umbraco/Umbraco-CMS release-17.3.0-rc on GitHub

Upgrade Notes

In 17.3 we have upgraded our dependency on MailKit to 4.15.1. This is a minor version update, but we found a few changes we had to make in core to accommodate changes to nullability constraints. Unless using methods of this library, or it's transitive dependency MimeKit, it's unlikely projects will be affected. The update is necessary though, as the version we previously depended on now has a security vulnerability raised against it.

We have made a change to how we handle redirects which brings a significant performance improvement for publish time on large sites, when documents with many descendent nodes are published. If you have custom URL providers you should review this change, as there are some very rare cases where you'll need to adjust to ensure descendent redirects are correctly handled.

Note also that we now auto-generate HMAC secret key for new installs. This has been applied to make Umbraco more secure by default, but it's not been forced for upgrades.

What's Changed

🙌 Notable Changes

Templates: Add optional Central Package Management support to UmbracoProject and UmbracoExtension templates by @NguyenThuyLan in #21641
Service registration: Allow running Umbraco with different combinations of backoffice, website and delivery API (closes #21622) by @AndyButland in #21630
Imaging Configuration: Auto-generate HMAC secret key for new installs by @AndyButland in #21976
Migrations: Run unattended upgrades in background, add liveness/readiness health probes (closes #21987) by @AndyButland in #22020

💥 Breaking Changes

Dependencies: Update MailKit to 4.15.1 by @AndyButland in #22028

📦 Dependencies

Bump lodash from 4.17.21 to 4.17.23 in /tests/Umbraco.Tests.AcceptanceTest in the npm_and_yarn group across 1 directory by @dependabot[bot] in #21519
Bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in #21754
Bump qs from 6.14.1 to 6.14.2 in /src/Umbraco.Web.UI.Client in the npm_and_yarn group across 1 directory by @dependabot[bot] in #21755
Dependencies: Bumps @umbraco-ui/uui from 1.17.0 to 1.17.1 by @iOvergaard in #22029
Dependencies: Updates @umbraco-ui/uui to 1.17.2 to fix multiple folder drag-and-drop failing (closes #21837) by @iOvergaard in #21886
Backoffice: Update vite from 7.1.11 to 7.3.1 by @iOvergaard in #22065
Dependencies: Update server-side dependencies to latest patch or minor releases by @AndyButland in #21860

🚤 Performance

Performance: Implement key-based caching for data type and template repositories by @AndyButland in #21280
Management API: Optimize collection view performance by eliminating N+1 patterns by @AndyButland in #21684
Performance: Optimize handling of content type updates by @kjac in #21910
Backoffice Performance: Add inflight request deduplication to item data request managers by @madsrasmussen in #21767
URL and Alias Caches: Optimize for invariant documents by @AndyButland in #21558
Custom Views: Prevent re-rendering Block Views and Properties by @rickbutterfield in #21186
Core: Minimize await to a single JS cycle (refactor #21186) by @nielslyngsoe in #22074
Auth: Skip /token refresh when access token is still valid by @iOvergaard in #22087
Memory Management: Dispose IDisposable resources correctly in four internal classes by @AndyButland in #22014
Redirect Tracking: Fix segment change detection and optimise descendant traversal (closes #22082) by @AndyButland in #22091

🌈 Accessibility Improvements

Entity Actions: Adds a descriptive title to the first action so you know what it does by @iOvergaard in #21739
Search field: Added aria-label and name to search input for accessibility (closes #21938) by @andreaslborg in #21962
List view: Added labels entity bulk action buttons by @andreaslborg in #21964
Accessibility: Add title attributes to buttons in block list entry and property editor UI by @manutdkid77 in #21842
Accessibility: Add tooltips to block grid entry actions by @manutdkid77 in #21958
Accessibility: Added title attribute for icon in content types by @TechPdo in #21956

