What's Changed
Warning
ImageSharp licence check: Release builds can fail after upgrading
This release updates SixLabors.ImageSharp to 3.2.0 and SixLabors.ImageSharp.Web to 3.3.0 to take Six Labors' security fixes (#24158). These versions add a build-time licence check from Six Labors. Whether your project is affected depends on how it references ImageSharp:
- ImageSharp comes in only through Umbraco (or another package): no change.
- Your project has a direct
PackageReferencetoSixLabors.ImageSharporSixLabors.ImageSharp.Web: Release builds fail with "No Six Labors license found". Debug builds only warn, so you may not notice this until CI or publish. - Your direct reference is pinned to an older version (for example 3.1.12): restore fails with NU1605 (package downgrade). After you update the reference, the point above applies.
To resolve this, either remove the direct reference if it only exists to pin a version (Umbraco still brings ImageSharp in, so its APIs stay available), or get a licence key from Six Labors. See Security Support and License Enforcement for licence options. Sites using Umbraco.Cms.Imaging.ImageSharp2 stay on ImageSharp 2.x and are not affected.
🙌 Notable Changes
- Dependencies: Bump SixLabors.ImageSharp to 3.2.0 and ImageSharp.Web to 3.3.0 for security fixes (17) by @AndyButland in #24158
📦 Dependencies
- Templates: Fix npm install of the Umbraco Extension template by aligning @hey-api/openapi-ts with 0.99 by @iOvergaard in #24030
- Dependencies: Bumps @umbraco-ui/uui from 2.0.2 to 2.1.0 by @iOvergaard in #24113
- Dependencies: Bumps @umbraco-ui/uui from 2.1.0 to 2.1.1 by @iOvergaard in #24154
- Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23785
- Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23857
- Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23918
- Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24007
- Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24086
- Icons: Update
lucide-staticto 1.52.0 andsimple-iconsto 16.34.0 and regenerate icons by @leekelleher in #24105 - Dependencies: Pin
System.Security.Cryptography.Pkcsand.Xmlto 10.0.13 to resolve vulnerability warnings (17) by @AndyButland in #24212
🚀 New Features
- Management API: Add
hasChildrento document and media collection responses by @AndyButland in #23685 - Backoffice: Add breadcrumbs to missing workspaces by @madsrasmussen in #23832
- Members: Add Member Group column to the member collection table view by @madsrasmussen in #23819
- Block actions: observable api props by @nielslyngsoe in #23725
- Template card: support href by @nielslyngsoe in #23722
- UI: add more loading indications by @nielslyngsoe in #23666
- Sorting: Add server-side sort of children by field (closes #19703) by @AndyButland in #23377
- Dictionary: Add
KeySearchModesetting to control how the filter matches the item key (closes #23881) by @NicoM77 in #23882 - Breadcrumb: Support navigate to breadcrumb folders and root by @madsrasmussen in #23949
- Document Blueprints: Add workspace breadcrumb support for items and folders by @madsrasmussen in #24000
- Tags: Split pasted comma/newline lists into multiple tags while keeping typed commas literal by @AndyButland in #23419
- SignalR: Automatically reconnect backoffice preview and server-event connections (closes #21648) by @AndyButland in #23170
- Entity Actions: Add separatorBefore to render separators in action menus by @iOvergaard in #23997
- Image Cropper: Add checkered background + docs by @bjarnef in #23652
- Document Picker: Render the full Collection UI when browsing into a node that has one by @madsrasmussen in #23712
- Members: Add group to member filter item by @Zeegaan in #23795
🚤 Performance
- Auth: Do not tear down a session established while an older token refresh was in flight by @iOvergaard in #23811
- Cache instructions: Do not hold a read transaction while refreshing caches by @ronaldbarendse in #23961
- Routing: Persist document URL aliases inside the content transaction instead of under the global DocumentUrlAliases lock by @nikolajlauridsen in #24100
- Performance: Multi URL Picker re-requests info for each change by @iOvergaard in #23793
🐛 Bug Fixes
- Multinode Treepicker: Correct the entity types advertised by the value schema by @AndyButland in #23760
- Rich Text: Fix local link tag matching for encoded braces and neighbouring tags by @ronaldbarendse in #23767
- Scoping: Correct WriteLock/ReadLock return behaviour when TimeSpan is passed in by @liamlaverty in #23777
- Maintenance page: Fix custom view override and make view paths configurable (closes #23749) by @AndyButland in #23763
- Workspace: Reload workspace structure when an entity's structure changes (e.g. after "Move to") by @madsrasmussen in #23803
- Sync: Attempt to resolve server role during boot by @kjac in #23801
- Block Editors: Align element level variance to the culture of the owning property value (closes #23588) by @AndyButland in #23690
