Release 3.6.3

Activity Log, owned collections and bot protection

22 October 2026

  • Activity Log — Utilities → Activity Log shows who changed, downloaded or called what, and when, including every MCP tool call, with filters and export
  • Owned collections — name an owner property and members see and edit only their own objects
  • Protected fields — a schema property can refuse non-admin changes or be forced to a value, so a moderated object can't approve itself
  • Public registration from the collection form — auth collections get Allow Public Registration, Require Email Verification and Registration Groups settings
  • Bot protection for public forms — a honeypot and a signed time trap on register and create forms, and on form mail
  • Install an extension from a zip — a drop zone on the Extensions page, plus tcms extension:install and extension:package
  • Twig — cms.badge for "Built with Total CMS" badges, cms.redirect(), cms.notFound(), dark-mode images in cms.render.picture() and cms.media.imageDataUri()
  • MCP and API keys — the tool list follows a connection's OAuth scopes and access groups, an API key limited to some collections is limited over MCP too, and new update_collection, delete_collection and delete_object tools
  • Sessions — Total CMS no longer logs visitors out of other PHP apps on the same site, such as VibraCart Pro
  • Upgrade notes — Stacks 6 admins are signed out once as the login moves to the "Stacks" session, and pdo_sqlite is now required (check the PHP your cron runs as well)
Full release notes → All releases →