djust 1.0.0rc11 Release Notes

Cross-origin dj-navigate / live_redirect / live_patch no longer throws SecurityError (#1599). Reported from production djust.org: clicking <a dj-navigate="https://djustlive.com/"> (or any cross-origin URL) crashed the JS runtime with Uncaught SecurityError: Failed to execute 'pushState' on 'History': A history state object with URL 'https://djustlive.com/' cannot be created in a document with origin 'https://djust.org'. Root cause: handleLiveRedirect() and handleLivePatch() in python/djust/static/djust/src/18-navigation.js both build newUrl = new URL(data.path, window.location.origin) — when data.path is an absolute URL, the URL() base argument is ignored, so newUrl becomes the cross-origin URL. The subsequent pushState then triggers the browser's same-origin policy (history API forbids cross-origin pushState). Fix: detect newUrl.origin !== window.location.origin BEFORE the pushState call in both handlers; on cross-origin, fall back to window.location.href = newUrl.toString() which performs a full-page navigation — the caller's intent — and avoids the crash. Preserves all same-origin behavior unchanged. _executePatch() (the dj-patch click handler) was incidentally safe because it builds newUrl from window.location.href and only overwrites pathname when patchValue starts with / — but a defense-in-depth grep for this pattern in nav-touching code is a candidate Stage 11 reviewer check (filed as candidate action-tracker rule). Covered by 3 new regression cases in tests/js/navigation.test.js under the issue #1599 — cross-origin pushState guard describe block: handleLiveRedirect with cross-origin path does NOT call pushState, handleLivePatch with cross-origin path does NOT call pushState, and same-origin paths still use pushState (regression backstop for guard breadth). Gate-the-fix-off self-test (Action #1200/#1468) passes: stripping both cross-origin guards from the source, exactly 2 of 24 navigation tests fail (the cross-origin cases) — the same-origin backstop + all 21 pre-existing tests continue to pass.

djust 1.0.0rc11

Fixed