umbraco/Umbraco-CMS release-18.3.0-rc on GitHub

What's Changed

Warning

ImageSharp licence check: Release builds can fail after upgrading

This release updates SixLabors.ImageSharp to 3.2.0 and SixLabors.ImageSharp.Web to 3.3.0 to take Six Labors' security fixes (#24159). These versions add a build-time licence check from Six Labors. Whether your project is affected depends on how it references ImageSharp:

ImageSharp comes in only through Umbraco (or another package): no change.
Your project has a direct PackageReference to SixLabors.ImageSharp or SixLabors.ImageSharp.Web: Release builds fail with "No Six Labors license found". Debug builds only warn, so you may not notice this until CI or publish.
Your direct reference is pinned to an older version (for example 3.1.12): restore fails with NU1605 (package downgrade). After you update the reference, the point above applies.

To resolve this, either remove the direct reference if it only exists to pin a version (Umbraco still brings ImageSharp in, so its APIs stay available), or get a licence key from Six Labors. See Security Support and License Enforcement for licence options. Sites using Umbraco.Cms.Imaging.ImageSharp2 stay on ImageSharp 2.x and are not affected.

🙌 Notable Changes

Dependencies: Bump SixLabors.ImageSharp to 3.2.0 and ImageSharp.Web to 3.3.0 for security fixes (18) by @AndyButland in #24159

📦 Dependencies

Templates: Fix npm install of the Umbraco Extension template by aligning @hey-api/openapi-ts with 0.99 by @iOvergaard in #24031
Dependencies: Bumps @umbraco-ui/uui from 2.0.2 to 2.1.0 by @iOvergaard in #24113
Dependencies: Bumps @umbraco-ui/uui from 2.1.0 to 2.1.1 by @iOvergaard in #24155
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23785
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23786
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23857
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23858
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23918
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #23919
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24007
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24008
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24086
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in #24087
Icons: Update lucide-static to 1.52.0 and simple-icons to 16.34.0 and regenerate icons by @leekelleher in #24105
Dependencies: Pin System.Security.Cryptography.Pkcs and .Xml to 10.0.13 to resolve vulnerability warnings (18) by @AndyButland in #24213

🚀 New Features

Members: Add group to member filter item by @Zeegaan in #23795
Management API: Add hasChildren to document and media collection responses by @AndyButland in #23685
Backoffice: Add breadcrumbs to missing workspaces by @madsrasmussen in #23832
Members: Add Member Group column to the member collection table view by @madsrasmussen in #23819
Block actions: observable api props by @nielslyngsoe in #23725
Template card: support href by @nielslyngsoe in #23722
UI: add more loading indications by @nielslyngsoe in #23666
Sorting: Add server-side sort of children by field (closes #19703) by @AndyButland in #23377
Dictionary: Add KeySearchMode setting to control how the filter matches the item key (closes #23881) by @NicoM77 in #23882
Localization: Complete Simplified Chinese (zh) translation by @PolarBears in #23916
Document Picker: Render the full Collection UI when browsing into a node that has one by @madsrasmussen in #23712
Breadcrumb: Support navigate to breadcrumb folders and root by @madsrasmussen in #23949
Document Blueprints: Add workspace breadcrumb support for items and folders by @madsrasmussen in #24000
Image Cropper: Add checkered background + docs by @bjarnef in #23652
Tags: Split pasted comma/newline lists into multiple tags while keeping typed commas literal by @AndyButland in #23419
SignalR: Automatically reconnect backoffice preview and server-event connections (closes #21648) by @AndyButland in #23170
Entity Actions: Add separatorBefore to render separators in action menus by @iOvergaard in #23997
Users: Add "Type" filter (User / API User) to Users overview by @AndyButland in #23348
Scheduled Publishing: Schedule all selected languages at once by @AndyButland in #23375

🚤 Performance

Auth: Do not tear down a session established while an older token refresh was in flight by @iOvergaard in #23811
Performance: Multi URL Picker re-requests info for each change by @iOvergaard in #23793
Cache instructions: Do not hold a read transaction while refreshing caches by @ronaldbarendse in #23961
Migrations: Process single block list property data in pages to bound memory use (closes #23766, #23936) by @AndyButland in #23778
Routing: Persist document URL aliases inside the content transaction instead of under the global DocumentUrlAliases lock by @nikolajlauridsen in #24100

