Website Rendering: Add configurable output caching for template rendered pages#22338
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces first-class, opt-in output caching for Umbraco’s server-side rendered (SSR/Razor) website pages by integrating ASP.NET Core Output Caching with Umbraco’s rendering pipeline and adding automatic eviction/tagging mechanisms.
Changes:
- Add
Umbraco:CMS:Website:OutputCachetyped configuration and constants to support enabling and tuning website output caching. - Apply an output-cache policy to
RenderController-based rendering and implement tagging/vary-by hooks plus eviction handlers for content/media/member changes. - Add unit tests covering caching enable/disable conditions, tagging, vary-by providers, and eviction behavior.
Reviewed changes
Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/Umbraco.JsonSchema/UmbracoCmsSchema.cs | Adds Website settings into the generated Umbraco JSON schema model. |
| src/Umbraco.Core/DependencyInjection/UmbracoBuilder.Configuration.cs | Registers WebsiteSettings as Umbraco options. |
| src/Umbraco.Core/Constants-Configuration.cs | Adds ConfigWebsite configuration key constant. |
| src/Umbraco.Core/Constants-Website.cs | Introduces website output cache policy/tag constants. |
| src/Umbraco.Core/Configuration/Models/WebsiteSettings.cs | Adds typed WebsiteSettings including OutputCache duration and enable flag. |
| src/Umbraco.Core/Cache/OutputCacheContentChangedContext.cs | Adds eviction context model for custom eviction providers. |
| src/Umbraco.Core/Cache/IWebsiteOutputCacheDurationProvider.cs | New extension point for per-content cache duration selection. |
| src/Umbraco.Core/Cache/IWebsiteOutputCacheEvictionProvider.cs | New extension point for custom eviction tag mapping on content changes. |
| src/Umbraco.Core/Cache/IWebsiteOutputCacheManager.cs | New API for programmatic eviction by content/tag/all. |
| src/Umbraco.Core/Cache/IWebsiteOutputCacheTagProvider.cs | New extension point for adding custom cache tags per content item. |
| src/Umbraco.Web.Common/Controllers/RenderController.cs | Applies [OutputCache] policy to the default SSR render action. |
| src/Umbraco.Web.Website/DependencyInjection/UmbracoBuilderExtensions.cs | Wires output caching services/policy, pipeline filter, eviction handlers, and default providers. |
| src/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicy.cs | Implements website caching decision logic, tagging, vary-by provider invocation, and no-store/set-cookie storage prevention. |
| src/Umbraco.Web.Website/Caching/WebsiteOutputCachePipelineFilter.cs | Adds UseOutputCache() into the Umbraco pipeline via a filter. |
| src/Umbraco.Web.Website/Caching/WebsiteOutputCacheEvictionHandler.cs | Evicts cached pages/tags based on content cache refresher payloads (including branch/all). |
| src/Umbraco.Web.Website/Caching/MediaOutputCacheEvictionHandler.cs | Evicts cached pages that reference changed media via automatic relations. |
| src/Umbraco.Web.Website/Caching/MemberOutputCacheEvictionHandler.cs | Evicts cached pages that reference changed members via automatic relations. |
| src/Umbraco.Web.Website/Caching/RelationOutputCacheEvictionProvider.cs | Provides document-relation-based eviction tags for content changes. |
| src/Umbraco.Web.Website/Caching/WebsiteOutputCacheManager.cs | Implements IWebsiteOutputCacheManager by delegating to IOutputCacheStore tag eviction. |
| src/Umbraco.Web.Website/Caching/ContentTypeOutputCacheTagProvider.cs | Default tag provider to tag entries by content type alias. |
| src/Umbraco.Web.Website/Caching/DefaultWebsiteOutputCacheDurationProvider.cs | Default duration provider that defers to configured duration. |
| src/Umbraco.Web.Website/Caching/IWebsiteOutputCacheVaryByProvider.cs | Adds vary-by extension point for custom cache variation rules. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicyTests.cs | Unit tests for caching decisions, duration logic, tagging, and response storage disqualifiers. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCacheEvictionHandlerTests.cs | Unit tests for content-based eviction behavior and custom eviction providers. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/RelationOutputCacheEvictionProviderTests.cs | Unit tests for relation-based eviction tags. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCacheManagerTests.cs | Unit tests for programmatic eviction methods. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/DefaultWebsiteOutputCacheDurationProviderTests.cs | Unit test for default duration provider behavior. |
| tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/ContentTypeOutputCacheTagProviderTests.cs | Unit test for content-type tag generation. |
…tionProvider header comment. Co-authored-by: Sven Geusens <sge@umbraco.dk>
…b.com/umbraco/Umbraco-CMS into v17/feature/configurable-output-cache
|
Thanks for the review @Migaroez. I've addressed the points you raised inline and what we discussed (which is implemented now via the |
Migaroez
left a comment
There was a problem hiding this comment.
