Engineering notes

Ten days of Umbraco: an Umbraco 17 dashboard built with Vite, load-balancing prep, Windows Server 2025 setup, a Next.js release, and Codegarden roadmap coverage worth checking against the vendor.

Umbraco 17.4.0 exposed JSON Schema for data types and document types, which is what makes programmatic content writing verifiable. Around it: four Umbraco.AI add-ons in beta, uSync 17.3.0's version jump, and a preview-URL auth bypass.

A thin month. Nine Umbraco items in thirty-one days, no vendor release and no advisory. What landed: uSync 17.0.2 fixing a v13 picker migration defect, the first hands-on Umbraco Compose writeup, and ISO 27001.

Four of the month's eleven Umbraco items are about MCP and AI. An agent built an element type from a single prompt, Umbraco Commerce got an MCP proof-of-concept, and the only post that said anything about who should be allowed to do that was a uSync patch note.

Umbraco's 6 May advisory fixed a moderate user-enumeration issue in 10.x and 13.x, but the patch only exists on the latest minor. Plus ContentAudit, uSync 15.1.8 and the v16 release candidate.

March's advisory fixed two moderate CMS issues plus a high-severity ImageSharp CVE, but only on the latest minor of each supported major. Also: uSync 13.2.7 and 15.1.5, a V8-to-V13 upgrade written up honestly, and a backoffice accessibility fix.