test git-env isolation fix (#3179) by @johnrtipton in #3183
• chore(release): 1.3.0rc4 by @johnrtipton in #3185
• feat(deploy): add djust deploy logs to print a deployment's build log by @johnrtipton in #3196
• fix(presence): join the formatted presence group after mount; two-command Redis presence list (#3202, #3203) by @johnrtipton in #3205
• fix: tooling and test health drain (Group J): #3170 #3172 #3177 #3184 #3181 #3208 by @johnrtipton in #3213
• fix(exposure): explicit-exposure resilience: save deadline excludes queueing; fresh mount for a lost session (#3200, #3201) by @johnrtipton in #3206
• docs: add a Scaling djust guide with multi-pod requirements and measured numbers (#3216) by @johnrtipton in #3220
• fix: transport and render drain (#3186, #3187, #3178, #3164) by @johnrtipton in #3214
• fix(deploy): fail clearly without a TTY; refresh expired tokens in status by @johnrtipton in #3113
• fix(checks): allow dj-root to satisfy T012 and update hint (#3171) by @DYNOSuprovo in #3194
• docs+fix: forms docs accuracy, channels_redis socket_timeout (C023), Toast styles, djust link contrast by @johnrtipton in #3207
• docs: scaling advice follow-ups, socket_timeout 20, T012 wording (#3219, #3210, #3171) by @johnrtipton in #3224
• docs: move the 19 task-shaped tutorials into docs/website/guides (#3173) by @johnrtipton in #3223
• fix: small fixes and test health drain (Group R): #3209 #3218 #3222 by @johnrtipton in #3226
• fix: SSE and explicit-exposure follow-ups (#3211, #3212, #3221) by @johnrtipton in #3229
• chore(release): 1.3.0rc5 by @johnrtipton in #3233
• fix: runtime follow-ups to #3229 (#3227, #3231, #3232) by @johnrtipton in #3234
• fix: actor shutdown waits for the actor to stop and drops Python objects attached (#3228, #3222) by @johnrtipton in #3235
• fix: checks and theming drain (Group T): #3225 #3230 by @johnrtipton in #3238
• test: deterministic stuck-cap and save-pool teardown tests (#3240, #3241) by @johnrtipton in #3243
• fix: runtime lifecycle drain (Group V): #3236 #3237 #3239 by @johnrtipton in #3242
• fix: WebSocket view replacement teardown (Group X): #3244 #3245 by @johnrtipton in #3250
• fix: state persistence edges drain (Group Y): #3246 #3247 #3248 by @johnrtipton in #3251
• docs: audit runtime guidance and examples by @johnrtipton in #3249
• docs(readme): link Discord and the YouTube channel under Community by @johnrtipton in #3198
• deps: Bump eslint from 10.10.0 to 10.11.0 by @dependabot[bot] in #3081
• deps: Bump jsdom from 30.0.1 to 30.1.1 by @dependabot[bot] in #3082
• test: wait for the expected WebSocket frame instead of a 0.3 s quiet window (#3256) by @johnrtipton in #3258
• feat(markdown-editor): table actions, selection/empty-line menus, window.djust.getHook (#3107, #3108) by @johnrtipton in #3260
• Release 1.3.0rc6 by @johnrtipton in #3263
• docs: audit component API and examples by @johnrtipton in #3257
• test: stabilize teardown and tick checks, improve failure diagnostics by @johnrtipton in #3268
• fix: stop authentication-refusal reconnect loops and honor safe redirects by @johnrtipton in #3269
• fix: isolate performance tracking between concurrent event tasks by @johnrtipton in #3271
• security: rotate admin login sessions through Django HTTP authentication by @johnrtipton in #3272
• fix: persist deferred events and refresh HTTP state snapshots by @johnrtipton in #3273
• fix: release registry locks before Python finalizers run by @johnrtipton in #3274
• fix: align root locators with HTML attribute tokenization by @johnrtipton in #3275
• fix(theming): visible focus, missing component CSS, [hidden], contrast coverage by @johnrtipton in #3305
• fix(uploads): default chunk size fits the websocket frame limit, wire upload progress, drop stale client.js.backup by @johnrtipton in #3308
• feat(theming): bindings/attrs passthrough, select value, alert info/role, preset allow-list, CSP nonce, LiveView-capable layouts by @johnrtipton in #3309
• fix(cli): djust init keeps existing pins, ai_context refuses to overwrite and carries security guidance, hot-reload banner off stdout by @johnrtipton in #3311
• chore(deps): xterm 6 for the vendored ttyd terminal; Python 3.15 in the CI matrix by @johnrtipton in #3314
• fix(checks): T019-T022 on Djust-only TEMPLATES, A014 under test runner, comment-aware template checks, is_staff and csrf_token warnings by @johnrtipton in #3306
• fix(runtime): SSE close untracks presence (#3254); #3248 and #3046 verified already fixed by @johnrtipton in #3313
• fix: template-backend spelling lookup, CSP nonce for live theme switching, init/ai_context follow-ups by @johnrtipton in #3315
• fix(runtime): djust warnings reach stderr by default, check for dj-root on html/body, HTTP fallback honours queued navigation, docs for login-over-WS by @johnrtipton in #3316
• fix(cli): ai-context carries login-over-WS and get_context_data notes; init handles marker and duplicate requirements by @johnrtipton in #3321
• feat(auth): structured refusal codes + client event; pin csrf_token in the page shell by @johnrtipton in #3323
• fix(theming): nav active state follows dj-navigate, preset selector keeps its selection across mode toggle by @johnrtipton in #3322
• fix(ai-context): stop telling AI assistants that dj-submit resets the form by @johnrtipton in #3291
• feat(tenants): tenant-keyed saved view state; tenant_redis presence through the global registry by @johnrtipton in #3324
• docs: add AI Guardrails guide by @johnrtipton in #3286
• feat(navigation): full page load when the destination's page-shell assets differ; update hook for reused sticky children by @johnrtipton in #3330
• feat(presence): per-connection presence records aggregated per user and room by @johnrtipton in #3325
• chore(tests): refresh .test_durations from CI (shard-balance headroom) by @johnrtipton in #3332
• fix(state): Back restores the latest rendered state — coalesced trailing save with ordering and logout safeguards by @johnrtipton in #3331