One more code health suggestion
Migaroez
left a comment
There was a problem hiding this comment.
Tests out great 🚀. Feel free to merge after considering the last code health suggestion
…bled checks around debug logging, further unit test.
Updated [Umbraco.Cms](https://github.com/umbraco/Umbraco-CMS) from 17.3.4 to 17.4.0. <details> <summary>Release notes</summary> _Sourced from [Umbraco.Cms's releases](https://github.com/umbraco/Umbraco-CMS/releases)._ ## 17.4.0 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc3 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0 ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 ... (truncated) ## 17.4.0-rc3 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ... (truncated) ## 17.4.0-rc2 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 ... (truncated) ## 17.4.0-rc ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 * Micro-optimization: Use Array.ConvertAll instead of LINQ .Select .ToArray by @Henr1k80 in umbraco/Umbraco-CMS#20292 * Entity Service: Batch GetAllPaths queries to avoid SQL Server parameter limit (closes #22470) by @AndyButland in umbraco/Umbraco-CMS#22471 * Document URL Service: Batch delete of obsolete URL segment records to avoid SQL Server parameter limit (closes #22339) by @AndyButland in umbraco/Umbraco-CMS#22340 * Content Version Cleanup: Optimize for large datasets (closes #22224) by @AndyButland in umbraco/Umbraco-CMS#22239 * Migrations: Optimise sortable value population for date properties by @AndyButland in umbraco/Umbraco-CMS#22547 * Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL Server (closes #22377) by @AndyButland in umbraco/Umbraco-CMS#22382 * Umb-icon color setting optimization by @nielslyngsoe in umbraco/Umbraco-CMS#22433 ### 🌈 Accessibility Improvements * Accessibility: Fix missing labels on uui-select elements causing console warnings by @andreaslborg in umbraco/Umbraco-CMS#22385 * Accessibility: Include visible initials in name displayed on account menu button (closes #21942) by @andreaslborg in umbraco/Umbraco-CMS#22117 ... (truncated) ## 17.3.5 ## What's Changed ### 🐛 Bug Fixes * Revert fix for making block editors read-only in trashed documents which causes a regression in certain multi-lingual block editing scenarios (closes #22472, re-opens #21982) by @nielslyngsoe in umbraco/Umbraco-CMS#22656 **Full Changelog**: umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5 Commits viewable in [compare view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0). </details> Updated [Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS) from 17.3.4 to 17.4.0. <details> <summary>Release notes</summary> _Sourced from [Umbraco.Cms.Persistence.Sqlite's releases](https://github.com/umbraco/Umbraco-CMS/releases)._ ## 17.4.0 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc3 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0 ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 ... (truncated) ## 17.4.0-rc3 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ... (truncated) ## 17.4.0-rc2 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 ... (truncated) ## 17.4.0-rc ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 * Micro-optimization: Use Array.ConvertAll instead of LINQ .Select .ToArray by @Henr1k80 in umbraco/Umbraco-CMS#20292 * Entity Service: Batch GetAllPaths queries to avoid SQL Server parameter limit (closes #22470) by @AndyButland in umbraco/Umbraco-CMS#22471 * Document URL Service: Batch delete of obsolete URL segment records to avoid SQL Server parameter limit (closes #22339) by @AndyButland in umbraco/Umbraco-CMS#22340 * Content Version Cleanup: Optimize for large datasets (closes #22224) by @AndyButland in umbraco/Umbraco-CMS#22239 * Migrations: Optimise sortable value population for date properties by @AndyButland in umbraco/Umbraco-CMS#22547 * Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL Server (closes #22377) by @AndyButland in umbraco/Umbraco-CMS#22382 * Umb-icon color