# CPalius CMF 2.2.26

**Released:** 2026-09-26 · **Channel:** stable · **Critical:** no

Turkish: [2.2.26-tr.md](2.2.26-tr.md)

A design, accessibility and security pass across the public homepage, blog and forum. No schema changes.

## Security

- Member bios and blog/page bodies are sanitized when rendered, not only when an admin form saves them. The migration importer wrote them unsanitized, so an imported profile could carry script onto public pages.
- `cp_thumb` no longer turns a remote image URL into a broken `/uploads/https://…` path.

## Forum

- Long topics no longer stay blank on phones (the scroll-reveal could never trigger on very tall content).
- Forum index and search have a proper H1; search fields are labelled; the index title no longer repeats "CPalius Forum".
- Activity tabs, hover cards and the image viewer work from the keyboard; quoting a selection works on touch screens; sharing a post confirms the copy.
- "Edited by" no longer appears on posts nobody edited; the relative time no longer repeats the date.
- Profile card stacks on phones; small metadata text is larger; avatars load as thumbnails.

## Blog

- Dates in the reader's language ("22 Eyl 2026" / "Sep 22, 2026").
- Tag pages show the tag name; reading time shown once; proper heading order.
- The featured strip no longer scrolls on its own.
- Covers and avatars are served at display size.

## Homepage

- New hero: download the latest release, whitepaper second, a real `#[CpResource]` example instead of the animated orb.
- Forum feeds removed from the homepage (the forum stays at /forum).
- Navigation collapses below 1200px instead of hiding sign-in on laptops and tablets.
- Copy fixes: the missing words in the English subtitle, PHP 8.4+ in the footer, "Roadmap" instead of "Chapter 10".

## Everywhere

- Link, button and meta text colours meet 4.5:1 contrast; a visible keyboard focus ring; a skip-to-content link and `<main>` landmark; reduced-motion settings are respected.
- The language switcher no longer loads flag images.