• feat(runtime): independently interactive embedded/lazy/batched views over WebSocket; embedded children over the HTTP fallback by @johnrtipton in #3333
• feat!: require Python 3.11+ for djust 1.3 (drop 3.10) by @johnrtipton in #3326
• fix(tests): filter bridge marks itself done before a Django engine exists by @johnrtipton in #3345
• deps: bump the vitest group with 6 updates by @dependabot[bot] in #3339
• fix(theming): derived --destructive-text token so error text meets AA in every preset and mode by @johnrtipton in #3343
• deps: bump magic-string from 1.4.1 to 1.4.2 by @dependabot[bot] in #3340
• chore(deps): bump pyjwt and urllib3 to clear the pip-audit gate by @johnrtipton in #3336
• deps: bump eslint-plugin-security from 4.0.1 to 4.1.0 by @dependabot[bot] in #3341
• feat(theming): block-tag forms (theme_card_block, theme_alert_block, …) for container components by @johnrtipton in #3342
• deps: bump thiserror from 2.0.20 to 2.0.21 by @dependabot[bot] in #3338
• deps: bump smallvec from 1.16.1 to 1.16.2 by @dependabot[bot] in #3337
• fix(client): bind dj-model inputs added after init; re-arm the lazy-view container sweep by @johnrtipton in #3350
• fix(theming): gallery editor knows --destructive-text; Tailwind, demo and W001 follow-ups by @johnrtipton in #3349
• feat: PersistentLiveView base class that opts views into state snapshots by @johnrtipton in #3348
• docs(schema): sturdier pins and exact wording for the corrected directive descriptions by @johnrtipton in #3352
• docs(adr): ADR-041 pluggable state protection and a compliance profile (proposed) by @johnrtipton in #3346
• fix(state): the post-event session save merges djust's own keys instead of overwriting the whole session by @johnrtipton in #3354
• Release 1.3.0rc7 by @johnrtipton in #3358
• fix: make affected test selection fail closed and stage full checks by @johnrtipton in #3365
• fix: select and verify Python matrix interpreters in CI by @johnrtipton in #3357
• fix: green the supported-Python matrix on CPython 3.13.15 and 3.14.7 (explicit-save late failure log, striptags pin, title Unicode sweep) by @johnrtipton in #3366
• fix: write every schema directive into the generated AI-context files; correct dj-input timing docs by @johnrtipton in #3367
• feat(init): report the djust-first TEMPLATES shape; --templates adds it (#2884) by @johnrtipton in #3368
• feat: render the theme_context HTML lazily, keep the settings eager (#3028) by @johnrtipton in #3369
• feat: add @push_handler, an explicit marker for server-push-only handlers by @johnrtipton in #3370
• docs(adr): ADR-042 shared room clock (proposed) by @johnrtipton in #3371
• fix(theming): move preset text colours that miss AA by a small step (#2885) by @johnrtipton in #3372
• feat: connected() and disconnected() LiveView hooks, with a documented lifecycle contract (#3007) by @johnrtipton in #3373
• fix: one ownership-aware root selection rule for the Python render and the Rust VDOM (#3031) by @johnrtipton in #3374
• feat(components): ship the hooks for SortableList, SortableGrid, JsonViewer and LogViewer (#2985) by @johnrtipton in #3375
• fix(templates): lazy block.super for Python-bridged tags (#2918) by @johnrtipton in #3376
• fix(client): draft mode and dj-model keep working for elements a patch adds (#3351, #3355) by @johnrtipton in #3377
• test: make the #2858 stale-closure cases wait for the effect, not a fixed sleep by @johnrtipton in #3378
• docs: add the AI Guardrails and Multiple Views guides to the docs nav (#3329) by @johnrtipton in #3379
• test: de-flake the hot-reload dispatcher and UDS restart tests (#3359) by @johnrtipton in #3380
• fix(serve): install the signal handlers before binding the UNIX socket by @johnrtipton in #3381
• docs(templates): document where striptags differs from Django on newer CPython by @johnrtipton in #3382
• feat(templates): dict-style block.super reads as a deprecated compat path (#2918) by @johnrtipton in #3383
• feat(theming): derived --primary-text, --info-text, --success-text, --warning-text, --brand-text so fills read as text (#2885) by @johnrtipton in #3384
• feat: independent multi-view over SSE and per-view state isolation (#3252) by @johnrtipton in #3385
• feat(components): ImageLightbox, FileTree, ResizablePanel and AnimatedNumber interactions (#2985, batch 2) by @johnrtipton in #3387
• fix(keyboard-nav): Escape in a dialog only uses an explicit close control by @johnrtipton in #3386
• feat(components): ActivityFeed, Terminal and Tour interactions (#2985, batch 3) by @johnrtipton in #3388
• fix: keep deferred state-save recovery nonblocking by @johnrtipton in #3406
• fix: correct CPython HTML parser release citations by @johnrtipton in #3404
• fix: unblock Python 3.15 CI and document wheel ABI evidence (#3255) by @johnrtipton in #3405
• feat: implement VoiceInput with bounded final transcripts (#2985) by @johnrtipton in #3403
• feat: per-view render locks and turn lanes, so a slow view stops delaying its siblings (#3252) by @johnrtipton in #3394
• feat: implement ImageCropper interaction and bounded server crops (#2985) by @johnrtipton in #3402
• fix: preserve dialog Escape isolation while simplifying Tab handling by @johnrtipton in #3391
• fix(components): LogViewer/Terminal reader detection uses event timestamps; Terminal auto_scroll (#2985) by @johnrtipton in #3392
• fix(theming): label and link colours that failed AA flip or move so they read; fills unchanged (#2885) by @johnrtipton in #3390
• fix(theming): refuse script-bearing URL schemes in nav/breadcrumb/auth/error-page tags by @johnrtipton in #3400
• feat: a refused lazy or batched view fails alone (#3252) by @johnrtipton in #3397
• security: patch development source-map-js denial of service by @johnrtipton in #3408
• feat(components): DashboardGrid, MentionsInput, CursorsOverlay and CollabSelection interactions (#2985, batch 4) by @johnrtipton in #3395
