Changelog — Pure Comments Docs

Unreleased

Added lines to .htaccess that prevents public access to the db and backup folders.

1.7.4 - 15 September 2026

Fixed

Fixed an issue where attached images in Fediverse comments and Webmentions (such as u-photo entry attachments or JSON-LD media) were omitted and stripped during HTML sanitisation.

1.7.3 - 11 September 2026

Added

Added DoS throttling protection for moderation notification emails, ensuring that surges of incoming comments or Webmentions within a 5-minute window only trigger a single notification email.

Changed

Boosts and likes are now hidden by default on the administration dashboard to reduce clutter, with a rocker switch toggle added below the search box to view them on demand.

Fixed

Fixed an issue where author replies published to the Fediverse via Bridgy were backfed via Webmentions and created duplicate loopback comments. Incoming Webmentions originating from the configured author Fediverse profile or site domain are now automatically identified and filtered out.

1.7.2 - 08 September 2026

Fixed

Fixed Fediverse reply mentions in the administration panel so replies extract and target the author’s full @username@instance handle from their profile URL instead of prepending @ to display names.
Fixed Fediverse conversation threading for published author replies by translating Bridgy comment URLs into canonical Fediverse status URLs in comment.php, ensuring replies correctly attach to live threads.
Resolved author reply Webmention source URLs via post_base_url and added <link rel="me"> author discovery links in comment.php.

1.7.1 - 08 September 2026

Fixed

Fixed an issue where Webmentions targeting a site’s root homepage URL were incorrectly attributed to the most recently commented post slug instead of resolving to home.
Fixed an issue in the in-app updater where root files introduced in newer versions (such as comment.php) were not tracked in the core file list and were therefore omitted during updates.

Changed

Improved input field and textarea spacing in the embedded comment form.
Refined avatar rendering for reaction facepiles.

v1.7.0 - 07 September 2026

Added

Webmentions & Fediverse backfeed support: Pure Comments can now receive and display Webmentions from IndieWeb blogs as well as backfeed replies, likes, and boosts from the Fediverse via Bridgy.
Reaction facepiles: Likes and boosts are aggregated and displayed as compact avatar facepiles above the comments section, with singular/plural count formatting.
Webmention author replies: Author replies submitted via the administration panel generate IndieWeb-compatible h-entry permalinks for Webmention replies.
Webmention settings & moderation controls: Added configuration options to enable Webmentions, specify your personal Fediverse profile URL for <link rel="me"> discovery, and toggle auto-approval separately for reactions and text replies.
Documentation: Added a detailed guide on Webmentions & Fediverse integration.

Changed

Non-textual reactions in the administration panel now display an informative notice rather than an empty placeholder, and the reply form is automatically disabled for likes and boosts.
Simplified reply button verbiage and standardised translation keys across all supported languages (English, German, French, Italian, Romanian).

v1.6.7 - 27 July 2026

Changed

Migrated the in-app updater check endpoint to pull release metadata from packages.purecommons.org/comments/latest.json instead of the GitHub Releases API.
Added a 🎉 New Version Available status header above the release metadata in the updates panel.

v1.6.6 - 19 July 2026

Changed

Moved back to GitHub for repo hosting.
Localised the PHP timezone and date format documentation links in the setup and settings forms, allowing both the link text and URLs to be translated (thanks @citizenk for reporting this in issue #10).

Added

Updated Italian translations, completing missing localisation strings (thanks @citizenk for #6) and #9.
Added French translations (thanks @citizenk for #8).

v1.6.5 - 07 July 2026

Changed

Updated the license to version 1.1 to restrict only commercial hosting for a fee, while explicitly permitting free hosting for friends and family.

