Added

Bootstrap 5 compatibility layer

• New css/bs2-bs5-bridge.css (116 CS-PATCH blocks), loaded as the last stylesheet in the head with a file-time version marker. It maps Cosmo’s Bootstrap 2 grid (.row-fluid, .spanN, offsets, column stacking on phones), the hidden-phone / visible-phone utilities, tabs, collapse, tooltips and popovers and the modal shell onto Joomla 5’s Bootstrap 5, and keeps the page at the original 1170 px width on wide screens (CS-PATCH: container-1170-cap).
• Joomla’s own icon classes (icon-eye, icon-angle-left / -right / -double-left / -double-right and others) are mapped to Font Awesome glyphs (CS-PATCH: joomla-icon-classes-to-fa6), so the password show/hide button and the pagination arrows draw an icon.
• Bootstrap 2 marks an open dialog .in where Bootstrap 5 uses .show; the bridge re-points those rules (CS-PATCH: bs2-fade-in-to-show, bs5modal-on-bs2) so the log-in dialog opens visible and centred.

jQuery 3 compatibility

• New js/cs-jq-compat.js, loaded right after Joomla’s head scripts. It restores four jQuery 1.x features that Joomla 5’s jQuery 3.7 no longer has but Cosmo’s bundled scripts still use: .live() (the built-in slideshow’s play/stop controls in camera.min.js), .offset() on the window and .load(fn) as a load-event shortcut (both used by the jquery.stellar parallax bands), and $.browser, which camera.min.js reads when it starts.

Phone layout

• New js/cs-mobile-generic.js: at 767 px and below Cosmo gets a compact header with a 56×56 px menu button in the logo row that opens a slide-in menu drawer built from the site’s real nested menu, with a button to open each sub-menu.
• One centred toolbar row in the header with six buttons: Section menu (the page’s sidebar menu, or the main menu’s top level where a page has none), Log in, Register, Search, Follow us (the social links) and the Cart. All six use Cosmo’s accent colour (#b71b4f) with white icons, and the cart’s item count sits on the corner of the cart icon.
• The phone search panel is full width and has a real Search button; its field uses a 16 px font and a 44 px height, so iPhones do not zoom the page when you tap into it.
• Open panels close when you tap the shaded area behind them, press Escape, or widen the window past phone size.
• The page cannot be pushed sideways on phones (CS-PATCH: mobile-root-overflow-clip), and the layout stays edge to edge (cs-no-bs2-gutter body class), as Cosmo’s own phone layout was.
• All of this is hidden at 768 px and wider; the desktop layout is unchanged.

Password show/hide

• New js/cs-password-eyeball.js: every password field (log-in dialog, log-in page, registration and account forms, including fields added after the page loads) gets an eye button that shows or hides what you have typed.

Colour picker

• New custom field fields/colorpicker.php with the bundled Coloris picker (js/coloris.min.js, css/coloris.min.css). All 20 colour settings (color1–color12, sitenamecolor, slogancolor, cookiecolor1–cookiecolor4, cam_loaderColor, cam_loaderBgColor) changed from Joomla’s built-in type="color" field to colorpicker, with a live swatch and keyboard support. Existing values carry over unchanged.
• New fields/adminui.php: a hidden field that loads the jQuery framework the Options screen’s scripts need, makes the template’s Details panel follow Joomla’s light or dark admin theme, and runs the Favicon tab’s help text across the top of the tab instead of squeezing it into the label column.

Favicon tool

• New Favicon tab (fieldset faviconsettings) with a media field (favicon) and a crop tool (fields/favicontool.php): pick any image, drag a square over the part you want, and create the favicon. With thanks to Gianluca, whose favicon question inspired this tool.
• index.php builds the set through two new helpers, phFaviconSet() and phIcoBytes(): a real favicon.ico (16, 32 and 48 px), 32, 192 and 512 px PNGs and a 180 px Apple touch icon, cached in images/favicon-generated/ and linked automatically. .ico and .svg files are used as they are; with no image chosen, the template’s own favicon.ico is used.
• 10 new language strings in en-GB.tpl_cosmostore.ini (74 → 84), e.g. TPL_COSMOSTORE_FAVICON_TAB, TPL_COSMOSTORE_FAVICON_LABEL, TPL_COSMOSTORE_FAVICONTOOL_CREATE.

