Skip to content

Website Rendering: Add configurable output caching for template rendered pages#22338

Merged
AndyButland merged 15 commits into
mainfrom
v17/feature/configurable-output-cache
Apr 11, 2026
Merged

Website Rendering: Add configurable output caching for template rendered pages#22338
AndyButland merged 15 commits into
mainfrom
v17/feature/configurable-output-cache

Conversation

@AndyButland
Copy link
Copy Markdown
Contributor

@AndyButland AndyButland commented Apr 2, 2026

Description

Adds opt-in output caching for Umbraco's server-side rendered (SSR/Razor) pages using the ASP.NET Core Output Caching middleware.

Currently, every front-end page request runs the full rendering pipeline: Razor view execution, property value converters, content tree traversal, Examine queries, etc. The ASP.NET Core Output Caching middleware can solve this, but it doesn't work out-of-the-box with Umbraco due to pipeline ordering and the need for explicit policy application. Customers must manually wire up middleware, create custom controllers, and handle cache eviction — several non-obvious steps.

This PR makes output caching a simple configuration toggle with sensible defaults, automatic cache eviction on publish, and extensibility points for advanced scenarios.

References GitHub Discussion #22218.

The Delivery API already has output caching support. This PR looks to bring similar to the template rendering pipeline.

Configuration

Enable output caching by adding the following to appsettings.json:

{
  "Umbraco": {
    "CMS": {
      "Website": {
        "OutputCache": {
          "Enabled": true,
          "ContentDuration": "00:00:30"
        }
      }
    }
  }
}
Property Type Default Description
Enabled bool false Enable or disable website output caching.
ContentDuration TimeSpan 00:00:10 Default cache duration. Can be overridden per content item via IWebsiteOutputCacheDurationProvider.

Note that the feature is Disabled by default so there's no breaking change or surprise behaviour for existing sites.

Default Behaviour

When enabled, the following happens out of the box with no additional code:

What is cached

  • All pages rendered via RenderController or controllers inheriting from it (route hijacking).

What is NOT cached

  • Preview mode requests (by default).
  • Authenticated member requests (by default).
  • Pages with Cache-Control: no-store in the response (e.g. pages rendering @Html.AntiForgeryToken()).
  • Pages with Set-Cookie response headers.
  • Pages where the routing pipeline sets SetNoCacheHeader on the published request.
  • Controllers implementing IRenderController directly (without inheriting RenderController).

Automatic eviction

By content item: When content is published, unpublished, moved, or deleted, the cached page for that content item is automatically evicted.

By branch: Branch operations (e.g. moving a node with children) evict all descendants. This uses ancestor-based tagging — each cached page is tagged with its ancestor keys, and branch eviction targets the ancestor tag.

By content type: Each cached page is tagged with its content type alias (e.g. umb-content-type-blogPost), enabling eviction by content type if needed via IWebsiteOutputCacheManager.

By relations: When content, media, or a member is saved, any documents that reference the changed item via picker properties (content pickers, media pickers, member pickers) are automatically evicted. This uses Umbraco's automatic relation types (umbDocument, umbMedia, umbMember).

Global: A full content cache refresh evicts all cached pages.

Distributed support

Eviction is triggered by ContentCacheRefresherNotification (and MediaCacheRefresherNotification, MemberCacheRefresherNotification), which fire on all servers in a load-balanced setup. Each server evicts from its own output cache store.

Extension Points

Request Filter (IWebsiteOutputCacheRequestFilter)

Controls whether a request is eligible for output caching. Useful when the default behaviour (skip caching for preview mode and authenticated member requests) needs to be customised — for example, to allow caching for authenticated members when personalised content is delivered client-side via JavaScript.

Single registration — replace the default via builder.Services.AddSingleton<IWebsiteOutputCacheRequestFilter, MyFilter>().

The default implementation (DefaultWebsiteOutputCacheRequestFilter) returns false (not cacheable) for preview mode and authenticated member requests. It exposes virtual methods for each check, so customers can inherit and override individual concerns without reimplementing the full filter.