setting optimization by @nielslyngsoe in umbraco/Umbraco-CMS#22433 ### 🌈 Accessibility Improvements * Accessibility: Fix missing labels on uui-select elements causing console warnings by @andreaslborg in umbraco/Umbraco-CMS#22385 * Accessibility: Include visible initials in name displayed on account menu button (closes #21942) by @andreaslborg in umbraco/Umbraco-CMS#22117 ... (truncated) ## 17.3.5 ## What's Changed ### 🐛 Bug Fixes * Revert fix for making block editors read-only in trashed documents which causes a regression in certain multi-lingual block editing scenarios (closes #22472, re-opens #21982) by @nielslyngsoe in umbraco/Umbraco-CMS#22656 **Full Changelog**: umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5 Commits viewable in [compare view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0). </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updated [Umbraco.Cms.DevelopmentMode.Backoffice](https://github.com/umbraco/Umbraco-CMS) from 17.3.4 to 17.4.0. <details> <summary>Release notes</summary> _Sourced from [Umbraco.Cms.DevelopmentMode.Backoffice's releases](https://github.com/umbraco/Umbraco-CMS/releases)._ ## 17.4.0 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc3 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0 ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 ... (truncated) ## 17.4.0-rc3 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-r2 ### 📦 Dependencies * Bump @umbraco-ui/uui to 1.17.3 by @iOvergaard in umbraco/Umbraco-CMS#22753 ### 🔒 Security * Backoffice: Add `localize.htmlString()` helper to prevent XSS in HTML-rendered translations by @iOvergaard in umbraco/Umbraco-CMS#22731 ### 🐛 Bug Fixes * Auth: Un-deprecate getLatestToken and route per-request fetches through it by @iOvergaard in umbraco/Umbraco-CMS#22736 * Color Picker: Refresh stored label when data type label changes (closes #22741) by @AndyButland in umbraco/Umbraco-CMS#22761 * Published Content: Fix Fallback.ToAncestors with no match throwing exception at property level (closes #22759) by @AndyButland in umbraco/Umbraco-CMS#22763 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3 ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ... (truncated) ## 17.4.0-rc2 ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed Since 17.4.0-rc ### 🐛 Bug Fixes * Block permissions: Correction of read-only inheritance and language access (closes #22472, #21973) by @nielslyngsoe in umbraco/Umbraco-CMS#22522 * Redirect Tracker: Prevent creation of redirects from unrouteable URLs (closes #22652, #22256) by @AndyButland in umbraco/Umbraco-CMS#22657 * [Blueprints: Fix intermittent blank workspace when creating documents from blueprints (closes #21996)](umbraco/Umbraco-CMS#22422 (comment)) by @AndyButland in umbraco/Umbraco-CMS#22422 **Full Changelog**: umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2 ## What's Changed Since the Previous Version (17.3.5) ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 ... (truncated) ## 17.4.0-rc ## Upgrade Notes Be aware of a change to behaviour for detecting the Umbraco application URL. Previously, `ApplicationMainUrl` was automatically set from the Host header of incoming HTTP requests. In environments where Umbraco is not behind a reverse proxy that validates the Host header, this could allow a forged Host header to overwrite the URL used in password reset links, user invitations, and other email notifications. While this is normally mitigated by proper hosting configuration and setting `UmbracoApplicationUrl` explicitly, we felt that the auto-detection behaviour should be hardened up and become an opt-in rather than the default. You can read more about this under "Breaking Changes" below, the [linked PR](umbraco/Umbraco-CMS#22307) and the [documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection). There are a few updates related to performance in this release that are worth investigating for larger sites. Using output cache in your projects, with