• feat: implement ImageUploadPreview with the existing upload pipeline (#2985) by @johnrtipton in #3401
• fix: is a supported root, on the server and in the client (#3302) by @johnrtipton in #3398
• feat(components): ResizablePanel resize_event and FileTree toggle_event (#2985) by @johnrtipton in #3396
• feat(components): SignaturePad interaction and a safe signature decoder (#2985 batch 5) by @johnrtipton in #3399
• feat(components): MapPicker interaction on a vendored Leaflet (#2985 batch 5) by @johnrtipton in #3393
• fix(theming): neutralise script-bearing data-derived URLs instead of raising by @johnrtipton in #3407
• fix(ci): stop the retro-gate audit workflow discarding its own findings (#3129) by @johnrtipton in #3409
• fix: spell a Decimal's refusal type name the way the running interpreter does (#3255) by @johnrtipton in #3410
• test: stop the regroup Decimal-name pin excluding the bare spelling (#3255) by @johnrtipton in #3411
• fix: fill a lazy slot over the page-POST fallback (#3252) by @johnrtipton in #3412
• test: emit each multiloop marker as one write so two loops cannot splice it by @johnrtipton in #3414
• test: pin that a WebSocket reconnect does not bypass the login gate by @johnrtipton in #3415
• docs: stop claiming the proxy-count coercion cannot widen trust by @johnrtipton in #3416
• chore(deps): vendor markup5ever_rcdom 0.40 and move the parser stack to 0.40 by @johnrtipton in #3417
• fix(theming): escape the theme editor's inline JSON for its script block by @johnrtipton in #3419
• fix(theming): one denylist for data-derived URLs, object items, per-page pagination check by @johnrtipton in #3420
• feat(clocks): one shared clock per room, process-local (ADR-042 phases 1-3) by @johnrtipton in #3425
• feat(#3252): attribute-form lazy views over the HTTP fallback, by render provenance by @johnrtipton in #3427
• fix(#3428): rendered-branch liveness, template-scoped include sites, selector-keyed plans by @johnrtipton in #3429
• deps: bump tendril, tokio, pyo3 and uuid; regenerate the distribution SBOM by @johnrtipton in #3444
• deps: bump the vitest group with 3 updates by @dependabot[bot] in #3434
• deps: bump eslint-plugin-security from 4.1.0 to 4.2.0 by @dependabot[bot] in #3435
• deps: update black requirement from >=26.5.1 to >=26.10.0 by @dependabot[bot] in #3437
• deps: bump jsdom from 30.1.1 to 30.1.2 by @dependabot[bot] in #3439
• deps: update sphinx requirement from >=8.1.3 to >=9.0.4 by @dependabot[bot] in #3441
• fix(clocks): bounded join wait, first joiner sees its clock, changelog note (#3426) by @johnrtipton in #3443
• deps: bump eslint from 10.11.0 to 10.12.0 by @dependabot[bot] in #3438
• deps: bump magic-string from 1.4.2 to 1.4.3 by @dependabot[bot] in #3440
• fix(#3430): template-literal output counts toward lazy-container liveness by @johnrtipton in #3442
• docs(adr): ADR-043 — AI capability discovery for components and theming by @johnrtipton in #3447
• feat(audit): djust_audit UI rules X101–X105 (ADR-043 D2) by @johnrtipton in #3452
• feat(ai): djust_ai discovery commands, MCP UI tools, djust.I001–I003 checks (ADR-043 D3+D1) by @johnrtipton in #3453
• Release 1.3.0rc8 by @johnrtipton in #3457
• feat(ai): UI building blocks docs, djust_ai_context over manifest, themed scaffold with components (ADR-043 D4) by @johnrtipton in #3455
• fix(checks): read (prefix, path) STATICFILES_DIRS entries in the Tailwind check (#3449) by @mayuriphad in #3461
• drain v1.3.0-10: load-tolerant WS tests, toast docstring, Windows ai-inventory hand-off by @johnrtipton in #3463
• docs(retro): milestone v1.3.0-10 + action tracker update by @johnrtipton in #3465
• fix(security): gate CI dependency audits, runnable checklist tests, exact proxy-count floor (v1.3.0-11) by @johnrtipton in #3472
• drain v1.3.0-12: CodeQL cleanup, load-tolerant WS test defaults, Windows inventory owner/DACL check, audit carry-forward by @johnrtipton in #3474
• chore(codeql): import ctypes.wintypes one way in _windows_acl by @johnrtipton in #3475
• release: 1.3.0rc9 by @johnrtipton in #3476
• security(deps): allowlist twisted.mail IMAP ReDoS in the release pip-audit gate (main) by @johnrtipton in #3480
• docs(retro): milestones v1.3.0-11 and v1.3.0-12 (+ v1.3.0-4 backfill) by @johnrtipton in #3483
• docs: 1.3 release notes and upgrade guide from 1.2 by @johnrtipton in #3484
• fix: clean up failed late mounts; no double handlers in noscript frames by @johnrtipton in #3492
• release: 1.3.0rc10 by @johnrtipton in #3496
• chore(packaging): stop shipping tests, client sources and unused images by @johnrtipton in #3506
• fix(client): deliver presence_event frames; remove the dead i18n flush by @johnrtipton in #3508
• docs: djust 2.0.0 plan; run CI on 2.* branches by @johnrtipton in #3499
• test: keep the range(10**9) runaway child from exhausting the CI runner by @johnrtipton in #3516
• test: make the audit-ui linear-scan timing check robust to CI noise by @johnrtipton in #3522
• fix(doctor): warn below the declared Django floor, 4.2 by @johnrtipton in #3509
• test: retry a slow sample in the audit-ui two-second scan bound by @johnrtipton in #3526
• docs: use the canonical template backend and state backend paths by @johnrtipton in #3532
• fix(sse): apply layout frames on the SSE transport by @johnrtipton in #3527
• fix(decorators): list action and is_action in decorators.all by @johnrtipton in #3538
• fix(http): carry push_event and set_layout on HTTP fallback answers; run defer() by @johnrtipton in #3541
• refactor(transport): share one error-frame builder between WebSocket and SSE by @johnrtipton in #3542
• ci: on-demand filter-parity-differential --compare between two refs by @johnrtipton in #3550
• fix(http): warn when the HTTP fallback drops background work by @johnrtipton in #3544
• fix(scripts): count only live leaks in the differential's leak totals by @johnrtipton in #3553
• fix(templates): type a variable dictsort argument by its resolved value by @johnrtipton in #3552