Example — allow caching for authenticated members:

public class AllowAuthenticatedCachingFilter : DefaultWebsiteOutputCacheRequestFilter
{
    public AllowAuthenticatedCachingFilter(IUmbracoContextAccessor umbracoContextAccessor)
        : base(umbracoContextAccessor) { }

    // Allow caching for authenticated members.
    protected override bool ShouldExcludeAuthenticated(HttpContext context) => false;
}

public class MyCacheComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
        => builder.Services.AddSingleton<IWebsiteOutputCacheRequestFilter, AllowAuthenticatedCachingFilter>();
}

Example — skip caching for specific content types:

public class SkipSearchResultsCachingFilter : DefaultWebsiteOutputCacheRequestFilter
{
    public SkipSearchResultsCachingFilter(IUmbracoContextAccessor umbracoContextAccessor)
        : base(umbracoContextAccessor) { }

    public override bool IsCacheable(HttpContext context, IPublishedContent content)
    {
        // Don't cache search results pages.
        if (content.ContentType.Alias == "searchResults")
        {
            return false;
        }

        return base.IsCacheable(context, content);
    }
}

Custom Cache Duration (IWebsiteOutputCacheDurationProvider)

Override cache duration per content item. Useful when different content types have different freshness requirements (e.g. you could have the home page cache for a shorter time than rarely edited historical press releases).

Return null to use the configured default, a positive TimeSpan to override, or TimeSpan.Zero to disable caching for that content item.

Single registration — replace the default via builder.Services.AddSingleton<IWebsiteOutputCacheDurationProvider, MyProvider>().

Example — cache press releases for 1 hour, home page for 5 minutes:

public class MyDurationProvider : IWebsiteOutputCacheDurationProvider
{
    public TimeSpan? GetDuration(IPublishedContent content)
        => content.ContentType.Alias switch
        {
            "pressRelease" => TimeSpan.FromHours(1),
            "homePage" => TimeSpan.FromMinutes(5),
            _ => null // use configured default
        };
}

Custom Cache Tags (IWebsiteOutputCacheTagProvider)

Add custom tags to cached responses. Tags can be targeted by the eviction provider or via IWebsiteOutputCacheManager.EvictByTagAsync().

Multiple registrations allowed. Register via builder.Services.AddSingleton<IWebsiteOutputCacheTagProvider, MyProvider>().

See "evict blog category pages when a blog post of that category is published" example below.

Custom Cache Eviction (IWebsiteOutputCacheEvictionProvider)

Add custom eviction logic when content changes. Works as a pair with IWebsiteOutputCacheTagProvider.

Multiple registrations allowed. Register via builder.Services.AddSingleton<IWebsiteOutputCacheEvictionProvider, MyProvider>().

Example — evict all pages on any publish:

public class EvictAllOnPublishProvider : IWebsiteOutputCacheEvictionProvider
{
    public Task<IEnumerable<string>> GetAdditionalEvictionTagsAsync(
        OutputCacheContentChangedContext context,
        CancellationToken cancellationToken = default)
        => Task.FromResult<IEnumerable<string>>(
            [Constants.Website.OutputCache.AllContentTag]);
}

Example — evict blog category pages when a blog post of that category is published:

// Step 1: Tag provider — tag category pages with a custom tag
public class BlogCacheTagProvider : IWebsiteOutputCacheTagProvider
{
    public IEnumerable<string> GetTags(IPublishedContent content)
    {
        if (content.ContentType.Alias == "blogCategory")
            yield return $"blog-category-{content.Key}";
    }
}