🚀 New Features

Tiptap RTE: Add delete action support for RTE blocks (closes #21345) by @leekelleher in #21615
Tiptap RTE: Add clipboard copy/paste support for RTE blocks (closes #21345) by @leekelleher in #21604
Imaging: Intelligent format detection for thumbnail generation by @iOvergaard in #21570
Tiptap RTE: Adds actionButton kind for toolbar extensions (closes #21682) by @leekelleher in #21703
Management API: Add endpoints, service and repository methods for retrieving the allowed parents for content types by @NillasKA in #21586
Block List/Grid: Add "Clear" property action. by @engijlr in #21436
Collection: Add description support to default collection item card and ref elements by @madsrasmussen in #21654
Block Editor: Implements hints for Tabs (fixes #21178) by @nielslyngsoe in #21672
Textbox/area: Add character countdown message (closes #19505) by @engijlr in #21722
Document Collection: Enable Entity Actions on cards by @madsrasmussen in #21802
Media Collection: Introduce Entity Actions for cards by @madsrasmussen in #21816
Entity Data Picker: Add text filter feature toggle for Collection Data Sources by @madsrasmussen in #21732
Image cropper and file upload: Implemented automatic naming of uploaded file (closes #21764) by @TechPdo in #21775
Entity Signs: Enable entity signs for media items (closes #21786) by @AndyButland in #21832
Management API: Add document and data types tree search endpoints by @Migaroez in #21628
Members: Enable sorting on member table and order member groups by name (closes #21960) by @AndyButland in #21963
Management API: Add item ancestors endpoints returning item response models by @AndyButland in #21874
Collection Views: Add sortable value column for custom property sorting (closes #21425) by @AndyButland in #21479
Entity Data Picker: Add configurable Picker Views for Collection Data Sources by @madsrasmussen in #21738
Account login: Separate AllowConcurrentLogins settings for users and members (closes #21667) by @AndyButland in #21940
Link Picker, RTE: Support linking to a specific culture by @NguyenThuyLan in #21466
Management API: Add batch read endpoints for Document Types, Media Types, Member Types, and Data Types by @AndyButland in #21565
Extension: Introduce extension core module and umb-input-extension element by @madsrasmussen in #21705
Condition: is-routable-context-condition by @nielslyngsoe in #21428

