Update and security notices

On this page

djust tells you, in one line, when a newer release is available or when the version you have installed has a published security advisory. It never prompts, never upgrades anything, and never blocks.

djust 1.2.1 is available (you have 1.1.3): uv pip install -U djust

SECURITY: djust 1.1.1 has 1 published advisory (GHSA-xjw9-38cr-6372): upgrade to 1.1.2 or later: uv pip install -U djust. https://github.com/djust-org/djust/security/advisories

Where it appears

Entry point	Behaviour
`djust new`, `djust init`	Checked before any work, with a 2-second cap. The hint is `uv tool upgrade djust` for a `uv tool` install, otherwise `uvx djust@latest`.
Development server start	Checked on a background thread; the line is logged on the `django.djust.updates` logger (warning for an advisory, info for a release), which Django's default logging shows on the console.
`manage.py check`	Reported as `djust.U001`: a warning for an advisory, an informational message for a release. The check reads the cached result and never fetches; only a running development server refreshes the cache.

What it sends

Two requests, carrying only User-Agent: djust/<installed version> and Accept: application/json:

https://pypi.org/pypi/djust/json for the latest release.
https://api.github.com/repos/djust-org/djust/security-advisories?state=published&per_page=100 for published advisories and their version ranges.

The result is cached for 24 hours in ~/.cache/djust/updates.json ($XDG_CACHE_HOME/djust, or %LOCALAPPDATA%\djust on Windows; override with DJUST_CACHE_DIR). A failed request is silent and not retried for an hour.

When it stays quiet

DEBUG = False (the dev server and manage.py check never check in production).
The CI environment variable is set.
Standard output is not a terminal (djust new and djust init).
The process is not a development server: manage.py migrate, check and other management commands never fetch.
Any network error, timeout, or unexpected response.
Under pytest.

Pre-releases are compared sensibly: a final release is never told about a pre-release, and a pre-release only hears about something higher.

Turning it off

In a project:

DJUST_CONFIG = {"update_check": False}

For the CLI, or everywhere:

export DJUST_NO_UPDATE_CHECK=1

To silence only the system check, add "djust.U001" to SILENCED_SYSTEM_CHECKS.