akismet_antispam 1.1.0

Akismet 1.1.0 adds Drupal 12 support, a one-step upgrade from the older Akismet module, and a round of security and reliability fixes.

New

• Drupal 12 support. Comment, registration and contact form protection is tested on Drupal 12.0.0-beta1. On Drupal 12, Contact is the separate drupal/contact project. Webform, Contact Storage, Key, Honeypot, CAPTCHA and Antibot don't have Drupal 12 releases yet, so we haven't verified them there.
• Upgrade from the older Akismet module in place. Swap drupal/akismet for drupal/akismet_antispam and run database updates. Your API key, timeout and protection settings carry over, and the update prints a report of what it moved, changed or dropped. The switch is one way, so read the README's migration section first.
• Delete stored API key button. It shows up when a key in settings.php or the Key module overrides the one saved in configuration.

Fixes

• Akismet now receives the browser signals the module collects, which helps it catch bots.
• Comments posted while your Akismet subscription is suspended are held for review instead of published.
• A Key module provider that returns nothing (an unset environment variable, for example) no longer breaks every protected form.
• Deleting a user account also erases what they submitted under an earlier email address.
• Uninstalling the module no longer deletes Drupal's comment admin view after you've edited it in Views UI.
• New sites installed with Comment get the Akismet status column and bulk actions on the comment admin view.
• Spam and ham reports sent while Akismet is rate-limiting your site wait and retry later.
• A mistyped strictness, contact blocking level or timeout setting falls back to its default. Before, it could switch strict mode off or make requests wait forever.

Security

• The webhook address Akismet calls back, which carries your API key, now comes only from a trusted site address. A forged request can't redirect it.
• The webhook refuses repeated bad requests from the same address (50 an hour).
• The secret the module uses to hash email addresses moved out of exportable configuration, so drush cex no longer writes it to your repository.
• Usernames and passwords in the Site URL stay on your site instead of going to Akismet.
• Registration log entries record a hash instead of the person's email address.
• Views fields that show a moderator's spam verdict now require an Akismet permission.

Before you upgrade

• Run database updates (drush updb) after you update the code.
• If you manage configuration in code, delete hmac_key from akismet.settings.yml in your sync directory after updating, then re-export. Otherwise the next drush deploy puts it back. If that value was ever committed, treat it as exposed.
• If your site sits behind a proxy, load balancer or CDN, set reverse_proxy and reverse_proxy_addresses in settings.php. Then the webhook's limit applies to each caller instead of everyone at once.

Full list of changes: CHANGELOG.md