Skip to content

Auth: Skip /token refresh when access token is still valid#22087

Merged
leekelleher merged 6 commits intomainfrom
v17/improvement/skip-token-refresh-when-access-token-valid
Mar 11, 2026
Merged

Auth: Skip /token refresh when access token is still valid#22087
leekelleher merged 6 commits intomainfrom
v17/improvement/skip-token-refresh-when-access-token-valid

Conversation

@iOvergaard
Copy link
Copy Markdown
Contributor

@iOvergaard iOvergaard commented Mar 11, 2026 •
edited
Loading

Summary

  • Skip /token when access token is still valid — configureClient()'s auth callback and getLatestToken() now guard with #isAccessTokenValid(), so the token endpoint is only hit when the access token has actually expired. Previously every API request triggered a refresh regardless, causing unnecessary token churn and OpenIddict ID2019 errors on in-flight requests.

  • Wait for ongoing cross-tab refresh — when the access token is valid but another tab holds the umb:token-refresh Web Lock (proactive refresh via keepUserLoggedIn), the auth callback now waits for that refresh to complete before proceeding. This restores the cross-tab serialization that the guard above removed, preventing requests from being sent with a token that is about to be revoked.

  • Remove redundant first-check validateToken() on startup — UmbAppAuthController.isAuthorized() previously called validateToken() on the very first guard evaluation, producing a second /token call immediately after setInitialState() had already verified the session. This was a leftover from the AppAuth/localStorage era. setInitialState() now owns server verification; stale peer-sourced sessions are handled lazily by the 401 interceptor.

How each caller behaves after these changes

Caller Behaviour
configureClient() auth callback (per request) Skips /token when access token valid; waits if another tab is refreshing
getLatestToken() (deprecated, userland) Same as above
UmbAuthSessionTimeoutController → validateToken() Unchanged — always calls makeRefreshTokenRequest() for proactive refresh
app-auth.controller.ts startup guard Removed redundant first-check; setInitialState() is authoritative

Why the popup re-auth path doesn't call /token from the main window

After timeout → popup re-auth, the popup's authorization_code exchange calls /token and the server's HideBackOfficeTokensHandler writes fresh encrypted cookies to the response. Cookies are domain-scoped, so the main window has the new cookies immediately — no separate /token call needed. The "Stay logged in" button takes a different path (refresh_token grant directly from the main window), but both paths end with equivalent fresh cookie state.

Test plan

  • Navigate between sections — /token should only fire when the access token expires, not on every request
  • With keepUserLoggedIn=true: open two tabs, verify only one /token call fires per proactive refresh cycle (no ID2019 on the other tab)
  • Let the session timeout naturally → re-auth via popup → verify the encrypted cookie value changes and subsequent requests succeed without errors
  • Click "Stay logged in" in the timeout modal → verify /token is called and the session timer resets
  • Verify startup has exactly one /token call (not two)

🤖 Generated with Claude Code

@iOvergaard @claude
Auth: Skip /token refresh when access token is still valid
ef01e5e 
Guard the per-request validateToken() call sites with #isAccessTokenValid()
in configureClient() and getLatestToken(). Previously, every API request
triggered a /token call even when the access token had not expired, causing
unnecessary token churn and OpenIddict ID2019 errors for in-flight requests.

Proactive refresh via UmbAuthSessionTimeoutController and startup validation
in app-auth.controller.ts are unaffected — those call validateToken() directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 11, 2026 06:50
Copilot AI reviewed Mar 11, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR reduces unnecessary /token refresh calls in the backoffice client by avoiding validateToken() refreshes on every API request when the in-memory access token is still valid, aiming to reduce token endpoint load and mitigate OpenIddict ID2019 errors caused by frequent token revocation.

Changes:

  • Guard getLatestToken() to call validateToken() only when #isAccessTokenValid() is false.
  • Guard the OpenAPI client auth callback in configureClient() similarly, so requests don’t trigger refresh while the access token is still valid.

