Engineering notes

Umbraco 13.0.0-13.12.0 got a moderate security patch on 9 December. Everything else the month produced came from 24 Days in Umbraco, plus a new Enterprise bundle and a Q1 2026 date for Compose.

Umbraco 17 LTS landed on 27 November on .NET 10, with three years of support. uSync 17.0.0 and Clean Starter Kit v7 shipped the same day. The community had a harder month than the product did.

Umbraco 17 shipped as a beta on 15 October with the final set for 27 November, and uSync 16.1.0 was declared the last feature release for v16. What that costs a site still on 13.

Umbraco's September 2025: a security patch for Umbraco 13 through the Smidge dependency, the Developer MCP Server beta moving into Umbraco's own namespace, two uSync patches, and the 2026 price list read after the fact.

Four of the month's eleven Umbraco items are about MCP and AI. An agent built an element type from a single prompt, Umbraco Commerce got an MCP proof-of-concept, and the only post that said anything about who should be allowed to do that was a uSync patch note.

A moderate-severity Content Delivery API advisory patched in 13.9.3, 15.4.4 and 16.1.1; three uSync releases in nine days, all of it v13 upgrade debt; and Umbraco's roadmap post on MCP, Compose and search.

Two moderate advisories, the last public patch for Umbraco 10, uSync moving development to v16, and Codegarden announcements that mostly land after the v17 LTS.

Umbraco's 6 May advisory fixed a moderate user-enumeration issue in 10.x and 13.x, but the patch only exists on the latest minor. Plus ContentAudit, uSync 15.1.8 and the v16 release candidate.