• fix: reauth reads the stored session, CSP nonce on config script, dj-view follows live_redirect, get_http_status(), async metadata decorators, re_path route map by @johnrtipton in #3558
• perf(runtime): cut per-page CPU on the shared sync thread (many pages at once) by @johnrtipton in #3559
• perf(templates): locate the rendered page's root with the Rust scanner by @johnrtipton in #3560
• fix(templates): one html5ever-aligned locator for the rendered page's root by @johnrtipton in #3561
• fix(client): stop dj-poll timers when their element leaves the page by @johnrtipton in #3562
• fix: HTTP fallback restore, url_change start_async, and reset_form target by @johnrtipton in #3564
• fix(templates): match Django for include planning, custom-filter objects and {% tabs %} by @johnrtipton in #3565
• feat(auth): any-of permissions, 403 for signed-in check_permissions() refusals, live-probe redirects, HVR on fresh page loads by @johnrtipton in #3563
• feat: async mount and push handlers, ASGI lifespan, turn-scoped push origin, djust:patched by @johnrtipton in #3567
• fix: stream_text appends, dj-poll on the root and in child views, click vs debounced edit, contents by @johnrtipton in #3569
• test(playwright): keep natural save latency off the transient-save count by @johnrtipton in #3568
• fix(components): strict nonce CSP, stable ids, dialog/menu semantics by @johnrtipton in #3566
• fix(http): keep the white space of text in the HTTP render by @johnrtipton in #3570
• fix(hvr): an edit to a mixin or base class in another module reaches its views by @johnrtipton in #3572
• fix(components): no inline handlers or scripts in the remaining components by @johnrtipton in #3571
• feat: create_task()/track_task() tie a view's own tasks to its start_async work by @johnrtipton in #3573
• fix(components): dropdown_menu keyboard, native modal dialog, form-field ARIA by @johnrtipton in #3574
• fix(websocket): full-origin check, actionable size-limit error, reserved view attributes by @johnrtipton in #3575
• fix(state): in-memory backend stores snapshots, so pool threads never share a Rust view by @johnrtipton in #3576
• feat: turn middleware — LIVEVIEW_MIDDLEWARE wraps every LiveView turn on every transport (ADR-044) by @johnrtipton in #3577
• fix(templates): give the raw-body parser a template origin by @johnrtipton in #3578
• fix(components): combobox/rich_select submit the chosen value; modal role, description, close button by @johnrtipton in #3579
• perf(state): one walk for change detection, safe strings and Rust conversion in the state sync by @johnrtipton in #3581
• feat(auth): async def check_permissions, awaited on the event loop by @johnrtipton in #3580
• fix(components): field name on option picks, opt-in combobox search, modal heading level and description block by @johnrtipton in #3586
• fix(websocket): clear a closing view's live handles after its in-flight render by @johnrtipton in #3585
• fix(components): {% tabs %} roving tabindex, tab-list label and URL param by @johnrtipton in #3583
• test: explicit connect/close deadlines for the shared-session socket test by @johnrtipton in #3587
• perf(render): egress HTML normalizer in Rust without the GIL; keep nested preserved blocks; normalize a template source once per GET by @johnrtipton in #3582
• fix(components): combobox keyboard support (WAI-ARIA combobox pattern) by @johnrtipton in #3588
• fix(components): combobox Escape stays out of the dialog; blur commit keeps one Tab by @johnrtipton in #3589
• fix(theming): form fields fill from --input-background and outline with --input by @johnrtipton in #3590
• fix(theming,components,auth): field fill, fonts, sizing and opaque overlays by @johnrtipton in #3591
• fix(components,theming): buttons inherit the page font; menus and option lists sit on --popover by @johnrtipton in #3592
• Test speed: fix red main, fast tier for pushes and PRs, faster check tests by @johnrtipton in #3594
• security(deps): lock certifi 2026.10.19 for PYSEC-2026-4320 by @johnrtipton in #3595
• perf(ci): build the Rust extension once per interpreter and share the wheel by @johnrtipton in #3593
• ci: JS coverage as its own job; PRs skip it unless labelled full-tests by @johnrtipton in #3596
• test: make the Redis TTL test immune to load and concurrent runs by @johnrtipton in #3597
• security(deps): vitest 5.0.5 (#176) and the stale Dependabot bumps by @johnrtipton in #3598
• security(theming): gallery template paths from a listing, not the URL; CodeQL notes by @johnrtipton in #3599
• release: 1.3.0rc11 by @johnrtipton in #3600
• fix(worker-pool): give the pool slots asgiref 3.13's _exited by @johnrtipton in #3614
• deps: bump tokio from 1.53.2 to 1.53.3 by @dependabot[bot] in #3602
• feat(state): get_render_only_context(); a legacy save keeps the view's state, not the whole context by @johnrtipton in #3608
• fix(jit): log the serializer's diagnostics at DEBUG instead of printing to stderr by @johnrtipton in #3609
• fix(jit): serialize a list-valued property item by item when the template reads inside it by @johnrtipton in #3610
• chore(pre-push): DJUST_PREPUSH_TARGETED=1, the direct selection instead of a blast-radius FULL by @johnrtipton in #3611
• feat(worker-pool): worker_pinning=False, lanes instead of pinned threads by @johnrtipton in #3613
• feat: view_state_in_session option keeps view state out of the session by @johnrtipton in #3616
• feat(state): LiveView.handle_restore(request), called after a view is rebuilt from its saved session state by @johnrtipton in #3612
• perf(render): keep the JIT source and dj-model allowlist per template; warn on a tag or filter name two libraries share by @johnrtipton in #3618
• security(sbom): regenerate djust.cdx.json for tokio 1.54.1 by @johnrtipton in #3619
• feat(turns): LIVEVIEW_CONFIG["sync_turn_wrapper"], a scope around each sync step of a turn by @johnrtipton in #3615
