Comentario » 3.19.0 Maghera

Comments

Comentario 3.19.0 Maghera is released, bringing webhooks, an audit log, and a widget that is now fully accessible.

Comentario is a fast and powerful free comment server for web pages, written in Go.

You can follow relevant news in the Comentario blog or via RSS .

Enter AI

One thing worth mentioning here.

This version is the first developed with the extensive assistance of AI (Claude Code). All the generated code, though, is meticulously reviewed and corrected by me (still human). It often takes numerous iterations — planning, refining, re-planning, implementing and reimplementing — but all in all, I’m very positive about the results of this collaboration. It has immensely accelerated the development, allowing me to build much more feature-rich implementations without getting bogged down in the increasingly more complex internal machinery: just have a look at the sheer volume of changes since the last release.

What’s new

Toasts are now notices

The most visible change in the Administration UI is that toasts, the messages that popped up in a corner of the screen and faded away a few seconds later, have been replaced with notices (!38).

A notice shows up where it’s relevant: on the page it applies to, globally in the Control Center, or, for things that require your attention right away, in a modal dialog. Errors and warnings are scrolled into view, so they can’t go unnoticed, and a dismissed notice stays dismissed for that user.

Routine confirmations no longer need a message at all: a successfully completed action now briefly displays a tick on the button you’ve just clicked.

Notices also tell you when a new Comentario version is available, and the number of pending Control Center notices is shown on the User button in the navbar.

Webhooks

Comentario can now notify your own services of what’s happening on a domain via outbound webhooks (#152). Whenever a comment is created, updated, deleted, approved, or rejected, Comentario POSTs a JSON payload describing the event to a URL you nominate.

This turns Comentario into an event source for the rest of your stack: a new comment can land in a chat channel, kick off a static site rebuild, or feed a moderation queue of your own, all without polling the API.

Webhooks are registered per domain by its owner, via the new Webhooks button in the domain properties. Each webhook gets its own signing secret for verifying deliveries, and a test (ping) delivery tells you right away whether your endpoint is reachable and accepts what Comentario sends. Commenters’ personal data (email, IP address, and country) is never included in the payload.

Audit log

The new audit log records administrative and security-relevant actions on the instance: who signed in (or failed to), who changed domain settings, who moderated a comment, who banned a user, and so on.

The log is append-only, cleaned up automatically after the retention period, and a user’s personal data is scrubbed from it when their account is deleted, making it GDPR-compliant.

Its entries can also be filtered by multiple criteria, such as object type, action, outcome, used authentication method, correlation ID (an identifier used for grouping related entries, so it’s easy to connect a reported error with what happened on the server), and others.

Accessibility

Following up on the work done in 3.18.0, the embedded comments widget has seen further accessibility improvements, with the initial work contributed by Georgiana Frincu. All colour contrast issues are now resolved (#234), and the widget is built to meet WCAG 2.2 Level AA, which is automatically checked with axe in the end-to-end tests.

TLS and Unix socket listeners

Until now, Comentario only spoke plain HTTP, leaving TLS to a reverse proxy. It can now also listen on HTTPS directly, or on a Unix domain socket (#233), selected with the new scheme option:

comentario --scheme=unix --socket-path=/run/comentario/comentario.sock --socket-perms=0660

A socket is handy when the reverse proxy runs on the same host: no TCP port is occupied, and access is governed by file permissions. HTTPS is meant for setups with no TLS-terminating proxy at all; keep in mind the certificate is only read at startup.

Administration UI

New editors for domain and user attributes.
The Domain User Manager gained a role filter (#166).

Other changes

Only count approved, non-deleted comments on domain and page (#203)
Embed: fix race in live update resurrecting comments, or racing own comment changes
Admin UI: render checkmarks with translated screen-reader text
Admin UI: user properties: domain role list items now link to domain users rather than domains
Backend: fix domain SSO config verification; unify URL checks
Backend: allow EmailFrom to contain a non-ASCII name
Backend: more robust i18n; reset attribute caches on DB reset
Plugins: extend the (experimental) plugin API with audit, KV store, mailer, i18n, notices, confirmations, actor-aware events, and new plug locations
Helm: add schema for values, webhooks config; chart now officially carries the version 1.0.0
Docs: add audit log and WCAG compliance notes
E2e: embed API coverage, headless interactive SSO test
Toolchain/dependency updates (Go 1.27.2, Yarn 4.18). Comentario now requires at least Go 1.27 to compile.