iOvergaard and others added 3 commits March 11, 2026 08:09
@iOvergaard @claude
Auth: Remove redundant first-check validateToken() on app startup
f90d1fc 
setInitialState() already handles server verification before the router
evaluates guards — either via a direct /token call (makeRefreshTokenRequest)
or via peer session adoption (BroadcastChannel). The #isFirstCheck guard in
UmbAppAuthController was a leftover from the AppAuth/localStorage era, where
token state was restored from storage and needed a server round-trip to confirm
validity. That assumption no longer holds: if getIsAuthorized() is true after
setInitialState(), the session came directly from the server or from a peer
whose timing is still valid. Stale/revoked peer sessions are handled lazily
by the 401 interceptor, which triggers re-auth as needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@iOvergaard @claude
Auth: Wait for ongoing cross-tab refresh before sending requests
b781bbd 
Restores the cross-tab lock serialization that was implicitly provided by
the old unconditional validateToken() call. When another tab holds the
umb:token-refresh lock (keepUserLoggedIn proactive refresh), API requests
in this tab now wait for it to complete before proceeding. This prevents
sending requests with an access token that is about to be revoked, which
caused OpenIddict ID2019 errors on in-flight requests.

The fast path (token valid, no refresh in progress) remains: navigator.locks.query()
is a cheap browser-internal call, and the lock.request() no-op is only
incurred when a cross-tab refresh is actually happening.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@iOvergaard @claude
Auth: Extract #ensureTokenReady(), improve naming and JSDoc
69e475f 
- Extract duplicate guard logic from configureClient() and getLatestToken()
  into a single #ensureTokenReady() private method
- Rename from #ensureValidToken() → #ensureTokenReady() to distinguish from
  the validate/valid naming cluster (validateToken, isAccessTokenValid)
- Add JSDoc to #isAccessTokenValid() clarifying it is a local timestamp check
  with no network call
- Improve JSDoc on validateToken() to make clear it forces a network refresh
  (unconditional /token call), distinct from the per-request #ensureTokenReady()
  gate which skips the call when the access token is still live

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@leekelleher leekelleher self-requested a review March 11, 2026 08:31
iOvergaard and others added 2 commits March 11, 2026 09:45
@iOvergaard
Merge remote-tracking branch 'origin/main' into v17/improvement/skip-…
34224dd 
…token-refresh-when-access-token-valid
@iOvergaard @claude
fix(auth): prevent re-entrant /token call when session$ fires synchro…
467fbe9 
…nously inside lock

With keepUserLoggedIn=true and a short access token lifetime (e.g. expiresIn ≤ buffer),
#updateSession() triggers session$ synchronously inside the lock callback. The observer
fires #scheduleCheck → #onSessionExpiring → validateToken() before the lock is released.
This re-entrant call captures sessionBefore = newSession (already updated), so the
reference guard cannot detect it, resulting in a duplicate /token request.

Fix by tracking #inSessionUpdateCallback around the #updateSession() call. Re-entrant
callers return true immediately; concurrent non-re-entrant callers are unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@leekelleher leekelleher enabled auto-merge (squash) March 11, 2026 10:48
@leekelleher leekelleher merged commit 14a047b into main Mar 11, 2026
29 checks passed
@leekelleher leekelleher deleted the v17/improvement/skip-token-refresh-when-access-token-valid branch March 11, 2026 11:23
@iOvergaard iOvergaard mentioned this pull request Mar 11, 2026
Merged
This was referenced Apr 2, 2026
Open
Open
Open
Closed
Closed
Merged
Merged
alexsee added a commit to alexsee/umbraco-container that referenced this pull request Apr 9, 2026
@dependabot @alexsee
Bump Umbraco.Cms.Persistence.Sqlite from 17.2.2 to 17.3.0 (#163)
335a18a 
Updated
[Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS)
from 17.2.2 to 17.3.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.Persistence.Sqlite's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.3.0

## Upgrade Notes

In 17.3 we have upgraded our dependency on `MailKit` to 4.15.1. This is
a minor version update, but we found a few changes we had to make in
core to accommodate changes to nullability constraints. Unless using
methods of this library, or it's transitive dependency `MimeKit`, it's
unlikely projects will be affected. The update is necessary though, as
the version we previously depended on now has a security vulnerability
raised against it.

We have made a change to how we handle redirects which brings a
significant performance improvement for publish time on large sites,
when documents with many descendent nodes are published. If you have
custom URL providers you should review this change, as there are some
[very rare
cases](umbraco/Umbraco-CMS#22091 (comment))
where you'll need to adjust to ensure descendent redirects are correctly
handled.

Note also that we now auto-generate HMAC secret key for new installs.
This has been applied to make Umbraco more secure by default, but it's
not been forced for upgrades.