// Step 2: Eviction provider — when a blog post changes, evict its category
public class BlogEvictionProvider : IWebsiteOutputCacheEvictionProvider
{
    private readonly IContentService _contentService;

    public BlogEvictionProvider(IContentService contentService)
        => _contentService = contentService;

    public Task<IEnumerable<string>> GetAdditionalEvictionTagsAsync(
        OutputCacheContentChangedContext context,
        CancellationToken cancellationToken = default)
    {
        var content = _contentService.GetById(context.ContentKey);
        if (content?.ContentType.Alias == "blogPost" && content.ParentId > 0)
        {
            var parent = _contentService.GetById(content.ParentId);
            if (parent != null)
            {
                return Task.FromResult<IEnumerable<string>>(
                    [$"blog-category-{parent.Key}"]);
            }
        }

        return Task.FromResult<IEnumerable<string>>([]);
    }
}

// Register both in a composer
public class BlogCacheComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.AddSingleton<IWebsiteOutputCacheTagProvider, BlogCacheTagProvider>();
        builder.Services.AddSingleton<IWebsiteOutputCacheEvictionProvider, BlogEvictionProvider>();
    }
}

Programmatic Eviction (IWebsiteOutputCacheManager)

Evict cache entries from custom code, e.g. when external data changes. Inject via DI. All methods are no-ops when output caching is not enabled.

public class MyWebhookController : Controller
{
    private readonly IWebsiteOutputCacheManager _cacheManager;

    public MyWebhookController(IWebsiteOutputCacheManager cacheManager)
        => _cacheManager = cacheManager;

    [HttpPost]
    public async Task<IActionResult> OnExternalDataChanged(Guid contentKey)
    {
        await _cacheManager.EvictContentAsync(contentKey);
        return Ok();
    }
}

Custom Cache Variation (IWebsiteOutputCacheVaryByProvider)

Control which request dimensions produce separate cache entries. Gives direct access to ASP.NET Core's CacheVaryByRules.

Multiple registrations allowed. Register via builder.Services.AddSingleton<IWebsiteOutputCacheVaryByProvider, MyProvider>().

Example — only vary by "page" query parameter, ignoring UTM tracking params:

public class QueryKeyVaryByProvider : IWebsiteOutputCacheVaryByProvider
{
    public void ConfigureVaryBy(HttpContext context, CacheVaryByRules rules)
    {
        rules.QueryKeys = new StringValues(["page", "sort"]);
    }
}

Example — vary by culture cookie:

public class CultureVaryByProvider : IWebsiteOutputCacheVaryByProvider
{
    public void ConfigureVaryBy(HttpContext context, CacheVaryByRules rules)
    {
        var culture = context.Request.Cookies["umb_culture"];
        if (culture is not null)
        {
            rules.VaryByValues["culture"] = culture;
        }
    }
}

Route Hijacking

Controllers inheriting from RenderController inherit caching automatically. To opt out:

public class FormPageController : RenderController
{
    // ... constructor ...

    [OutputCache(NoStore = true)]
    public override IActionResult Index()
        => CurrentTemplate(new ContentModel(CurrentPage));
}

Controllers implementing IRenderController directly (not inheriting RenderController) are NOT cached by default. To opt in:

[OutputCache(PolicyName = Constants.Website.OutputCache.ContentCachePolicy)]
public IActionResult Index() => View();

Debugging

The policy logs all cache decisions at Debug level. Enable with:

{
  "Serilog": {
    "MinimumLevel": {
      "Override": {
        "Umbraco.Cms.Web.Website.Caching": "Debug"
      }
    }
  }
}

Log messages include why caching was skipped (preview, authenticated, no-store, disabled, etc.) or why it was enabled (content key, duration, tag count). The Age response header indicates cache hits.

Testing

Automated

Unit tests for all default components are added in tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/:

  • WebsiteOutputCachePolicyTests (14 tests) — request filter integration, SetNoCacheHeader, no route values, duration provider (custom, null fallback, zero disables), tagging (content key, ancestors, all tag, custom providers), vary-by providers, Set-Cookie detection, Cache-Control: no-store detection.
  • DocumentOutputCacheEvictionHandlerTests (11 tests) — RefreshNode, Remove, RefreshBranch, RefreshAll, multiple payloads, custom eviction providers, null key, relation-based eviction, deduplication of related documents across payloads.
  • DefaultWebsiteOutputCacheRequestFilterTests (4 tests) — anonymous + not preview (cacheable), preview mode (not cacheable), authenticated member (not cacheable), no Umbraco context (cacheable).
  • WebsiteOutputCacheManagerTests (3 tests) — evict by content key, evict all, evict by tag passthrough.
  • ContentTypeOutputCacheTagProviderTests (1 test) — returns content type tag.
  • DefaultWebsiteOutputCacheDurationProviderTests (1 test) — returns null.

