djust 1.0.0rc2 Release Notes

This is a pre-release. djust 1.0.0 has shipped since: read the djust 1.0.0 release notes.

Before you upgrade, read the upgrade guide.

Added

scripts/check-adr-status.py — ADR status/version-line consistency audit (#1501). A new pre-commit/CI gate that enforces an invariant the #1493 cleanup established: an ADR with **Status**: Accepted must record where it shipped via a **Shipped in**: vX.Y.Z line, not a forward-looking **Target version**: line (a Target version on an Accepted ADR is stale metadata — the ADR is no longer targeting, it has shipped). The script hard-fails (exit 1) on any Accepted ADR still carrying a Target version line, and emits a soft warning for the inverse drift (a Proposed/Draft ADR that already names a Shipped in version). Wired into .pre-commit-config.yaml (runs when any docs/adr/ file is staged), .github/workflows/test.yml, and a make check-adr-status target. Covered by tests/test_check_adr_status.py — 11 tests.
scripts/check-doc-snippets.py — doc-snippet smoke test + mechanically-derivable claim assertions (#1500). A new pre-commit/CI gate that AST/import-checks every fenced Python code block in README.md and QUICKSTART.md — catching malformed snippets (syntax errors) and phantom imports (an import of a name djust does not export) before they reach a reader. It also asserts two mechanically-derivable doc claims against their source of truth: the Django minimum-version claim is checked against pyproject.toml, and the JS client-bundle-size claim is checked against the actual bundle (±3 KB tolerance). Wired into .pre-commit-config.yaml, .github/workflows/test.yml, and a make check-doc-snippets target. Covered by tests/test_check_doc_snippets.py — 14 tests. (Doc-example security/style linting is deferred to a follow-up issue.)
scripts/check-lockfile-versions.py — lockfile self-entry version audit (#1498, closes #1487). A new pre-commit/CI gate that asserts the djust self-entry recorded inside Cargo.lock and uv.lock matches the version declared in the corresponding manifest (Cargo.toml / pyproject.toml). A stale lockfile self-entry is a silent class of release bug — the manifest bumps but the lockfile keeps the old version, so a fresh resolve installs a mismatched package metadata version. Wired into the make version, make release, and make version-check targets, .github/workflows/test.yml, a .pre-commit-config.yaml hook (runs when a lockfile or manifest is staged), and documented in RELEASING.md. Covered by tests/test_check_lockfile_versions.py — 6 tests.
Two mandatory:false Stage-4 plan-template rules added to .pipeline-templates/feature-state.json + bugfix-state.json (#1502). Plan authors are now prompted to describe ARIA intent rather than pinning specific role values, and to grep constraint tables before labeling dependencies — both internal contributor-process guidance.
Two new Y accessibility system checks — Y003 / Y004 (#1496). Extends the Y category (a11Y) shipped in 1.0.0rc1 with two more regex template-scan checks. Y003 flags an <input> / <select> / <textarea> form control with no associated label (WCAG 1.3.1 / 3.3.2, Level A) — a control counts as labelled by a <label for>, a wrapping <label>, an aria-label, or an aria-labelledby; hidden/submit/button/reset/image input types are skipped, and controls with dynamically-injected ({% %} / {{ }}) attributes are treated conservatively as "label may be present" and not flagged (a data-type attribute is not mistaken for the input type). Y004 flags a positive tabindex value — a WCAG 2.4.3 focus-order anti-pattern; tabindex="0" / tabindex="-1" and interpolated values are valid and not flagged (a data-tabindex attribute is not mistaken for tabindex). Both emit a DjustWarning (never an error) and are suppressible via DJUST_CONFIG['suppress_checks'] or SILENCED_SYSTEM_CHECKS. Implemented in python/djust/checks.py; covered by the TestY003CheckIntegration and TestY004CheckIntegration classes in python/djust/tests/test_accessibility_checks.py — 26 tests.

Fixed

12 ADRs' stale Target version metadata corrected to match reconciled Status (#1493). ADRs docs/adr/002–008 and 013–017 carried **Target version**: lines that no longer matched their reconciled **Status**: lines. Accepted ADRs that have shipped were relabelled **Shipped in**: vX.Y.Z; deferred ADRs were marked post-1.0 (deferred). The metadata now accurately reflects each ADR's lifecycle state — Accepted ADRs name where they landed, deferred ADRs are no longer mislabelled as targeting a near-term version. The new scripts/check-adr-status.py audit (see Added) prevents this drift class from recurring.
Orphaned TARBALL_EXCLUDES constant wired into _create_tarball — CodeQL #2330 py/unused-global-variable (#1495). python/djust/deploy_cli.py defined a TARBALL_EXCLUDES constant with a # Default patterns to exclude from tarball comment, but _create_tarball ignored it and hardcoded two separate inline pattern lists — leaving the constant with zero call sites. The constant is now the single source of truth, consulted for both the directory filter and the file filter. Its glob-prefixed entries (*.pyc, *.pyo, *.egg-info, *.log) were normalized to substring form (the function matches by in, not glob — a leading * would never match). This is an intended behavior change: deploy tarballs created by _create_tarball now also exclude .hg and .svn directories, logs/, media/, and staticfiles/ directories, and .log files (the old inline *.log entry never matched, due to the literal *, so .log files were silently shipped before). Nothing previously excluded becomes included. These are build/runtime artifacts (SCM metadata, collectstatic output, user uploads, runtime logs) that should be regenerated server-side rather than shipped in a source deploy tarball. Regression coverage in the new TestCreateTarball class (python/tests/test_deploy_cli.py) — 3 tests, all of which fail if the constant wiring is reverted.
Empty except: pass in check_psycopg3_for_pg_notify documented — CodeQL #2334 py/empty-except (#1495). A bare except Exception: pass in python/djust/checks.py (the psycopg2 __version__ read guard) was the only pass-only except in the file lacking an explanatory comment. It is now replaced with an explicit psycopg2_version = "" fallback assignment plus a comment explaining the guard: getattr already supplies a "" default, so the block only fires on a pathological __version__ descriptor, and psycopg2_version keeping its "" ("version unknown") value is the correct, intentional fallback. No behavior change.
README roadmap reconciliation — 2 stale checkboxes flipped + a broken register_component example corrected (#1497). The README roadmap had two unchecked items — Redis-backed session storage and horizontal scaling — that both shipped via RedisStateBackend; their checkboxes are now ticked. A register_component example snippet was also broken: it imported from the wrong package and used a Component base class that register_component rejects. The snippet is corrected to import and subclass LiveComponent (execution-verified). docs/roadmap.md carried no mechanical rot and is left unchanged.
Stale djust self-entry in uv.lock corrected 0.9.7 → 1.0.0rc1 (#1498, #1487). The uv.lock djust package self-entry still recorded 0.9.7 after the pyproject.toml bump to 1.0.0rc1, so a fresh resolve installed mismatched package metadata. The new scripts/check-lockfile-versions.py audit (see Added) prevents this drift class from recurring.

All releases · Atom feed