Engineering notes

July forced two jobs: patch the Delivery API flaw (13.15.1 / 17.5.3 / 18.0.2) and patch Umbraco Forms (13.9.8 / 17.4.7 / 18.0.5). Everything else in the month was the December calendar, argued from four directions.

Umbraco 18 beta1 landed 13 May, beta2 on 14 May, the RC on 28 May, with thirty-five breaking entries in the notes. Elements phase one, typed OpenAPI schemas, Swashbuckle gone, and the field notes worth your afternoon.

Three vulnerabilities patched in Umbraco 16.5.1 and 17.2.2 on 10 March. The rest of the month was mostly umbraco.com itself: Agent Skills, the Q1 product update, an AI community team.

Umbraco shipped Umbraco.AI (open source, provider-agnostic) and Umbraco Compose (commercial SaaS) in the same month. What each one costs you, plus the 13 to 17 upgrade 403 and uSync 17.0.4.

A thin month. Nine Umbraco items in thirty-one days, no vendor release and no advisory. What landed: uSync 17.0.2 fixing a v13 picker migration defect, the first hands-on Umbraco Compose writeup, and ISO 27001.

A moderate-severity Content Delivery API advisory patched in 13.9.3, 15.4.4 and 16.1.1; three uSync releases in nine days, all of it v13 upgrade debt; and Umbraco's roadmap post on MCP, Compose and search.

Three moderate-severity issues patched on 21 January 2025 in Umbraco 10.8.8, 13.5.3, 14.3.2 and 15.1.2 — and the catch is that you must already be on the latest minor. Six items in the whole month, half of them from Umbraco HQ.