CPalius CMF 2.2.44

Released: 2026-10-12 · Channel: stable · Critical: no

Cookie consent: categories and Google Consent Mode v2#

• The cookie banner now offers three categories: Necessary (always on), Analytics and Marketing, with a Preferences panel and a "Save choices" button. The older Accept and Only essential buttons still work and old consent cookies stay valid.
• New {{ cp_consent_mode() }} Twig function (already added to the Default and Githeme theme heads): analytics, ad storage and ad personalization start as denied and are restored from the visitor's cookie. When the visitor chooses, gtag('consent', 'update') is sent.
• Scripts written as <script type="text/plain" data-cp-consent="analytics"> start only when their category is granted. A link or button with data-cp-consent-open re-opens the preferences.
• AACP → Settings → Cookie consent: switch Consent Mode on or off, hide the Analytics or Marketing category, and edit every text per language. Still off by default.

404 log#

• Static files (images, CSS, JS, fonts), scanner paths (wp-login.php, .env, phpmyadmin, ...) and crawlers or empty user agents are no longer counted.
• Each row now has a target field and a Create 301 button: it creates the redirect, and the row leaves the list. When a published page has the same slug as the missing address, its address is filled in for you.

Menus#

• A menu can be assigned to a location (Main header, Footer, plus any location a theme declares under menu_locations in theme.json or a module registers with the cpalius.menu_location tag). Pick it when creating or editing a menu.
• {{ cp_menu_location('main_header') }} prints the assigned menu, with each item's rel, target, icon and CSS class. {{ cp_menu_location_items('main_header') }} returns the item tree for themes with their own markup.

Speed#

• AACP and the site no longer fetch icons from api.iconify.design while pages render. The icons used by the panel ship in assets/icons/; a missing icon is drawn empty instead of breaking the page. The panel also no longer loads scripts from a CDN in hot-reload mode.
• Thumbnails (cp_thumb): one page request now spends at most 300 ms creating new thumbnails and skips images that would not fit in memory_limit. The remaining images show their originals and finish on later visits, instead of one page stalling for seconds. A small source image is no longer enlarged to the requested size.
• Module activation on servers that cannot release a response early (Apache mod_fcgid, e.g. Laragon): the safety check (compile and YAML lint, Manifesto Law 2.2) runs in a background process, so the click returns at once and the module appears active a few seconds later. A failed check still quarantines the module. After a module is switched on or off on such servers, the new container is built in the background and swapped in when ready. Servers on PHP-FPM keep the previous behaviour.
• The Performance card shows a warning when PHP's OPcache is full (a full cache silently makes every request recompile all PHP).
• Deprecation notices from the admin menu registration are gone.

AI module#

• Choose the AI service for translations: OpenRouter, Groq, Cerebras, Gemini and Mistral (free tiers), DeepSeek, Qwen, ChatGPT, Claude and Grok (paid), or your own OpenAI-compatible server. Every service keeps its own API key and model, so switching never deletes the others; keys stay encrypted on the server. A failed AI answer falls back to the free translation, and the service's own error message is shown when a connection test fails.

Database#

Menu module: one new nullable column, cp_menu_menus.location, added by the module migration on update. Clear cp-core/var/cache/prod/ after updating, and the Redis cache if you use one.