Engineering notes

Ten days of Umbraco: an Umbraco 17 dashboard built with Vite, load-balancing prep, Windows Server 2025 setup, a Next.js release, and Codegarden roadmap coverage worth checking against the vendor.

July forced two jobs: patch the Delivery API flaw (13.15.1 / 17.5.3 / 18.0.2) and patch Umbraco Forms (13.9.8 / 17.4.7 / 18.0.5). Everything else in the month was the December calendar, argued from four directions.

Umbraco 18 beta1 landed 13 May, beta2 on 14 May, the RC on 28 May, with thirty-five breaking entries in the notes. Elements phase one, typed OpenAPI schemas, Swashbuckle gone, and the field notes worth your afternoon.

Umbraco 17.4.0 exposed JSON Schema for data types and document types, which is what makes programmatic content writing verifiable. Around it: four Umbraco.AI add-ons in beta, uSync 17.3.0's version jump, and a preview-URL auth bypass.

Three vulnerabilities patched in Umbraco 16.5.1 and 17.2.2 on 10 March. The rest of the month was mostly umbraco.com itself: Agent Skills, the Q1 product update, an AI community team.

A thin month. Nine Umbraco items in thirty-one days, no vendor release and no advisory. What landed: uSync 17.0.2 fixing a v13 picker migration defect, the first hands-on Umbraco Compose writeup, and ISO 27001.

Umbraco 13.0.0-13.12.0 got a moderate security patch on 9 December. Everything else the month produced came from 24 Days in Umbraco, plus a new Enterprise bundle and a Q1 2026 date for Compose.

The new Content Hub import/export engine is now the default and existing CI/CD pipelines break. Everything else in December was the community explaining SitecoreAI, Blok, Connect and App Router without a single post from sitecore.com.