• fix(jit): find template paths inside {% tabs %} and in inline templates' includes; template_paths() and serialize_for_template() by @johnrtipton in #3617
• release: 1.3.0rc12 by @johnrtipton in #3620
• security(deps): undici 8.12.3; lock twisted 26.10.0rc1 and allowlist four unreachable twisted advisories by @johnrtipton in #3621
• release: 1.3.0rc13 by @johnrtipton in #3622
• fix(templates): stop re-bridging a library whose tag djust refuses on every {% load %} by @johnrtipton in #3623
• release: 1.3.0rc14 by @johnrtipton in #3627
• fix: keep ThemeMixin's rendered HTML out of view state; large-state warning reports its parts (#3626) by @johnrtipton in #3633
• fix: enter sync_turn_wrapper around handle_tick, handle_async_result and the test client's calls by @johnrtipton in #3636
• fix(http): run handle_params() and start_async work on the stateless fallback POST by @johnrtipton in #3630
• docs(roadmap): add v1.3.0-10 drain bucket by @johnrtipton in #3628
• fix(release): alert when the pre-release security audit blocks a release (#3482) by @johnrtipton in #3638
• fix(sync-turn): the HTTP fallback runs handle_async_result in the async step (main is red) by @johnrtipton in #3642
• perf: keep the theme processor's theme_presets out of stored view state; warn when a view grows (#3631) by @johnrtipton in #3640
• feat(http): a deadline for the fallback's background work; the first POST loads a page the GET left loading (#3634, #3635) by @johnrtipton in #3641
• feat(deprecation): warn when a LiveView defines the duck-typed accessibility hooks (#3629) by @johnrtipton in #3644
• fix: enter sync_turn_wrapper around auth checks, on_mount, lifecycle, cursor/presence hooks and replay (#3637) by @johnrtipton in #3643
• fix: stream-only handlers and temporary_assigns append rows reach the page over patches (#3639) by @johnrtipton in #3645
• fix: resolve the limits of per-container dj-update accumulation (#3647) by @johnrtipton in #3648
• docs(roadmap): add the v1.3.0-14 drain bucket by @johnrtipton in #3650
• fix: sync_turn_wrapper teardown hooks and four missed hops; rebuild the structural pin (#3646) by @johnrtipton in #3649
• fix(docs): README hero example sets template, not template_string; execute README LiveView snippets in tests by @johnrtipton in #3651
• fix(docs): README and QUICKSTART asgi.py serve static files under uvicorn by @johnrtipton in #3653
• fix(docs): framework asgi.py examples serve static files by @johnrtipton in #3654
• fix(template-libraries): log the expected refusals of djust's own libraries at DEBUG (#3655) by @johnrtipton in #3660
• security: refuse unknown events on the HTTP fallback; reserve view as a state field name by @johnrtipton in #3661
• security: bump pulldown-cmark to 0.13.5 (RUSTSEC-2026-0414) by @johnrtipton in #3671
• test: parity ratchet for djust's own template libraries, Django engine vs Rust engine (#3663) by @johnrtipton in #3670
• fix(template-libraries): consult the raw-block registry; key library policy on every entry, not the first (#3668) by @johnrtipton in #3672
• fix: native Rust handlers take the Python tags' positional parameters (#3664) by @johnrtipton in #3673
• fix(accumulating): scan linearly on quadratic html.parser; bound the scan by growth, not wall clock by @johnrtipton in #3674
• security: sanitise {% avatar src %} and sweep every URL parameter of djust's tags and components (#3665) by @johnrtipton in #3675
• deps: Bump smallvec from 1.16.3 to 1.16.4 by @dependabot[bot] in #3680
• test: stop a bound tenant leaking into later tests on the same worker by @johnrtipton in #3601
• deps: bump unicode-normalization from 0.1.25 to 0.1.26 by @dependabot[bot] in #3604
• deps: bump jsdom from 30.1.2 to 30.1.3 by @dependabot[bot] in #3605
• deps: Bump parking_lot from 0.12.5 to 0.13.0 by @dependabot[bot] in #3682
• deps: bump eslint from 10.12.0 to 10.13.0 by @dependabot[bot] in #3606
• deps: Bump uuid from 1.28.0 to 1.29.0 by @dependabot[bot] in #3683
• deps: Bump magic-string from 1.4.3 to 1.4.5 by @dependabot[bot] in #3681
• deps: Bump the vitest group across 1 directory with 3 updates by @dependabot[bot] in #3603
• build(deps): make daphne an optional extra, djust[daphne] by @johnrtipton in #3684
• feat(deprecation): warn that the JSX-style <Rust…/> template tags are removed in 2.0.0 by @johnrtipton in #3547
• feat(client): warn once when a client API removed in 2.0.0 is used by @johnrtipton in #3537
• feat(state): static_render views keep no diff baseline (#3626) by @johnrtipton in #3678
• test: execute every documented LiveView/LiveComponent snippet; inventory of documented examples that fail by @johnrtipton in #3652
• feat(deprecations): warn about everything djust 2.0 removes by @johnrtipton in #3535
• security: lock autobahn to the CVE-2026-116579 fix (26.10.2) by @johnrtipton in #3690
• docs: the 2.0 deprecations are "since 1.3", not 1.4 by @johnrtipton in #3693
• fix: address a slot's offloaded push frame to its view (#3692) by @johnrtipton in #3694
• fix: reset the worker-pool settings before every test (#3692) by @johnrtipton in #3695
• security: lock pyasn1 to 0.6.5 (CVE-2026-119194..119197) by @johnrtipton in #3696
• docs(roadmap): add the v1.3.0-15 drain bucket (14 open issues) by @johnrtipton in https://github.com/djust-org/djust/pull/3697
• fix(components): restrict TtydTerminalView ?url= to an allowed ws/wss origin (#3679) by @johnrtipton in https://github.com/djust-org/djust/pull/3698
• feat: audit and test DX — Y005/Y006, per-view query_budget, X105 named colours + X106 + style= (#3685, #3686, #3687) by @johnrtipton in https://github.com/djust-org/djust/pull/3702
• feat: page HTTP status from state (#3688) and declared URL params via params_form (#3689) by @johnrtipton in https://github.com/djust-org/djust/pull/3703
• fix: close the low-severity review leftovers from #3535, #3652 and #3678 (#3691) by @johnrtipton in https://github.com/djust-org/djust/pull/3704
• test: fix the timing races behind the four #3692/#3707 flakes (no framework bug found) by @johnrtipton in https://github.com/djust-org/djust/pull/3708
