Bump Umbraco.Cms.Web.Website from 18.0.0 to 18.1.2 by dependabot[bot] · Pull Request #109 · umbraco-community/Umbraco.Community.Sustainability

dependabot · 2026-08-22T07:05:30Z

Updated Umbraco.Cms.Web.Website from 18.0.0 to 18.1.2.

Release notes

Sourced from Umbraco.Cms.Web.Website's releases.

18.1.1 What's Changed

🔒 Security

Resolved incorrect authorization lets Content-only backoffice users modify Templates, enabling remote code execution from GHSA-f7m5-5x7g-2p52
Resolved insufficient authorization on Management API search endpoints from GHSA-w5q3-9wf8-43gg

🐛 Bug Fixes

Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #22581) by @AndyButland in Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #22581) umbraco/Umbraco-CMS#23653

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc...release-18.1.1

18.1.0 What's Changed Since 18.1.0-rc2

🐛 Bug Fixes

Scoping: Isolate the ambient scope stacks across execution context flows (closes #23336) by @Ron-Brouwer in Scoping: Isolate the ambient scope stacks across execution context flows (closes #23366) umbraco/Umbraco-CMS#23492

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc2...release-18.1.0

What's Changed Since 18.1.0-rc

📦 Dependencies

build(deps): bumps @umbraco-ui/uui from 2.0.1 to 2.0.2 by @iOvergaard in build(deps): bumps @umbraco-ui/uui from 2.0.1 to 2.0.2 umbraco/Umbraco-CMS#23490

🐛 Bug Fixes

Migrations: Ensure the umbracoContent.contentTypeId index is created when upgrading from 18.0 to 18.1 by @AndyButland in Migrations: Ensure the umbracoContent.contentTypeId index is created when upgrading from 18.0 to 18.1 umbraco/Umbraco-CMS#23466
Auth: Do not treat a boot-time token refresh rejection as a session timeout (closes #23462) by @iOvergaard in Auth: Do not treat a boot-time token refresh rejection as a session timeout (closes #23462) umbraco/Umbraco-CMS#23494
Content Notifications: Raise ContentSavedNotification on save-and-publish (closes #23523)- #23528
by @AndyButland in Content Notifications: Raise ContentSavedNotification on save-and-publish (closes #23523) umbraco/Umbraco-CMS#23528

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc...release-18.1.0-rc2

What's Changed Since the Previous Version (18.0.2)

📦 Dependencies

Login: Removes @hey-api/openapi-ts from the login project by @iOvergaard in Login: Removes @hey-api/openapi-ts from the login project umbraco/Umbraco-CMS#22757
build(deps): bumps @umbraco-ui/uui to 1.18.0 by @iOvergaard in build(deps): bumps @umbraco-ui/uui to 1.18.0 umbraco/Umbraco-CMS#23035
build(deps): bumps @umbraco-ui/uui to 1.18.1 by @iOvergaard in build(deps): bumps @umbraco-ui/uui to 1.18.1 umbraco/Umbraco-CMS#23184
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in Dependencies: Update NuGet packages to latest minor and patch versions umbraco/Umbraco-CMS#23269 and Dependencies: Update NuGet packages to latest minor and patch versions (18) umbraco/Umbraco-CMS#23454
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in Dependencies: Update NuGet packages to latest minor and patch versions umbraco/Umbraco-CMS#23270
UUI: Upgrade to 2.0.1 by @iOvergaard in UUI: Upgrade to 2.0.1 umbraco/Umbraco-CMS#23209
Build(deps): Bump the npm_and_yarn group across 4 directories with 4 updates by @dependabot[bot] in Build(deps): Bump the npm_and_yarn group across 4 directories with 4 updates umbraco/Umbraco-CMS#23338
Dependencies: Upgrade Examine to 3.8.0 by @si25 in Dependencies: Upgrade Examine to 3.8.0 umbraco/Umbraco-CMS#23075
Dependencies: Pin SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version (closes #23325) by @AndyButland in Dependencies: Pin SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version (closes #23325) umbraco/Umbraco-CMS#23393