intelligent and customisable detection of page invalidation, is now a [configuration option for templated websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching), with extension points also [applied for the Delivery API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching). We have optimised content cache rebuild after schema updates, with an option for [deferred rebuild in the background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode). If considering a project with significant expected concurrency for member login and registration, and you prefer to use an external service for member management, the new option for [lightweight external members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members) will be worth reviewing. If working with AI tools such as Umbraco MCP, additions to management API endpoints that expose JSON schema for data types and allow for patch updates of specific properties, should improve accuracy and reliability. As usual please find the full list of PRs that have contributed to Umbraco 17.4 as follows. ## What's Changed ### 🙌 Notable Changes * Management API: Add JSON Schema support for data types and content types by @Migaroez in umbraco/Umbraco-CMS#21771 * Media Picker: Add Cards/Table view switcher (closes #22005) by @madsrasmussen in umbraco/Umbraco-CMS#22138 * Management API: Add document patch endpoint by @Migaroez in umbraco/Umbraco-CMS#22104 * Website Rendering: Add configurable output caching for template rendered pages by @AndyButland in umbraco/Umbraco-CMS#22338 * Basic Authentication: Standalone login page for frontend-only deployments (closes #22144) by @AndyButland in umbraco/Umbraco-CMS#22168 * Icons: extends icon data + improved search by @nielslyngsoe in umbraco/Umbraco-CMS#22436 * Members: Add lightweight external-only members (closes #12741) by @AndyButland in umbraco/Umbraco-CMS#22162 * Cache: Add deferred content type rebuild mode with de-duplication by @AndyButland in umbraco/Umbraco-CMS#22194 ### 💥 Breaking Changes * Application URL: Add `ApplicationUrlDetection` setting to control application URL auto-detection by @AndyButland in umbraco/Umbraco-CMS#22307 ### 📦 Dependencies * Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by @dependabot[bot] in umbraco/Umbraco-CMS#22334 * Dependencies: Update minor and patch versions by @AndyButland in umbraco/Umbraco-CMS#22498 * Update npm dependencies for v17.4.0-rc by @NguyenThuyLan in umbraco/Umbraco-CMS#22464 * Bump the npm_and_yarn group across 3 directories with 4 updates by @dependabot[bot] in umbraco/Umbraco-CMS#22537 * Dependencies: Update Microsoft packages to latest patch and fix HybridCache ParseFault with Redis by @AndyButland in umbraco/Umbraco-CMS#22278 * Dependencies: Pin `System.Security.Cryptography.Xml` to resolve vulnerability warning by @AndyButland in umbraco/Umbraco-CMS#22514 ### 🚤 Performance * Performance: Batch backoffice media thumbnail URL requests to reduce N+1 API calls by @AndyButland in umbraco/Umbraco-CMS#22329 * Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across all repositories by @AndyButland in umbraco/Umbraco-CMS#22264 * Performance: Optimize `ContentTypeRepository` deep-clone on cache reads (closes #22250) by @AndyButland in umbraco/Umbraco-CMS#22263 * Performance: Use `GeneratedRegex` instead of generating at runtime in string extensions by @Henr1k80 in umbraco/Umbraco-CMS#22534 * Performance: Avoid allocating a string if `_publishedContentCache` has a cached version in `MediaCacheService` by @Henr1k80 in umbraco/Umbraco-CMS#22535 * Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix naming & formatting of exceptions) by @Henr1k80 in umbraco/Umbraco-CMS#22506 * Micro-optimization: Use Array.ConvertAll instead of LINQ .Select .ToArray by @Henr1k80 in umbraco/Umbraco-CMS#20292 * Entity Service: Batch GetAllPaths queries to avoid SQL Server parameter limit (closes #22470) by @AndyButland in umbraco/Umbraco-CMS#22471 * Document URL Service: