13.12.1

What's Changed

🔒 Security

• Resolves vulnerability relating to the handling and deletion of temporary files during the dictionary and content type upload process discussed in https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hfv2-pf68-m33x.

Full Changelog: release-13.12.0...release-13.12.1

13.13.0-rc2

What's Changed Since 13.13.0-rc

🔒 Security

• Resolves vulnerability relating to the handling and deletion of temporary files during the dictionary and content type upload process released in 13.12.1 and discussed in GHSA-hfv2-pf68-m33x.

Full Changelog: release-13.13.0-rc...release-13.13.0-rc2

What's Changed Since the Previous Release (13.12.0)

🐛 Bug Fixes

• Redirects: Fix self referencing redirects for 13 (closes #20139) by @NillasKA in #20908
• Content picker: Allow selections on a content picker on a read-only document to be opened (closes #20816) by @AndyButland in #20819
• Block Grid: Align read-only display with other property editors by @bjarnef in #21007
• Content editing: Correct handling of read-only of name field when A action is removed in SendingContentNotification by @bjarnef in #20072
• Content picker: Remove multi-node content picker entries by UDI to account for index not aligning with stored values (closes #20943) by @AndyButland in #20950
• Content picker: Allow selections on a content picker on a read-only document to be opened (closes #20816) by @AndyButland in #20819
• Media Picker Fixed folder navigation when returning from an empty folder (closes #20975) by @AndyButland in #20987
• Media Picker: Present root nodes for users with more than one media root node assigned (closes #20967 and #21048) by @AndyButland in #20993

Full Changelog: release-13.12.0...release-13.13.0-rc

17.0.1

What's Changed

🐛 Bug Fixes

• Delivery API: Only add default strategy if delivery API is not registered (closes #20976) by @Zeegaan in #20982
• Rendering: Don't use element cache level on snapshot cache level properties by @kjac in #21006
• Delivery API: Missing Member Open API security scheme references by @lauraneto in #21020
• Tree: Fix incorrect error notification when deleting last child (closes #20977) by @iOvergaard in #20985
• Delivery API: Retain the Delivery API login redirect behavior in .NET 10 (closes #21000) by @kjac in #21023
• Segments: Fix processing data for segments variants by @nielslyngsoe in #21018
• Static files: Fix tree to only provide items from expected folders (closes #20962) by @AndyButland in #21001
• Management API: Return not found from request for content references when entity does not exist (closes #20997) by @AndyButland in #20999
• Migrations: Ensure umbracoPropertyData column casing by @AndyButland in #21015
• Cache: Add awaits to memory cache rebuilds to fix race conditions by @nikolajlauridsen in #20960

🚤 Performance

• Migrations: Optimise ConvertLocalLinks migration to process data in pages, to avoid having to load all property data into memory by @AndyButland in #21003
• Migrations: Set a long timeout by default on the migration of system dates (closes #21013) by @AndyButland in #21022

Full Changelog: release-17.0.0...release-17.0.1

16.4.1

What's Changed

🐛 Bug Fixes

• Delivery API: Only add default strategy if delivery API is not registered (closes #20976) by @Zeegaan in #20982

Full Changelog: release-16.4.0...release-16.4.1

13.13.0-rc

What's Changed

🐛 Bug Fixes

• Redirects: Fix self referencing redirects for 13 (closes #20139) by @NillasKA in #20908
• Content picker: Allow selections on a content picker on a read-only document to be opened (closes #20816) by @AndyButland in #20819
• Block Grid: Align read-only display with other property editors by @bjarnef in #21007
• Content editing: Correct handling of read-only of name field when A action is removed in SendingContentNotification by @bjarnef in #20072
• Content picker: Remove multi-node content picker entries by UDI to account for index not aligning with stored values (closes #20943) by @AndyButland in #20950
• Content picker: Allow selections on a content picker on a read-only document to be opened (closes #20816) by @AndyButland in #20819
• Media Picker Fixed folder navigation when returning from an empty folder (closes #20975) by @AndyButland in #20987
• Media Picker: Present root nodes for users with more than one media root node assigned (closes #20967 and #21048) by @AndyButland in #20993

