djust 1.0.0rc3

Pre-releaseReleased
GitHub releasePyPIUpgrade guide
Install
pip install djust==1.0.0rc3

This is a pre-release. djust 1.0.0 has shipped since: read the djust 1.0.0 release notes.

Before you upgrade, read the upgrade guide.

Added

  • scripts/check-doc-snippets.py gained a check_security_style() AST walker — doc examples are now linted for djust auto-reject triggers (#1509, completes part (c) of #1500). Every fenced Python code block in README.md / QUICKSTART.md is now also scanned for the security/style anti-patterns the djust PR-checklist auto-rejects: a print() call, a print(f"...") call, an interpolating mark_safe(f"..."), a bare except: pass, and f-string logging (logger.<level>(f"...")). Each is a hard failure (exit 1) — a published doc snippet should never teach a pattern the framework's own review forbids. @csrf_exempt is reported as a non-blocking WARNING (it is sometimes legitimate with a documented justification). A new <!-- doc-snippet-check: anti-pattern --> HTML-comment marker placed immediately before a fenced block opts that block out of the security/style verdict — for deliberately-wrong "don't do this" examples — while still subjecting it to the existing syntax and import checks. This completes part (c) of #1500 (doc-example security/style linting), which the original #1500 PR deferred. Covered by tests/test_check_doc_snippets.py — 28 tests.
  • scripts/AUDIT_TEMPLATE.md — fill-in-the-blank template for new scripts/check-*.py audits (#1515). Codifies the canonical audit-script shape — the run() / build_arg_parser() / main() skeleton, the exit-code convention, the four wiring points (.pre-commit-config.yaml, .github/workflows/test.yml, a make target, and scripts/README.md), and the test conventions — so the next audit script is fill-in-the-blank rather than reverse-engineered from an existing one. scripts/README.md now references it. Internal contributor tooling.
  • ARIA for the P2/P3 component library — built-in roles, states, and accessible names for progress, badge, tooltip, and avatar (#1513). Extends the framework-wide component ARIA work (1.0.0rc1, unit 4) to the P2/P3 component tier so these components are correct to assistive technology out of the box. progress gets role="progressbar" plus aria-valuenow / aria-valuemin / aria-valuemax. badge gets a visually-hidden status-text element for screen readers, with its decorative dot marked aria-hidden="true". tooltip gets role="tooltip" on the tip element and aria-describedby wiring it to its trigger. avatar marks its initials-fallback path with role="img" + an aria-label, and marks the decorative status span aria-hidden="true". A decorative-icon aria-hidden="true" sweep was also applied across the P2/P3 component templates. card was deliberately left unchanged — it is a generic container, and assigning it a role would be over-reach. All changes are additive — no class was renamed and no existing element removed or reparented, so downstream CSS/JS selectors are unaffected (mirroring the add-only guarantee of PR #1491); the only new element is badge's visually-hidden status <span> (a fresh sr-only class, not a selector target). Separately, 3 unlabeled form controls in examples/demo_project templates — Y003 defects surfaced by PR #1512's dogfood pass — were given proper labels. This completes a slice of #1496's accessibility long-tail; the remainder — keyboard-interaction JS and djust_audit a11y reporting — is deferred to follow-up issues. Component-markup guarantees covered by python/djust/components/tests/test_component_aria.py — 27 new tests.

Fixed

  • _create_tarball exclude-matching anchored — substring containment dropped legitimately-named files from deploy tarballs (#1505). python/djust/deploy_cli.py's _create_tarball matched every TARBALL_EXCLUDES entry via substring containment (pattern in name), so any file or directory whose name merely contained an exclude token was over-excluded — venv dropped venvironment.py, dist dropped distance.py, media dropped media_helper.py, and similar lookalikes. TARBALL_EXCLUDES is now split into five typed groups — EXCLUDE_DIR_NAMES, EXCLUDE_DIR_SUFFIXES, EXCLUDE_FILE_SUFFIXES, EXCLUDE_FILENAMES, and EXCLUDE_FILENAME_STEMS — and the directory/file filters use anchored matching (exact basename / path-segment / suffix / stem) instead of substring containment, so only genuinely-matching artifacts are dropped. Sensitive files remain excluded with no credential-leak regression: a naive switch to exact-filename matching would have started shipping .env.production, .env.local, and SQLite sidecar files into deploy tarballs, so EXCLUDE_FILENAME_STEMS applies a file == stem or file.startswith(stem + ".") or file.startswith(stem + "-") rule — .env, .env.production, .env.local, db.sqlite3, and its WAL/SHM sidecars (db.sqlite3-wal, db.sqlite3-shm, etc.) are all still excluded, while a lookalike like .environment is correctly not excluded. Regression coverage in the TestCreateTarball class (python/tests/test_deploy_cli.py) — 60 tests in the file.
  • 4 HTML-attribute regexes in checks.py re-anchored to stop false-matching data-* attributes (#1514). _ACCESSIBLE_NAME_ATTR_RE, _HREF_ATTR_RE, _IMG_HAS_ALT_RE, and _CONTROL_ID_RE used a bare \b word-boundary anchor before the attribute name. Because - is a non-word character, \b matches inside a data- prefix (between data- and the attribute name), so each regex false-matched data-* attributes — e.g. _IMG_HAS_ALT_RE treated <img data-alt=...> as having a real alt (a Y002 false negative on a genuinely alt-less image), and _HREF_ATTR_RE could treat <a data-href=...> as a real link (a Y001 false positive). All four are now anchored with (?<![\w-]), which rejects both word characters and hyphens immediately before the attribute name. This is the same fix PR #1512 applied to the Y003/Y004 regexes — the third occurrence of this \b/data-* defect class. Recurrence is guarded against by a new meta-check test, TestChecksRegexHardening in python/djust/tests/test_accessibility_checks.py, which introspects every compiled attribute regex in checks.py and fails on any bare-\b anchor; the four _LIVE_RENDER_* template-tag-kwarg regexes are allowlisted since they scan {% %} kwargs rather than HTML attributes (#1517). 8 new tests in python/djust/tests/test_accessibility_checks.py.

All releases · Atom feed