Batch delete of obsolete URL segment records to avoid SQL Server parameter limit (closes #22339) by @AndyButland in umbraco/Umbraco-CMS#22340 * Content Version Cleanup: Optimize for large datasets (closes #22224) by @AndyButland in umbraco/Umbraco-CMS#22239 * Migrations: Optimise sortable value population for date properties by @AndyButland in umbraco/Umbraco-CMS#22547 * Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL Server (closes #22377) by @AndyButland in umbraco/Umbraco-CMS#22382 * Umb-icon color setting optimization by @nielslyngsoe in umbraco/Umbraco-CMS#22433 ### 🌈 Accessibility Improvements * Accessibility: Fix missing labels on uui-select elements causing console warnings by @andreaslborg in umbraco/Umbraco-CMS#22385 * Accessibility: Include visible initials in name displayed on account menu button (closes #21942) by @andreaslborg in umbraco/Umbraco-CMS#22117 ... (truncated) ## 17.3.5 ## What's Changed ### 🐛 Bug Fixes * Revert fix for making block editors read-only in trashed documents which causes a regression in certain multi-lingual block editing scenarios (closes #22472, re-opens #21982) by @nielslyngsoe in umbraco/Umbraco-CMS#22656 **Full Changelog**: umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5 Commits viewable in [compare view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Description
Adds opt-in output caching for Umbraco's server-side rendered (SSR/Razor) pages using the ASP.NET Core Output Caching middleware.
Currently, every front-end page request runs the full rendering pipeline: Razor view execution, property value converters, content tree traversal, Examine queries, etc. The ASP.NET Core Output Caching middleware can solve this, but it doesn't work out-of-the-box with Umbraco due to pipeline ordering and the need for explicit policy application. Customers must manually wire up middleware, create custom controllers, and handle cache eviction — several non-obvious steps.
This PR makes output caching a simple configuration toggle with sensible defaults, automatic cache eviction on publish, and extensibility points for advanced scenarios.
References GitHub Discussion #22218.
The Delivery API already has output caching support. This PR looks to bring similar to the template rendering pipeline.
Configuration
Enable output caching by adding the following to
appsettings.json:{ "Umbraco": { "CMS": { "Website": { "OutputCache": { "Enabled": true, "ContentDuration": "00:00:30" } } } } }EnabledboolfalseContentDurationTimeSpan00:00:10IWebsiteOutputCacheDurationProvider.Note that the feature is Disabled by default so there's no breaking change or surprise behaviour for existing sites.
Default Behaviour
When enabled, the following happens out of the box with no additional code:
What is cached
RenderControlleror controllers inheriting from it (route hijacking).What is NOT cached
Cache-Control: no-storein the response (e.g. pages rendering@Html.AntiForgeryToken()).Set-Cookieresponse headers.SetNoCacheHeaderon the published request.IRenderControllerdirectly (without inheritingRenderController).Automatic eviction
By content item: When content is published, unpublished, moved, or deleted, the cached page for that content item is automatically evicted.
By branch: Branch operations (e.g. moving a node with children) evict all descendants. This uses ancestor-based tagging — each cached page is tagged with its ancestor keys, and branch eviction targets the ancestor tag.
By content type: Each cached page is tagged with its content type alias (e.g.
umb-content-type-blogPost), enabling eviction by content type if needed viaIWebsiteOutputCacheManager.By relations: When content, media, or a member is saved, any documents that reference the changed item via picker properties (content pickers, media pickers, member pickers) are automatically evicted. This uses Umbraco's automatic relation types (
umbDocument,umbMedia,umbMember).Global: A full content cache refresh evicts all cached pages.