• test: judge the root-locator walk by growth, not a 1 s ceiling (#3710) by @johnrtipton in https://github.com/djust-org/djust/pull/3712
• docs(retro): milestone v1.3.0-15 + roadmap rows struck through by @johnrtipton in https://github.com/djust-org/djust/pull/3716
• docs(retro): record #3712 merged and main Tests green by @johnrtipton in https://github.com/djust-org/djust/pull/3717
• fix: ttyd ?rows/?cols parsing + clamp (#3699), doc-snippet network guard and per-match line counter (#3705) by @johnrtipton in https://github.com/djust-org/djust/pull/3719
• chore: shared gate-off harness and a non-gating PR-body lint (#3714, #3713) by @johnrtipton in https://github.com/djust-org/djust/pull/3720
• feat: V023 params_form check, test client drives handle_params, run-time query budgets (#3706, #3701) by @johnrtipton in https://github.com/djust-org/djust/pull/3722
• test: judge growth and ordering, not wall-clock bounds; ratchet them; report GC pauses (#3711, #3709, #3715) by @johnrtipton in https://github.com/djust-org/djust/pull/3721
• docs(roadmap): open v1.3.0-16 with nine follow-up issues by @johnrtipton in https://github.com/djust-org/djust/pull/3718
• test: unbreak main after #3721 and #3722 merged together by @johnrtipton in https://github.com/djust-org/djust/pull/3727
• test: stop two T017 tests leaking suppress_checks to the worker (#3728) by @johnrtipton in https://github.com/djust-org/djust/pull/3729
• test: wait for frames that arrive instead of draining with a short timeout (#3726) by @johnrtipton in https://github.com/djust-org/djust/pull/3732
• fix: an overriding get_context_data() runs once per GET (#3725) by @johnrtipton in https://github.com/djust-org/djust/pull/3730
• perf: linear _blank_template_comments and extract_template_variables (#3723, #3724) by @johnrtipton in https://github.com/djust-org/djust/pull/3731
• docs(retro): milestone v1.3.0-16, open v1.3.0-17, strike through delivered rows by @johnrtipton in https://github.com/djust-org/djust/pull/3736
• fix: ManualClock.sleep keeps the deadline it was asked for (#3451) by @johnrtipton in https://github.com/djust-org/djust/pull/3738
• docs(retro): milestone v1.3.0-17, strike through delivered rows by @johnrtipton in https://github.com/djust-org/djust/pull/3740
• docs: resolve #3739 — reviewer brief checks measured and causal claims by @johnrtipton in https://github.com/djust-org/djust/pull/3743
• docs: add the one-PR-at-a-time batch merge rule to the Pipeline block (#3735) by @johnrtipton in https://github.com/djust-org/djust/pull/3744
• docs(roadmap): add v1.3.0-18 (#3676, #3677, #3666, #3667) by @johnrtipton in https://github.com/djust-org/djust/pull/3745
• fix: native raw component tags refuse a bare operand like Django does (#3676) by @johnrtipton in https://github.com/djust-org/djust/pull/3746
• fix: djust_theming sanitises URLs with the djust_components allowlist (#3677) by @johnrtipton in https://github.com/djust-org/djust/pull/3747
• test: isolate the git environment of the URL sweep subprocess (red main on a54278e) by @johnrtipton in https://github.com/djust-org/djust/pull/3754
• security: bump pulldown-cmark to 0.13.6 (RUSTSEC-2026-0433) by @johnrtipton in https://github.com/djust-org/djust/pull/3752
• fix: native handlers take objects and refuse invalid input like the Python tags (#3666, #3667) by @johnrtipton in https://github.com/djust-org/djust/pull/3753
• test: delete the group the socket-mount test creates (red main on 384fabf) by @johnrtipton in https://github.com/djust-org/djust/pull/3758
• docs(retro): milestone v1.3.0-18, strike through delivered rows by @johnrtipton in https://github.com/djust-org/djust/pull/3759
• feat: DJUST_CONFIG["debug_panel"] turns the DEBUG debug panel off by @johnrtipton in https://github.com/djust-org/djust/pull/3760
• release: 1.3.0rc15 by @johnrtipton in https://github.com/djust-org/djust/pull/3761
• test: make merge-gates, and close the communicator-timeout ratchet's blind spots (#3757, #3737, #3709) by @johnrtipton in https://github.com/djust-org/djust/pull/3763
• test: fix two flaky tests (cap burst holds its slots; debug-panel file stops poisoning the static storage) by @johnrtipton in https://github.com/djust-org/djust/pull/3764
• security: judge the URL a theming template prints; strip leading controls in the Rust avatar (#3748, #3749) by @johnrtipton in https://github.com/djust-org/djust/pull/3765
• fix: a form crosses to the Rust engine as itself, json_viewer renders by type, ErrorList spells itself (#3755, #3756) by @johnrtipton in https://github.com/djust-org/djust/pull/3770
• test: make the URL-scheme sweep ~3.4x cheaper per cell and budget its size (main red on python-tests shard 2/4) by @johnrtipton in https://github.com/djust-org/djust/pull/3780
• test: fix two flakes that failed main's python-tests py3.14 shard 1/4 (#3715, #3756) by @johnrtipton in https://github.com/djust-org/djust/pull/3783
• security: a template that names a mutating callable no longer runs it in the queryset serializer (#3772) by @johnrtipton in https://github.com/djust-org/djust/pull/3776
• security: theme_icon validates size and builds its markup with format_html (#3766) by @johnrtipton in https://github.com/djust-org/djust/pull/3775
• security: the typed-args key is the engine's; an application context key of that name never reaches a handler (#3773) by @johnrtipton in https://github.com/djust-org/djust/pull/3784
• security: validate theme css_prefix at config load (#3779) by @johnrtipton in https://github.com/djust-org/djust/pull/3786
• fix: a QuerySet's related-manager .all renders its rows on a LiveView (#3777) by @johnrtipton in https://github.com/djust-org/djust/pull/3785
• chore: refresh .test_durations from CI run 41821512928 (main is red on the stale-durations gate) by @johnrtipton in https://github.com/djust-org/djust/pull/3792
