Version 1.18.0

Upgrade Notes

• with the bolt store, a session's site must exactly match a configured --site value, and login requests for unknown sites are rejected. Remote-store deployments keep accepting any site here, as the remote store decides which sites exist #2262 @paskal
• remark_config.__colors__ is deprecated in favour of custom_properties. It keeps working, and custom_properties wins when both set the same key #2253 @Bluetegu

Security Fixes

• the delete-me approval page could run a requesting user's markup in the admin's session, and the token in a delete-me link could be used to act as the requesting user. The page now renders the server's response and errors as text, and delete-me tokens are rejected as sessions. Site-scoped admin sessions can now process deletion tokens only for their own site #2262 @paskal
• the token in an email unsubscribe link could be used to sign in as that email address. Email login now accepts only the confirmation token it issued itself, and the token is no longer written to the log on login errors. go-pkgz/auth is at v2.3.1 #2265 @paskal

New Features

• remark_config.custom_properties overrides the widget's CSS custom properties from the embedding page. --font-family is the supported one, so the widget can match the host page's font #2253 @Bluetegu
• the reply form has its own placeholder, "Your reply here" in English. Other locales keep their comment placeholder until translated #2235 @Bluetegu
• Dutch #2252 @ftechmax and Icelandic #2254 @birgirsteinn locales, and corrections to the Italian one #2259 @AlexzanDev

Bug Fixes

• the demo, counter and last-comments pages under /web use the first configured site when served by the binary, as the docker image already did. On an instance not serving site remark they failed with "site not found" and opening them signed the reader out #2264 @paskal
• a 403 response no longer signs the reader out. The widget cleared its session on any 403, including one for another site on the same host. Sign-out now also completes when the server refuses the logout request #2264 @paskal
• /api/v1/last is cached per user. One reader's votes could be shown to others, and a voter kept seeing the state from before the vote #2263 @paskal
• an admin is recognised right after anonymous, email or Telegram sign-in, without a page reload #2260 @pkvach
• the email subscription token field uses dark theme colours in the dark theme #2255 @pkvach

Version 1.17.1

Bug Fixes

• pages with large comment threads were rebuilt on every request since 1.17.0. CACHE_MAX_VALUE defaulted to 65536 bytes and had never been enforced for the responses remark42 caches until lcw 2.1.0 started sizing byte slices, so any /api/v1/find response of 64 KiB or more stopped being cached; a page with 300 comments went from 4.6 ms to 200 ms. The default is now 0, unlimited per value, which is the behaviour every earlier release had in practice. CACHE_MAX_SIZE still caps the whole cache at 50 MB, and an explicit CACHE_MAX_VALUE keeps its value #2250 @paskal

Version 1.17.0

Upgrade Notes

• every embed loses its 6px inset. If your page relied on that gutter, add it to the host container. The widget also stops reporting 24px of surplus iframe height #2151 @paskal
• for cross-domain Email, Telegram and anonymous sign-in, set AUTH_SEND_JWT_HEADER=true with ALLOWED_HOSTS on HTTPS. AUTH_SAME_SITE=none is not needed alongside it. This stores the token in a cookie JavaScript can read. Reloads work in the tested Chrome and Safari 27 configurations, including third-party cookie blocking; Firefox's "block all third-party cookies" still prevents persistence. OAuth providers remain unsupported across separate domains. See the setup and browser compatibility guide #2197 #2218 #2222 #2223 @paskal #2221 @umputun
• when Telegram authentication is enabled, Remark42 now fails startup if its Telegram update source cannot initialise #2228 @paskal
• collapsed-thread preferences reset once because the stored format changed #2188 @paskal
• linux armv7 binaries are no longer published. Docker images remain available for amd64 and arm64 #2120 @paskal
• darwin binaries require macOS 13 or later #2245
• building from source now requires Node 24 and Go 1.27. Run frontend commands from frontend/apps/remark42 #2168 #2178 #2197 @paskal #2245
• existing /web/*.js embed URLs remain supported by Remark42's file server. Installations serving /web directly through nginx or a CDN need .mjs URLs #2192 @umputun

Security Fixes

• messages from unrelated frames can no longer resize the widget, scroll the host page, open profiles, or change the widget's theme or sign-in state #2197 @paskal
• the fallback sign-in page no longer reflects its url query parameter into markup #2197 @paskal

New Features

• TELEGRAM_API_URL points Telegram authentication and notifications at a proxy or a self-hosted Bot API server. Use an origin with an optional base path, without the trailing /bot. The token travels in the request path, so use a host you control #2228 @paskal
• SMTP_HELO_HOST sets the SMTP HELO/EHLO hostname for relays that reject the default localhost greeting #2146 @damnms
• Swedish #2227 @dunderrrrrr and Hebrew #2229 @Bluetegu locales, plus corrections across existing catalogues and the Telegram paragraph in Japanese and Chinese #2177 #2187 @paskal