Run with:

dotnet test tests/Umbraco.Tests.UnitTests/ --filter "FullyQualifiedName~Umbraco.Web.Website.Caching"

Manual

All manual tests were performed with output caching enabled for one minute (ContentDuration: 00:01:00) using a template that renders @DateTime.Now to show whether the page is cached.

Test 1: Basic Caching

Browse to a content page, note timestamp. Refresh within 60 seconds — timestamp unchanged (cached). Wait 60 seconds and refresh — new timestamp.

Test 2: Cache Eviction on Publish

Browse to a page, note timestamp. Publish the page in the backoffice. Refresh — new timestamp immediately.

Test 3: Publish Isolation

Browse to Page A and Page B, note both timestamps. Publish Page B. Refresh Page A — still shows cached timestamp. Refresh Page B — new timestamp.

Test 4: Preview Mode Bypasses Cache

Browse to a cached page. Click "Save and Preview" in backoffice. Preview always shows current timestamp — never cached.

Test 5: Antiforgery / Forms Not Cached

Create a template with @Html.AntiForgeryToken() in a form:

<form method="post">
    @Html.AntiForgeryToken()
    <button type="submit">Submit</button>
</form>

Browse to the page — timestamp changes on every refresh because the antiforgery middleware sets Cache-Control: no-store.

Test 6: Authenticated Member Bypasses Cache

Log in as a member (e.g. via DebugMemberLoginController). Browse to a page — timestamp changes on every refresh. Log out — caching resumes.

Member login controller for testing:

[ApiController]
[Route("debug/member")]
public class DebugMemberLoginController : ControllerBase
{
    private readonly IMemberSignInManager _memberSignInManager;

    public DebugMemberLoginController(IMemberSignInManager memberSignInManager)
        => _memberSignInManager = memberSignInManager;

    [HttpGet("login")]
    public async Task<IActionResult> Login()
    {
        var result = await _memberSignInManager.PasswordSignInAsync(
            "test@test.com", "password", true, false);
        return Ok(result.ToString());
    }

    [HttpGet("logout")]
    public async Task<IActionResult> Logout()
    {
        await _memberSignInManager.SignOutAsync();
        return Ok("Logged out");
    }
}

Test 7: Hijacked Controller Inherits Caching

Create for example a ContactController : RenderController for the "contact" document type. Added ViewData["HijackedBy"] and rendered in the template to prove the hijacked controller is active. Page is still cached — inherits from RenderController.

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.ViewEngines;
using Microsoft.AspNetCore.OutputCaching;
using Umbraco.Cms.Core.Models;
using Umbraco.Cms.Core.Web;
using Umbraco.Cms.Web.Common.Controllers;

public class ContactController : RenderController
{
    public ContactController(
        ILogger<ContactController> logger,
        ICompositeViewEngine compositeViewEngine,
        IUmbracoContextAccessor umbracoContextAccessor)
        : base(logger, compositeViewEngine, umbracoContextAccessor)
    {
    }

    public override IActionResult Index()
    {
        ViewData["HijackedBy"] = nameof(ContactController);
        return CurrentTemplate(new ContentModel(CurrentPage));
    }
}

Test 8: Hijacked Controller Opts Out

Added [OutputCache(NoStore = true)] to the hijacked controller's Index(). Timestamp changes on every refresh — opted out of caching.

