This release includes 1 security fix for security teams reviewing exposed deployments.
Published 2mo
Automation & Workflows
✓ No known CVEs patched
This release patches 1 known CVE
Topics
commenting
disqus
javascript
self-hosted
sqlite
Summary
AI summaryDrop support for Python 3.7/3.8 and fix stored XSS vulnerability.
Full changelog
New Features
- Add Catalan localisation (#966, welpo)
- Add Arabic localisation (#972)
- Add Galician localisation (ghose)
- Make
<code class="language-$lang">for syntax highlighting (#998, pkvach) - Add search for comments by URL in the admin interface (#1000, pkvach)
- Add CSS variables for better organization and flexibility (#1001, pkvach)
- Add support for comment search by Thread URL in admin interface (#1020, pkvach)
- Add sorting option for comments (#1005, pkvach)
- admin: Add log out button (#870, bbaovanc)
- Add support for environment variables in config (#1037, pkvach)
- Add Japanese localisation (#1051, zurukumo)
- Add Indonesian localisation (#1088, suhindra)
- Add Mistune as new Markdown rendering engine (#1079, ritzmann)
Breaking Changes
- Drop support for Python 3.7 (#974) and 3.8; add support for Python 3.13 and 3.14 (jelmer)
- Rework the Docker image tagging scheme:
isso:latestis now rebuilt on every push tomaster, whileisso:releasepoints to the latest stable release (#970, janw). Previously,:latestpointed to the latest stable (tagged) version - Disavow IE10 compatibility: (Not-so) recent changes mean that Isso is no longer compatible (#1022, ix5)
- The Markdown rendering engine Misaka has been deprecated. Please start using Mistune, see Migration from Misaka to Mistune for differences to Misaka.
- Migrate from
pkg_resourcestoimportlib.metadataandimportlib.resources(jelmer)
Security Fixes
- Fix stored XSS in website and author fields (jelmer)
Bugfixes & Improvements
- Changed website validation to allow domain names containing umlauts (#951, schneidr)
- Improve Spanish translation (#967, welpo)
- Make language code handling more robust (#983, ix5)
- Prevent auto creation of invalid links in comments (#995, pkvach)
- Fix W3C Validation issues (#999, pkvach)
- Handle deleted comments in Disqus migration (#994, pkvach)
- Fix total comments count calculation (#997, pkvach)
- Fix newline character handling in data-isso-* i18n strings (#992, pkvach)
- Add link logging for management of new comments in Stdout (#1016, pkvach)
- Change logging to include datetime and loglevel (#1023, ix5)
- Make 'text' field in 'comments' table NOT NULL and handling data migration (#1019, pkvach)
- Python 3.12 support (#1015, ix5)
- Disable Postbox submit button on click, enable after response (#993, pkvach)
- Document title parameter and improve error handling for /new API (#1058, pkvach)
- Set reply sorting to always be oldest (#1035, ggtylerr)
- Apply the same validations when editing comments as when creating them (#1038, Lucas Cimon)
- Fix
Offset.localTime()failing ifOffset.update()hasn't been called yet. - Fix 'Log Out' button behavior in admin interface.
Breaking Changes
- Drop support for Python 3.7 and 3.8; add support for Python 3.13 and 3.14
- Rework Docker image tagging: `isso:latest` now rebuilds on every master push, while `isso:release` points to the latest stable release
- Disavow IE10 compatibility – Isso is no longer compatible with Internet Explorer 10
- Deprecate Markdown rendering engine Misaka; migrate to Mistune (see Migration guide)
- Migrate from `pkg_resources` to `importlib.metadata` and `importlib.resources`
Security Fixes
- Fix stored XSS in website and author fields
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Isso
Lightweight commenting server written in Python and Javascript. It aims to be a drop-in replacement for Disqus.
Beta — feedback welcome: [email protected]