- Database: Honour "Command Timeout" from the connection string (closes #23705) by @AndyButland in #23817
- Tiptap RTE: Restore the Text Direction toolbar buttons (closes #23806) by @leekelleher in #23825
- Tiptap RTE: Re-evaluate toolbar element disabled state on editor changes (closes #23823) by @leekelleher in #23833
- Tiptap RTE: Tiptap preserve links when clearing formatting (closes #23695) by @andreaslborg in #23708
- Document/Media Recycle Bin: Redirect the workspace to the parent after trashing the open document or media item (closes #23347) by @madsrasmussen in #23797
- Distributed Locking: Bound the SQL Server lock command by its own lock timeout by @AndyButland in #23842
- Publishing: Make branch publishing property variance aware by @kjac in #23850
- Validation: Reset validation when valid by @nielslyngsoe in #23694
- Trees: Remove the debounce delaying tree active-state updates after navigation by @madsrasmussen in #23859
- Block Grid: observe catalogue routes by @nielslyngsoe in #23723
- Localization: Clipboard by @Lantzify in #23856
- Backoffice Section Menu: Do not expand the parent tree item when creating by @madsrasmussen in #23860
- Localization: Use UK conventions when formatting dates for "English (UK)" backoffice users (closes #23809) by @AndyButland in #23899
- Preview: Inject the preview badge via an
ITagHelperComponent(closes #23505) by @iOvergaard in #23594 - Document Picker: Fix removal of a "not found" reference (closes #23792) by @AndyButland in #23796
- Cookies: Write the exposed backoffice cookie only once per token response (closes #23885) by @AndyButland in #23888
- Property settings: preserve selected custom validation option when re-opening (closes #22916) by @AndyButland in #22930
- Tiptap RTE: Fix style menu class detection on marks and stuck toggles by @leekelleher in #23915
- Workspace: Redirect to parent after permanent delete by @madsrasmussen in #23880
- Markdown Editor: Toolbar shadow only shows once scrolled by @leekelleher in #23929
- Block Editors: Publish segment variant values on culture varying document types (closes #23553) by @AndyButland in #23566
- Member Types: Add missing breadcrumb to member type folder workspaces by @madsrasmussen in #23952
- Folder: Folder workspaces use the shared entity detail workspace editor by @madsrasmussen in #23953
- Document URLs: Persist URL segments and aliases regardless of elected server role (closes #23565) by @AndyButland in #23943
- SQLite: Stop combining shared-cache mode with write-ahead logging (closes #23828) by @ronaldbarendse in #23960
- Block Editors: Clean up target block values when merging at publish time (closes #23540) by @kjac in #23965
- Block: Config description refinement by @nielslyngsoe in #23992
- Routing: Make legacy routing take ancestor publish status into account by @kjac in #23974
- Recycle Bin: Broaden trashable workspace context compatibility with name-write guard by @madsrasmussen in #24004
- Publishing: Localise the unroutable-content warning and state the actual reason (closes #23654) by @AndyButland in #23966
- Imaging: Bound image processing memory so containers are not OOM-killed when browsing media (closes #23556) by @AaronSadlerUK in #23557
- ModelsBuilder: Handle an InMemoryAuto mode that no live factory can satisfy by @AndyButland in #23755
- Validation: refactor and fix validation across variants by @nielslyngsoe in #23706
- Application URL: Let FirstRequest detection upgrade loopback and HTTP URLs and stop EveryRequest downgrading them by @ronaldbarendse in #23980
- Documents: Show only allowed templates in the document info template picker (closes #22539) by @TechPdo in #24029
- Blocks: Inline Editing tabs styling by @nielslyngsoe in #24026
- Localization: Apply localization to the user workspace entity actions and modals by @Lantzify in #24057
- Localization: A failing localization extension no longer breaks localization for the session (closes #23815) by @iOvergaard in #23996
- Variant Selector: hide when selected by @nielslyngsoe in #24092
- Tree: Polish Collection children appearance by @nielslyngsoe in #24010
- Media Input: provide a good identifier for the sorter by @nielslyngsoe in #24091
- Cache sync: run the inline isolated-cache sync without locks and without published-cache work by @nikolajlauridsen in #24034
- Media: Restore upload placeholder tiles in the media collection (closes #24088) by @iOvergaard in #24097
- Media Pickers: Show a "not found" state for deleted items instead of silently dropping or leaving them stuck loading by @madsrasmussen in #23739
- Published Cache: Prevent concurrent existence probes from reporting published content as cached null (closes #24066, #23405) by @AndyButland in #24076
- Document Collections: Show the collection symbol as the children indicator in the document table views by @madsrasmussen in #24075