• fix: theme_icon never raises on a long digit string under the pure-Python decimal (#3766) by @johnrtipton in https://github.com/djust-org/djust/pull/3793
• security: a tag rendered through the {% load %} bridge is held to the serialization floor (#3771) by @johnrtipton in https://github.com/djust-org/djust/pull/3789
• test: pin the handler-context builder set; stop a slow save flaking the ws_event benchmark (#3787, #3791) by @johnrtipton in https://github.com/djust-org/djust/pull/3795
• test: fix the CSRF-token flake (#3794), sweep rows other connections commit (#3782), widen the timeout ratchet (#3709), name the static-URL leak (#3751) by @johnrtipton in https://github.com/djust-org/djust/pull/3804
• chore(ci): merge_group support, path-scoped skips, hang dump, one URL sweep per run (#3800, #3781) by @johnrtipton in https://github.com/djust-org/djust/pull/3805
• fix: QuerySet .all follow-ups - nested QuerySets, chained methods, row cap (#3788) by @johnrtipton in https://github.com/djust-org/djust/pull/3803
• chore(ci): merge-queue diff hardening (union of two diffs), W14 pin, python-tests job timeout (#3800) by @johnrtipton in https://github.com/djust-org/djust/pull/3807
• security: a model form's values are held to the serialization floor under the native engine (#3790) by @johnrtipton in https://github.com/djust-org/djust/pull/3796
• test: the silent shard 3 was gh stopping at a 65 KB log line; fix the two flakes it hid (#3800) by @johnrtipton in https://github.com/djust-org/djust/pull/3808
• fix: pre-push attribution flake (grep -q vs printf under pipefail) + refresh .test_durations (#3810, #3781) by @johnrtipton in https://github.com/djust-org/djust/pull/3812
• security: rust.serialize_context holds render() and get* to the call guard and the serialization floor (#3778) by @johnrtipton in https://github.com/djust-org/djust/pull/3811
• security: a password-widget field's typed value is on the form floor, by widget type (#3798); a row's str documented as public text (#3806) by @johnrtipton in https://github.com/djust-org/djust/pull/3813
• security: pin pulldown-cmark >= 0.13.6 past RUSTSEC-2026-0414 and -0433 (#3741, #3742) by @johnrtipton in https://github.com/djust-org/djust/pull/3817
• docs: the merge queue ruleset and the gh run view --log truncation gotcha by @johnrtipton in https://github.com/djust-org/djust/pull/3822
• docs: what the first real merge-queue run confirmed by @johnrtipton in https://github.com/djust-org/djust/pull/3823
• security: audit of the 125 mark_safe sites outside theming (0 vulnerable in the flagged sinks), a checked baseline, and one attribute-name fix (#3774) by @johnrtipton in https://github.com/djust-org/djust/pull/3821
• fix: a form held as LiveView state reaches the template as the form, not as {name: widget HTML} (#3767) by @johnrtipton in https://github.com/djust-org/djust/pull/3825
• security: a PWA tag's resolved argument is data, not Django template source (#3824) by @johnrtipton in https://github.com/djust-org/djust/pull/3828
• perf+fix: password-name floor asked by name (#3816); serialize_context bounded against cycles (#3814) by @johnrtipton in https://github.com/djust-org/djust/pull/3826
• fix: a Django form's str() is asked for when a template reads it, not when it crosses (#3769) by @johnrtipton in https://github.com/djust-org/djust/pull/3829
• security: a POST key of any length costs linear work against the form floor (#3830) by @johnrtipton in https://github.com/djust-org/djust/pull/3833
• test: hygiene for #3831, #3832, #3827 (broadcast count, lazy-form deferral pins, RCDATA sweep payload) by @johnrtipton in https://github.com/djust-org/djust/pull/3836
• security: one passthrough-attribute policy (#3818) and an escaping contract for raw-markup slots (#3819) by @johnrtipton in https://github.com/djust-org/djust/pull/3839
• security: bound a form's submitted data over the socket, and filter form.data once (#3834) by @johnrtipton in https://github.com/djust-org/djust/pull/3837
• test: the broadcast count test must not getattr dunder names (fails on 3.13+) by @johnrtipton in https://github.com/djust-org/djust/pull/3840
• perf: weigh a form's stored data in bulk and exactly; count work instead of timing it (#3841, #3835) by @johnrtipton in https://github.com/djust-org/djust/pull/3842
• fix: native engine: a dict lazy= on live_render (#3838) and a tuple/UUID/Path in a component tag (#3768) by @johnrtipton in https://github.com/djust-org/djust/pull/3843
• test: mask the locale-spelled now() in the form-floor differential (main flake) by @johnrtipton in https://github.com/djust-org/djust/pull/3851
• fix: {% modal_description %} is located by a marker escaped text cannot spell by @johnrtipton in https://github.com/djust-org/djust/pull/3852
• security: teach the safe-markup guard flow, narrowing, the project's escapers and the wrapper sinks (#3820) by @johnrtipton in https://github.com/djust-org/djust/pull/3848
• test: count the characters _blank_html_comments examines instead of timing it (#3835) by @johnrtipton in https://github.com/djust-org/djust/pull/3855
• security: bound a form's stored data by member count, not only characters (#3844) by @johnrtipton in https://github.com/djust-org/djust/pull/3857
• chore: keep local pytest runs light and measure time per PR/issue by @johnrtipton in https://github.com/djust-org/djust/pull/3859
• fix: a namedtuple operand keeps its type through the native typed channel; a large tuple costs less counted work (#3849) by @johnrtipton in https://github.com/djust-org/djust/pull/3856
• fix(examples): five multi-line {# #} comments rendered as page text by @johnrtipton in https://github.com/djust-org/djust/pull/3853
• fix: log an unrebuildable namedtuple through log_failure (main is red on test_log_exposure_pin) by @johnrtipton in https://github.com/djust-org/djust/pull/3866
• security: wizard data limits are a total, remove_row asks the form-data bound, config.set validates the limits (#3858) by @johnrtipton in https://github.com/djust-org/djust/pull/3860
