October report 2026

• Total.js Website
• Join Total.js Telegram
• Join Total.js WhatsApp
• Sign-in to Total.js Platform

Total.js framework 4

• fixed mail attachments using attachmentfs()
• added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column
• improved hostname security against Node.js vulnerabilities (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072)
• added U.validhost() for hostname and IP address validation
• added U.tohost() for hostname normalization and validation
• improved hostname validation in REQUEST(), U.resolve(), and HTTP redirects
• improved hostname validation in U.connect() and LDAP()
• improved hostname validation in the WebSocket client
• improved SMTP hostname normalization and validation

Total.js framework 5

• extended stats by adding app property
• added Total.FsPromises as a reference to node:fs/promises
• added mcp module
  • CONF.$mcp = true activates MCP route POST /$mcp/
  • any NEWACTION with the mcp: true property will be available in the endpoint
• added JSONSchema.toAIObject() for AI-compatible object schemas
• added JSONSchema.toAITool() for AI tool definitions
• added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column
• fixed AIPARSER() with AI tool calling
• added controller method $.content() for custom content types
• added a new event reset in the FlowStream
• added caching support for NEWACTION() based on request parameters and user context
• added compact schema types json and ip with validation
• fixed CRON() step expressions (*/15, 5/20)
• fixed the limit argument in setTimeout2()
• fixed AJAX() responses with XML content types
• fixed promise handling in F.python() and F.pipinstall()
• fixed LOGMAIL() with an object as the body
• improved error handling in IMPORT()
• fixed error and abort messages in the tunnel client (proxy.js)
• fixed controller method $.href()
• fixed field filtering in QueryBuilder.gridfields()
• optimized pending request handling
• fixed LDAP() bind error handling
• fixed mail attachments using attachmentfs()
• fixed Base64 encoding of Buffer attachments in attachment()
• fixed @{hostname()} view engine command
• improved hostname security against Node.js vulnerabilities (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072)
• added U.validhost() for hostname and IP address validation
• added U.tohost() for hostname normalization and validation
• improved hostname validation in U.resolve() and REQUEST()
• improved hostname validation in U.connect()
• improved SMTP hostname normalization and validation
• Added AbortSignal cancellation to REQUEST and RESTBuilder

QueryBuilderPG, QueryBuilderSQLServer & QueryBuilderMySQL

• added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column

UI Components

Website: https://componentator.com

• fixed resetting page when the filter is applied in j-ServerGrid
• added a small delay to shortcuts in the j-Approve

LessCode

Website: https://www.totaljs.com/lesscode/

• fixed drag & drop components

Online Flow editor

Website: https://flow.totaljs.com

• fixed drag & drop components

FlowOS

Website: https://www.totaljs.com/flowos/

• fixed drag & drop components

Flow

Website: https://www.totaljs.com/flow/

• fixed downloading files from the /private/ directory
• fixed drag & drop components
• updated Docker base image to Node.js 24 with security fixes

Components:

• added a new component Flow Stats
• improved component Console debug

Tables

Website: https://www.totaljs.com/tables/

• improved dynamic formatting
• added support for dynamic row formatting
• added a table option recoverable that creates a copy of the data in an independent table when a record is removed
• fixed displaying name in the related tables
• added support for dynamic format in the column settings
• fixed datagrid

Todomator

Website: https://www.totaljs.com/todomator/

• Fixed watchers in tickets_create action
• updated Docker base image to Node.js 24 with security fixes

Code

Website: https://www.totaljs.com/code/

• updated Docker base image to Node.js 24 with security fixes
• improved hostname validation in Hosts tools
• fixed DNS resolution vulnerability (CVE-2026-105482)
• fixed command injection vulnerability in the ping tool