- Cache sync: publish repository cache versions after their instructions and adopt them after processing by @nikolajlauridsen in #24053
- Notifications: Show notification handler messages on the first save of new content (closes #23589) by @AndyButland in #23613
- Members: Restore the external-only member workspace view (closes #23824) by @AndyButland in #23826
- Documents: Report both the save and the publish outcome from combined create/update-and-publish operations (closes #23781, #23954, #24041) by @AndyButland in #23699
- Content: Respect server-reassigned key after create (closes #23344) by @AndyButland in #23353
- Management API: Sign out disabled or locked out users instead of issuing new tokens (closes #15309) by @arnelirobles in #23995
- Dynamic Root: Return no roots when the query resolves to the content root instead of the system root key by @AndyButland in #24068
- Tiptap RTE: Stop persisting an invalid
type="external"attribute on links (closes #23648) by @AndyButland in #23676 - Users: Show no start nodes in the user access overview when a user has no content or media access by @lauraneto in #24101
- Resources: Make the abortSignal option of tryExecute work for every request by @iOvergaard in #24047
- Document Workspace: Resolve the user permission condition by alias for Save and publish (closes #24123) by @Luuk1983 in #24125
- Dynamic Root: Prevent selecting document type folders in query steps (closes #24116) by @AndyButland in #24121
- Redirect URL Management: Keep the search term applied when paging, and show the create date (closes #23687) by @AndyButland in #23818
- Content Types: Page through all allowed content types rather than stopping at the first 100 (closes #23512) by @AndyButland in #23522
- Backoffice: Allow running without website rendering (closes #24084) by @andreaslborg in #24128
- Removed <title> elements from 11 icons by @abjerner in #23752
- Media: Parse the file ext to the media card (closes #23520) by @iOvergaard in #23805
- Relations: Open items from the Trash Dialog as hrefs with
target="_blank"by @iOvergaard in #23812 - Database: Specify the log file when creating a LocalDB database (closes #23852) by @Luuk1983 in #23854
- Tiptap RTE: Detect class-only style menu items outside paragraphs and match whole class names by @erwindamsma in #23891
- Backoffice: keep a long block headline within the workspace editor by @Abhay-Dobariya in #23904
- Localize the collection view and child items labels by @christianfredh in #23983
- Health Checks: fix collapsing icon with long description text by @nathanwoulfe in #24018
- Fixed (some) Danish translations for compound words related to the block list by @abjerner in #24085
- Detail Request Manager: Return the saved item after an update instead of a stale cached copy by @iOvergaard in #24142
- Detail Request Manager: Pass the create and update request types in the right order by @iOvergaard in #24147
- Password reset: Report an unconfigured application URL before the user lookup and always apply the minimum response time by @iOvergaard in #24152
- Extensions: Run user entry points only after the signed-in user has loaded by @iOvergaard in #24167
🧪 Testing
- Tests: Harden
RecurringHostedServiceBasetiming tests against lost fake-clock ticks by @AndyButland in #23711
🛡️ Code Quality, Documentation and Refactoring
- Templates: Correct the help text for the Umbraco Extension template's --version option by @iOvergaard in #24051
- Tiptap RTE: Document the toolbar menu item argument on execute/isActive (closes #23660) by @leekelleher in #23844
- Menu: Generalise
UmbMenuStructureWorkspaceContextto support variant specialisation by @leekelleher in #23876 - Content Type Designer: Refactor route setup by @nielslyngsoe in #23855
- Users: Refactored Assign Access panel to use
umb-property-datasetand property editor UIs by @leekelleher in #23994 - User Group: Refactored Assign Access panel to use umb-property-dataset and property editor UIs by @madsrasmussen in #24002
- Tree Views: Retire the legacy tree-item-children collection view by @madsrasmussen in #23975
- Workspaces: extract leftover hardcoded workspace editors to workspace views by @nielslyngsoe in #23865
- Users: Restructured unlock user to make it consistent with the enable/disable operations by @Lantzify in #24067
- Notifications: Obsolete ServerVariablesParsingNotification, which is no longer published by @iOvergaard in #24090
- Backoffice: Remove or update references to our.umbraco.com by @bjarnef in #23667
🧑💻 Developer Experience
- Templates: Align the v17 Umbraco Extension template with v18 by @iOvergaard in #24054
New Contributors
- @Abhay-Dobariya made their first contribution in #23904
- @erwindamsma made their first contribution in #23891
- @NicoM77 made their first contribution in #23882
- @christianfredh made their first contribution in #23983
Full Changelog: release-17.7.1...release-17.8.0-rc