Engineering notes

Umbraco.AI 1.0.0 through 1.13.x carry a moderate information-disclosure flaw and the 1.14.0 fix is a breaking change. Plus Umbraco 18 and Elements, uSync v18, and 14 December 2026 on Umbraco 13.

Umbraco 17.4.0 exposed JSON Schema for data types and document types, which is what makes programmatic content writing verifiable. Around it: four Umbraco.AI add-ons in beta, uSync 17.3.0's version jump, and a preview-URL auth bypass.

A thin month. Nine Umbraco items in thirty-one days, no vendor release and no advisory. What landed: uSync 17.0.2 fixing a v13 picker migration defect, the first hands-on Umbraco Compose writeup, and ISO 27001.

Umbraco 17 LTS landed on 27 November on .NET 10, with three years of support. uSync 17.0.0 and Clean Starter Kit v7 shipped the same day. The community had a harder month than the product did.

Umbraco 17 shipped as a beta on 15 October with the final set for 27 November, and uSync 16.1.0 was declared the last feature release for v16. What that costs a site still on 13.

A moderate-severity Content Delivery API advisory patched in 13.9.3, 15.4.4 and 16.1.1; three uSync releases in nine days, all of it v13 upgrade debt; and Umbraco's roadmap post on MCP, Compose and search.

March's advisory fixed two moderate CMS issues plus a high-severity ImageSharp CVE, but only on the latest minor of each supported major. Also: uSync 13.2.7 and 15.1.5, a V8-to-V13 upgrade written up honestly, and a backoffice accessibility fix.

Umbraco 8 reached end of life in February 2025, alongside Azure TLS deadlines, a Cloud WAF default and Commerce 15 throughput claims. Six citable items in the whole month, three of them from umbraco.com.