Loving Tina? us on GitHub0.0k

Spit Happens: May & June 2026

ByIsaac Lombard

We're bringing back regular updates via blog and newsletter.

This will be a short recap of what shipped across TinaCMS and TinaCloud, posted here on the blog and sent out as a newsletter.

What's new

Across May and June the team merged 70+ PRs into TinaCMS and shipped a wave of updates to TinaCloud. Here are the highlights:

⭐️ TinaCMS in the Astro news

TinaCMS got a shout-out in Astro's "What's new in May" post. We here have loved trying out Astro in our own projects and have been impressed with what their team has put out!

🧩 All-in on Astro

This is a big change for us.

TinaCMS visual editing no longer needs React.

A ~2 KB vanilla-JS bridge can now power live editing, and it now works on statically-built pages too, with Astro 6 supported and the starter rebuilt React-free.

We've done this as Astro was winning in terms of user interest – we've been collecting some stats on this. After this update Astro jumped up to 6× the starter clone rate of Next.js for our CMS starter projects!

We've kept polishing the Astro dev experience too. New pages now show up as you write content, without having to restart the dev server.

🚀 Tina V4 announced

We officially announced Tina V4. The seven-epic foundation work kicked off in Sprint 109, and auth is heading to WorkOS AuthKit.

This is already happening! We've scaffolded the new core package and shipped the first of the V4 field plugins (String, Boolean and Number).

🩺 The doctor will see you now

Two changes to smooth the road to V4: the new tinacms doctor command flags any outdated Tina package against the latest on npm, and legacy .tina/ folders now surface a deprecation warning. We're hoping this makes the maintenance story when using TinaCMS even more compelling.

🔒 Security hardening

We ran a focused security pass over the codebase, and published advisories for the issues we found and fixed:

  • postMessage handlers have origin validation
  • Rich-text link and image URL sanitisation
  • The dev server rejects cross-origin media uploads
  • Production media adapters are locked down against arbitrary writes and deletes
  • The Forestry migration no longer allows code execution

We also tightened the supply chain, with least-privilege CI permissions and a locked-down publish pipeline.

There's nothing needed on your side, this all just makes Tina safer by default.

✨ UX improvements

A few quality-of-life upgrades for editors: the editorial workflow now has a save-options dropdown for choosing between draft and ready-for-review, and admin editor pages have a back-to-collection breadcrumb so it's quicker to move around.

create-tina-app also shows live install activity as it scaffolds, so you're not left watching a silent spinner.

🧪 More tests

We're committed to writing more frontend tests, to improve reliability and limit any risk of regressions.

📦 Downloads

Over 200,000 package downloads in the month of May.

☁️ TinaCloud improvements

The cloud team worked on reliability, and the numbers reflect that:

  • Content API 500s cut from ~13K to ~2K, and Identity API 500s down 87%.
  • Search rebuilds on large repos no longer fail from GitHub rate limits.
  • Rate limiting now stops runaway traffic from taking the API down.

We also shipped Separate Content Repos: you can now bind two GitHub repos to a single TinaCloud project. More in Separate Content Repos are here for TinaCloud.

Keep up with socials

Our social channels have been quiet for a while… the dev effort hasn't been and we want to keep everyone in the loop.

So we're back to posting regularly, with product updates, video and tutorial content, and related news.

Follow our business accounts to keep up:

Two of the devs on the team, Brook and Isaac, will be posting and replying to comments directly, so when you reply you'll be talking to real people on the team.

Come say hi.

That's the catch-up

We'll send these out roughly every two months.

Till next time 👋🦙

Last Edited:
Last Page
Separate Content Repos are here for TinaCloud