Test 9: Custom Duration Provider

Registered a custom IWebsiteOutputCacheDurationProvider that returns TimeSpan.FromSeconds(5) for home document type, null for everything else. Home page expires after 5 seconds, other pages use the configured 60-second default.

public class TestDurationProvider : IWebsiteOutputCacheDurationProvider
{
    public TimeSpan? GetDuration(IPublishedContent content)
        => content.ContentType.Alias == "home"
            ? TimeSpan.FromSeconds(5)
            : null;
}

public class TestOutputCacheDurationComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
        => builder.Services.AddSingleton<IWebsiteOutputCacheDurationProvider, TestDurationProvider>();
}

Test 10: Custom Tag + Eviction Provider (Cross-Content Eviction)

Registered a tag provider that tags home pages with "evict-on-blogpost-publish", and an eviction provider that returns that tag when a blogpost is published. Publishing a blogpost evicts the home page. Publishing other content types does not.

public class HomeCacheTagProvider : IWebsiteOutputCacheTagProvider
{
    public IEnumerable<string> GetTags(IPublishedContent content)
    {
        if (content.ContentType.Alias == "home")
        {
            yield return "evict-on-blogpost-publish";
        }
    }
}

public class BlogPostEvictionProvider : IWebsiteOutputCacheEvictionProvider
{
    private readonly IContentService _contentService;

    public BlogPostEvictionProvider(IContentService contentService)
        => _contentService = contentService;

    public Task<IEnumerable<string>> GetAdditionalEvictionTagsAsync(
        OutputCacheContentChangedContext context,
        CancellationToken cancellationToken = default)
    {
        var content = _contentService.GetById(context.ContentKey);
        if (content?.ContentType.Alias == "blogpost")
        {
            return Task.FromResult<IEnumerable<string>>(["evict-on-blogpost-publish"]);
        }

        return Task.FromResult<IEnumerable<string>>([]);
    }
}

public class TestOutputCacheEvictionComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.AddSingleton<IWebsiteOutputCacheTagProvider, HomeCacheTagProvider>();
        builder.Services.AddSingleton<IWebsiteOutputCacheEvictionProvider, BlogPostEvictionProvider>();
    }
}

Test 11: VaryBy Provider — Query Key Filtering

Registered a provider that sets rules.QueryKeys = ["page"]. Browsing to /?utm_source=google serves the same cached response as /. Browsing to /?page=2 produces a separate cache entry.

public class QueryKeyVaryByProvider : IWebsiteOutputCacheVaryByProvider
{
    public void ConfigureVaryBy(HttpContext context, CacheVaryByRules rules)
        => rules.QueryKeys = new StringValues(["page"]);
}

public class TestVaryByComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
        => builder.Services.AddSingleton<IWebsiteOutputCacheVaryByProvider, QueryKeyVaryByProvider>();
}

Test 11b: VaryBy Provider — Culture Cookie

Registered a provider that varies by a test_culture cookie. You can add these as key value pairs via the browser's developer tool. Different cookie values produce separate cache entries. Switching back to a previously seen value returns the cached response.

public class CultureVaryByProvider : IWebsiteOutputCacheVaryByProvider
{
    public void ConfigureVaryBy(HttpContext context, CacheVaryByRules rules)
    {
        var culture = context.Request.Cookies["test_culture"];
        if (culture is not null)
        {
            rules.VaryByValues["culture"] = culture;
        }
    }
}

Test 12: Feature Disabled by Default

Removed the Website:OutputCache section from appsettings. Timestamp changes on every refresh — no caching active. No errors.

Test 13: Relation-Based Eviction

Home page has a content picker selecting an article. Published the article — home page cache evicted automatically via the built-in umbDocument relation. Published an unrelated page — home page remains cached. Also verify:

  • Saving a media item referenced by a document via a media picker evicts that document's cached page.
  • Saving a member referenced by a document via a member picker evicts that document's cached page.

