Release 1.3.0

Commentail 1.3.0

Stable · 22 October 2026

Install with python -m pip install commentail==1.3.0.

Changes

• Connect Google reCAPTCHA v2 checkbox or Yandex SmartCaptcha through Python settings. Arithmetic remains the default, and existing custom backends keep their interface. External checks require JavaScript, with a clear explanation and no fallback that bypasses the selected provider.
• Add hidden-field and server-owned form-age signals, guest attempt budgets before external verification/mail, adaptive or always-check CAPTCHA policy and private, translated moderator explanations. Fast submission is a review signal, not a forced wait or automatic rejection.
• Review repeated normalized guest text of at least 80 characters within one hour per Site, or three explicit HTTP(S)/www links. Both checks cover guest author revisions, retain the submitted text and have configurable thresholds. Short common replies and one or two links do not trigger the default checks.
• Keep independent forms valid across tabs, preserve draft age through recovery and navigation, and retain editable drafts during provider errors. External widgets show Retry check after errors instead of a routine Refresh task button.
• Keep the bundled external check's local binding valid for the form lifetime so writing does not spend its deadline before the widget is solved. Provider token expiry/single use remain enforced; no background renewal is added.
• Bound external response/token sizes, timeouts and endpoints, reject redirects and mismatched host claims, and reserve concurrent proofs without keeping the Site quota lock during network work. Retain rate events for configured windows longer than one hour so cleanup cannot reset their protection early.

Upgrade from 1.2.0

1. Rehearse on a restored test database with local mail. Back up the database, settings, templates, media, SECRET_KEY and exact installed dependency versions.
2. Install commentail==1.3.0, run migrate and check. Migrations 0016 and 0017 add proof state, server-owned form age and private comment/revision signal lists. Existing content and queued mail are retained.
3. Run collectstatic --noinput, refresh cached assets and restart application and background processes through your normal deployment procedure.
4. Compare overridden form/CAPTCHA templates with the installed versions. Keep CSRF, submission keys, challenge/answer fields and draft-age/provider hooks. Older forms that omit the honeypot still work but do not supply that signal.
5. Review the new guest protection settings for your traffic. Default short attempt budgets are shared per Site/session and IP; configure actual trusted proxies and account for shared networks. A zero duplicate window/link threshold disables that content check; a zero form-age threshold disables timing. Existing accepted-comment quotas remain active.
6. External providers are optional. To enable one, create matching site-owned keys, register actual domains and follow provider setup. Keep the secret in server settings. Review privacy disclosures and CSP, test real host/token verification and explain the JavaScript requirement to guests. The adaptive remembered-email exemption remains; strict mode checks every guest.
7. Verify guest/account submissions, errors and draft recovery, independent tabs, replies, email confirmation, moderation reasons and guest revisions on your actual templates/themes. Keep one background schedule and monitor its queue.

No dependency changes are required. Current SMTP/other Django mail backends and host task queues retain their contracts. Content fingerprints start with new accepted guest submissions; old comment bodies are not scanned or backfilled. These signals request review, not automatic deletion. Early rejection by hard word rules before email confirmation remains future work.

For an earlier starting version, also follow the intervening 1.2.0, 1.1.0, 1.0.0, 0.2.0 and 0.1.1 notes. See restoration guidance.

Verification boundaries

The unchanged runtime passed the complete local 30-combination matrix: 456 tests per combination, with only the SQLite-specific plan test skipped on PostgreSQL. All 49 JavaScript tests, translations, lint, migrations and package/example checks passed. Both external providers accepted real localhost proofs using disposable registrations, which were then deleted. Delayed submission was tested with a simulated 20-minute writing interval. These checks do not measure real-world spam reduction, provider availability, inbox delivery or the capacity of a deployed site. Exact-commit hosted CI and public-archive verification remain separate release gates.