## What's Changed Since 17.3.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc3...release-17.3.0

## What's Changed Since 17.3.0-rc2

### 📦 Dependencies

* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278

### 🐛 Bug Fixes

* Examine: Fix DocumentUrlService not initialized during Examine
indexing after package upgrade by @​AndyButland in
umbraco/Umbraco-CMS#22243
* Unattended Upgrades: Rebuild routing caches after background
migrations to fix unrouteable document URLs by @​AndyButland in
umbraco/Umbraco-CMS#22269
* Migrations: Fix NPoco auto-select breaking re-trust FK migration by
@​AndyButland in umbraco/Umbraco-CMS#22270

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc2...release-17.3.0-rc3

## What's Changed Since 17.3.0-rc1

### 🐛 Bug Fixes
* Migrations: Fix re-trust constraints migration targeting non-Umbraco
tables and transaction failure (closes #​22227) by @​AndyButland in
umbraco/Umbraco-CMS#22229
* Distributed Locking: Add ROWLOCK hint to prevent cross-row contention
on umbracoLock table (closes #​22113) by @​AndyButland in
umbraco/Umbraco-CMS#22126
* Application URLs: Prevent back office hosts being overwritten in a
shared database setup (closes #​16741) by @​matthewcare in
umbraco/Umbraco-CMS#22160
* Migrations: Fix property detection for invariant content types with
culture-varying compositions (closes #​22159) by @​AndyButland in
umbraco/Umbraco-CMS#22167
* Migrations: Fix package migrations not running after fresh install
with packages (closes #​22202) by @​AndyButland in
umbraco/Umbraco-CMS#22204

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc...release-17.3.0-rc2

## What's Changed Since the Previous Version (17.2.2)

### 🙌 Notable Changes
* Templates: Add optional Central Package Management support to
UmbracoProject and UmbracoExtension templates by @​NguyenThuyLan in
umbraco/Umbraco-CMS#21641
* Service registration: Allow running Umbraco with different
combinations of backoffice, website and delivery API (closes #​21622) by
@​AndyButland in umbraco/Umbraco-CMS#21630
* Imaging Configuration: Auto-generate HMAC secret key for new installs
by @​AndyButland in umbraco/Umbraco-CMS#21976
* Migrations: Run unattended upgrades in background, add
liveness/readiness health probes (closes #​21987) by @​AndyButland in
umbraco/Umbraco-CMS#22020

### 💥 Breaking Changes
* Dependencies: Update MailKit to 4.15.1 by @​AndyButland in
umbraco/Umbraco-CMS#22028

### 📦 Dependencies
* Bump lodash from 4.17.21 to 4.17.23 in
/tests/Umbraco.Tests.AcceptanceTest in the npm_and_yarn group across 1
directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21519
 ... (truncated)

## 17.3.0-rc3

## Upgrade Notes

In 17.3 we have upgraded our dependency on `MailKit` to 4.15.1. This is
a minor version update, but we found a few changes we had to make in
core to accommodate changes to nullability constraints. Unless using
methods of this library, or it's transitive dependency `MimeKit`, it's
unlikely projects will be affected. The update is necessary though, as
the version we previously depended on now has a security vulnerability
raised against it.

We have made a change to how we handle redirects which brings a
significant performance improvement for publish time on large sites,
when documents with many descendent nodes are published. If you have
custom URL providers you should review this change, as there are some
[very rare
cases](umbraco/Umbraco-CMS#22091 (comment))
where you'll need to adjust to ensure descendent redirects are correctly
handled.

Note also that we now auto-generate HMAC secret key for new installs.
This has been applied to make Umbraco more secure by default, but it's
not been forced for upgrades.

## What's Changed Since 17.3.0-rc2

### 📦 Dependencies

* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278

### 🐛 Bug Fixes

* Examine: Fix DocumentUrlService not initialized during Examine
indexing after package upgrade by @​AndyButland in
umbraco/Umbraco-CMS#22243
* Unattended Upgrades: Rebuild routing caches after background
migrations to fix unrouteable document URLs by @​AndyButland in
umbraco/Umbraco-CMS#22269
* Migrations: Fix NPoco auto-select breaking re-trust FK migration by
@​AndyButland in umbraco/Umbraco-CMS#22270