🐛 Bug Fixes

Upload Field: Show filename after file upload (closes #21587) by @iOvergaard in #21887
Media Picker: Allow folder selection in media entity picker (closes #21885) by @AndyButland in #21895
Media: Mark touchstart handler as non-passive using @eventOptions decorator by @iOvergaard in #21845
Repositories: Use FirstOrDefault over ExecuteScalar for GUID and nullable types (closes #21448) by @idseefeld in #21552
Content Type Designer: transfer root properties when creating first tab. by @nielslyngsoe in #21582
TipTap: Avoid empty target attribute on links by @AndyButland in #21572
Repositories: Quote table, column and alias names (closes #21451) by @idseefeld in #21577
Duplicate to: switch to split icon by @nielslyngsoe in #21616
External Login Providers: Fixes deleting a member with more than 1 external login provider causes an error by @NillasKA in #21625
OEmbed providers: Tighten up resource URL matching for providers by @NguyenThuyLan in #21583
Picker: Add pagination to search results by @madsrasmussen in #21593
Block Catalogue: Adaptive modal size based on the amount of Block Types by @nielslyngsoe in #21619
Block Editors: UX Flow when creating one block / block with no content properties / inline editing by @nielslyngsoe in #20836
Enable usage of umb-input-entity-data element without registering a propertyEditorDataSource. by @madsrasmussen in #21686
Configuration: Add UserPassword and MemberPassword properties to SecuritySettings for appsettings.json intellisense (closes #21657) by @NguyenThuyLan in #21681
Package Manifest: Enable cache buster token replacement for extensions (closes #16893) by @iOvergaard in #21709
Delivery API: Make the Delivery API "access" attributes public (closes #21677) by @kjac in #21760
Razor Template Debugging: Allow Umbraco projects to work with the Razor cohosting editor by @davidwengier in #21861
Create new folder on enter in media picker by @bjarnef in #20648
User History: Improve recent history display with better labels and de-duplication by @AndyButland in #21656
Member Group Picker: Add server-side paging to public access modal (closes #21790) by @AndyButland in #21834
Move/Duplicate: Filter tree picker based on allowed parent rules. by @engijlr in #21646
Backoffice Search: Default global search to current section (closes #21621) by @AndyButland in #21636
Templating: Prevent editing of templates and partial views in production runtime mode (closes #21564) by @AndyButland in #21600
Media Picker: Allow custom folder types when creating inline folders (closes #21850) by @AndyButland in #21959
Health Checks: Add check for imaging HMAC secret key by @AndyButland in #21991
Configuration: Make MainDom acquisition timeout configurable by @AndyButland in #22013
Backoffice: Add CSP nonce support for inline scripts (closes #21575) by @AndyButland in #21581
Media Picker: Show friendly inline validation error when uploading a file with required media type properties (closes #20295) by @AndyButland in #22025
Backoffice: Export block-single package for external consumers (closes #22044) by @AndyButland in #22045
Management API: Add server-side validation preventing element types from varying by segment (closes #21643) by @AndyButland in #21728
Account login: Enforce AllowConcurrentLogins for backoffice users and members by @AndyButland in #21928
External Login Providers: Set SignOutRedirectUrl on backoffice sign-out to support external OIDC provider logout (closes #21854, #16869) by @NguyenThuyLan in #21952
Referenced Items: Prevent move to recycle bin when referenced and DisableDeleteWhenReferenced is enabled (closes #21986) by @AndyButland in #21999
Media Item Search: Fixing missing attribute for constructor by @NillasKA in #21659
Extension Insights: Fix collection by avoiding shallow copy of manifests by @madsrasmussen in #21660
Collection: Fix undefined take in collection filter and hide pagination when all items are shown by @madsrasmussen in #21662
Block Editors: Sync Validation Messages when in Inline Mode (Fixes #21518) by @nielslyngsoe in #21669
21599: Removed the icon from redirect URL dashboard as per request in… by @TechPdo in #21665
Content Type Properties: make content type property responsive by @nielslyngsoe in #21559
Block Grid Editor: adjust styling of default Grid Block views (Fixes #16375) by @nielslyngsoe in #21685
Block Grid Editor: improved extension initialization for Inline Mode Blocks by @nielslyngsoe in #21661
User Management: Avoid discard changes dialog after enabling/disabling a user (closes #19019) by @AndyButland in #21702
Long Running Operations: Increase type column length and handle rebuilds of Examine indexes with long names (closes #21666) by @NguyenThuyLan in #21715
Repositories: Fix GetAllContentTypeIds query on content type to generate correct SQL (closes #21611) by @AndyButland in #21612
Persistence models: Fix incorrect webhook DTO by @nikolajlauridsen in #21736
Persistence Models: DTO attribute fixes by @idseefeld in #21670
Permissions: Fix GetPermissionsAsync to resolve permissions from nearest ancestor by @lauraneto in #21741
Decimal Property Editor: Increase step size precision for configuration fields (closes #21759) by @AndyButland in #21769
Migrations: Re-trust untrusted foreign key and check constraints on SQL Server and fix bulk inserts to prevent recurrence by @AndyButland in #21744
Audit: Fix container update operations incorrectly logged as new by @lauraneto in #21774
Packaging: Fix package migration plans re-running all steps when a new step is added (closes #21730) by @AndyButland in #21734
Repository Caches: Fix GUID read repository cache key collision causing GetAll failures (closes #21756) by @AndyButland in #21762
RTE Link Picker: Fix media selection to allow items not permitted at root. by @engijlr in #21678
Media Querying: Fix MediaAtRoot() to use IMediaNavigationQueryService root keys by @FabCodeDE in #21807
Server Events: Invalidate client-side cache for composing types on composition deletion (closes #21768) by @AndyButland in #21831
Localization: Added missing translation values for field label on create member form by @Yinzy00 in #21835
Block Variance: Ensure de-duplication and removal of orphaned expose entries in BlockEditorVarianceHandler by @kiannidev in #21801
Document Workspace: Update document status on publish and unpublish (closes #21650) by @AndyButland in #21668
Cache Refreshers: Fix change tracking for content types by @kjac in #21856
Routing: Fix umbracoUrlName being ignored in DefaultUrlSegmentProvider on culture-variant content when property is invariant (closes #16791) by @NguyenThuyLan in #21735