🚀 New Features

feat(components): adds umb-entity-frame component + Storybook stories by @leekelleher in feat(components): adds umb-entity-frame component + Storybook stories umbraco/Umbraco-CMS#22844
UFM: Add umbMemberName component (closes #22147) by @leekelleher in UFM: Add umbMemberName component (closes #22147) umbraco/Umbraco-CMS#23165
UFM: Add umbElementName component by @leekelleher in UFM: Add umbElementName component umbraco/Umbraco-CMS#23162
Element Picker: Adds valueSummary display and value resolver by @leekelleher in Element Picker: Adds valueSummary display and value resolver umbraco/Umbraco-CMS#23154
Media: Add umb-media-thumbnail with configurable checkerboard background (closes #23177) by @iOvergaard in Media: Add umb-media-thumbnail with configurable checkerboard background (closes #23177) umbraco/Umbraco-CMS#23178
Media picker: Allows cancellation of folder creation, and adds buttons for better accessibility (closes #20452) by @iOvergaard in Media picker: Allows cancellation of folder creation, and adds buttons for better accessibility (closes #20452) umbraco/Umbraco-CMS#23276
Notifications: Add htmlMessage for opt-in HTML rendering in toasts by @andrejd22 in Notifications: Add htmlMessage for opt-in HTML rendering in toasts umbraco/Umbraco-CMS#23152
Property Editors: Add value summary extensions for collection views by @nielslyngsoe in Property Editors: Add value summary extensions for collection views umbraco/Umbraco-CMS#23027
Redirects: Adding notification for redirect save and deletion by @NillasKA in Redirects: Adding notification for redirect save and deletion umbraco/Umbraco-CMS#22985
Property editors: Add configuration and validation of allowed types for element picker, document picker, media picker by @NguyenThuyLan in Property editors: Add configuration and validation of allowed types for element picker, document picker, media picker umbraco/Umbraco-CMS#23026
Scheduled publishing: Add configurable period and optional clock-aligned scheduling by @AndyButland in Scheduled publishing: Add configurable period and optional clock-aligned scheduling umbraco/Umbraco-CMS#23127
Management API: Add endpoints to sort the children of a document or media item by a system field by @AndyButland in Management API: Add endpoints to sort the children of a document or media item by a system field umbraco/Umbraco-CMS#23077
Delivery API: Include Element names in the Delivery API output (closes #23242) by @kjac in Delivery API: Include Element names in the Delivery API output (closes #23242) umbraco/Umbraco-CMS#23260
Packaging: Add support for Elements by @lauraneto in Packaging: Add support for Elements umbraco/Umbraco-CMS#23254
Management API: Introduce published element endpoint by @lauraneto in Management API: Introduce published element endpoint umbraco/Umbraco-CMS#23305
Media: Add support for Media URL providers with cache busting (Closes #23282) by @kjac in Media: Add support for Media URL providers with cache busting (Closes #23282) umbraco/Umbraco-CMS#23327
Global Elements: Adds "Element or Element Folder" User Permission Condition by @leekelleher in Global Elements: Adds "Element or Element Folder" User Permission Condition umbraco/Umbraco-CMS#23051
Elements: Support create-and-publish and update-and-publish as a single operation by @AndyButland in Elements: Support create-and-publish and update-and-publish as a single operation umbraco/Umbraco-CMS#23277

🚤 Performance

Performance: Parallelize independent boot API requests (server status/config + public extensions) by @iOvergaard in Performance: Parallelize independent boot API requests (server status/config + public extensions) umbraco/Umbraco-CMS#23020
... (truncated)

18.1.0-rc2

What's Changed Since 18.1.0-rc

📦 Dependencies

build(deps): bumps @umbraco-ui/uui from 2.0.1 to 2.0.2 by @iOvergaard in build(deps): bumps @umbraco-ui/uui from 2.0.1 to 2.0.2 umbraco/Umbraco-CMS#23490

🐛 Bug Fixes

Migrations: Ensure the umbracoContent.contentTypeId index is created when upgrading from 18.0 to 18.1 by @AndyButland in Migrations: Ensure the umbracoContent.contentTypeId index is created when upgrading from 18.0 to 18.1 umbraco/Umbraco-CMS#23466
Auth: Do not treat a boot-time token refresh rejection as a session timeout (closes #23462) by @iOvergaard in Auth: Do not treat a boot-time token refresh rejection as a session timeout (closes #23462) umbraco/Umbraco-CMS#23494
Content Notifications: Raise ContentSavedNotification on save-and-publish (closes #23523)- #23528
by @AndyButland in Content Notifications: Raise ContentSavedNotification on save-and-publish (closes #23523) umbraco/Umbraco-CMS#23528

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc...release-18.1.0-rc2

What's Changed Since the Previous Version (18.0.2)

18.1.0-rc

What's Changed

📦 Dependencies

Login: Removes @hey-api/openapi-ts from the login project by @iOvergaard in Login: Removes @hey-api/openapi-ts from the login project umbraco/Umbraco-CMS#22757
build(deps): bumps @umbraco-ui/uui to 1.18.0 by @iOvergaard in build(deps): bumps @umbraco-ui/uui to 1.18.0 umbraco/Umbraco-CMS#23035
build(deps): bumps @umbraco-ui/uui to 1.18.1 by @iOvergaard in build(deps): bumps @umbraco-ui/uui to 1.18.1 umbraco/Umbraco-CMS#23184
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in Dependencies: Update NuGet packages to latest minor and patch versions umbraco/Umbraco-CMS#23269 and Dependencies: Update NuGet packages to latest minor and patch versions (18) umbraco/Umbraco-CMS#23454
Dependencies: Update NuGet packages to latest minor and patch versions by @AndyButland in Dependencies: Update NuGet packages to latest minor and patch versions umbraco/Umbraco-CMS#23270
UUI: Upgrade to 2.0.1 by @iOvergaard in UUI: Upgrade to 2.0.1 umbraco/Umbraco-CMS#23209
Build(deps): Bump the npm_and_yarn group across 4 directories with 4 updates by @dependabot[bot] in Build(deps): Bump the npm_and_yarn group across 4 directories with 4 updates umbraco/Umbraco-CMS#23338
Dependencies: Upgrade Examine to 3.8.0 by @si25 in Dependencies: Upgrade Examine to 3.8.0 umbraco/Umbraco-CMS#23075
Dependencies: Pin SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version (closes #23325) by @AndyButland in Dependencies: Pin SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version (closes #23325) umbraco/Umbraco-CMS#23393

🚀 New Features

feat(components): adds umb-entity-frame component + Storybook stories by @leekelleher in feat(components): adds umb-entity-frame component + Storybook stories umbraco/Umbraco-CMS#22844
UFM: Add umbMemberName component (closes #22147) by @leekelleher in UFM: Add umbMemberName component (closes #22147) umbraco/Umbraco-CMS#23165
UFM: Add umbElementName component by @leekelleher in UFM: Add umbElementName component umbraco/Umbraco-CMS#23162
Element Picker: Adds valueSummary display and value resolver by @leekelleher in Element Picker: Adds valueSummary display and value resolver umbraco/Umbraco-CMS#23154
Media: Add umb-media-thumbnail with configurable checkerboard background (closes #23177) by @iOvergaard in Media: Add umb-media-thumbnail with configurable checkerboard background (closes #23177) umbraco/Umbraco-CMS#23178
Media picker: Allows cancellation of folder creation, and adds buttons for better accessibility (closes #20452) by @iOvergaard in Media picker: Allows cancellation of folder creation, and adds buttons for better accessibility (closes #20452) umbraco/Umbraco-CMS#23276
Notifications: Add htmlMessage for opt-in HTML rendering in toasts by @andrejd22 in Notifications: Add htmlMessage for opt-in HTML rendering in toasts umbraco/Umbraco-CMS#23152
Property Editors: Add value summary extensions for collection views by @nielslyngsoe in Property Editors: Add value summary extensions for collection views umbraco/Umbraco-CMS#23027
Redirects: Adding notification for redirect save and deletion by @NillasKA in Redirects: Adding notification for redirect save and deletion umbraco/Umbraco-CMS#22985
Property editors: Add configuration and validation of allowed types for element picker, document picker, media picker by @NguyenThuyLan in Property editors: Add configuration and validation of allowed types for element picker, document picker, media picker umbraco/Umbraco-CMS#23026
Scheduled publishing: Add configurable period and optional clock-aligned scheduling by @AndyButland in Scheduled publishing: Add configurable period and optional clock-aligned scheduling umbraco/Umbraco-CMS#23127
Management API: Add endpoints to sort the children of a document or media item by a system field by @AndyButland in Management API: Add endpoints to sort the children of a document or media item by a system field umbraco/Umbraco-CMS#23077
Delivery API: Include Element names in the Delivery API output (closes #23242) by @kjac in Delivery API: Include Element names in the Delivery API output (closes #23242) umbraco/Umbraco-CMS#23260
Packaging: Add support for Elements by @lauraneto in Packaging: Add support for Elements umbraco/Umbraco-CMS#23254
Management API: Introduce published element endpoint by @lauraneto in Management API: Introduce published element endpoint umbraco/Umbraco-CMS#23305
Media: Add support for Media URL providers with cache busting (Closes #23282) by @kjac in Media: Add support for Media URL providers with cache busting (Closes #23282) umbraco/Umbraco-CMS#23327
Global Elements: Adds "Element or Element Folder" User Permission Condition by @leekelleher in Global Elements: Adds "Element or Element Folder" User Permission Condition umbraco/Umbraco-CMS#23051
Elements: Support create-and-publish and update-and-publish as a single operation by @AndyButland in Elements: Support create-and-publish and update-and-publish as a single operation umbraco/Umbraco-CMS#23277