• fix: a loop and a QuerySet method on one .all, a row's count field in the codegen, a depth-bound warning (#3801) by @johnrtipton in https://github.com/djust-org/djust/pull/3863
• chore: pipeline templates target main, stop telling agents to run the whole suite, add versioned agent briefs by @johnrtipton in https://github.com/djust-org/djust/pull/3868
• security: the safe-markup guard checks where safe_url output lands in +, %, .format and built strings, and a class attribute's definition (#3850) by @johnrtipton in https://github.com/djust-org/djust/pull/3865
• feat: LIVEVIEW_CONFIG http_status_of_state project-wide default and V025 (#3706) by @johnrtipton in https://github.com/djust-org/djust/pull/3877
• fix: native handlers emit the dj-* event attributes the Python tag emits (#3669) by @johnrtipton in https://github.com/djust-org/djust/pull/3875
• security: {% include obj %} and the component tags no longer call a flagged render()/get_full_name() (#3815) by @johnrtipton in https://github.com/djust-org/djust/pull/3879
• security: a form floor field never renders its stored value, whatever widget the author chose (#3797) by @johnrtipton in https://github.com/djust-org/djust/pull/3876
• fix: remove_row exempts the fields a form adds in init; tests for the inline FK, the TOTAL_FORMS clamp and the kept-rows sidecar (#3861, #3867) by @johnrtipton in https://github.com/djust-org/djust/pull/3881
• fix: block-tag unresolved arguments, whitespace of resolved arguments, dict rows in the Python data_table (#3870 #3871 #3872) by @johnrtipton in https://github.com/djust-org/djust/pull/3884
• feat: self.server_push(), self.live_transport and tick_interval over SSE (#3809, slice 1) by @johnrtipton in https://github.com/djust-org/djust/pull/3886
• fix: the engine remembers a refused namedtuple shape; #3849/#3867 residuals measured and pinned by @johnrtipton in https://github.com/djust-org/djust/pull/3890
• feat: params_form_fallback = "fields" keeps the fields that validated (#3874) by @johnrtipton in https://github.com/djust-org/djust/pull/3889
• test: diagnose #3888 and pin the filtered-operand x relation-read boundary (no fix) by @johnrtipton in https://github.com/djust-org/djust/pull/3893
• fix: native data_table draws row_url navigation and link columns like the Python tag (#3887) by @johnrtipton in https://github.com/djust-org/djust/pull/3897
• security: the Python data_table checks and escapes a marked-safe row value in an attribute (#3894) by @johnrtipton in https://github.com/djust-org/djust/pull/3899
• security: marked-safe values are no longer exempt from the URL scheme check or attribute escaping (#3898) by @johnrtipton in https://github.com/djust-org/djust/pull/3903
• fix: a raw model crosses the engine boundary as a floored live handle (#3888) by @johnrtipton in https://github.com/djust-org/djust/pull/3901
• fix: a field named in dictsort's or regroup's argument is a read of each row (#3892) by @johnrtipton in https://github.com/djust-org/djust/pull/3916
• fix: a Component's hybrid template escapes and URL-checks its attribute slots like the Rust and custom paths (#3900) by @johnrtipton in https://github.com/djust-org/djust/pull/3915
• fix: params_form_fallback "fields" fills an unsupplied kept field's initial after clean(), as the valid path does (#3891) by @johnrtipton in https://github.com/djust-org/djust/pull/3921
• fix: child-view and other Django-engine renders refuse a flagged include render (#3880) by @johnrtipton in https://github.com/djust-org/djust/pull/3929
• fix: a marked-safe item value is escaped in every attribute a template tag writes it to (#3904) by @johnrtipton in https://github.com/djust-org/djust/pull/3930
• fix: textarea/title/comment text is escaped, and LiveComponent/BoundComponent inline templates get the attribute rule (#3913, #3914) by @johnrtipton in https://github.com/djust-org/djust/pull/3934
• fix: a top-level single model through DjustTemplateBackend is a floored live handle, like a list row (#3902) by @johnrtipton in https://github.com/djust-org/djust/pull/3937
• chore: batch gate-off with failure-text attribution, one full run per batch (#3905) by @johnrtipton in https://github.com/djust-org/djust/pull/3940
• test: reset the whole static-URL state before each test, and name the test that left it dirty (Refs #3751) by @johnrtipton in https://github.com/djust-org/djust/pull/3939
• fix: main-health: model-in-QueryDict copy refusal, SSE tick coverage, refreshed shard durations (#3917) by @johnrtipton in https://github.com/djust-org/djust/pull/3941
• fix: gate_off_batch leaves no orphaned children after a hang or a hard kill (#3905) by @johnrtipton in https://github.com/djust-org/djust/pull/3942
• fix: an option whose value contains &, <, >, or a quote is drawn as selected (#3927) by @johnrtipton in https://github.com/djust-org/djust/pull/3943
• fix: the JIT attribute gate applies the column-type floor like the serialization path by @johnrtipton in https://github.com/djust-org/djust/pull/3944
• deps: Update watchdog requirement from <7,>=3.0.0 to >=3.0.0,<8 by @dependabot[bot] in https://github.com/djust-org/djust/pull/3909
• deps: Bump eslint from 10.13.0 to 10.14.0 by @dependabot[bot] in https://github.com/djust-org/djust/pull/3908
• deps: Bump the vitest group with 6 updates by @dependabot[bot] in https://github.com/djust-org/djust/pull/3906
• deps: Bump eslint-plugin-security from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/djust-org/djust/pull/3907
• chore(deps): override minimatch to 11.x (GHSA-g3hv-75wg-m249) by @johnrtipton in https://github.com/djust-org/djust/pull/3950
• test: consolidate redundant coverage and render work by @johnrtipton in https://github.com/djust-org/djust/pull/3946

New Contributors

• @DYNOSuprovo made their first contribution in #3194
• @mayuriphad made their first contribution in #3461

Full Changelog: v1.2.1...v1.3.0