Full Changelog: release-13.12.0...release-13.13.0-rc

17.0.0

What's Changed

See the prior release notes for each pre-release version:

• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.0.0-rc4
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.0.0-rc3
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.0.0-rc2
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.0.0-rc1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.0.0-beta

Release overview: https://releases.umbraco.com/release/umbraco/Umbraco-CMS/17.0.0

16.4.0

What's Changed Since 16.4.0-rc2

🐛 Bug Fixes

• Block Editors: avoid discard changes for no changes (Fixes #20680) by @nielslyngsoe in #20941
• Localization: Restores region-specific cultures (#20939) by @iOvergaard in #20942

Full Changelog: release-16.4.0-rc2...release-16.4.0

Changes in 16.4.0-rc2 Since 16.4.0-rc

🙌 Notable Changes

• Backoffice Login: Move access/refresh tokens to secure cookies by @kjac in #20779
• Backoffice Login: Redact back-office PKCE codes from the server (V16) by @kjac in #20851
  As an added security feature used by default in Umbraco 17, user authentication tokens can be returned in secure cookies from the server's authentication requests. For backwards compatibility reasons, the feature is disabled by default, but can be enabled via the boolean configuration at Umbraco:Cms:Security:BackOfficeTokenCookie:Enabled. Read more in the Umbraco documentation.

Full Changelog: release-16.4.0-rc...release-16.4.0-rc2

Changes in in 16.4.0-rc

📦 Dependencies

• Bump tar-fs from 3.1.0 to 3.1.1 in /src/Umbraco.Web.UI.Client by @dependabot[bot] in #20260
• Dependencies: Updates all npm dependencies for Client, Login, and UmbracoExtension by @iOvergaard in #20386
• build(deps): bumps @umbraco-ui/uui from 1.15.0 to 1.16.0-rc.0 by @iOvergaard in #20402
• Dependencies: Fixed dependency conflicts when installing Microsoft.EntityFrameworkCore.Design (closes #20421) by @lauraneto in #20474
• build(deps): bumps @umbraco-ui/uui from 1.16.0-rc.0 to 1.16.0 by @iOvergaard in #20535
• Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Client by @dependabot[bot] in #20580
• Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in #20621
• Dependencies: Update dotnet sdk and node development dependency to latest secure version of current major (16) by @AndyButland in #20734

🌈 Accessibility Improvements

• Login form: Improves accessibility by removing duplicate label and aria-label by @MrHutmat in #20232
• Add accessibility label for splitview divider by @OskarKruger in #20380
• Announce newest notification using live region by @engijlr in #19979
• Entity Actions: Create button discernible text (fixes #20205) by @OskarKruger in #20434
• Entity Actions: More create button discernible text, extension of #20434 by @OskarKruger in #20458

🚀 New Features

• Add more icons correct Content Type Designer Icons by @nielslyngsoe in #20252
• Segments: Auto unfold the culture variant in non-culture-variant mode by @nielslyngsoe in #20189
• Loader bar: Implement loader for Content Workspaces by @nielslyngsoe in #20288
• Segments: Adds deprecation notices to AllowNonExistingSegmentsCreation by @iOvergaard in #20413
• Backoffice: Add Entity Signs (overlay icons) to tree items. by @engijlr in #20328
• Permissions: Added User fallback permission condition (closes #20097) by @madsrasmussen in #20224

🚤 Performance

• Performance: Added request cache to media type retrieval in media picker validation by @AndyButland in #20405
• Performance: Reduce number of database calls in save and publish operations by @AndyButland in #20485
• Performance: Request cache referenced entities when saving documents with block editors by @kjac in #20590