Test 14: Custom Request Filter — Skip Caching by Content Type

Registered a custom IWebsiteOutputCacheRequestFilter that inherits from DefaultWebsiteOutputCacheRequestFilter and skips caching for the "contact" document type. All other pages use the default behaviour (cached unless preview or authenticated).

public class SkipContactCachingFilter : DefaultWebsiteOutputCacheRequestFilter
{
    public SkipContactCachingFilter(IUmbracoContextAccessor umbracoContextAccessor)
        : base(umbracoContextAccessor) { }

    public override bool IsCacheable(HttpContext context, IPublishedContent content)
    {
        if (content.ContentType.Alias == "contact")
        {
            return false;
        }

        return base.IsCacheable(context, content);
    }
}

public class TestRequestFilterComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
        => builder.Services.AddSingleton<IWebsiteOutputCacheRequestFilter, SkipContactCachingFilter>();
}

Steps:

  1. Browse to the contact page — note timestamp, refresh immediately — timestamp changes (not cached).
  2. Browse to the home page — note timestamp, refresh immediately — timestamp unchanged (cached).
  3. Preview the home page — timestamp changes (preview still excluded via base.IsCacheable()).

Documentation

Need to document the configuration and extension points.

Copilot AI review requested due to automatic review settings April 2, 2026 14:23
@AndyButland AndyButland changed the title Website: Add configurable output caching for SSR/Razor rendered pages Website Rendering: Add configurable output caching for template rendered pages Apr 2, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces first-class, opt-in output caching for Umbraco’s server-side rendered (SSR/Razor) website pages by integrating ASP.NET Core Output Caching with Umbraco’s rendering pipeline and adding automatic eviction/tagging mechanisms.

Changes:

  • Add Umbraco:CMS:Website:OutputCache typed configuration and constants to support enabling and tuning website output caching.
  • Apply an output-cache policy to RenderController-based rendering and implement tagging/vary-by hooks plus eviction handlers for content/media/member changes.
  • Add unit tests covering caching enable/disable conditions, tagging, vary-by providers, and eviction behavior.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
tools/Umbraco.JsonSchema/UmbracoCmsSchema.cs Adds Website settings into the generated Umbraco JSON schema model.
src/Umbraco.Core/DependencyInjection/UmbracoBuilder.Configuration.cs Registers WebsiteSettings as Umbraco options.
src/Umbraco.Core/Constants-Configuration.cs Adds ConfigWebsite configuration key constant.
src/Umbraco.Core/Constants-Website.cs Introduces website output cache policy/tag constants.
src/Umbraco.Core/Configuration/Models/WebsiteSettings.cs Adds typed WebsiteSettings including OutputCache duration and enable flag.
src/Umbraco.Core/Cache/OutputCacheContentChangedContext.cs Adds eviction context model for custom eviction providers.
src/Umbraco.Core/Cache/IWebsiteOutputCacheDurationProvider.cs New extension point for per-content cache duration selection.
src/Umbraco.Core/Cache/IWebsiteOutputCacheEvictionProvider.cs New extension point for custom eviction tag mapping on content changes.
src/Umbraco.Core/Cache/IWebsiteOutputCacheManager.cs New API for programmatic eviction by content/tag/all.
src/Umbraco.Core/Cache/IWebsiteOutputCacheTagProvider.cs New extension point for adding custom cache tags per content item.
src/Umbraco.Web.Common/Controllers/RenderController.cs Applies [OutputCache] policy to the default SSR render action.
src/Umbraco.Web.Website/DependencyInjection/UmbracoBuilderExtensions.cs Wires output caching services/policy, pipeline filter, eviction handlers, and default providers.
src/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicy.cs Implements website caching decision logic, tagging, vary-by provider invocation, and no-store/set-cookie storage prevention.
src/Umbraco.Web.Website/Caching/WebsiteOutputCachePipelineFilter.cs Adds UseOutputCache() into the Umbraco pipeline via a filter.
src/Umbraco.Web.Website/Caching/WebsiteOutputCacheEvictionHandler.cs Evicts cached pages/tags based on content cache refresher payloads (including branch/all).
src/Umbraco.Web.Website/Caching/MediaOutputCacheEvictionHandler.cs Evicts cached pages that reference changed media via automatic relations.
src/Umbraco.Web.Website/Caching/MemberOutputCacheEvictionHandler.cs Evicts cached pages that reference changed members via automatic relations.
src/Umbraco.Web.Website/Caching/RelationOutputCacheEvictionProvider.cs Provides document-relation-based eviction tags for content changes.
src/Umbraco.Web.Website/Caching/WebsiteOutputCacheManager.cs Implements IWebsiteOutputCacheManager by delegating to IOutputCacheStore tag eviction.
src/Umbraco.Web.Website/Caching/ContentTypeOutputCacheTagProvider.cs Default tag provider to tag entries by content type alias.
src/Umbraco.Web.Website/Caching/DefaultWebsiteOutputCacheDurationProvider.cs Default duration provider that defers to configured duration.
src/Umbraco.Web.Website/Caching/IWebsiteOutputCacheVaryByProvider.cs Adds vary-by extension point for custom cache variation rules.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicyTests.cs Unit tests for caching decisions, duration logic, tagging, and response storage disqualifiers.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCacheEvictionHandlerTests.cs Unit tests for content-based eviction behavior and custom eviction providers.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/RelationOutputCacheEvictionProviderTests.cs Unit tests for relation-based eviction tags.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/WebsiteOutputCacheManagerTests.cs Unit tests for programmatic eviction methods.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/DefaultWebsiteOutputCacheDurationProviderTests.cs Unit test for default duration provider behavior.
tests/Umbraco.Tests.UnitTests/Umbraco.Web.Website/Caching/ContentTypeOutputCacheTagProviderTests.cs Unit test for content-type tag generation.

