Accent CMS 0.25 — the hub, from the command line

Accent CMS 0.25.0 is out. Unlike 0.24, nothing here needs action when you upgrade — this release adds rather than changes.

0.24 turned the plugin registry into an ecosystem hub and gave the binary the client to read it. What was missing was everything you would actually do with it. That is what 0.25 adds.

Themes install the way plugins already did.

accent theme install developer-portfolio
accent theme list --remote
accent theme info developer-portfolio

The same vendor-key pinning applies, and the same --allow-unverified escape hatch if you are installing something you have checked yourself.

Installed artifacts can tell you they are behind. accent plugin outdated and accent theme outdated compare what you have against the registry. accent plugin update moves you forward. Until now the only way to find out that a plugin had a newer version was to go and look.

You can find something without opening a browser. accent plugin search seo reads the registry index, so it answers from whatever the hub last published.

A withdrawn version stops spreading. If a plugin or theme is retracted — for a defect, or a security problem — installing it is refused and outdated reports it, rather than the artifact staying installable until somebody notices.

Starter templates are discoverable. accent init --template now finds templates published to the registry, and accent init --list shows them alongside the built-in ones. The built-ins have not gone anywhere; the registry adds to them.

You can publish something and charge for it. A commercial plugin, theme or template downloads freely and is verified at the point it is used — a plugin when its component loads, a theme when it is activated, a template before it scaffolds — against a licence signed by its vendor. A missing or wrong licence is refused, and says why. This is the half of the distribution model that was specified in 0.24 and had not yet shipped.

The catalog those commands read is now a site. hub.accentcms.dev lists plugins, themes and their authors, generated from the same registry documents the CLI reads, by the same engine that builds this site. The product site, the documentation and the hub now navigate as one.

Underneath

The plugin runtime moves to Wasmtime 48.0.0, an LTS release. LTS lines carry 24 months of guaranteed security backports where an ordinary release gets two, which is the property that matters for a runtime executing third-party code. Sandbox behaviour is unchanged: Wasmtime simplified its filesystem permissions to one read-only-or-read-write choice per grant, and that is exactly the distinction Accent’s plugin grants already made.

load_data() now works during accent build, not only under accent serve. It reads a site’s data files from a template, and it is what lets a catalog like the hub be built as static files at all.

A site’s link index can be re-checked on a schedule, so a link that rots after publication is noticed rather than waiting for a reader to find it.

Fixes worth naming

Two dependency defects reached users. A cache race could leak an entry slot on each occurrence, so a long-running server’s usable cache capacity drifted below its configured maximum. And an HTTP/2 denial-of-service advisory (RUSTSEC-2026-0258) is patched, together with the follow-up that kept its own frame limiter from rejecting legitimate traffic.

llms.txt — the index Accent publishes for machine readers — no longer wastes their budget. A section’s index page was listed twice, sections were ordered by directory name rather than by your navigation order, a truncated list looked identical to a complete one, and llms-full.txt published HTML comments as visible text. All four are fixed, and a page that has a description but no lead now publishes that description instead of a truncated excerpt of its body.

Install or upgrade:

curl -fsSL https://accentcms.dev/install.sh | sh

Binaries for all platforms, checksums, and signatures are on the GitHub release page.