djust 0.2.1 Release Notes

Security

WebSocket Event Security Hardening - Three-layer defense for WebSocket event dispatch: (#104)
- Event name guard — regex pattern filter (^[a-z][a-z0-9_]*$) blocks private methods, dunders, and malformed names before getattr()
- @event_handler decorator allowlist — only methods decorated with @event_handler (or listed in _allowed_events) are callable via WebSocket. Configurable via event_security setting ("strict" default, "warn", "open")
- Server-side rate limiting — per-connection token bucket algorithm with configurable rate/burst. Per-handler @rate_limit decorator for expensive operations. Automatic disconnect after repeated violations (close code 4429)
- Per-IP connection limit — process-level IPConnectionTracker enforces a maximum number of concurrent WebSocket connections per IP (default: 10) and a reconnection cooldown after rate-limit disconnects (default: 5 seconds). Configurable via max_connections_per_ip and reconnect_cooldown in rate_limit settings. Supports X-Forwarded-For header for proxied deployments. (#108, #121)
- Message size limit — 64KB default (max_message_size setting)

Added migration guide for @event_handler decorator requirement and strict mode upgrade path (#105, #122)
Added @event_handler decorator to all example demo view handler methods

is_event_handler(func) — check if a function is decorated with @event_handler
@rate_limit(rate, burst) — per-handler server-side rate limiting decorator
_allowed_events class attribute — escape hatch for bulk allowlisting without decorating each method
LIVEVIEW_CONFIG settings: event_security, rate_limit (including max_connections_per_ip, reconnect_cooldown), max_message_size