Exponential 6.0.x roadmap

Delivered in 2026

• Delivered: Exponential 6.0.11 (1 January 2026), 6.0.12 (10 February 2026), 6.0.13 (20 April 2026) with security hardening, PHP 8 session fixes, SQLite improvements and PHPUnit 10 tests, and 6.0.14 (7 June 2026) with the MongoDB 8 database adapter and setup wizard fixes for shared hosting and PostgreSQL.
• Delivered: stabilization of the PHP 8 line and bug fixes for PHP 8 warnings. This was the first item of the previous roadmap.
• Delivered: the PHP-version floor metapackage (1.3.2). It selects the dependency versions that work on each PHP version, so one composer.json installs from PHP 7.4 to 8.5.
• Delivered: Exponential Velocity, the persistent PHP application server, is part of Exponential and is required by it. See the Exponential Velocity roadmap.

Exponential 6.0.15, the release target for 2026/Q4

6.0.15 is the largest release of the 6.0 line. Its changelog lists several hundred changes since 6.0.14. The release itself is In progress. Features marked Delivered (development branch) are finished and merged, and can be installed now with Composer as the development version (6.0.x-dev). They will be released together with 6.0.15. The headline features:

Three template engines: tpl, Twig 3 and Smarty 5

• In progress: Smarty 5 templates (.stpl) and Twig 3 templates next to the classic Exponential templates (.tpl). They are found, overridden, included and cached like any template, they see the same variables, and they use every template operator, fetch function and view function.
• In progress: converters between tpl, Twig and Smarty in every direction, run with the exp:template commands (exp:template:convert and its variants). A converter turns a whole design into another engine, with notes on what needs a person's eye.
• In progress: the media design in all three engines, as reference designs for site builders.
• In progress: guides for the new engines: a first template step by step, operators and functions, caching and performance, migrating a design, troubleshooting, security and escaping.

Sign-in and account security

• In progress: passkeys (WebAuthn and FIDO2). Sign in with a passkey instead of a password, with a security console for passkeys in every siteaccess.
• In progress: "Verify it's you". A user confirms their identity again before a sensitive action, such as approving a new account.
• Delivered (development branch): two-step sign-in (two-factor authentication) with TOTP apps or e-mail codes, on every sign-in path of the web forms. A new installation requires it for administrators and editors.
• In progress: sign-in session tracking and management. "Your devices" lists every signed-in session of a user with its place, host and second step. Users can sign out one session or every session, and administrators get a sign-in report, security activity per account and security alerts. Users can export and erase their sign-in data.
• Delivered (development branch): passwords. Well-known passwords are refused everywhere, forgot-password links expire, administrators can require a password change at the next sign-in, and changing a password ends the other sessions.
• Delivered (development branch): approval of new editor and staff accounts by administrators, and member management for editors, with every action recorded in the audit log.
• Delivered (development branch): OAuth with PKCE and state, CORS for the REST API, personal API keys with scopes, and OAuth tokens that stop working for disabled users.

Upgrades and PHP versions

• Delivered (development branch): exp:upgrade, one-command upgrades from the console. Before every step it records a caption of the code with git_manager. It moves the code and the libraries, verifies the installation after the upgrade, and rolls back to any point in time.
• Delivered (development branch): PHP support for 6.0.15. Supported: PHP 8.0 to 8.5. Usable without support: PHP 7.4 (Exponential 6.0.15 and later).
• Delivered (development branch): console commands that change something do so only with --apply and show what they would change otherwise. Further commands copy .htaccess and config.php into place and read and set config.php values.

The administration

• Delivered (development branch): the admin4 design, light and dark. It works on phones, tablets and wide windows and follows the system's color mode. It has keyboard and screen reader support, mega menus for the main tabs, Bootstrap Icons, and an enforced Content Security Policy without inline scripts.
• Delivered (development branch): the in-admin help system. Help is maintained as content, in the reader's language, with e-books (EPUB and PDF) of the help manuals. See the documentation and help roadmap.
• In progress: bookmarks. Bookmarks can be sorted into a tree of folders, and any system page can be bookmarked with its view parameters.
• Delivered (development branch): the audit log. A hash-chained, signed and searchable record of sign-ins, content, settings, commerce and deploys, with a timeline and a user audit log.
• Delivered (development branch): 155 administration languages, including right-to-left languages. See the languages and localization roadmap.
• Delivered (development branch): tools for administrators. The Exp Debug bar, a log viewer and log management, content checks for broken relations and missing files, resumable content jobs for large operations, a content finder, a pause for cronjob parts, and the exp:ini settings editor.
• Delivered (development branch): notifications and e-mail. A notification status page, e-mail preferences with a consent log, one-click unsubscribe, and every mail as HTML with a plain-text part.
• Delivered (development branch): the online editor on TinyMCE 8 as an opt-in second engine, the expimageeditor image editor in the browser, and sub-items reordered by drag and drop.
• Delivered (development branch): expservices, about 1,100 remote services over ezjscore, and the transfer registry, one engine and one run history for every import and export tool.
• Delivered (development branch): demo mode for public demonstration sites.

After 6.0.15

• Next: Exponential 6.0.16 and later maintenance releases with fixes, security updates and support for new PHP releases.
• Next: a GraphQL API built into the kernel. One endpoint per siteaccess, with a schema generated from the content classes of the installation: class identifiers become types and attributes become fields. It is secured by the same users, roles and policies as the administration and accepts the OAuth2 tokens and personal API keys that the REST API uses. It comes with a browser playground and can be switched on with one console command. It requires Exponential 6.0.15 or later.
• Next: expwt, a site-side management sidebar. It is a fork of the classic Website Toolbar (ezwt). The sidebar sits on the edge of the page in the site's own design and lets editors and administrators edit content, layouts and templates, manage media, users and translations, and clear caches without leaving the site. Everything it offers comes from the existing roles and policies. Once expwt is released, it replaces ezwt as a default Composer requirement of Exponential.
• Next: the kernel service container, beyond the first part that 6.0.15 brings.
• Considering: video guides for installing, upgrading and building a first site.

Help wanted

• Install a 6.0.15 pre-release from the development branch on your PHP version and database, and report what breaks in the issue tracker.
• Run the template converters on your own designs and tell us which constructs do not convert cleanly.
• Test passkeys and two-step sign-in with your browsers, devices and authenticator apps.
• Try exp:upgrade on a copy of a real installation and report each step that needs a person.
• Tell us in the Developer forum what a GraphQL API and the expwt sidebar must do for your projects.
• Code contributions need a signed CLA 1.1.0.