🐛 Bug Fixes

Multinode Treepicker: Correct the entity types advertised by the value schema by @AndyButland in #23760
Rich Text: Fix local link tag matching for encoded braces and neighbouring tags by @ronaldbarendse in #23767
Scoping: Correct WriteLock/ReadLock return behaviour when TimeSpan is passed in by @liamlaverty in #23777
Maintenance page: Fix custom view override and make view paths configurable (closes #23749) by @AndyButland in #23763
Workspace: Reload workspace structure when an entity's structure changes (e.g. after "Move to") by @madsrasmussen in #23803
Sync: Attempt to resolve server role during boot by @kjac in #23801
Block Editors: Align element level variance to the culture of the owning property value (closes #23588) by @AndyButland in #23690
Database: Honour "Command Timeout" from the connection string (closes #23705) by @AndyButland in #23817
Tiptap RTE: Restore the Text Direction toolbar buttons (closes #23806) by @leekelleher in #23825
Tiptap RTE: Re-evaluate toolbar element disabled state on editor changes (closes #23823) by @leekelleher in #23833
Tiptap RTE: Tiptap preserve links when clearing formatting (closes #23695) by @andreaslborg in #23708
Document/Media Recycle Bin: Redirect the workspace to the parent after trashing the open document or media item (closes #23347) by @madsrasmussen in #23797
Distributed Locking: Bound the SQL Server lock command by its own lock timeout by @AndyButland in #23842
Publishing: Make branch publishing property variance aware by @kjac in #23850
Validation: Reset validation when valid by @nielslyngsoe in #23694
Database: Specify the log file when creating a LocalDB database (closes #23852) by @Luuk1983 in #23854
Trees: Remove the debounce delaying tree active-state updates after navigation by @madsrasmussen in #23859
Block Grid: observe catalogue routes by @nielslyngsoe in #23723
Localization: Clipboard by @Lantzify in #23856
Backoffice Section Menu: Do not expand the parent tree item when creating by @madsrasmussen in #23860
Delivery API: Update Delivery API cache level for block editors by @kjac in #23873
Relations: Open items from the Trash Dialog as hrefs with target="_blank" by @iOvergaard in #23812
Localization: Use UK conventions when formatting dates for "English (UK)" backoffice users (closes #23809) by @AndyButland in #23899
Preview: Inject the preview badge via an ITagHelperComponent (closes #23505) by @iOvergaard in #23594
Document Picker: Fix removal of a "not found" reference (closes #23792) by @AndyButland in #23796
Backoffice: keep a long block headline within the workspace editor by @Abhay-Dobariya in #23904
Tiptap RTE: Detect class-only style menu items outside paragraphs and match whole class names by @erwindamsma in #23891
Cookies: Write the exposed backoffice cookie only once per token response (closes #23885) by @AndyButland in #23888
Property settings: preserve selected custom validation option when re-opening (closes #22916) by @AndyButland in #22930
Media: Parse the file ext to the media card (closes #23520) by @iOvergaard in #23805
Tiptap RTE: Fix style menu class detection on marks and stuck toggles by @leekelleher in #23915
Workspace: Redirect to parent after permanent delete by @madsrasmussen in #23880
Markdown Editor: Toolbar shadow only shows once scrolled by @leekelleher in #23929
Block Editors: Publish segment variant values on culture varying document types (closes #23553) by @AndyButland in #23566
Member Types: Add missing breadcrumb to member type folder workspaces by @madsrasmussen in #23952
Folder: Folder workspaces use the shared entity detail workspace editor by @madsrasmussen in #23953
Document URLs: Persist URL segments and aliases regardless of elected server role (closes #23565) by @AndyButland in #23943
SQLite: Stop combining shared-cache mode with write-ahead logging (closes #23828) by @ronaldbarendse in #23960
Block Editors: Clean up target block values when merging at publish time (closes #23540) by @kjac in #23965
Block: Config description refinement by @nielslyngsoe in #23992
Routing: Make legacy routing take ancestor publish status into account by @kjac in #23974
Recycle Bin: Broaden trashable workspace context compatibility with name-write guard by @madsrasmussen in #24004
Publishing: Localise the unroutable-content warning and state the actual reason (closes #23654) by @AndyButland in #23966
Imaging: Bound image processing memory so containers are not OOM-killed when browsing media (closes #23556) by @AaronSadlerUK in #23557
ModelsBuilder: Handle an InMemoryAuto mode that no live factory can satisfy by @AndyButland in #23755
Localize the collection view and child items labels by @christianfredh in #23983
Health Checks: fix collapsing icon with long description text by @nathanwoulfe in #24018
Validation: refactor and fix validation across variants by @nielslyngsoe in #23706
Application URL: Let FirstRequest detection upgrade loopback and HTTP URLs and stop EveryRequest downgrading them by @ronaldbarendse in #23980
Documents: Show only allowed templates in the document info template picker (closes #22539) by @TechPdo in #24029
Blocks: Inline Editing tabs styling by @nielslyngsoe in #24026
URL Aliases: Ignore aliases of unpublished documents (closes #23948) by @RizgarOzan in #23967
Localization: Apply localization to the user workspace entity actions and modals by @Lantzify in #24057
Localization: A failing localization extension no longer breaks localization for the session (closes #23815) by @iOvergaard in #23996
Variant Selector: hide when selected by @nielslyngsoe in #24092
Tree: Polish Collection children appearance by @nielslyngsoe in #24010
Media Input: provide a good identifier for the sorter by @nielslyngsoe in #24091
Cache sync: run the inline isolated-cache sync without locks and without published-cache work by @nikolajlauridsen in #24034
Elements: trash and delete redirects by @madsrasmussen in #24059
Media: Restore upload placeholder tiles in the media collection (closes #24088) by @iOvergaard in #24097
Fixed (some) Danish translations for compound words related to the block list by @abjerner in #24085
Media Pickers: Show a "not found" state for deleted items instead of silently dropping or leaving them stuck loading by @madsrasmussen in #23739
Removed <title> elements from 11 icons by @abjerner in #23752
Published Cache: Prevent concurrent existence probes from reporting published content as cached null (closes #24066, #23405) by @AndyButland in #24076
Element Picker: Return null for an empty value instead of an empty string (closes #23779) by @leekelleher in #24102
Document Collections: Show the collection symbol as the children indicator in the document table views by @madsrasmussen in #24075
Cache sync: publish repository cache versions after their instructions and adopt them after processing by @nikolajlauridsen in #24053
Notifications: Show notification handler messages on the first save of new content (closes #23589) by @AndyButland in #23613
Members: Restore the external-only member workspace view (closes #23824) by @AndyButland in #23826
Documents: Report both the save and the publish outcome from combined create/update-and-publish operations (closes #23781, #23954, #24041) by @AndyButland in #23699
Content: Respect server-reassigned key after create (closes #23344) by @AndyButland in #23353
Management API: Sign out disabled or locked out users instead of issuing new tokens (closes #15309) by @arnelirobles in #23995
Dynamic Root: Return no roots when the query resolves to the content root instead of the system root key by @AndyButland in #24068
Tiptap RTE: Stop persisting an invalid type="external" attribute on links (closes #23648) by @AndyButland in #23676
Users: Show no start nodes in the user access overview when a user has no content or media access by @lauraneto in #24101
Resources: Make the abortSignal option of tryExecute work for every request by @iOvergaard in #24047
Document Workspace: Resolve the user permission condition by alias for Save and publish (closes #24123) by @Luuk1983 in #24125
Dynamic Root: Prevent selecting document type folders in query steps (closes #24116) by @AndyButland in #24121
Redirect URL Management: Keep the search term applied when paging, and show the create date (closes #23687) by @AndyButland in #23818
Content Types: Page through all allowed content types rather than stopping at the first 100 (closes #23512) by @AndyButland in #23522
Element Folders: Show allowed element types in "Create" action when user has permission by @AndyButland in #23935
Backoffice: Allow running without website rendering (closes #24084) by @andreaslborg in #24128
Detail Request Manager: Return the saved item after an update instead of a stale cached copy by @iOvergaard in #24142
Detail Request Manager: Pass the create and update request types in the right order by @iOvergaard in #24147
Password reset: Report an unconfigured application URL before the user lookup and always apply the minimum response time by @iOvergaard in #24152
Extensions: Run user entry points only after the signed-in user has loaded by @iOvergaard in #24167