Examine: For indexing in the RTE, replace all HTML tags with spaces to make sure word boundaries are preserved by @arknu in #21797
Examine: Keep track of rebuilding in memory on startup and move use of LongRunningOperationService to user triggered rebuilds (closes #21716) by @Zeegaan in #21821
UmbracoExtension template: Use runtimeConfigPath for automatic auth by @iOvergaard in #21838
Content Type: Fix null property description displaying as "null" string (closes #21873) by @AndyButland in #21879
Content Picker: Fix dynamic root resolution for new unsaved documents (closes #21870) by @AndyButland in #21880
Backoffice Search: Discard stale search results when switching providers (closes #21784) by @AndyButland in #21849
Document Repository: Batch document IDs in GetContentSchedulesByIds to avoid SQL parameter limit (closes #21865) by @AndyButland in #21868
Dotnet Templates: Update default UmbracoVersion template value using MSBuild target (closes #21889) by @AndyButland in #21893
Database Cache: Fix full database cache rebuild dropping variant and composed property values (closes #21863, #21882) by @AndyButland in #21890
URL Info: Fix invariant content URLs missing under non-default language domains (closes #21866) by @AndyButland in #21883
Cache: Ensure local cache instructions count towards last synced ID by @kjac in #21907
Data Types: Use configured ValueType when creating Label data types (closes #21853) by @AndyButland in #21914
Media Picker: Fix missing tooltip on media items in picker modal and property editor by @engijlr in #21913
Block Editors: Align create label by @nielslyngsoe in #21731
Block List: consistent spacing between blocks by @nielslyngsoe in #21750
Fix: Increase size of modal listing property editors by @TechPdo in #21825
Repeatable Textstring: Skip empty strings in validation and persistence (closes #21912) by @AndyButland in #21915
Media Dropzone: Clarify error messages when file upload is not allowed (closes #21506) by @AndyButland in #21708
Public Access: Handle inherited protection gracefully in modal dialog (closes #21965) by @AndyButland in #21971
Account logout: Handle revocation request for cookie-stored back-office tokens (closes #21918) by @AndyButland in #21944
Tiptap RTE: Table node-view refactor to fix popover menus (closes #20614) by @leekelleher in #21696
Hybrid Cache: Resolve IsPublished() returning false in preview mode (closes #21983) by @AndyButland in #21985
Block editors: Make block editors read-only when document is trashed (closes #21973) by @AndyButland in #21982
Media Workspace: Fix collection view showing root items after creating new folder (closes #21700) by @AndyButland in #21753
Backoffice Toast Notifications: prevent double toast notifications on cancelled server operation statuses by @madsrasmussen in #21993
Content Types: Fix API response for cancelled delete operation by @marcoteodoro in #21758
Update badge icon (to use Lucide id-card) by @TechPdo in #21911
Content Picker: Pass preview flag to published content cache lookups (closes #21972) by @AndyButland in #21975
Decimal Property Editor: Align step precision with database storage (closes #22003) by @AndyButland in #22004
Content Rollback: error handling by @nielslyngsoe in #22018
Data Access: Modifies entity repository sibling queries to support custom database p[oviders (closes #21852) by @idseefeld in https://github.com//pull/21671
Breadcrumb variant-name logic improvment by @nielslyngsoe in #21617
Content picker: Fix dynamic root not firing when inside block list (closes #22008) by @EPP-KMD in #22011
Data Types: Fix collection view references not showing in data type usages (closes #21649) by @AndyButland in #21655
Localization: Add for restore entity action by @Lantzify in #22040
Localization: Export dictionary modal by @Lantzify in #22038
Localization: Add for language picker modal by @Lantzify in #22043
Sorter: Detecting outside drops when browser does not get events by @nielslyngsoe in #21664
URL Picker: Fix validation error persisting after link selection (closes #21903, #21454) by @AndyButland in #22034
fix: combine external-supplied pickableFilter with internal filter in picker input contexts (closes #21859) by @0xRozier in #21989
Content: Only validate selected Cultures by @nielslyngsoe in #21361
Redirect Tracking: Fix segment duplication when domain has a path segment (closes #21763) by @AndyButland in #21772
Auth: Fix multi-tab auth failures by removing appauth dependency (closes #20873, #21598, #21704, #22022) by @iOvergaard in #21830
URL Picker: Fix title field only showing first character when typing URL (closes #22048) by @AndyButland in #22053
Migrations: Run AddSortableValueToPropertyData before MoveDocumentBlueprintsToFolders by @AndyButland in #22063
Templates: Add direct Swashbuckle dependency to extension template (closes #21864) by @AndyButland in #21869
Auth: Addresses regression where you could not configure separate auth cookie names (closes #22049) by @iOvergaard in #22057
Relations: Exclude relateParentDocumentOnDelete from EmptyRecycleBin reference check (closes #21926) by @AndyButland in #21954
Member Service: Fix skip/take pagination in GetAll (closes #22006) by @AndyButland in #22010
Management API: Defensively handle path integrity issues when resolving ancestors (closes #21822) by @AndyButland in #22036
Routing: Safely ensure AliasUrlProvider URLs have a leading slash by @callumbwhyte in #22068
Localization: Added missing Japanese translations by @Lantzify in #22056
Public Access: Preserve ancestor settings in dialog when setting up protection (closes #21740) by @farmergeek94 in #21742
Notifications: Correct the deep link URL in notification emails (closes #22047) by @AndyButland in #22050
Public Access: Align state and initial display of toggles and buttons on modal (closes #22084) by @AndyButland in #22086
Fix the CSP in our local project to support iframing the marketplace by @AndyButland in #22093
Relations: Fix relation type detail navigation from collection list (closes #22092) by @AndyButland in #22095
Auth: Fix re-entrant /token call after OAuth code exchange by @iOvergaard in #22097
Media: Allow File media type as fallback when no specific extension match is available (closes #21733) by @AndyButland in #22054
Content Picker: Fix item reference link navigation (closes #22085) by @AndyButland in #22103
File Upload: Lowercase file extension before validation (closes #22096) by @iOvergaard in #22108
Upload Field: Fix image overflowing content container (closes #22106) by @iOvergaard in #22107

