umputun/remark42 v1.17.0

Version 1.17.0

on GitHub

Upgrade Notes

• every embed loses its 6px inset. If your page relied on that gutter, add it to the host container. The widget also stops reporting 24px of surplus iframe height #2151 @paskal
• for cross-domain Email, Telegram and anonymous sign-in, set AUTH_SEND_JWT_HEADER=true with ALLOWED_HOSTS on HTTPS. AUTH_SAME_SITE=none is not needed alongside it. This stores the token in a cookie JavaScript can read. Reloads work in the tested Chrome and Safari 27 configurations, including third-party cookie blocking; Firefox's "block all third-party cookies" still prevents persistence. OAuth providers remain unsupported across separate domains. See the setup and browser compatibility guide #2197 #2218 #2222 #2223 @paskal #2221 @umputun
• when Telegram authentication is enabled, Remark42 now fails startup if its Telegram update source cannot initialise #2228 @paskal
• collapsed-thread preferences reset once because the stored format changed #2188 @paskal
• linux armv7 binaries are no longer published. Docker images remain available for amd64 and arm64 #2120 @paskal
• darwin binaries require macOS 13 or later #2245
• building from source now requires Node 24 and Go 1.27. Run frontend commands from frontend/apps/remark42 #2168 #2178 #2197 @paskal #2245
• existing /web/*.js embed URLs remain supported by Remark42's file server. Installations serving /web directly through nginx or a CDN need .mjs URLs #2192 @umputun

Security Fixes

• messages from unrelated frames can no longer resize the widget, scroll the host page, open profiles, or change the widget's theme or sign-in state #2197 @paskal
• the fallback sign-in page no longer reflects its url query parameter into markup #2197 @paskal

New Features

• TELEGRAM_API_URL points Telegram authentication and notifications at a proxy or a self-hosted Bot API server. Use an origin with an optional base path, without the trailing /bot. The token travels in the request path, so use a host you control #2228 @paskal
• SMTP_HELO_HOST sets the SMTP HELO/EHLO hostname for relays that reject the default localhost greeting #2146 @damnms
• Swedish #2227 @dunderrrrrr and Hebrew #2229 @Bluetegu locales, plus corrections across existing catalogues and the Telegram paragraph in Japanese and Chinese #2177 #2187 @paskal

Improved

• Preact bindings replace the React compatibility and internationalisation dependencies. Runtime dependencies fall from 15 to 9, and compilation uses Babel alone #2175 #2176 #2178 @paskal
• the privacy page, markdown help and sample image are embedded in the binary and served under /web, including when absent from --web-root #2181 @paskal
• expanded browser tests cover authentication, comments, voting, profiles and cross-domain embedding over TLS #2180 #2196 #2214 #2225 #2226 #2232 #2233 #2234 #2239 #2243 #2215 @paskal
• the documentation site moved from Eleventy to Hugo #2179 @paskal

Bug Fixes

• the fallback page offered when embedded sign-in cannot work is restored, fixing its 404 #2197 @paskal
• abandoned OAuth popups stop polling, and repeated createInstance calls no longer stack listeners on a reused iframe #2197 @paskal
• the Telegram subscription panel refreshes expired tokens and displays errors #2228 @paskal
• concurrent migrations for the same site are rejected with 409, and failed uploads no longer leave temporary files behind #2231 @paskal
• exporting an unknown site returns 400 instead of 500 #2124 @paskal
• failed email notifications report errors for every failed recipient #2106 @paskal
• comment-tree pagination no longer drops a subtree that exactly fits the last page #2110 @paskal
• malformed cookies no longer abort API requests, empty XSRF-TOKEN cookies no longer produce headers that lighttpd rejects, and corrupt saved collapse data no longer strands the widget on its preloader #2226 #2193 @paskal
• closing the sign-in panel restores the correct iframe height #2213 @paskal
• host-page messages and clicks inside the Sign In dropdown no longer close it or discard input. The email subscription panel also has a Close button #2149 @paskal #2211 @yzxcj797
• collapsed threads restore after reload, edit deadlines account for clock skew, and the controversy tooltip is restored #2188 @paskal
• embedded /web/ pages use the configured REMARK_URL, fixing stock binaries that directed browsers to 127.0.0.1:8080 #2150 #2198 @paskal
• assets load correctly under URL prefixes, including when their URLs are already absolute #2197 #2224 @paskal
• loading placeholders in the host container are no longer mistaken for the comments iframe #2192 @umputun
• development bundles are served under /web/ again #2236 @Bluetegu

Planned for the Next Release

The expanded tests prepare for a frontend built without npm, with static HTML, CSS and JavaScript, stable class names and CSS customisation (#5). That simplification is planned work; it is not part of this release.