Engineering notes

Umbraco.AI 1.0.0 through 1.13.x carry a moderate information-disclosure flaw and the 1.14.0 fix is a breaking change. Plus Umbraco 18 and Elements, uSync v18, and 14 December 2026 on Umbraco 13.

Umbraco 17.4.0 exposed JSON Schema for data types and document types, which is what makes programmatic content writing verifiable. Around it: four Umbraco.AI add-ons in beta, uSync 17.3.0's version jump, and a preview-URL auth bypass.

Umbraco shipped Umbraco.AI (open source, provider-agnostic) and Umbraco Compose (commercial SaaS) in the same month. What each one costs you, plus the 13 to 17 upgrade 403 and uSync 17.0.4.

Umbraco 13.0.0-13.12.0 got a moderate security patch on 9 December. Everything else the month produced came from 24 Days in Umbraco, plus a new Enterprise bundle and a Q1 2026 date for Compose.

Umbraco 17 LTS landed on 27 November on .NET 10, with three years of support. uSync 17.0.0 and Clean Starter Kit v7 shipped the same day. The community had a harder month than the product did.

Umbraco's September 2025: a security patch for Umbraco 13 through the Smidge dependency, the Developer MCP Server beta moving into Umbraco's own namespace, two uSync patches, and the 2026 price list read after the fact.

Four of the month's eleven Umbraco items are about MCP and AI. An agent built an element type from a single prompt, Umbraco Commerce got an MCP proof-of-concept, and the only post that said anything about who should be allowed to do that was a uSync patch note.