🚤 Performance

Performance: Parallelize independent boot API requests (server status/config + public extensions) by @iOvergaard in Performance: Parallelize independent boot API requests (server status/config + public extensions) umbraco/Umbraco-CMS#23020
Performance: Load stylesheets parallel to extensions in Tiptap by @nielslyngsoe in Performance: Load stylesheets parallel to extensions in Tiptap umbraco/Umbraco-CMS#23024
Cache: Add scope-level cache version tier to reduce DB hits in bulk operations by @nikolajlauridsen in Cache: Add scope-level cache version tier to reduce DB hits in bulk operations umbraco/Umbraco-CMS#22563
Backoffice: Add Cache-Control headers to cache-busted backoffice assets (AB#68478) by @iOvergaard in Backoffice: Add Cache-Control headers to cache-busted backoffice assets (AB#68478) umbraco/Umbraco-CMS#22951
Repositories: Batch WHERE IN queries to avoid SQL Server 2100-parameter limit by @AndyButland in Repositories: Batch WHERE IN queries to avoid SQL Server 2100-parameter limit umbraco/Umbraco-CMS#22987
Performance: Coalesce concurrent tree data requests (Management API client) by @iOvergaard in Performance: Coalesce concurrent tree data requests (Management API client) umbraco/Umbraco-CMS#23021
Request Logging: Avoid forcing a session store load when resolving the session id for logging (closes #23082) by @AndyButland in Request Logging: Avoid forcing a session store load when resolving the session id for logging (closes #23082) umbraco/Umbraco-CMS#23083
Languages: Page through to load all configured languages by @AndyButland in Languages: Page through to load all configured languages umbraco/Umbraco-CMS#22765
Examine: Stream value sets to a single index during rebuild to reduce reindex peak memory by @AndyButland in Examine: Stream value sets to a single index during rebuild to reduce reindex peak memory umbraco/Umbraco-CMS#23150
Document & Media Workspace: Limit route generation (closes #22910) by @nielslyngsoe in Document & Media Workspace: Limit route generation (closes #22910) umbraco/Umbraco-CMS#23085
Caching: Add an optional bounded, limit to the published-content (L0) cache by @AndyButland in Caching: Add an optional bounded, limit to the published-content (L0) cache umbraco/Umbraco-CMS#23158
Performance: Add index on umbracoContent.contentTypeId by @AndyButland in Performance: Add index on umbracoContent.contentTypeId umbraco/Umbraco-CMS#23328
Performance: Batch the content cache delete on structural content type changes by @AndyButland in Performance: Batch the content cache delete on structural content type changes umbraco/Umbraco-CMS#23329
Performance: Skip the content cache rebuild when a document type property is removed by @AndyButland in Performance: Skip the content cache rebuild when a document type property is removed umbraco/Umbraco-CMS#23330
Media: Port Children/Descendants traversal optimisations to media (#22742 follow-up) by @AndyButland in Media: Port Children/Descendants traversal optimisations to media (#22742 follow-up) umbraco/Umbraco-CMS#23356
Document URLs: Retrieve only the current culture's URL for the Info workspace links panel (closes #23196) by @AndyButland in Document URLs: Retrieve only the current culture's URL for the Info workspace links panel (closes #23196) umbraco/Umbraco-CMS#23265
Performance: Avoid heap allocations when converting between int & Guid by @Henr1k80 in Performance: Avoid heap allocations when converting between int & Guid umbraco/Umbraco-CMS#23389

