Total.js Platform
Total.js Platform

Total.js Platform news and tutorials

Website: https://www.totaljs.com
October report 2026

October report 2026

Total.js framework 4

  • fixed mail attachments using attachmentfs()
  • added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column
  • improved hostname security against Node.js vulnerabilities (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072)
  • added U.validhost() for hostname and IP address validation
  • added U.tohost() for hostname normalization and validation
  • improved hostname validation in REQUEST(), U.resolve(), and HTTP redirects
  • improved hostname validation in U.connect() and LDAP()
  • improved hostname validation in the WebSocket client
  • improved SMTP hostname normalization and validation

Total.js framework 5

  • extended stats by adding app property
  • added Total.FsPromises as a reference to node:fs/promises
  • added mcp module
    • CONF.$mcp = true activates MCP route POST /$mcp/
    • any NEWACTION with the mcp: true property will be available in the endpoint
  • added JSONSchema.toAIObject() for AI-compatible object schemas
  • added JSONSchema.toAITool() for AI tool definitions
  • added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column
  • fixed AIPARSER() with AI tool calling
  • added controller method $.content() for custom content types
  • added a new event reset in the FlowStream
  • added caching support for NEWACTION() based on request parameters and user context
  • added compact schema types json and ip with validation
  • fixed CRON() step expressions (*/15, 5/20)
  • fixed the limit argument in setTimeout2()
  • fixed AJAX() responses with XML content types
  • fixed promise handling in F.python() and F.pipinstall()
  • fixed LOGMAIL() with an object as the body
  • improved error handling in IMPORT()
  • fixed error and abort messages in the tunnel client (proxy.js)
  • fixed controller method $.href()
  • fixed field filtering in QueryBuilder.gridfields()
  • optimized pending request handling
  • fixed LDAP() bind error handling
  • fixed mail attachments using attachmentfs()
  • fixed Base64 encoding of Buffer attachments in attachment()
  • fixed @{hostname()} view engine command
  • improved hostname security against Node.js vulnerabilities (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072)
  • added U.validhost() for hostname and IP address validation
  • added U.tohost() for hostname normalization and validation
  • improved hostname validation in U.resolve() and REQUEST()
  • improved hostname validation in U.connect()
  • improved SMTP hostname normalization and validation
  • Added AbortSignal cancellation to REQUEST and RESTBuilder

QueryBuilderPG, QueryBuilderSQLServer & QueryBuilderMySQL

  • added QueryBuilder.autoqueryjson() for properties stored in a JSON(B) column

UI Components

Website: https://componentator.com

  • fixed resetting page when the filter is applied in j-ServerGrid
  • added a small delay to shortcuts in the j-Approve

LessCode

Website: https://www.totaljs.com/lesscode/

  • fixed drag & drop components

Online Flow editor

Website: https://flow.totaljs.com

  • fixed drag & drop components

FlowOS

Website: https://www.totaljs.com/flowos/

  • fixed drag & drop components

Flow

Website: https://www.totaljs.com/flow/

  • fixed downloading files from the /private/ directory
  • fixed drag & drop components
  • updated Docker base image to Node.js 24 with security fixes

Components:

  • added a new component Flow Stats
  • improved component Console debug

Tables

Website: https://www.totaljs.com/tables/

  • improved dynamic formatting
  • added support for dynamic row formatting
  • added a table option recoverable that creates a copy of the data in an independent table when a record is removed
  • fixed displaying name in the related tables
  • added support for dynamic format in the column settings
  • fixed datagrid

Todomator

Website: https://www.totaljs.com/todomator/

  • Fixed watchers in tickets_create action
  • updated Docker base image to Node.js 24 with security fixes

Code

Website: https://www.totaljs.com/code/

  • updated Docker base image to Node.js 24 with security fixes
  • improved hostname validation in Hosts tools
  • fixed DNS resolution vulnerability (CVE-2026-105482)
  • fixed command injection vulnerability in the ping tool

Other posts