🐛 Bug Fixes

• Tiptap: QA Added acceptance tests for regression issue #19763 by @andr317c in #20226
• UX: Make approved colour picker remove button consistent with other multi value item remove buttons by @bjarnef in #20257
• Update Readme to signpost the Forum by @OwainWilliams in #20268
• QA Skip the known failing smoke test to avoid blocking other PRs by @nhudinh0309 in #20269
• UX: Add slightly more padding at top so user card outline is not cutoff by @bjarnef in #20258
• NuGet vulnerability warnings: Warn in non-Release mode, Error in non-Release mode by @emmagarland in #17244
• AllowEditInvariantFromNonDefault : Fix property write guard to use correct variant ID (closes #20250) by @madsrasmussen in #20277
• Layout header top custom property by @floede in #20080
• Micro-optimization: Move compilation of some Regex generation to compile time instead of runtime, make some static ones compiled by @Henr1k80 in #20287
• E2E nightly pipeline: QA Fix failing acceptance tests for invalid cases by @nhudinh0309 in #20289
• Media Workspace Path: add parent path to support absolute path generation by @nielslyngsoe in #20302
• Models: PropertyType constructor sets the DataTypeKey if IDataType has identity by @psot in #20301
• Log Viewer: Fixes continuous polling (closes #20274) by @leekelleher in #20310
• Localization: Fixed message in block group delete confirm modal (closes #20308) by @bjarnef in #20312
• Migrations: Create missing tabs on content types when referenced by both composition and content type groups (closes #20058) by @lauraneto in #20303
• Extend logging (add delay and period) by @erikjanwestendorp in #20333
• UX: Removed the dot "." in front of the jpg file extension example by @andersreus in #20334
• Refactoring: Add extension method for retrieval of language ISO codes if that's all we need by @AndyButland in #20324
• Media: Prevent svg image to extend outside the editor bounds by @ardelean94 in #20346
• Exception handling: Improve error messaging on invalid umbraco-package.json file by @AndyButland in #20332
• Handle vary by segment variant-entires by @nielslyngsoe in #20191
• Data Type: Improve missing property editor and property editor UI feedback by @lauraneto in #20339
• Caching: Fixes regression of the caching of null representations for missing dictionary items (closes #20336 for 16) by @AndyButland in #20349
• Switch container to use SQL 2022 instead of SQL Edge by @CarlSargunar in #17262
• Color Picker: Set initial hex value for picker (closes #20326) by @bjarnef in #20357
• Color Picker: Styling for drag handle at swatch items by @bjarnef in #20360
• Localization: Added translations for area validation property labels by @bjarnef in #20362
• E2E Pipeline: QA Remove continue on error condition by @andr317c in #20365
• Change to layout of default Content area dashboard by @dalyUSN in #20355
• Block Grid: Add icon to allowed block types in area by @bjarnef in #20364
• Management API: Use EndpointMetadata to check for MapToApiAttribute at runtime to include Controller in Swagger document by @mdubbelv in #20144
• Block Grid: Add more spacing in combobox group header by @bjarnef in #20373
• Block Grid: Add a bit more spacing and align button in block grid areas config by @bjarnef in #20374
• Slider: improved value fallback handling + validation by @nielslyngsoe in #20228
• Entity-Action Bundle: Ensure First Action are updated in rendering by @nielslyngsoe in #20351
• Extension Registry: QA Added acceptance tests for readOnlyGuards rule, entity action and custom property editor by @nhudinh0309 in #19939
• Content: QA Add acceptance tests for regression issue #17735 by @nhudinh0309 in https://github.com/umbraco/Umbraco-CMS/pull/...

17.0.0-rc4

What's Changed

💥 Breaking Changes

• Dependencies: Updates Swashbuckle to v10 by @lauraneto in #20925
  • We have taken this dependency due to Swashbuckle 9 having a dependency on a version of Microsoft.OpenApi that will go out of support within the lifetime of Umbraco 17. In this way we can avoid having to make this update later, and incur a breaking change in a later minor of 17. The CMS will still generate OpenAPI 3.0.4 schemas. For more details, please see #20902 and the PR linked above.