Improved

• Preact bindings replace the React compatibility and internationalisation dependencies. Runtime dependencies fall from 15 to 9, and compilation uses Babel alone #2175 #2176 #2178 @paskal
• the privacy page, markdown help and sample image are embedded in the binary and served under /web, including when absent from --web-root #2181 @paskal
• expanded browser tests cover authentication, comments, voting, profiles and cross-domain embedding over TLS #2180 #2196 #2214 #2225 #2226 #2232 #2233 #2234 #2239 #2243 #2215 @paskal
• the documentation site moved from Eleventy to Hugo #2179 @paskal

Bug Fixes

• the fallback page offered when embedded sign-in cannot work is restored, fixing its 404 #2197 @paskal
• abandoned OAuth popups stop polling, and repeated createInstance calls no longer stack listeners on a reused iframe #2197 @paskal
• the Telegram subscription panel refreshes expired tokens and displays errors #2228 @paskal
• concurrent migrations for the same site are rejected with 409, and failed uploads no longer leave temporary files behind #2231 @paskal
• exporting an unknown site returns 400 instead of 500 #2124 @paskal
• failed email notifications report errors for every failed recipient #2106 @paskal
• comment-tree pagination no longer drops a subtree that exactly fits the last page #2110 @paskal
• malformed cookies no longer abort API requests, empty XSRF-TOKEN cookies no longer produce headers that lighttpd rejects, and corrupt saved collapse data no longer strands the widget on its preloader #2226 #2193 @paskal
• closing the sign-in panel restores the correct iframe height #2213 @paskal
• host-page messages and clicks inside the Sign In dropdown no longer close it or discard input. The email subscription panel also has a Close button #2149 @paskal #2211 @yzxcj797
• collapsed threads restore after reload, edit deadlines account for clock skew, and the controversy tooltip is restored #2188 @paskal
• embedded /web/ pages use the configured REMARK_URL, fixing stock binaries that directed browsers to 127.0.0.1:8080 #2150 #2198 @paskal
• assets load correctly under URL prefixes, including when their URLs are already absolute #2197 #2224 @paskal
• loading placeholders in the host container are no longer mistaken for the comments iframe #2192 @umputun
• development bundles are served under /web/ again #2236 @Bluetegu

Planned for the Next Release

The expanded tests prepare for a frontend built without npm, with static HTML, CSS and JavaScript, stable class names and CSS customisation (#5). That simplification is planned work; it is not part of this release.

Version 1.16.4

Bug Fixes

• white flash of the comments iframe on dark host pages #2127 @umputun

Fixes a regression from #2023 (shipped in v1.16.0), which set color-scheme on the iframe element to fix a Firefox dark-mode bug. The document inside the iframe got no color-scheme until its bundle ran, and a mismatch between the two makes the embedded canvas opaque instead of transparent, so it painted white. Underneath that, browsers paint a default surface for an iframe before its document is parsed at all, which WebKit renders white and Chromium hides behind paint holding.

The document now sets its color-scheme in an inline head script before first paint, and the iframe stays hidden until its document reports itself ready, with a timeout fallback.

Version 1.16.3

Bug Fixes

• comments iframe collapsing to preloader height on load #2126 @paskal

Fixes a regression from the dependency refresh in #2091 (shipped in v1.16.2), where the embed iframe was shrunk to the preloader height and then grown back step by step, showing a visible blink on every page load.

Version 1.16.2

Security

• Sanitise comment text in email notifications, blocking HTML/phishing injection that rendered attacker markup in notification emails - GHSA-74pc-3r2m-ppx3 #2093 @paskal, reported by @de3erve-hunter
• Add --trusted-proxy to gate client-IP forwarding headers, fixing a per-IP rate-limit bypass where spoofed X-Forwarded-For/X-Real-IP headers were trusted from any client - GHSA-56x6-q882-mf27 / CVE-2026-77463 #2116 #2118 @paskal, reported by @de3erve-hunter. Upgrading alone does not fix this. Behind a proxy, set --trusted-proxy to that proxy's network only, and configure the proxy to overwrite X-Real-IP with the real client IP and discard client-supplied forwarding headers. When Remark42 is exposed directly, set a non-matching value such as 127.0.0.1/32.