Comment thread src/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicy.cs Outdated
Comment thread src/Umbraco.Core/Cache/IWebsiteOutputCacheDurationProvider.cs Outdated
Comment thread src/Umbraco.Core/Cache/IWebsiteOutputCacheDurationProvider.cs Outdated
Comment thread src/Umbraco.Web.Website/Caching/MediaOutputCacheEvictionHandler.cs Outdated
Comment thread src/Umbraco.Web.Website/Caching/MediaOutputCacheEvictionHandler.cs
Comment thread src/Umbraco.Web.Website/DependencyInjection/UmbracoBuilderExtensions.cs Outdated
Comment thread src/Umbraco.Web.Website/DependencyInjection/UmbracoBuilderExtensions.cs Outdated
@AndyButland
Copy link
Copy Markdown
Contributor Author

AndyButland commented Apr 8, 2026

Thanks for the review @Migaroez. I've addressed the points you raised inline and what we discussed (which is implemented now via the IWebsiteOutputCacheRequestFilter). Details are added in the PR description.

@AndyButland AndyButland requested a review from Migaroez April 8, 2026 11:41
@AndyButland AndyButland added the status/needs-docs Requires new or updated documentation label Apr 8, 2026
Copy link
Copy Markdown
Contributor

@Migaroez Migaroez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One more code health suggestion

Comment thread src/Umbraco.Web.Website/Caching/WebsiteOutputCachePolicy.cs Outdated
Copy link
Copy Markdown
Contributor

@Migaroez Migaroez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests out great 🚀. Feel free to merge after considering the last code health suggestion

…bled checks around debug logging, further unit test.
@AndyButland AndyButland enabled auto-merge (squash) April 11, 2026 06:15
@AndyButland AndyButland merged commit 95bcd8f into main Apr 11, 2026
28 of 29 checks passed
@AndyButland AndyButland deleted the v17/feature/configurable-output-cache branch April 11, 2026 06:52
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
Updated [Umbraco.Cms](https://github.com/umbraco/Umbraco-CMS) from
17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Updated
[Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.Persistence.Sqlite's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
Updated
[Umbraco.Cms.DevelopmentMode.Backoffice](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.DevelopmentMode.Backoffice's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

category/notable release/17.4.0 status/needs-docs Requires new or updated documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants