Skip to content

Umb-icon color setting optimization#22433

Merged
engijlr merged 5 commits into
mainfrom
v17/improvement/umb-icon-color-inheritance
Apr 15, 2026
Merged

Umb-icon color setting optimization#22433
engijlr merged 5 commits into
mainfrom
v17/improvement/umb-icon-color-inheritance

Conversation

@nielslyngsoe
Copy link
Copy Markdown
Member

@nielslyngsoe nielslyngsoe commented Apr 10, 2026

Optimizing the umb icon, very little bit. Work as part of investigation. So it is just a micro optimization.

Copilot AI review requested due to automatic review settings April 10, 2026 18:29
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR optimizes <umb-icon> color styling by removing Lit styleMap usage and instead applying the --uui-icon-color CSS custom property directly on the host element.

Changes:

  • Remove Lit styleMap/StyleInfo state and inline style binding from the rendered <uui-icon>.
  • Imperatively set/reset --uui-icon-color via this.style.setProperty/removeProperty when color/name changes.

Comment thread src/Umbraco.Web.UI.Client/src/packages/core/components/icon/icon.element.ts
Comment thread src/Umbraco.Web.UI.Client/src/packages/core/components/icon/icon.element.ts
@claude
Copy link
Copy Markdown

claude Bot commented Apr 10, 2026

PR Review

Target: origin/main · Based on commit: 368ae4021c78aedd0448669edab6fcd2e4cd6928

Refactors umb-icon color application from a Lit @state() + styleMap() on the inner <uui-icon> to direct this.style manipulation on the host element. This eliminates unnecessary Lit re-renders when only the color changes, and moves the CSS custom property to the host so external CSS can compose more naturally.

No breaking changes detected — the color and name @property() fields are unchanged, the element tag is unchanged, and UmbIconElement remains accessible via the ./components package export.

Suggestions

  • icon.element.ts:48-61: The existing icon.test.ts only checks instantiation and has no coverage for color behavior. Since this PR changes where --uui-icon-color is applied (from an inline style on the inner <uui-icon> to the host via this.style), a few tests would help guard against regressions: verify the property is set on the host when color is assigned, removed when unset, and that a color suffix in name (e.g. icon-heart color-red) resolves correctly.

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

claude[bot]
claude Bot reviewed Apr 10, 2026
View reviewed changes
Comment thread src/Umbraco.Web.UI.Client/src/packages/core/components/icon/icon.element.ts
@claude claude Bot added the area/frontend label Apr 10, 2026
engijlr
engijlr approved these changes Apr 15, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@engijlr engijlr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified in Backoffice: inline style correctly moved to host, inner inherits via cascade. I just added the suggested tests. LGTM 👍

@engijlr engijlr merged commit 37bfe65 into main Apr 15, 2026
30 checks passed
@engijlr engijlr deleted the v17/improvement/umb-icon-color-inheritance branch April 15, 2026 10:10
This was referenced May 18, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
Merged
Merged
Open
This was referenced May 21, 2026
Closed
Open
Merged
Open
Open
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
@dependabot
Bump Umbraco.Cms and Umbraco.Cms.Persistence.Sqlite (#175)
0f8b6ba 
Updated [Umbraco.Cms](https://github.com/umbraco/Umbraco-CMS) from
17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Updated
[Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.Persistence.Sqlite's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot dependabot Bot mentioned this pull request May 21, 2026
Closed
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
@dependabot
Bump Umbraco.Cms.DevelopmentMode.Backoffice from 17.3.4 to 17.4.0 (#176)
aafb1ef 
Updated
[Umbraco.Cms.DevelopmentMode.Backoffice](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.DevelopmentMode.Backoffice's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced May 21, 2026
Open
Open
Open
Open
Closed
Open
Open
Closed
Merged
Merged
This was referenced May 31, 2026
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@claude claude[bot] claude[bot] left review comments

@engijlr engijlr engijlr approved these changes

Assignees

No one assigned

Labels

area/frontend release/17.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nielslyngsoe @engijlr