Added

Updated Romanian translations, completing previously missing localisation strings (thanks @ThinkRoot for #5).

v1.6.4 - 04 July 2026

Fixed

Fixed translation issues in the embed widget where the comments title, load button, and loading indicator were stuck in English. Timestamps are also now dynamically localized using client-side Intl formatting (thanks @Ted11 for #4).

v1.6.3 - 29 June 2026

Fixed

Fixed an issue where the pending comments list in the admin panel incorrectly excluded comments from guests who submitted a comment with a name matching the admin author’s name (thanks @daj for #3).

v1.6.2 - 26 June 2026

Security

Secured the “Remember me” cookie mechanism by replacing the static HMAC token with random, database-backed tokens stored in a new remember_tokens table. Tokens are now invalidated on the server when logging out.

Fixed

Fixed an Undefined array key "smtp_debug" PHP notice when saving configurations with Amazon SES or no email provider selected.

v1.6.1 - 13 June 2026

Updated

German translations for search (thanks @bttr for #2)

v1.6.0 - 27 May 2026

Added

Pure Comments logo now appears on all admin pages (dashboard, settings, updates, login).
Search box on the dashboard to search comments by name or content (search terms are preserved when paginating through results).

Changed

Admin page headers and links are now themed red to match the Pure Comments brand colour.
Replaced emoji favicon with the Pure Comments logo.

v1.5.2 - 09 May 2026

Pure Comments has moved from GitHub to GitHub. The update checker now fetches release information from GitHub, and all relevant links have been updated accordingly.

Upgrade notice - This release restructures the in-app updater so a manual update is required.

Manual upgrade steps

Back up your site — download a copy of your entire Pure Comments directory before proceeding.
Download the v1.5.2 release zip from the GitHub releases page and extract it.
Delete everything EXCEPT for the db/ directory and the config.php file.
Copy the new files to your existing installation, replacing everything except your db/ directory and config.php file.

v1.5.1 - 04 May 2026

Updated license to v1.1: commercial self-use is now explicitly permitted.
Added Italian translation (thanks Elena Brescacin)

1.5.0 - 25 April 2026

New features

“Remember me” checkbox on the login page; sets a 90-day persistent cookie so the browser session survives a restart.
Filter by post - each comment row in the dashboard now has a “Filter by this post” link that scopes both pending and published lists to that post.
Filter by commenter - each comment row has a “Filter by this commenter” link; filters by email if the commenter provided one, otherwise by name.

Note: Translations for new strings were done by an AI, so will likely need a human review.

Improvements

Enhanced German translation (thanks werschreibt).

1.4.1 - 21 April 2026

Fixed incorrect email encoding for UTF-8 characters (e.g. umlauts) in SMTP notifications (fixes #2)
Added SMTP debug logging toggle to settings — displays the full SMTP conversation log in the admin UI when sending a test email (fixes #4)
Fixed updater not replacing the lang/ directory when upgrading — lang files will now be updated correctly from this version onwards

⚠️ One-off manual step for anyone upgrading to v1.4.1: the updater could not replace your lang files during this upgrade, so you will need to manually copy the lang/ directory from the release zip to your installation.

1.4.0 - 14 April 2026

Added translation support. Currently has English (en.php) and German (de.php). German translations were created by AI, so please submit a PR if updates are required. Read the docs.

⚠️⚠️⚠️⚠️ IMPORTANT NOTE AFTER UPDATING: Your site will produce a 500 error after updating. This is expected behaviour. It's because the current updater doesn't expect the /lang directory, so it won't copy the language files over during the update.

To fix this you have to manually copy the /lang directory to the root of your comments install. This is a one off action. Future updates will be fine.

1.3.2 — 21 March 2026

Fixed

The privacy policy URL field in settings is now optional. If left blank, the privacy link is hidden from the comment form entirely.

1.3.1 — 6 March 2026

Added

Rate limiting for comment submissions.

Fixed

Prevented unauthorised database downloads; emails are now encrypted at rest.

1.3.0 — 6 March 2026

Added

SMTP support for comment notification emails, with a test mail option in settings.