Skip to content

Isso

v0.14.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

commenting disqus javascript self-hosted sqlite

Summary

AI summary

Drop support for Python 3.7/3.8 and fix stored XSS vulnerability.

Full changelog

New Features

  • Add Catalan localisation (#966, welpo)
  • Add Arabic localisation (#972)
  • Add Galician localisation (ghose)
  • Make <code class="language-$lang"> for syntax highlighting (#998, pkvach)
  • Add search for comments by URL in the admin interface (#1000, pkvach)
  • Add CSS variables for better organization and flexibility (#1001, pkvach)
  • Add support for comment search by Thread URL in admin interface (#1020, pkvach)
  • Add sorting option for comments (#1005, pkvach)
  • admin: Add log out button (#870, bbaovanc)
  • Add support for environment variables in config (#1037, pkvach)
  • Add Japanese localisation (#1051, zurukumo)
  • Add Indonesian localisation (#1088, suhindra)
  • Add Mistune as new Markdown rendering engine (#1079, ritzmann)

Breaking Changes

  • Drop support for Python 3.7 (#974) and 3.8; add support for Python 3.13 and 3.14 (jelmer)
  • Rework the Docker image tagging scheme: isso:latest is now rebuilt on every push to master, while isso:release points to the latest stable release (#970, janw). Previously, :latest pointed to the latest stable (tagged) version
  • Disavow IE10 compatibility: (Not-so) recent changes mean that Isso is no longer compatible (#1022, ix5)
  • The Markdown rendering engine Misaka has been deprecated. Please start using Mistune, see Migration from Misaka to Mistune for differences to Misaka.
  • Migrate from pkg_resources to importlib.metadata and importlib.resources (jelmer)

Security Fixes

  • Fix stored XSS in website and author fields (jelmer)

Bugfixes & Improvements

  • Changed website validation to allow domain names containing umlauts (#951, schneidr)
  • Improve Spanish translation (#967, welpo)
  • Make language code handling more robust (#983, ix5)
  • Prevent auto creation of invalid links in comments (#995, pkvach)
  • Fix W3C Validation issues (#999, pkvach)
  • Handle deleted comments in Disqus migration (#994, pkvach)
  • Fix total comments count calculation (#997, pkvach)
  • Fix newline character handling in data-isso-* i18n strings (#992, pkvach)
  • Add link logging for management of new comments in Stdout (#1016, pkvach)
  • Change logging to include datetime and loglevel (#1023, ix5)
  • Make 'text' field in 'comments' table NOT NULL and handling data migration (#1019, pkvach)
  • Python 3.12 support (#1015, ix5)
  • Disable Postbox submit button on click, enable after response (#993, pkvach)
  • Document title parameter and improve error handling for /new API (#1058, pkvach)
  • Set reply sorting to always be oldest (#1035, ggtylerr)
  • Apply the same validations when editing comments as when creating them (#1038, Lucas Cimon)
  • Fix Offset.localTime() failing if Offset.update() hasn't been called yet.
  • Fix 'Log Out' button behavior in admin interface.

Breaking Changes

  • Drop support for Python 3.7 and 3.8; add support for Python 3.13 and 3.14
  • Rework Docker image tagging: `isso:latest` now rebuilds on every master push, while `isso:release` points to the latest stable release
  • Disavow IE10 compatibility – Isso is no longer compatible with Internet Explorer 10
  • Deprecate Markdown rendering engine Misaka; migrate to Mistune (see Migration guide)
  • Migrate from `pkg_resources` to `importlib.metadata` and `importlib.resources`

Security Fixes

  • Fix stored XSS in website and author fields

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Isso

Get notified when new releases ship.

Sign up free

About Isso

Lightweight commenting server written in Python and Javascript. It aims to be a drop-in replacement for Disqus.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]