Engineering notes

July forced two jobs: patch the Delivery API flaw (13.15.1 / 17.5.3 / 18.0.2) and patch Umbraco Forms (13.9.8 / 17.4.7 / 18.0.5). Everything else in the month was the December calendar, argued from four directions.

Umbraco.AI 1.0.0 through 1.13.x carry a moderate information-disclosure flaw and the 1.14.0 fix is a breaking change. Plus Umbraco 18 and Elements, uSync v18, and 14 December 2026 on Umbraco 13.

Umbraco 18 beta1 landed 13 May, beta2 on 14 May, the RC on 28 May, with thirty-five breaking entries in the notes. Elements phase one, typed OpenAPI schemas, Swashbuckle gone, and the field notes worth your afternoon.

Three vulnerabilities patched in Umbraco 16.5.1 and 17.2.2 on 10 March. The rest of the month was mostly umbraco.com itself: Agent Skills, the Q1 product update, an AI community team.

Umbraco shipped Umbraco.AI (open source, provider-agnostic) and Umbraco Compose (commercial SaaS) in the same month. What each one costs you, plus the 13 to 17 upgrade 403 and uSync 17.0.4.

Umbraco 13.0.0-13.12.0 got a moderate security patch on 9 December. Everything else the month produced came from 24 Days in Umbraco, plus a new Enterprise bundle and a Q1 2026 date for Compose.

Umbraco 17 shipped as a beta on 15 October with the final set for 27 November, and uSync 16.1.0 was declared the last feature release for v16. What that costs a site still on 13.

Umbraco's September 2025: a security patch for Umbraco 13 through the Smidge dependency, the Developer MCP Server beta moving into Umbraco's own namespace, two uSync patches, and the 2026 price list read after the fact.