Distributed support
Eviction is triggered by
ContentCacheRefresherNotification(andMediaCacheRefresherNotification,MemberCacheRefresherNotification), which fire on all servers in a load-balanced setup. Each server evicts from its own output cache store.Extension Points
Request Filter (
IWebsiteOutputCacheRequestFilter)Controls whether a request is eligible for output caching. Useful when the default behaviour (skip caching for preview mode and authenticated member requests) needs to be customised — for example, to allow caching for authenticated members when personalised content is delivered client-side via JavaScript.
Single registration — replace the default via
builder.Services.AddSingleton<IWebsiteOutputCacheRequestFilter, MyFilter>().The default implementation (
DefaultWebsiteOutputCacheRequestFilter) returnsfalse(not cacheable) for preview mode and authenticated member requests. It exposesvirtualmethods for each check, so customers can inherit and override individual concerns without reimplementing the full filter.Example — allow caching for authenticated members:
Example — skip caching for specific content types:
Custom Cache Duration (
IWebsiteOutputCacheDurationProvider)Override cache duration per content item. Useful when different content types have different freshness requirements (e.g. you could have the home page cache for a shorter time than rarely edited historical press releases).
Return
nullto use the configured default, a positiveTimeSpanto override, orTimeSpan.Zeroto disable caching for that content item.Single registration — replace the default via
builder.Services.AddSingleton<IWebsiteOutputCacheDurationProvider, MyProvider>().Example — cache press releases for 1 hour, home page for 5 minutes:
Custom Cache Tags (
IWebsiteOutputCacheTagProvider)Add custom tags to cached responses. Tags can be targeted by the eviction provider or via
IWebsiteOutputCacheManager.EvictByTagAsync().Multiple registrations allowed. Register via
builder.Services.AddSingleton<IWebsiteOutputCacheTagProvider, MyProvider>().See "evict blog category pages when a blog post of that category is published" example below.
Custom Cache Eviction (
IWebsiteOutputCacheEvictionProvider)Add custom eviction logic when content changes. Works as a pair with
IWebsiteOutputCacheTagProvider.Multiple registrations allowed. Register via
builder.Services.AddSingleton<IWebsiteOutputCacheEvictionProvider, MyProvider>().Example — evict all pages on any publish:
Example — evict blog category pages when a blog post of that category is published:
Programmatic Eviction (
IWebsiteOutputCacheManager)Evict cache entries from custom code, e.g. when external data changes. Inject via DI. All methods are no-ops when output caching is not enabled.
Custom Cache Variation (
IWebsiteOutputCacheVaryByProvider)Control which request dimensions produce separate cache entries. Gives direct access to ASP.NET Core's
CacheVaryByRules.Multiple registrations allowed. Register via
builder.Services.AddSingleton<IWebsiteOutputCacheVaryByProvider, MyProvider>().Example — only vary by "page" query parameter, ignoring UTM tracking params:
Example — vary by culture cookie:
Route Hijacking
Controllers inheriting from
RenderControllerinherit caching automatically. To opt out:Controllers implementing
IRenderControllerdirectly (not inheritingRenderController) are NOT cached by default. To opt in:Debugging
The policy logs all cache decisions at
Debuglevel. Enable with:{ "Serilog": { "MinimumLevel": { "Override": { "Umbraco.Cms.Web.Website.Caching": "Debug" } } } }Log messages include why caching was skipped (preview, authenticated, no-store, disabled, etc.) or why it was enabled (content key, duration, tag count). The
Ageresponse header indicates cache hits.Testing
Automated
Unit tests for all default components are added in
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/:WebsiteOutputCachePolicyTests(14 tests) — request filter integration, SetNoCacheHeader, no route values, duration provider (custom, null fallback, zero disables), tagging (content key, ancestors, all tag, custom providers), vary-by providers, Set-Cookie detection, Cache-Control: no-store detection.DocumentOutputCacheEvictionHandlerTests(11 tests) — RefreshNode, Remove, RefreshBranch, RefreshAll, multiple payloads, custom eviction providers, null key, relation-based eviction, deduplication of related documents across payloads.DefaultWebsiteOutputCacheRequestFilterTests(4 tests) — anonymous + not preview (cacheable), preview mode (not cacheable), authenticated member (not cacheable), no Umbraco context (cacheable).WebsiteOutputCacheManagerTests(3 tests) — evict by content key, evict all, evict by tag passthrough.ContentTypeOutputCacheTagProviderTests(1 test) — returns content type tag.DefaultWebsiteOutputCacheDurationProviderTests(1 test) — returns null.Run with:
Manual
All manual tests were performed with output caching enabled for one minute (
ContentDuration: 00:01:00) using a template that renders@DateTime.Nowto show whether the page is cached.Test 1: Basic Caching
Browse to a content page, note timestamp. Refresh within 60 seconds — timestamp unchanged (cached). Wait 60 seconds and refresh — new timestamp.