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc2...release-17.3.0-rc3

## What's Changed Since 17.3.0-rc1

### 🐛 Bug Fixes
* Migrations: Fix re-trust constraints migration targeting non-Umbraco
tables and transaction failure (closes #​22227) by @​AndyButland in
umbraco/Umbraco-CMS#22229
* Distributed Locking: Add ROWLOCK hint to prevent cross-row contention
on umbracoLock table (closes #​22113) by @​AndyButland in
umbraco/Umbraco-CMS#22126
* Application URLs: Prevent back office hosts being overwritten in a
shared database setup (closes #​16741) by @​matthewcare in
umbraco/Umbraco-CMS#22160
* Migrations: Fix property detection for invariant content types with
culture-varying compositions (closes #​22159) by @​AndyButland in
umbraco/Umbraco-CMS#22167
* Migrations: Fix package migrations not running after fresh install
with packages (closes #​22202) by @​AndyButland in
umbraco/Umbraco-CMS#22204

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc...release-17.3.0-rc2

## What's Changed Since the Previous Version (17.2.2)

### 🙌 Notable Changes
* Templates: Add optional Central Package Management support to
UmbracoProject and UmbracoExtension templates by @​NguyenThuyLan in
umbraco/Umbraco-CMS#21641
* Service registration: Allow running Umbraco with different
combinations of backoffice, website and delivery API (closes #​21622) by
@​AndyButland in umbraco/Umbraco-CMS#21630
* Imaging Configuration: Auto-generate HMAC secret key for new installs
by @​AndyButland in umbraco/Umbraco-CMS#21976
* Migrations: Run unattended upgrades in background, add
liveness/readiness health probes (closes #​21987) by @​AndyButland in
umbraco/Umbraco-CMS#22020

### 💥 Breaking Changes
* Dependencies: Update MailKit to 4.15.1 by @​AndyButland in
umbraco/Umbraco-CMS#22028

### 📦 Dependencies
* Bump lodash from 4.17.21 to 4.17.23 in
/tests/Umbraco.Tests.AcceptanceTest in the npm_and_yarn group across 1
directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21519
* Bump the npm_and_yarn group across 2 directories with 2 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#21754
* Bump qs from 6.14.1 to 6.14.2 in /src/Umbraco.Web.UI.Client in the
npm_and_yarn group across 1 directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21755
* Dependencies: Bumps @​umbraco-ui/uui from 1.17.0 to 1.17.1 by
@​iOvergaard in umbraco/Umbraco-CMS#22029
* Dependencies: Updates @​umbraco-ui/uui to 1.17.2 to fix multiple
folder drag-and-drop failing (closes #​21837) by @​iOvergaard in
umbraco/Umbraco-CMS#21886
 ... (truncated)

## 17.3.0-rc2

## Upgrade Notes

In 17.3 we have upgraded our dependency on `MailKit` to 4.15.1. This is
a minor version update, but we found a few changes we had to make in
core to accommodate changes to nullability constraints. Unless using
methods of this library, or it's transitive dependency `MimeKit`, it's
unlikely projects will be affected. The update is necessary though, as
the version we previously depended on now has a security vulnerability
raised against it.

We have made a change to how we handle redirects which brings a
significant performance improvement for publish time on large sites,
when documents with many descendent nodes are published. If you have
custom URL providers you should review this change, as there are some
[very rare
cases](umbraco/Umbraco-CMS#22091 (comment))
where you'll need to adjust to ensure descendent redirects are correctly
handled.

Note also that we now auto-generate HMAC secret key for new installs.
This has been applied to make Umbraco more secure by default, but it's
not been forced for upgrades.

## What's Changed Since 17.3.0-rc1

### 🐛 Bug Fixes
* Migrations: Fix re-trust constraints migration targeting non-Umbraco
tables and transaction failure (closes #​22227) by @​AndyButland in
umbraco/Umbraco-CMS#22229
* Distributed Locking: Add ROWLOCK hint to prevent cross-row contention
on umbracoLock table (closes #​22113) by @​AndyButland in
umbraco/Umbraco-CMS#22126
* Application URLs: Prevent back office hosts being overwritten in a
shared database setup (closes #​16741) by @​matthewcare in
umbraco/Umbraco-CMS#22160
* Migrations: Fix property detection for invariant content types with
culture-varying compositions (closes #​22159) by @​AndyButland in
umbraco/Umbraco-CMS#22167
* Migrations: Fix package migrations not running after fresh install
with packages (closes #​22202) by @​AndyButland in
umbraco/Umbraco-CMS#22204