🧪 Testing

E2E: QA Bumped version of test helper to fix the failing tests by @nhudinh0309 in #21596
Tests: Fix permission controller tests to use correct entity keys by @lauraneto in #21613
Preset property value: acceptance test by @NguyenThuyLan in #21498
E2E: QA Updated acceptance tests for adding block element to match the UI changes by @nhudinh0309 in #21679
Unit Tests: Add comprehensive coverage for BlockEditorVarianceHandler by @kiannidev in #21706
E2E: QA Added acceptance tests for for scheduled publishing by @nhudinh0309 in #19794
E2E: Move test helpers and builders into the acceptance test project and publish as @umbraco/acceptance-test-helpers by @andr317c in #21773
Integration tests: Re-virtualized CustomMvcSetup by @lars-erik in #21947
E2E: QA Updated AllowEditInvariantFromNonDefaultIsTrue tests to match the UI changes by @nhudinh0309 in #21950
Integration Tests: Fix null reference errors by @Migaroez in #21953
E2E: QA: Added acceptance tests for dynamic roots by @andr317c in #21966
E2E: QA: added acceptance tests for preview by @andr317c in #21967
E2E: QA Updated failing acceptance tests to match the UI changes by @nhudinh0309 in #22002
E2E: QA Added acceptance tests for allowing folder selection in media entity picker by @nhudinh0309 in #21981
E2E: QA: Updated locator to find rollback button on the document workspace by @andr317c in #22030
E2E: QA Updated the UI helper to verify that the image cropper is rendered by @nhudinh0309 in #22046

🛡️ Code Quality, Documentation and Refactoring

Content Rollback: Abstracted rollback into reusable contentRollback entity action and modal kinds by @leekelleher in #21939
Audit Log: Abstracted History Info App into reusable auditLog kind (for documents & media) by @leekelleher in #21898
Auth: Split auth modal into reusable view and introduce new non-dismissable modal type (closes #19628) by @iOvergaard in #21846
Content Type: Introduce Entity Content Type Entity Context by @madsrasmussen in #21817
Media Types: Add public constant for Folder media type GUID by @AndyButland in #21597
Updates Umbraco templates, removes framework choice, makes LTS version a wildcard by @Jeavon in #21430
Code Documentation: Add XML documentation to all public members in Umbraco.Core by @readingdancer in #21471
Backoffice NPM: use looser peerDependencies version ranges for plugin compatibility by @iOvergaard in #21644
Initial update to a couple of Management API endpoints (closes #20689) by @OwainWilliams in #20549
Add endpoint descriptions to all Management API controllers (closes #20689) by @Copilot in #20690
Extension Slot: JS Docs update by @nielslyngsoe in #21645
Docs: Add breaking changes avoidance policy to CLAUDE.md by @AndyButland in #21683
Developer Experience: Clarify nullability for BackOfficeAuthenticationBuilder.SchemeForBackOffice (closes #21689) by @PeterKvayt in #21690
Task: Regenerate OpenAPI definition and backoffice client SDK by @lauraneto in #21694
Developer Experience: Clarify obsoletion warning messages by @AndyButland in #21695
API Docs: Fix and optimize DocFX API documentation pipeline by @andr317c in #21707
Entity Data Picker: Register non-editor manifests statically by @leekelleher in #21721
Tree: Provide UmbEntityContext from the tree item context base by @madsrasmussen in #21770
Document Collection: Reuse card view kind by @madsrasmussen in #21791
CurrentUserModal: use getContext instead of consumeContext by @nielslyngsoe in #21843
Collection: Provide UmbEntityContext for entity collection item elements by @madsrasmussen in #21847
Slider Preset: make it easier to read the code by @nielslyngsoe in #21955
File Uploads: Remove legacy Windows path length checks and related tests by @ronaldbarendse in #21884

💻 Core Developer Experience

MCP: Basic setup for MCP in sourcecode by @nielslyngsoe in #21061

New Contributors

@TechPdo made their first contribution in #21665
@FabCodeDE made their first contribution in #21807
@kiannidev made their first contribution in #21801
@davidwengier made their first contribution in #21861
@andreaslborg made their first contribution in #21962
@EPP-KMD made their first contribution in #22011
@farmergeek94 made their first contribution in #21742

Full Changelog: release-17.2.2...release-17.3.0

umbraco/Umbraco-CMS release-17.3.0-rc 17.3.0-rc on GitHub