Improvements

• adopt go-pkgz/rest v1.22.0: CORS Vary + enforcing Timeout, drop local reimplementations #2105 @paskal
• replace go-chi/chi router with go-pkgz/routegroup #2103 @paskal
• replace go-chi/cors with go-pkgz/rest CORS #2102 @paskal
• use stdlib http.ServeMux instead of chi in cleanup_test #2101 @paskal
• consolidate request middlewares into middleware.go #2100 @paskal
• replace chi middleware.RealIP with rest.RealIP on the main router #2099 @paskal
• replace chi middleware.NoCache with rest.NoCache on the main router #2098 @paskal
• replace chi middleware.Timeout with the timeout helper, drop chi/middleware #2097 @paskal
• replace chi middleware.Throttle with rest.Throttle on the main router #2096 @paskal
• migrate ssl.go TLS routers from chi to routegroup #2095 @paskal
• update frontend and site dependencies to latest, bump pnpm to 10, clear audit alerts #2091 @paskal
• update backend dependencies to latest #2088 @paskal
• bump the github-actions-updates group across 1 directory with 4 updates #2092 @app/dependabot
• bump webpack-dev-server from 4.9.3 to 5.2.4 in /frontend #2063 @app/dependabot
• bump postcss from 8.4.14 to 8.5.10 in /frontend #2056 @app/dependabot

Bug Fixes

• surface real avatar-store errors on deleteme, tolerate only not-found #2113 @paskal
• remove user avatar on deleteme request #2104 @paskal
• make user deletion idempotent for users without comments 3fc5d6b
• ui error when no auth providers configured 406df02
• guard against falsy outputPath in eleventy htmlmin transform #2094 @paskal
• handle REST shutdown before server start 589e956

Version 1.16.1

Improvements

• rename auth.messsages.ts to auth.messages.ts #2079 @paskal
• close backtick in smtp.login_auth default cell #2075 @paskal
• bump remark42 image tag to v1.16.0 in kubernetes manual e8b9d70

Bug Fixes

• fetch latest site version client-side instead of embedding at build time #2072 @paskal
• no_footer scrollbar regression introduced in v1.16.0 #2076 @paskal
• parameter docs + --help text inconsistencies audit #2077 @paskal

Version 1.16.0

Security

• Reject non-image payloads in the image proxy and /picture/ to prevent stored XSS via content-type spoofing - GHSA-4c8j-mgm4-qqvp / CVE-2026-48788 #2067 @paskal, reported by @ildkh
• Fix IPv6 address truncation and image-proxy SSRF error leakage, and apply the SSRF-safe transport to the title extractor - GHSA-jjw2-g49p-rghx #2016 #2044 @umputun @paskal, reported by @srivarenya01

New Features

• custom oauth2 provider #2006 @alexma233
• make Microsoft Entra ID tenant configurable #1999 @paskal

Improvements

• build release artifacts with GoReleaser #2070 @umputun
• use testing/synctest to eliminate wall-clock sleeps #2048 @paskal
• use time.UTC in test fixtures to be timezone-agnostic #2047 @paskal
• modernise Go code with go fix #2027 @paskal
• add node dependency caching #2020 @paskal
• document loading placeholder support in remark42 div #2009 @paskal
• offer github private vulnerability reporting in security policy f3a7dea
• bump go modules in backend and example #2065 @paskal
• update Go modules #2042 @paskal

Bug Fixes

• reject decompression-bomb dimensions before raster decode #2064 @paskal
• close OAuth open-redirect by wiring AllowedRedirectHosts #2049 @paskal
• require explicit ?site= in matchSiteID middleware #2046 @paskal
• reject path traversal in /picture/{user}/{id} #2045 @paskal
• preserve orig verbatim in edit textarea #2041 @paskal
• Fix Firefox dark mode white background on comment iframe #2023 @amdevz
• Fix frontend not respecting ADMIN_EDIT config #2001 @paskal
• Fix email encoding, image cleanup CPU spin, and demo template paths #2000 @paskal
• Fix site rebuild on release #1993 @paskal
• fix type check failure in @remark42/api package ab9e667

Other

• Migrate remaining BEM components to CSS Modules (final batch) #2015 @paskal
• Migrate batch 1 components from BEM to CSS Modules #2014 @paskal
• Migrate 4 BEM components to CSS Modules #2013 @paskal
• Clean up deprecated CSS and fix silent CSS bugs in frontend #2012 @paskal
• Document EDIT_TIME=0 disables comment editing and image cleanup #2010 @paskal
• Add X-Content-Type-Options and Referrer-Policy security headers #2008 @paskal
• Drop GitHub token permissions on deploy jobs #2007 @paskal
• Sync example dependencies after go-modules-updates bump #2005 @app/copilot-swe-agent
• Document email template variables and plain-text email setup #2003 @paskal
• Clear user placeholder content when comments iframe loads #2002 @paskal
• Fix typo in Spanish localization for sort-by #2043 @aroman-arvo
• Probe /auth/status from frontend to avoid 401 on /user a4c5e17
• Update backend base image to buildgo-v1.17.0 in Dockerfile cdad560
• dependency bumps (dependabot): #2053 #2052 #2050 #2034 #2032 #2030 #2028 #1997 #1995 #1994 #1984

Version 1.15.0

What's Changed

New Features

• Discord OAuth support by @mgkbadola in #1824
• Add pagination to GET /api/v1/find endpoint by @paskal in #1699
• Implement function to prune string keeping HTML closing tags by @aliksend in #1870

Bug Fixes

• Fix login persistence with AUTH_SEND_JWT_HEADER enabled by @paskal in #1929
• Fix deleteme feature by @FredrikAppelros in #1923
• Fix WriteHeader + RenderJSON causing wrong Content-Type header by @paskal in #1980
• Toolbar buttons are stuck to the main comment form by @ur300 in #1948
• Straightforward fix for importing anonymous comments from commento by @aliksend in #1869
• Fix typo (rootDissapear should be rootDisappear) by @up9cloud in #1934
• Fixed typo by @talentedunicorn in #1936

New Translations

• Add Persian (fa) locale by @dnyall in #1831
• Add Macedonian translation by @diosfera in #1953
• Romanian language added by @notmalicik in #1962
• Update German (de.json) by @codiflow in #1875

UI Improvements

• Update Google and X (Twitter) logos to latest brand versions by @gatezh in #1969

Documentation

• Add system requirements section to installation guide by @paskal in #1914
• Add install instructions for setting up Remark42 as a systemd service by @paskal in #1918
• Improve backup instructions by @schnerring in #1947
• Update Telegram configuration with group notification details by @paskal in #1937
• Docs update describing available variables for webhook templating by @cubismod in #1878
• Add display name format to EMAIL_FROM examples by @paskal in #1973
• Update docker-compose.yml with example for local reverse proxy by @paskal in #1853
• Modify the example to avoid misunderstanding by @km0e in #1960

Infrastructure

• Migrate Docker images from Docker Hub to GitHub Container Registry by @paskal in #1907
• Migrate Docker builds to native GitHub ARM64 runners by @paskal in #1976
• Improve GitHub Actions workflows security and performance by @paskal in #1977
• Update to go-pkgz/auth/v2 and golang-jwt/jwt/v5 by @paskal in #1758
• Migrate golangci-lint to v2 and update Go version by @umputun in #1965
• Multiple improvements to CI by @paskal in #1846

Dependencies

• Bump golang.org/x/crypto from 0.37.0 to 0.45.0 by @dependabot in #1967
• Bump golang.org/x/net from 0.33.0 to 0.36.0 by @dependabot in #1912
• Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @dependabot in #1916
• Update go-pkgz, system modules by @paskal in #1930
• Update go dependencies by @paskal in #1972
• Get rid of github.com/go-chi/render use by @paskal in #1919

Internal

• Remove redundant frame ancestors log from middleware by @paskal in #1974
• Improve tests by @paskal in #1871
• Update pnpm from v7 to v8 by @paskal in #1845

New Contributors

• @dnyall made their first contribution in #1831
• @mgkbadola made their first contribution in #1824
• @aliksend made their first contribution in #1869
• @cubismod made their first contribution in #1878
• @up9cloud made their first contribution in #1934
• @talentedunicorn made their first contribution in #1936
• @diosfera made their first contribution in #1953
• @schnerring made their first contribution in #1947
• @notmalicik made their first contribution in #1962
• @km0e made their first contribution in #1960
• @FredrikAppelros made their first contribution in #1923

Full Changelog: v1.14.0...v1.15.0

Version 1.14.0

What's Changed

• Add Content-Security-Policy and Permissions-Policy headers by @paskal in #1805
• add RTL support by @adueck in #1799
• fix: Apple login integration by @tomy0000000 in #1806
• Fix problem with logout button by @paskal in #1815
• Fix restrictions for anonymous usernames by @paskal in #1809
• Add missing AUTH_APPLE_KID env variable cleanup by @paskal in #1826
• Detect proper avatar type to return instead of returning image/* by @paskal in #1817
• Switch playwright (e2e) to latest stable version by @paskal in #1802
• Update go modules by @paskal in #1801
• Move gcc installation before backend files addition by @paskal in #1814
• Bump path-to-regexp from 6.2.1 to 6.3.0 in /site by @dependabot in #1811
• docs: fix frontend paths in translation guide by @rusxg in #1807
• Bump micromatch from 4.0.5 to 4.0.8 in /site by @dependabot in #1808
• Fix CSP img-src directive to allow everything without proxy by @paskal in #1825
• Update docker-compose command to docker compose by @paskal in #1827
• Clarify ALLOWED_HOSTS description and usage by @paskal in #1829
• Deprecate Twitter OAuth and remove from feature list by @paskal in #1828
• fix: missing comma in example frontend configuration by @wtchangdm in #1830

New Contributors

• @adueck made their first contribution in #1799
• @rusxg made their first contribution in #1807
• @wtchangdm made their first contribution in #1830

Full Changelog: v1.13.1...v1.14.0