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.0-rc...release-17.3.0-rc2

## What's Changed Since the Previous Version (17.2.2)

### 🙌 Notable Changes
* Templates: Add optional Central Package Management support to
UmbracoProject and UmbracoExtension templates by @​NguyenThuyLan in
umbraco/Umbraco-CMS#21641
* Service registration: Allow running Umbraco with different
combinations of backoffice, website and delivery API (closes #​21622) by
@​AndyButland in umbraco/Umbraco-CMS#21630
* Imaging Configuration: Auto-generate HMAC secret key for new installs
by @​AndyButland in umbraco/Umbraco-CMS#21976
* Migrations: Run unattended upgrades in background, add
liveness/readiness health probes (closes #​21987) by @​AndyButland in
umbraco/Umbraco-CMS#22020

### 💥 Breaking Changes
* Dependencies: Update MailKit to 4.15.1 by @​AndyButland in
umbraco/Umbraco-CMS#22028

### 📦 Dependencies
* Bump lodash from 4.17.21 to 4.17.23 in
/tests/Umbraco.Tests.AcceptanceTest in the npm_and_yarn group across 1
directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21519
* Bump the npm_and_yarn group across 2 directories with 2 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#21754
* Bump qs from 6.14.1 to 6.14.2 in /src/Umbraco.Web.UI.Client in the
npm_and_yarn group across 1 directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21755
* Dependencies: Bumps @​umbraco-ui/uui from 1.17.0 to 1.17.1 by
@​iOvergaard in umbraco/Umbraco-CMS#22029
* Dependencies: Updates @​umbraco-ui/uui to 1.17.2 to fix multiple
folder drag-and-drop failing (closes #​21837) by @​iOvergaard in
umbraco/Umbraco-CMS#21886
* Backoffice: Update vite from 7.1.11 to 7.3.1 by @​iOvergaard in
umbraco/Umbraco-CMS#22065
* Dependencies: Update server-side dependencies to latest patch or minor
releases by @​AndyButland in
umbraco/Umbraco-CMS#21860

### 🚤 Performance
* Performance: Implement key-based caching for data type and template
repositories by @​AndyButland in
umbraco/Umbraco-CMS#21280
* Management API: Optimize collection view performance by eliminating
N+1 patterns by @​AndyButland in
umbraco/Umbraco-CMS#21684
* Performance: Optimize handling of content type updates by @​kjac in
umbraco/Umbraco-CMS#21910
* Backoffice Performance: Add inflight request deduplication to item
data request managers by @​madsrasmussen in
umbraco/Umbraco-CMS#21767
* URL and Alias Caches: Optimize for invariant documents by
@​AndyButland in umbraco/Umbraco-CMS#21558
* Custom Views: Prevent re-rendering Block Views and Properties by
@​rickbutterfield in umbraco/Umbraco-CMS#21186
* Core: Minimize await to a single JS cycle (refactor #​21186) by
@​nielslyngsoe in umbraco/Umbraco-CMS#22074
* Auth: Skip /token refresh when access token is still valid by
@​iOvergaard in umbraco/Umbraco-CMS#22087
* Memory Management: Dispose `IDisposable` resources correctly in four
internal classes by @​AndyButland in
umbraco/Umbraco-CMS#22014
* Redirect Tracking: Fix segment change detection and optimise
descendant traversal (closes #​22082) by @​AndyButland in
umbraco/Umbraco-CMS#22091
 ... (truncated)

## 17.3.0-rc

## Upgrade Notes

In 17.3 we have upgraded our dependency on `MailKit` to 4.15.1. This is
a minor version update, but we found a few changes we had to make in
core to accommodate changes to nullability constraints. Unless using
methods of this library, or it's transitive dependency `MimeKit`, it's
unlikely projects will be affected. The update is necessary though, as
the version we previously depended on now has a security vulnerability
raised against it.

We have made a change to how we handle redirects which brings a
significant performance improvement for publish time on large sites,
when documents with many descendent nodes are published. If you have
custom URL providers you should review this change, as there are some
[very rare
cases](umbraco/Umbraco-CMS#22091 (comment))
where you'll need to adjust to ensure descendent redirects are correctly
handled.

Note also that we now auto-generate HMAC secret key for new installs.
This has been applied to make Umbraco more secure by default, but it's
not been forced for upgrades.