Modern social network support

• Five new social services, each with a URL field and an on/off switch: Threads, Bluesky, Mastodon, TikTok, Discord (fields threads/threadsON … discord/discordON).
• Twitter is now X: the twitter field is labelled “X (formerly Twitter)” and shows the X logo.
• The header’s social links now cover 13 services (X, Facebook, Instagram, Threads, Bluesky, Mastodon, LinkedIn, YouTube, TikTok, Vimeo, Pinterest, Discord, RSS). Each is a Font Awesome 6 glyph (fab fa-*, fas fa-rss) instead of a Socicon font glyph, has a screen-reader label and a title, and opens with rel="noopener".
• The on/off switches are labelled “Show X (formerly Twitter)”, “Show Facebook” and so on.

Fonts and icons

• The front end loads Font Awesome 6.5.2 (all.min.css) with v4-shims.min.css from cdnjs.cloudflare.com, instead of Font Awesome 4.7.0 from MaxCDN. The template’s own icons use the Font Awesome 6 classes (fa fa-* in index.php 7 → 0; the mod_menu sub-menu arrows and the category grid/list switch use fas).

Security helpers

• Four new escaping helpers at the top of index.php: phEsc() (HTML escaping), phHexColor() (colour values, falls back to #000000), phCssDim() (sizes, accepting px, em, rem, %, vh, vw and other units) and phRichText() (formatted text). Details under Security.

Changed

Joomla 5 platform

• Built for Joomla 5.4.8 and VirtueMart 4.8.4 (the previous download was built for VirtueMart 4.4.4).
• The template renders on Joomla 5’s bundled Bootstrap 5 (/media/vendor/bootstrap/css/bootstrap.min.css, plus bootstrap.rtl.min.css for right-to-left sites) through css/bs2-bs5-bridge.css, instead of the three Bootstrap 2 stylesheets it used to load from its own css/bootstrap/ folder.
• The print view and VirtueMart pop-up windows (component.php, used for “Ask a question”, print and similar) and the error page (error.php) now load the same Bootstrap 5 base and compatibility stylesheet as the main layout, last in the cascade. Before, they rendered Cosmo’s Bootstrap 2 styling with no compatibility layer.
• templateDetails.xml version 07.08.2025 5.3.0/4.4.4 → 5.4.8, creation date 09/09/2022 → 2026-09-11; the version shown on the Options screen matches. method="upgrade" kept, so an existing install updates in place.

Log-in dialog on Bootstrap 5

• The log-in dialog is a Bootstrap 5 modal (modal fade with modal-dialog-centered and modal-content, was modal ahide afade with an inline display:none), opened with data-bs-toggle / data-bs-target.
• Both close controls use data-bs-dismiss="modal" (was data-dismiss). The footer’s Close is now a button instead of a link that ran jQuery('#LoginForm').hide(); jQuery('#LoginForm').modal('hide');.

J3 → J5 API migration

• 267 Joomla 3 static calls replaced (JRoute → Route, JText → Text, JURI → Uri, JFactory → Factory, JHtml / JHTML → HTMLHelper, JModuleHelper → ModuleHelper, JPluginHelper → PluginHelper, JComponentHelper → ComponentHelper, JDocumentHTML::countModules() → $this->countModules(), JError::raiseWarning() → new Exception()). These aliases exist only while Joomla’s Behaviour – Backward Compatibility plugin is enabled, and not at all in Joomla 6.
• index.php 37 → 0, plus its 4 jimport() calls; component.php and error.php converted.
• Template overrides converted (calls per file):
  • html/mod_login/default.php 20 (and it falls back to $type = 'login', which Joomla 5 no longer passes, instead of raising an “Undefined variable” warning).
  • html/com_virtuemart/user/login.php 14, edit_address.php 6, bs3-edit_address.php 5, bs3-edit_vendor.php 4, edit.php 3, bs3-edit.php 3, edit_orderlist.php 3, mail_raw_regvendor.php 3, edit_vendor.php 2, bs3-edit_shopper.php 1, bs3-edit_address_userfields.php 1, mail_html_reguser.php 1, mail_raw_reguser.php 1.
  • html/com_virtuemart/productdetails/default.php 16, default_images.php 4, default_reviews.php 4, default_addtocart.php 3, default_customfields.php 1, default_showcategory.php 1.
  • html/com_virtuemart/category/default.php 7, productsviewarray.php 4, categories.php 1.
  • html/com_virtuemart/virtuemart/default_products.php 7, default_categories.php 4, default.php 1.
  • html/com_virtuemart/cart/default_pricelist.php 5, default_address.php 2, default_coupon.php 1; sublayouts/addtocart.php and addtocartbar.php 1 each.
  • html/com_virtuemart/askquestion/form.php 3, bs3-form.php 3, mail_html_question.php 2.
  • html/mod_virtuemart_product/single.php 13, slick-slider.php 13, default.php 11; html/mod_virtuemart_category/default.php 6; html/mod_virtuemart_cart/default.php 3; html/mod_virtuemart_manufacturer/default.php 2; html/mod_virtuemart_currencies/default.php 1.
  • html/mod_k2_content/Slider/default.php 18; html/mod_articles_latest/default_items.php 6; html/mod_menu/default.php 2; html/mod_search/default.php and html/mod_breadcrumbs/default.php 1 each.
• In all, 49 of the 88 PHP overrides under html/ were modified.

