# CPalius CMF 2.1.1

**Released:** 2026-09-21 · **Channel:** stable · **Critical:** no

Turkish: [2.1.1-tr.md](2.1.1-tr.md)

This release is about what the board shows to people who have not signed in,
and about the tools an operator uses to present the site: fonts they host
themselves, a homepage picker that names every option, and a scheduler that
will not start the same job twice.

## What's new

**Spoilers that do not leak.** The forum editor has a spoiler block. Locked
output drops the inner HTML entirely — a CSS hide would still give the text
away through View Source, a quote, or a scraper. A spoiler opens for staff,
for search-engine spiders that need the inner HTML to index, for the post's
author, and for a member who liked that post or replied in the topic.
Visitors never unlock it. A one-click quote of a locked spoiler is plain
text with the secret already gone.

**A slimmer board for visitors, if you want one.** Studio → Forum now has two
toggles, both off by default. One strips the postbit down to name and photo
for guests and generic bots. The other hides post bodies from the same
visitors. Search-engine spiders still receive the full page — these are not
a lock; `forum.allow_guest_view` still owns that. Signed-in members see
everything as before.

**A font library you host yourself.** AACP → Appearance → Fonts downloads a
family from a Google Fonts stylesheet URL or a direct `.woff2` / `.woff` /
`.ttf` / `.otf` link into `public/fonts/` and serves it from your own site
from then on. You assign families to body, headings, code, serif, and to
h1 / h2 / h3 on their own. A role left empty keeps the typeface the theme
shipped with. Roboto, Roboto Condensed and JetBrains Mono ship installed.

**The homepage picker names every option.** The homepage screen moved from
Studio to AACP → Appearance, next to themes and fonts. The dropdown lists
every mode the installation can serve right now, and a separate list shows
the ones whose module is switched off — with the module name, so a single
entry no longer looks like the whole catalogue.

**A module can claim Studio.** A module that is the whole product — a shop,
a fleet system — can put its own name and logo on the Studio panel and
reduce the menu to itself plus whatever it still needs. It cannot restyle
the console, replace the layout, or hide AACP. `/aacp` stays one link away.
Without a claiming module the panel is unchanged.

**Scheduled jobs no longer overlap themselves.** A host calling the cron
endpoint every minute while a ten-minute sweep is still running used to
start another sweep. Each job, and the sweep itself, now takes an `flock`
the operating system releases if the process dies. "Run now" uses the same
lock, so a click cannot start a second copy of a job the scheduler is
mid-way through. The Cron screen says when a run was skipped because the
previous one is still going.

## Fixes

**Module scripts 404'd when the import map used a relative `./` path.**
Browsers normalise `/./` away before sending the request, the server
receives a path matching no logical path, and the module script is missing.
The loader now resolves through the asset map to the clean hashed URL.

**Activating a module no longer waits twenty seconds for a cache warmup.**
`cache:clear` already proved the container compiles. The next real request
warms it lazily instead of making the operator sit through it.

## Upgrade notes

**Guest hiding is off.** Existing boards look the same until you turn a
toggle on in Studio → Forum.

**Spoilers need the sanitiser allowlist this release ships.** The `div`
element with a `class` attribute is now permitted in stored post HTML. An
installation that overrode `html_sanitizer.yaml` and does not take this
change will strip spoiler blocks on save.

**Nothing in this release changes your database schema.** The new settings
live in tables that already exist.

**If you deploy by FTP rather than through the panel,** clear
`cp-core/var/cache/prod/` after uploading — leave the folder, empty its
contents. Upload `public/assets/`, `public/fonts/` and `public/vendor/` as
well.

## Known limits

**A locked spoiler is gone from the HTML, not merely folded.** That is the
point. There is no client-side reveal for a visitor who has not earned it.

**The cron lock is per machine.** `flock` coordinates processes on one
document root. A deployment spreading cron across several application
servers needs a shared lock of its own.

**A claimed Studio panel hides the platform footer on purpose.** Version
and update notices stay on AACP, which is where somebody who cares about
the platform version is working anyway.