## What's Changed

### 🙌 Notable Changes
* Templates: Add optional Central Package Management support to
UmbracoProject and UmbracoExtension templates by @​NguyenThuyLan in
umbraco/Umbraco-CMS#21641
* Service registration: Allow running Umbraco with different
combinations of backoffice, website and delivery API (closes #​21622) by
@​AndyButland in umbraco/Umbraco-CMS#21630
* Imaging Configuration: Auto-generate HMAC secret key for new installs
by @​AndyButland in umbraco/Umbraco-CMS#21976
* Migrations: Run unattended upgrades in background, add
liveness/readiness health probes (closes #​21987) by @​AndyButland in
umbraco/Umbraco-CMS#22020

### 💥 Breaking Changes
* Dependencies: Update MailKit to 4.15.1 by @​AndyButland in
umbraco/Umbraco-CMS#22028

### 📦 Dependencies
* Bump lodash from 4.17.21 to 4.17.23 in
/tests/Umbraco.Tests.AcceptanceTest in the npm_and_yarn group across 1
directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21519
* Bump the npm_and_yarn group across 2 directories with 2 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#21754
* Bump qs from 6.14.1 to 6.14.2 in /src/Umbraco.Web.UI.Client in the
npm_and_yarn group across 1 directory by @​dependabot[bot] in
umbraco/Umbraco-CMS#21755
* Dependencies: Bumps @​umbraco-ui/uui from 1.17.0 to 1.17.1 by
@​iOvergaard in umbraco/Umbraco-CMS#22029
* Dependencies: Updates @​umbraco-ui/uui to 1.17.2 to fix multiple
folder drag-and-drop failing (closes #​21837) by @​iOvergaard in
umbraco/Umbraco-CMS#21886
* Backoffice: Update vite from 7.1.11 to 7.3.1 by @​iOvergaard in
umbraco/Umbraco-CMS#22065
* Dependencies: Update server-side dependencies to latest patch or minor
releases by @​AndyButland in
umbraco/Umbraco-CMS#21860

### 🚤 Performance
* Performance: Implement key-based caching for data type and template
repositories by @​AndyButland in
umbraco/Umbraco-CMS#21280
* Management API: Optimize collection view performance by eliminating
N+1 patterns by @​AndyButland in
umbraco/Umbraco-CMS#21684
* Performance: Optimize handling of content type updates by @​kjac in
umbraco/Umbraco-CMS#21910
* Backoffice Performance: Add inflight request deduplication to item
data request managers by @​madsrasmussen in
umbraco/Umbraco-CMS#21767
* URL and Alias Caches: Optimize for invariant documents by
@​AndyButland in umbraco/Umbraco-CMS#21558
* Custom Views: Prevent re-rendering Block Views and Properties by
@​rickbutterfield in umbraco/Umbraco-CMS#21186
* Core: Minimize await to a single JS cycle (refactor #​21186) by
@​nielslyngsoe in umbraco/Umbraco-CMS#22074
* Auth: Skip /token refresh when access token is still valid by
@​iOvergaard in umbraco/Umbraco-CMS#22087
* Memory Management: Dispose `IDisposable` resources correctly in four
internal classes by @​AndyButland in
umbraco/Umbraco-CMS#22014
* Redirect Tracking: Fix segment change detection and optimise
descendant traversal (closes #​22082) by @​AndyButland in
umbraco/Umbraco-CMS#22091


### 🌈 Accessibility Improvements
* Entity Actions: Adds a descriptive title to the first action so you
know what it does by @​iOvergaard in
umbraco/Umbraco-CMS#21739
* Search field: Added aria-label and name to search input for
accessibility (closes #​21938) by @​andreaslborg in
umbraco/Umbraco-CMS#21962
* List view: Added labels entity bulk action buttons by @​andreaslborg
in umbraco/Umbraco-CMS#21964
* Accessibility: Add title attributes to buttons in block list entry and
property editor UI by @​manutdkid77 in
umbraco/Umbraco-CMS#21842
* Accessibility: Add tooltips to block grid entry actions by
@​manutdkid77 in umbraco/Umbraco-CMS#21958
* Accessibility: Added `title` attribute for icon in content types by
@​TechPdo in umbraco/Umbraco-CMS#21956

### 🚀 New Features
 ... (truncated)

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.2.2...release-17.3.0).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Umbraco.Cms.Persistence.Sqlite&package-manager=nuget&previous-version=17.2.2&new-version=17.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexander Seeliger <alexsee@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@leekelleher leekelleher leekelleher approved these changes

Assignees

No one assigned

Labels

area/frontend release/17.3.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@iOvergaard @leekelleher