Spit Happens: October 2026 News - Colour and faster indexing

The herd has been busy again 🦙. So far in October (1 to 22 October, Brisbane time) we've merged 122 pull requests across TinaCMS and TinaCloud and published 34 releases across individual TinaCMS packages. Here's a selection of that work, with published package changes distinguished from later merges awaiting a verified rollout.

📦 TinaCMS: 25 linked PRs

🎨 Text colour in the editor

TinaCMS 3.15.0 adds a Text Color dropdown next to Highlight in the rich-text toolbar. Give a field a palette with overrides.textColors. If you've defined your own overrides.toolbar, add textColor to the list to show the button (#7683). The rich-text docs cover the setup and the markup it saves.

Two things to know first. Bold, italic or strikethrough that starts or ends mid-word next to coloured text can reload with the formatting characters showing. And on TinaCloud projects, text colour also needs a TinaCloud-side GraphQL update, which hadn't been merged as of 22 October. Test it on your own content before you roll it out.

The same release makes the date picker follow timeFormat. A format like HH:mm now gives you a 24-hour picker with no AM/PM (#7798). List field descriptions wrap instead of getting cut off (#7734).

🔗 References that keep up

A reference inside a templated list item or an MDX component in rich text used to slip past the index, so a rename or delete could leave it pointing at the old path. @tinacms/graphql 4.0.1 now finds references by walking the document against your schema, and the lookup behind rename and delete no longer stops at 50 results (#7851).

Reindex after you upgrade. Existing indexes won't pick up the references they missed, or drop stale entries, on their own.

We also fixed a collection that sorts by a field whose index still listed a deleted document. The query skips it and logs a warning, instead of failing the whole list (#7133).

🔐 Self-hosted sign-in

Self-hosted sites get a new authCollection database option and an admin list, authCollection.admins, for the users who can add, edit and remove users. Other users can still change their own passwords (#7722).

The catch is that sign-in now needs a database client generated by the matching CLI. Update @tinacms/cli alongside @tinacms/graphql 4.0.0 and @tinacms/datalayer 3.0.0, then run tinacms build or tinacms dev to regenerate tina/__generated__/databaseClient.

Self-hosted Next.js App Router projects also get @tinacms/cli 4.0.3, which returns plain objects from the database client. That fixes the error when results cross from a Server Component to a Client Component (#7741).

🩹 Fewer snags

When TinaCloud fails to index a branch, tinacms build prints the reason it gives instead of a bare "Unable to seed" (#7786).

tinacms build now regenerates tina/tina-lock.json as dev does. After schema changes, run either command locally and commit and push the regenerated file so TinaCloud can read it; a CI build does not commit it for you (#7051). The "Indexing local files" spinner no longer hangs forever when the CLI loses a connection race (#7295).

Error modals get their own titles and a descriptive help link (#7738). The saved/unsaved indicator has an accessible name, so it doesn't rely on colour alone (#7791).

Three more fixes merged on 21 October, after the latest inspected package releases on 19 October; they are not established as available in those packages. The MDX serializer switches list markers instead of inserting an HTML comment between adjacent lists. Existing files containing the old <!----> separator still need that line removed manually; the regular Markdown parser is unchanged (#7861). Another fix omits empty optional, non-list image fields from frontmatter, including when an existing image is cleared (#7863). The third fixes image lists embedded in rich-text templates (#7319).

One upgrade note: 3.15.0 moves React Router to v7, which needs React 18 or later (#7606).

🚀 V4 keeps taking shape

V4 is still in progress. This month it gained a media contract and a Media Manager screen plugin, an image field, and arrays that hold templates (blocks) or single values.

V4's tinaCloud() work adds media and content, alongside the provider-neutral client auth contract and sign-in gate.

☁️ TinaCloud: 14 linked PRs

The inspected GitHub releases include the earlier changes below: 2026.09.5, 2026.10.0 and 2026.10.1. Release inclusion does not confirm every account's feature flags or current deployment. Later merges are marked separately.

⚡ Faster indexing

The changes included in the inspected TinaCloud releases add parallel index writes and remove repeatedly caught encoding errors during new-branch indexing. These changes target time spent waiting on storage and repeated CPU work; this recap does not claim a measured speed-up for every project.

🔎 Indexing that tells you what went wrong

When indexing fails, the status endpoint now returns the underlying reason, so older CLI versions print it too.

A later merged fix makes multi-repo pull-branch indexing use the generator repo's schema rather than quietly skipping the branch. It merged after the latest inspected non-prerelease TinaCloud release, so rollout is not established here.

🔐 Accounts and sign-in

Accounts on the new AuthKit sign-in can sign out all their other sessions from the dashboard's Security tab. The browser you're in stays signed in, and existing access tokens in the other sessions can remain valid for up to five minutes. Accounts with nothing to manage there no longer see an empty Security tab.

While account deletion is paused for the sign-in move, the Request Account Deletion section now says so and points to support, instead of vanishing.

A few safety nets landed too:

• A later merged change prevents demoting a project's last admin to Editor and shows the reason in both role editors. Its rollout after the latest inspected non-prerelease cloud release is not verified here.
• Signed-in visitors who land on /login or another unknown path go to Projects, not a blank page.

📱 A friendlier dashboard

On phones the dashboard nav is now a dropdown, so tabs like Leaderboard aren't hidden off the side. A later merged consent change asks before loading tracking scripts when the browser reports a Europe/ timezone, one of the additional configured regional zones, or an unknown/UTC zone. Timezone approximates location; this is not verified geolocation. Its rollout after the latest inspected non-prerelease cloud release is not established here.

🖼️ Assets

A merged assets fix preserves Cache-Control on original SVG, PNG and WebP copies and adds a CDN fallback for files without the header. It is intended to let browsers cache those files. It merged after the latest inspected non-prerelease cloud release, and its deployment-level verification remains pending.

Keep up with socials

We post product updates, tutorials and team news here:

• X: @tinacms
• LinkedIn: TinaCMS
• YouTube: @TinaCMS
• Bluesky: @tina.io
• Discord: Come chat with us!

Till next time 👋🦙