Template Options screen

• 109 field type changes in templateDetails.xml. The 89 remaining legacy class="switch" checkboxes (e.g. RSSON, H1TitleImgText, OverrideDefaultSettings, AdditionalGFontON, cam_autoAdvance, botmodulescontentwidth) now use Joomla’s native on/off switchers (94 in all with the new social switches), and the 20 colour settings are colour pickers.
• Fields 355 → 361, fieldsets 15 → 16. Tab names no longer end in “Settings”: “Fonts”, “Site Name & Slogan”, “Theme”, “EU Cookie Law Window”, “Drop Down Menus”, “Header & Footer Custom Code”, “Built-in Slideshow”, “Slick Products Slider”, “OWL Products Slider”, “Testimonials Slider”, “Manufacturers Slider”, “Product Images”, “Side Pop Up Box”, “Color”.
• The Options screen’s icon font now uses Font Awesome 6.5.2 + v4 shims from cdnjs instead of Font Awesome 4.6.3 from MaxCDN (maxcdn 2 → 0 across the template). The panel’s fa fa-* icons keep working through the shims.

Fonts

• The Google Fonts WebFontConfig JavaScript loader (which fetched webfont.js from ajax.googleapis.com before any font could load) is replaced by a direct stylesheet link for the same fonts, with preconnect hints and display=swap, in both index.php and component.php (WebFontConfig 2 → 0).

Menus and background without old jQuery plug-ins

• Drop-down menus open on hover through CSS instead of the Superfish/Supersubs plug-ins, and each sub-menu is attached to its parent item so it stays open while the pointer moves onto it. The Drop Down Speed setting and the opacity, height and width animation switches applied only to those plug-ins and no longer have an effect; the 2- to 5-column widths still apply.
• The page background image (bodybackgroundimage) is applied with CSS background-size: cover instead of Backstretch.
• None of these scripts is loaded any more. jQuery itself still loads for the slideshow, the carousels and the parallax bands.

Stylesheets

• blog.css, template.css, template-rtl.css, the compatibility stylesheet and the new scripts carry a file-time version marker, so style changes show straight after an update instead of waiting for visitors’ browser caches to expire.
• css/template.css (216,860 → 223,923 bytes): 103 Bootstrap 5 selectors added beside their Bootstrap 2 originals (.row / .col-md-N next to .row-fluid / .spanN, e.g. #footer .col-md-6, #customers-box .col-md-8.offset-md-2), so Cosmo’s own layout rules apply to either markup.

Fixed

• Every “page not found” returned a server error when Joomla’s backward-compatibility plugin was off (and always on Joomla 6). error.php used JError::raiseWarning() and JText; it now uses the Joomla 4+ API.
• The VirtueMart login form could stop with “behavior::formvalidation not found”. The Joomla 3 behavior.formvalidation call in html/com_virtuemart/user/login.php is now the Joomla 5 behavior.formvalidator (1 → 0). With thanks to Zoltán Szász, whose report found it.
• The address form could fail on PHP 8. html/com_virtuemart/user/bs3-edit_address.php called count($this->userFields['functions']) on a value that can be empty; it now uses !empty(). Also thanks to Zoltán Szász.
• The built-in slideshow raised a script error. jquery.mobile.customized.min.js fails while starting up under jQuery 3.7 and nothing in the template uses it; it is no longer loaded.
• Requests for stylesheets that do not exist were removed: css/camera.css (on every page with the built-in slideshow), css/reset.css, css/text.css and css/typography.css (error page), and css/template_rtl.css (print and error views on right-to-left sites). Each returned the site’s “page not found” response.
• The Options screen’s icons were requested from MaxCDN, which has shut down (see Template Options screen).
• Fixes from a maintenance pass across our templates:
  • The @font-face in css/template.css pointing at the removed media/jui/fonts/ IcoMoon font is disabled; it returned 404s on every page.
  • The pagination arrows (Previous, Next, First, Last) and the password show/hide button could show as empty boxes; they now draw Font Awesome glyphs.
  • Featured-article intro text in a single column is no longer clipped to its title (.blog-featured .blog-items.columns-1).
  • The search button sits flush with its search box again (CS-PATCH: cookstown-search-btn).
  With thanks to Michael Mullan, whose Expression bug report led to this maintenance pass across our templates.

