CPalius CMF 1.0.0

Released: 2026-09-14 · Channel: stable · Critical: no

First stable release.

Requirements

PHP — 8.4 or newer
Extensions — ctype, fileinfo, iconv, pdo_mysql, mbstring, openssl, and gd or imagick
Database — MySQL 8.0+ or MariaDB 10.6+
Production cache — Redis for the application cache and sessions, Memcached for the fragment cache

Module system: module.json manifest, installer, capability registration, contribution declarations
Role and capability based authorisation with Symfony Voter integration
Notification infrastructure: type registry, channel abstraction, per-user preferences
Global search: a single surface that modules join by registering a provider
Cron: attribute-declared jobs (#[CpCronJob]), virtual and real crontab support
Queue: Messenger-backed asynchronous job infrastructure
Update hooks: version-tagged, run-once data migrations tracked in a ledger
Backups, audit log, performance monitoring, origin HTML cache
Multilingual content and interface, with translations editable from the database
AACP administration panel: users, roles, modules, themes, settings, security centre, recovery console
cp:doctor — diagnostics covering migration state, modules, capabilities, translations, environment and security posture

Forum — three-level section hierarchy, topics and posts, polls, attachments, prefixes, ranks, reputation, drafts, topic split and merge, inline moderation, ban and mute, moderation log, per-section permission matrix
Blog — posts, categories, comments, portal blocks
Pages — static pages
Media — asset management, image processing, MIME allowlist
Menu — menu configuration
Seo — JSON-LD schema graph, per-source sitemaps, robots management, title formatting
Roadmap — roadmap entries with portal and search integration
Whitepaper — tree-structured document publishing
Widget — sidebar components
Importer — WordPress (WXR), Joomla, MyBB, XenForo and CSV imports, BBCode converter, paged and resumable transfer

Upload directory hardening — a five-layer .htaccess: access denial, handler removal, engine off, CGI off, and a restrictive CSP
CSRF protection, captcha, flood limiting
Two-factor authentication
Audit log and security centre
A recovery console that stays reachable when the database or firewall fails (AACP_RECOVERY_TOKEN)

Production mode requires Redis and Memcached; a filesystem fallback is defined only for the dev and test environments.
Forum search is LIKE-based; a full-text index is recommended for large datasets.
Private messaging is not part of this release.