📦 Dependencies

• Update further dependencies for 17 by @AndyButland in #20935
• build(deps): bump marked to 17.0.1 by @iOvergaard in #20933
• build(deps): bump @microsoft/signalr to 10.0.0 by @iOvergaard in #20932

🐛 Bug Fixes

• Localization: Restores region-specific cultures by @leekelleher in #20939

Full Changelog: release-17.0.0-rc3...release-17.0.0-rc4

17.0.0-rc3

What's Changed

🙌 Notable Changes

• Backoffice Login: Move access/refresh tokens to secure cookies (V17) by @kjac in #20820

💥 Breaking Changes

• Hosting: Require HTTPS by default (opt-out) by @kjac in #20813

📦 Dependencies

• .NET Packages: Update microsoft packages to non rc version by @nikolajlauridsen in #20858

🐛 Bug Fixes

• Entity Sign: Improve Firefox visibility and add focus support by @engijlr in #20733
• Picker Data Source: update getConfigValue with alias-based type safety by @madsrasmussen in #20802
• Collection Item Picker: support icon colors by @madsrasmussen in #20787
• Load Balancing: Clear request cache in cache version accessor on cache version update to prevent unnecessary cache roll forwards by @nikolajlauridsen in #20831
• News Dashboard: Replacing old hostname, with new custom one. by @NillasKA in #20837
• Extension template: Removes npm commands from MSBuild of the .csproj for umbraco-extension dotnet new template by @warrenbuckley in #20839
• Members: Fix EntityContainer.GetUdi() for member type containers by @ronaldbarendse in #20840
• Backoffice Login: Redact back-office PKCE codes from the server by @kjac in #20847
• Document input: Find variant name by @nielslyngsoe in #20853
• Rendering: Don't cache RTE value conversion (closes #20867) by @kjac in #20880
• Migrations: Handles rich text blocks created with TinyMCE in convert local links migration and refreshes internal datatype cache following migration requiring cache rebuild (closes #20885) by @AndyButland in #20887

Full Changelog: release-17.0.0-rc2...release-17.0.0-rc3

16.4.0-rc2

Changes since last RC

🙌 Notable Changes - Testing encouraged and appreciated!

• Backoffice Login: Move access/refresh tokens to secure cookies by @kjac in #20779
• Backoffice Login: Redact back-office PKCE codes from the server (V16) by @kjac in #20851
  As an added security feature used by default in Umbraco 17, user authentication tokens can be returned in secure cookies from the server's authentication requests. For backwards compatibility reasons, the feature is disabled by default, but can be enabled via the boolean configuration at Umbraco:Cms:Security:BackOfficeTokenCookie:Enabled. Read more in the Umbraco documentation.

Changes in previous RC for 16.4.0

📦 Dependencies

• Bump tar-fs from 3.1.0 to 3.1.1 in /src/Umbraco.Web.UI.Client by @dependabot[bot] in #20260
• Dependencies: Updates all npm dependencies for Client, Login, and UmbracoExtension by @iOvergaard in #20386
• build(deps): bumps @umbraco-ui/uui from 1.15.0 to 1.16.0-rc.0 by @iOvergaard in #20402
• Dependencies: Fixed dependency conflicts when installing Microsoft.EntityFrameworkCore.Design (closes #20421) by @lauraneto in #20474
• build(deps): bumps @umbraco-ui/uui from 1.16.0-rc.0 to 1.16.0 by @iOvergaard in #20535
• Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Client by @dependabot[bot] in #20580
• Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in #20621
• Dependencies: Update dotnet sdk and node development dependency to latest secure version of current major (16) by @AndyButland in #20734

🌈 Accessibility Improvements

• Login form: Improves accessibility by removing duplicate label and aria-label by @MrHutmat in #20232
• Add accessibility label for splitview divider by @OskarKruger in #20380
• Announce newest notification using live region by @engijlr in #19979
• Entity Actions: Create button discernible text (fixes #20205) by @OskarKruger in #20434
• Entity Actions: More create button discernible text, extension of #20434 by @OskarKruger in #20458

🚀 New Features

• Add more icons correct Content Type Designer Icons by @nielslyngsoe in #20252
• Segments: Auto unfold the culture variant in non-culture-variant mode by @nielslyngsoe in #20189
• Loader bar: Implement loader for Content Workspaces by @nielslyngsoe in #20288
• Segments: Adds deprecation notices to AllowNonExistingSegmentsCreation by @iOvergaard in #20413
• Backoffice: Add Entity Signs (overlay icons) to tree items. by @engijlr in #20328
• Permissions: Added User fallback permission condition (closes #20097) by @madsrasmussen in #20224

