Commentail 1.2.0

Commentail 1.2.0

Stable · 22 October 2026

Install with python -m pip install commentail==1.2.0.

Changes

• Use the configured Django EMAIL_BACKEND for guest verification and queued
  mail, including API-based backends. Non-SMTP backends no longer need SMTP
  settings. Configure the backend and its credentials in the host project.
• Schedule commentail.background.process_pending(mail_limit=100) through the
  project's existing task queue. The management command remains supported;
  choose one schedule. The database outbox still controls claims, retries,
  access checks and original link deadlines.
• Put reply cancellation beside Send comment as a quiet text action with a
  button surface on hover/focus. Compact the guest form, shorten the CAPTCHA
  field, place refresh beside it and clarify the email-confirmation hint.
  The submit button is emphasized using the host's text color.
• Reject oversized navigation/filter IDs, null bytes in comment text/names and
  guest email addresses longer than the stored field. Redact capability tokens
  from Django logs when the query parameter name is percent-encoded.
• Verify Wagtail 8.0.1 in the supported Wagtail 8 stacks. Update the test pins
  for certifi and Pillow to versions addressing the previous known advisories;
  these pins are not a production dependency lockfile for integrating sites.

Upgrade from 1.1.0

1. Rehearse on a restored test database. Keep mail local; back up the database,
   host settings, templates, media, SECRET_KEY and exact dependency versions.
2. Install commentail==1.2.0 or a verified release artifact in the test
   environment. No new Commentail migration is added over 1.1.0; framework
   upgrades may have their own migrations. Run migrate and check as usual.
3. Run collectstatic --noinput, refresh cached assets and restart application
   and background processes through your normal deployment procedure.
4. Compare overrides of commentail/form.html and commentail/captcha.html
   with the installed templates. Preserve form fields, CSRF, hidden keys and
   JavaScript hooks. Existing overrides keep precedence and need corresponding
   markup/CSS changes to adopt the new layout. Custom button fills need a
   contrasting text color; no site-specific CSS variables are required by default.
5. Existing SMTP plus the once-per-minute command needs no configuration change.
   For an API backend, follow its settings/timeout requirements. For a host queue,
   schedule process_pending() once per minute outside a database transaction
   and remove the separate command schedule. See email and scheduling.
6. Check signed-in and guest submissions, confirmation, moderation, replies,
   eligible edits, unsubscribe and queued mail. Test keyboard/no-JS forms and
   the actual light/dark themes. Monitor background failures and queue age.

Existing comments, settings, subscriptions, issued links and queued jobs are
retained. Protected-link deadlines are not extended. Backend acceptance does not
prove inbox delivery; an uncertain send can still be retried and duplicated.
Host proxy logs and error reporting must redact protected links independently.
See installation and restoration.

For an earlier starting version, also follow the intervening
1.1.0, 1.0.0, 0.2.0 and 0.1.1
notes as applicable.

Verification boundaries

The updated development runtime passed the local 30-combination matrix:
395 tests per combination, with one SQLite-only plan test skipped on each
PostgreSQL run. JavaScript, lint, translations, migration drift, source/wheel
archives and the runnable example passed. Real API mail and Redis/Celery
integration were checked separately; responsive/theme checks covered the new forms.
These are local results, not published-package or exact-commit hosted CI results.
Each integrating site must verify its own access rules, overrides and delivery.