Test 2: Cache Eviction on Publish
Browse to a page, note timestamp. Publish the page in the backoffice. Refresh — new timestamp immediately.
Test 3: Publish Isolation
Browse to Page A and Page B, note both timestamps. Publish Page B. Refresh Page A — still shows cached timestamp. Refresh Page B — new timestamp.
Test 4: Preview Mode Bypasses Cache
Browse to a cached page. Click "Save and Preview" in backoffice. Preview always shows current timestamp — never cached.
Test 5: Antiforgery / Forms Not Cached
Create a template with
@Html.AntiForgeryToken()in a form:Browse to the page — timestamp changes on every refresh because the antiforgery middleware sets
Cache-Control: no-store.Test 6: Authenticated Member Bypasses Cache
Log in as a member (e.g. via
DebugMemberLoginController). Browse to a page — timestamp changes on every refresh. Log out — caching resumes.Member login controller for testing:
Test 7: Hijacked Controller Inherits Caching
Create for example a
ContactController : RenderControllerfor the "contact" document type. AddedViewData["HijackedBy"]and rendered in the template to prove the hijacked controller is active. Page is still cached — inherits fromRenderController.Test 8: Hijacked Controller Opts Out
Added
[OutputCache(NoStore = true)]to the hijacked controller'sIndex(). Timestamp changes on every refresh — opted out of caching.Test 9: Custom Duration Provider
Registered a custom
IWebsiteOutputCacheDurationProviderthat returnsTimeSpan.FromSeconds(5)forhomedocument type,nullfor everything else. Home page expires after 5 seconds, other pages use the configured 60-second default.Test 10: Custom Tag + Eviction Provider (Cross-Content Eviction)
Registered a tag provider that tags home pages with
"evict-on-blogpost-publish", and an eviction provider that returns that tag when a blogpost is published. Publishing a blogpost evicts the home page. Publishing other content types does not.Test 11: VaryBy Provider — Query Key Filtering
Registered a provider that sets
rules.QueryKeys = ["page"]. Browsing to/?utm_source=googleserves the same cached response as/. Browsing to/?page=2produces a separate cache entry.Test 11b: VaryBy Provider — Culture Cookie
Registered a provider that varies by a
test_culturecookie. You can add these as key value pairs via the browser's developer tool. Different cookie values produce separate cache entries. Switching back to a previously seen value returns the cached response.Test 12: Feature Disabled by Default
Removed the
Website:OutputCachesection from appsettings. Timestamp changes on every refresh — no caching active. No errors.Test 13: Relation-Based Eviction
Home page has a content picker selecting an article. Published the article — home page cache evicted automatically via the built-in
umbDocumentrelation. Published an unrelated page — home page remains cached. Also verify:Test 14: Custom Request Filter — Skip Caching by Content Type
Registered a custom
IWebsiteOutputCacheRequestFilterthat inherits fromDefaultWebsiteOutputCacheRequestFilterand skips caching for the "contact" document type. All other pages use the default behaviour (cached unless preview or authenticated).Steps:
base.IsCacheable()).Documentation
Need to document the configuration and extension points.