# CPalius CMF 1.0.0

**Released:** 2026-09-14 · **Channel:** stable · **Critical:** no

First stable release.

## Requirements

- **PHP** — 8.4 or newer
- **Extensions** — `ctype`, `fileinfo`, `iconv`, `pdo_mysql`, `mbstring`, `openssl`, and `gd` or `imagick`
- **Database** — MySQL 8.0+ or MariaDB 10.6+
- **Production cache** — Redis for the application cache and sessions, Memcached for the fragment cache

## Core

- Module system: `module.json` manifest, installer, capability registration, contribution declarations
- Role and capability based authorisation with Symfony Voter integration
- Notification infrastructure: type registry, channel abstraction, per-user preferences
- Global search: a single surface that modules join by registering a provider
- Cron: attribute-declared jobs (`#[CpCronJob]`), virtual and real crontab support
- Queue: Messenger-backed asynchronous job infrastructure
- Update hooks: version-tagged, run-once data migrations tracked in a ledger
- Backups, audit log, performance monitoring, origin HTML cache
- Multilingual content and interface, with translations editable from the database
- AACP administration panel: users, roles, modules, themes, settings, security centre, recovery console
- `cp:doctor` — diagnostics covering migration state, modules, capabilities, translations, environment and security posture

## Modules

- **Forum** — three-level section hierarchy, topics and posts, polls, attachments, prefixes, ranks, reputation, drafts, topic split and merge, inline moderation, ban and mute, moderation log, per-section permission matrix
- **Blog** — posts, categories, comments, portal blocks
- **Pages** — static pages
- **Media** — asset management, image processing, MIME allowlist
- **Menu** — menu configuration
- **Seo** — JSON-LD schema graph, per-source sitemaps, robots management, title formatting
- **Roadmap** — roadmap entries with portal and search integration
- **Whitepaper** — tree-structured document publishing
- **Widget** — sidebar components
- **Importer** — WordPress (WXR), Joomla, MyBB, XenForo and CSV imports, BBCode converter, paged and resumable transfer

## Security

- Upload directory hardening — a five-layer `.htaccess`: access denial, handler removal, engine off, CGI off, and a restrictive CSP
- CSRF protection, captcha, flood limiting
- Two-factor authentication
- Audit log and security centre
- A recovery console that stays reachable when the database or firewall fails (`AACP_RECOVERY_TOKEN`)

## Known limitations

- Production mode requires Redis and Memcached; a filesystem fallback is defined only for the `dev` and `test` environments.
- Forum search is `LIKE`-based; a full-text index is recommended for large datasets.
- Private messaging is not part of this release.