Removed

Legacy scripts and stylesheets no longer loaded

• Scripts: superfish.js, supersubs.js, jquery.backstretch.min.js, jquery.mobile.customized.min.js, modernizr.js, selectivizr-min.js, the remote html5.js shiv from html5shiv.googlecode.com, and the webfont.js loader. The local files remain in js/ but nothing loads them.
• The inline jQuery.browser Internet Explorer detection block that only Superfish used.
• The Internet Explorer stylesheets ie.css and ie6.css and the conditional comments that loaded them and the shims. The files remain in css/.
• Font Awesome 4.7.0 from MaxCDN (replaced by Font Awesome 6.5.2, above).

The template’s own Bootstrap 2 copy

• css/bootstrap/: bootstrap.css, bootstrap.min.css, bootstrap-responsive.css, bootstrap-responsive.min.css, bootstrap-extended.css, bootstrap-rtl.css, bootstrap-tooltip-extended.css. index.php loaded three of them; Joomla 5’s Bootstrap 5 and the compatibility stylesheet take their place.

Dead module chromes

• html/modules.php, which defined seven modChrome_ functions (vmdefault, vmdefaultlogin, vmtab, testimonial, megamenu, parallax, slides). Joomla 5 has no modChrome_ code path; it uses the files of the same names in html/layouts/chromes/, which remain.

Unused files

• html/com_content.zip, an archive of 24 com_content override files left inside the overrides folder.

Retired social services

• Four social slots removed with their switches: Google+ (gplus), StumbleUpon, Digg, Blogger.

Security

• Template settings written into the page go through the new helpers at 182 call sites in index.php: 126 phEsc(), 48 phHexColor(), 5 phCssDim() and 3 phRichText(). They cover the theme colours (color1–color12) and the size, font-size, parallax and position values in the inline <style> block, the 13 social link URLs and the five custom icon URLs, the logo and slogan image addresses and the Google Fonts family list. Unescaped echo $this->params->get() calls in index.php: 209 → 36.
• Site name and slogan text (H1Title / H2Title) go through phRichText(): formatting markup such as a styled second word still shows, but scripts, styles, iframes and on* event handlers are stripped.
• Social links open with rel="noopener", so the opened site cannot control the Cosmo tab.

Quickstart Installer

The Quickstart is a complete Joomla 5.4.8 site with VirtueMart 4.8.4 and Cosmo installed as the active template, with the demo content.

• It is now a standard Joomla installation package that runs Joomla’s own web installer, replacing the previous Akeeba backup archive (cosmo-20250806-232811.jpa), so Akeeba Kickstart is not needed.
• Bundled extensions: Joomla 5.4.8, VirtueMart 4.8.4, Akeeba Backup 10.4.0, Weblinks 5.1.0, Search 4.0.0, MCP For J 2.6.1, StageIt 5.7.3.
• Only the templates the site uses are included: the templates/ folder holds cassiopeia, cosmostore and system. VirtueMart’s demo templates horme_3, vmbasic and vmbeez3 are gone; horme_3 and vmbeez3 carried error pages written with the removed Joomla 3 API, so activating either gave a server error.
• Joomla 5.4’s “What’s New” guided tour (tour 15) no longer starts by itself (autostart = 0). Before, it sent every administrator link to the dashboard on a fresh install. The tour is still available.
• On the VirtueMart account page (menu item 566), the two left-column promo banners (“Left Banner 4”, NEW Collection, and “Left Banner 5”, 100% Pure Argan Oil) are no longer shown, so on phones the account form is no longer pushed below them. They still show everywhere else they did.

Package format

• Standalone template: Cosmo now installs as a Joomla package (pkg_cosmostore-5.4.8.zip, manifest pkg_cosmostore.xml) that installs and registers the cosmostore template extension, replacing the bare cosmostore.zip. It declares method="upgrade", so an existing Cosmo updates in place, <blockChildUninstall>true</blockChildUninstall>, so the template is removed through the package rather than on its own, and an update server for Joomla’s Update Manager.
• Quickstart bundle: Cosmo-5.4.8-Quickstart.zip, a complete Joomla 5.4.8 install with VirtueMart 4.8.4 and Cosmo pre-loaded as the active template.