🚤 Performance

• Performance: Added request cache to media type retrieval in media picker validation by @AndyButland in #20405
• Performance: Reduce number of database calls in save and publish operations by @AndyButland in #20485
• Performance: Request cache referenced entities when saving documents with block editors by @kjac in #20590

🐛 Bug Fixes

• Tiptap: QA Added acceptance tests for regression issue #19763 by @andr317c in #20226
• UX: Make approved colour picker remove button consistent with other multi value item remove buttons by @bjarnef in #20257
• Update Readme to signpost the Forum by @OwainWilliams in #20268
• QA Skip the known failing smoke test to avoid blocking other PRs by @nhudinh0309 in #20269
• UX: Add slightly more padding at top so user card outline is not cutoff by @bjarnef in #20258
• NuGet vulnerability warnings: Warn in non-Release mode, Error in non-Release mode by @emmagarland in #17244
• AllowEditInvariantFromNonDefault : Fix property write guard to use correct variant ID (closes #20250) by @madsrasmussen in #20277
• Layout header top custom property by @floede in #20080
• Micro-optimization: Move compilation of some Regex generation to compile time instead of runtime, make some static ones compiled by @Henr1k80 in #20287
• E2E nightly pipeline: QA Fix failing acceptance tests for invalid cases by @nhudinh0309 in #20289
• Media Workspace Path: add parent path to support absolute path generation by @nielslyngsoe in #20302
• Models: PropertyType constructor sets the DataTypeKey if IDataType has identity by @psot in #20301
• Log Viewer: Fixes continuous polling (closes #20274) by @leekelleher in #20310
• Localization: Fixed message in block group delete confirm modal (closes #20308) by @bjarnef in #20312
• Migrations: Create missing tabs on content types when referenced by both composition and content type groups (closes #20058) by @lauraneto in #20303
• Extend logging (add delay and period) by @erikjanwestendorp in #20333
• UX: Removed the dot "." in front of the jpg file extension example by @andersreus in #20334
• Refactoring: Add extension method for retrieval of language ISO codes if that's all we need by @AndyButland in #20324
• Media: Prevent svg image to extend outside the editor bounds by @ardelean94 in #20346
• Exception handling: Improve error messaging on invalid umbraco-package.json file by @AndyButland in #20332
• Handle vary by segment variant-entires by @nielslyngsoe in #20191
• Data Type: Improve missing property editor and property editor UI feedback by @lauraneto in #20339
• Caching: Fixes regression of the caching of null representations for missing dictionary items (closes #20336 for 16) by @AndyButland in #20349
• Switch container to use SQL 2022 instead of SQL Edge by @CarlSargunar in #17262
• Color Picker: Set initial hex value for picker (closes #20326) by @bjarnef in #20357
• Color Picker: Styling for drag handle at swatch items by @bjarnef in #20360
• Localization: Added translations for area validation property labels by @bjarnef in #20362
• E2E Pipeline: QA Remove continue on error condition by @andr317c in #20365
• Change to layout of default Content area dashboard by @dalyUSN in #20355
• Block Grid: Add icon to allowed block types in area by @bjarnef in #20364
• Management API: Use EndpointMetadata to check for MapToApiAttribute at runtime to include Controller in Swagger document by @mdubbelv in #20144
• Block Grid: Add more spacing in combobox group header by @bjarnef in #20373
• Block Grid: Add a bit more spacing and align button in block grid areas config by @bjarnef in #20374
• Slider: improved value fallback handling + validation by @nielslyngsoe in #20228
• Entity-Action Bundle: Ensure First Action are updated in rendering by @nielslyngsoe in #20351
• Extension Registry: QA Added acceptance tests for readOnlyGuards rule, entity action and custom property editor by @nhudinh0309 in #19939
• Content: QA Add acceptance tests for regression issue #17735 by @nhudinh0309 in #20330
• Value Presets: also run value presets on load by @nielslyngsoe in #20239
• Block Grid: Configure minimum one column for areas by @bjarnef in #20363
• Block Grid: Styling of group drag with handle by @bjarnef in #20361
• Delivery API: QA Add acceptance test for media delivery api by @nhudinh0309 in #20182
• User Profile: Q...