🧪 Testing

Tests: Harden RecurringHostedServiceBase timing tests against lost fake-clock ticks by @AndyButland in #23711
Acceptance Tests: Fix flaky tests caused by racing waits and weak assertions by @andr317c in #23650
E2E: QA Added acceptance tests for approved color label by @andr317c in #23046
Tests: Fix flaky and broken acceptance tests by @andr317c in #24019

🛡️ Code Quality, Documentation and Refactoring

Templates: Correct the help text for the Umbraco Extension template's --version option by @iOvergaard in #24051
Tiptap RTE: Document the toolbar menu item argument on execute/isActive (closes #23660) by @leekelleher in #23844
Backoffice: Remove or update references to our.umbraco.com by @bjarnef in #23667
Menu: Generalise UmbMenuStructureWorkspaceContext to support variant specialisation by @leekelleher in #23876
Content Type Designer: Refactor route setup by @nielslyngsoe in #23855
Users: Refactored Assign Access panel to use umb-property-dataset and property editor UIs by @leekelleher in #23994
User Group: Refactored Assign Access panel to use umb-property-dataset and property editor UIs by @madsrasmussen in #24002
Tree Views: Retire the legacy tree-item-children collection view by @madsrasmussen in #23975
Workspaces: extract leftover hardcoded workspace editors to workspace views by @nielslyngsoe in #23865
Users: Restructured unlock user to make it consistent with the enable/disable operations by @Lantzify in #24067
Elements: Reuse element menu structure for folders by @madsrasmussen in #24081
Notifications: Obsolete ServerVariablesParsingNotification, which is no longer published by @iOvergaard in #24090

New Contributors

@Abhay-Dobariya made their first contribution in #23904
@erwindamsma made their first contribution in #23891
@NicoM77 made their first contribution in #23882
@PolarBears made their first contribution in #23916
@christianfredh made their first contribution in #23983
@RizgarOzan made their first contribution in #23967

Full Changelog: release-18.2.1...release-18.3.0-rc

umbraco/Umbraco-CMS release-18.3.0-rc 18.3.0-rc on GitHub