Engineering notes

July forced two jobs: patch the Delivery API flaw (13.15.1 / 17.5.3 / 18.0.2) and patch Umbraco Forms (13.9.8 / 17.4.7 / 18.0.5). Everything else in the month was the December calendar, argued from four directions.

Umbraco 18 beta1 landed 13 May, beta2 on 14 May, the RC on 28 May, with thirty-five breaking entries in the notes. Elements phase one, typed OpenAPI schemas, Swashbuckle gone, and the field notes worth your afternoon.

SUGCON Europe filled London and SitecoreAI took the stage, but the month's operational content was written by individuals: the JSS 22.x migration path, App Studio extensions, and a second search model.

From 1 June, Extended Support stops including security patches and production incident support. Content SDK 2.0 requires Next.js 16 and renames middleware.ts. And the manual for Sitecore's AI surface is being written by volunteers.

Umbraco shipped Umbraco.AI (open source, provider-agnostic) and Umbraco Compose (commercial SaaS) in the same month. What each one costs you, plus the 13 to 17 upgrade 403 and uSync 17.0.4.

Umbraco's September 2025: a security patch for Umbraco 13 through the Smidge dependency, the Developer MCP Server beta moving into Umbraco's own namespace, two uSync patches, and the 2026 price list read after the fact.

Content SDK 1.1 landed and the Experience Editor did not come with it. Every account of that migration in our September 2025 harvest came from a personal blog, not from a vendor page.

Four of the month's eleven Umbraco items are about MCP and AI. An agent built an element type from a single prompt, Umbraco Commerce got an MCP proof-of-concept, and the only post that said anything about who should be allowed to do that was a uSync patch note.