🌈 Accessibility Improvements

Accessibility: Added missing labels to code block copy button and embedded media URL input by @andreaslborg in Accessibility: Added missing labels to code block copy button and embedded media URL input umbraco/Umbraco-CMS#22825
... (truncated)

18.0.2 What's Changed

🔒 Security

Addressed vulnerability relating to expansion of property values relating to protected, picked content described in GHSA-wr57-hqmp-fgvh

Full Changelog: umbraco/Umbraco-CMS@release-18.0.1...release-18.0.2

18.0.1 What's Changed

🐛 Bug Fixes

Navigation: Preserve sort order when rebuilding the in-memory structure (closes #23156, #23230) by @AndyButland in Navigation: Preserve sort order when rebuilding the in-memory structure (closes #23156, #23230) umbraco/Umbraco-CMS#23239
Document URLs: Persist URL segments and aliases under distributed-cache-only notification publishers (closes #23214) by @ronaldbarendse in Document URLs: Persist URL segments and aliases under distributed-cache-only notification publishers (closes #23214) umbraco/Umbraco-CMS#23215
HybridCache: rebuild deferred content type changes under distributed-cache-only publishers by @ronaldbarendse in HybridCache: rebuild deferred content type changes under distributed-cache-only publishers umbraco/Umbraco-CMS#23231
Document URLs: persist URL segments on content type variation change under distributed-cache-only publishers by @ronaldbarendse in Document URLs: persist URL segments on content type variation change under distributed-cache-only publishers umbraco/Umbraco-CMS#23227
Relations: Allow Element and ElementContainer as allowed object types for relation creation by @ronaldbarendse in Relations: Allow Element and ElementContainer as allowed object types for relation creation umbraco/Umbraco-CMS#23217
OpenApi: Lowercase document name on registration to match AddOpenApi internal behaviour (closes #23210) by @lauraneto in OpenApi: Lowercase document name on registration to match AddOpenApi internal behaviour (closes #23210) umbraco/Umbraco-CMS#23212

Full Changelog: umbraco/Umbraco-CMS@release-18.0.0...release-18.0.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

--- updated-dependencies: - dependency-name: Umbraco.Cms.Web.Website dependency-version: 18.1.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-19T07:05:02Z

Superseded by #114.

dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 22, 2026

dependabot Bot mentioned this pull request Aug 22, 2026

Bump Umbraco.Cms.Web.Website from 18.0.0 to 18.1.1 #104

Closed

dependabot Bot closed this Sep 19, 2026

dependabot Bot deleted the dependabot/nuget/src/Umbraco.Community.Sustainability/Umbraco.Cms.Web.Website-18.1.2 branch September 19, 2026 07:05

Navigation Menu

Bump Umbraco.Cms.Web.Website from 18.0.0 to 18.1.2 - #109

Bump Umbraco.Cms.Web.Website from 18.0.0 to 18.1.2#109
dependabot[bot] wants to merge 1 commit into
v6/devfrom
dependabot/nuget/src/Umbraco.Community.Sustainability/Umbraco.Cms.Web.Website-18.1.2

dependabot Bot commented on behalf of github Aug 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 22, 2026

18.1.1

What's Changed

🔒 Security

🐛 Bug Fixes

18.1.0

What's Changed Since 18.1.0-rc2

🐛 Bug Fixes

What's Changed Since 18.1.0-rc

📦 Dependencies

🐛 Bug Fixes

What's Changed Since the Previous Version (18.0.2)

📦 Dependencies

🚀 New Features

🚤 Performance

18.1.0-rc2

What's Changed Since 18.1.0-rc

📦 Dependencies

🐛 Bug Fixes

What's Changed Since the Previous Version (18.0.2)

📦 Dependencies

🚀 New Features

🚤 Performance

18.1.0-rc

What's Changed

📦 Dependencies

🚀 New Features

🚤 Performance

🌈 Accessibility Improvements

18.0.2

What's Changed

🔒 Security

18.0.1

What's Changed

🐛 Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants