Skip to content

Entity Service: Batch GetAllPaths queries to avoid SQL Server parameter limit (closes #22470)#22471

Merged
AndyButland merged 2 commits into
mainfrom
v17/bugfix/22470-get-all-paths-ids-fix
Apr 15, 2026
Merged

Entity Service: Batch GetAllPaths queries to avoid SQL Server parameter limit (closes #22470)#22471
AndyButland merged 2 commits into
mainfrom
v17/bugfix/22470-get-all-paths-ids-fix

Conversation

@AndyButland
Copy link
Copy Markdown
Contributor

@AndyButland AndyButland commented Apr 14, 2026

Description

#22470 identifies a repository method that uses WHERE IN (...) where we need to retrieve in groups to avoid risking exceeding SQL Servers maximum parameter count.

Both overloads (by int[] IDs and Guid[] keys) now batch using SelectByGroups with Constants.Sql.MaxParameterCount, matching the fix pattern from other PRs such as #22340.

Added explicit integration tests in a dedicated test class that verify batched retrieval works for both overloads

Testing

This fix can be verified by running the two new integration tests: EntityServiceGetAllPathsTests.GetAllPaths_By_Ids_Returns_All_Paths_In_Batches and EntityServiceGetAllPathsTests.GetAllPaths_By_Keys_Returns_All_Paths_In_Batches. Both tests fail without the fix when run against SQL Server (LocalDb).

I've marked both tests as explicit as they take a while to run and, beyond verifying this fix, we don't need them running on the pipeline.

AndyButland and others added 2 commits April 14, 2026 17:21
Move the explicit SQL Server parameter limit tests into their own
class (EntityServiceGetAllPathsTests) with NewSchemaPerTest so the
raw SqlException surfaces instead of being masked by scope disposal.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings April 14, 2026 15:22
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prevents SQL Server “too many parameters” failures when retrieving entity paths for large ID/key collections by batching GetAllPaths queries in the infrastructure EntityRepository, aligning with the existing Constants.Sql.MaxParameterCount safeguard pattern. It also adds explicit integration tests to reproduce/validate the behavior when running against SQL Server (LocalDb).

Changes:

  • Batch EntityRepository.GetAllPaths(...) for both int[] and Guid[] overloads using SelectByGroups(..., Constants.Sql.MaxParameterCount).
  • Add explicit (manual) integration tests that create 2110 items and assert all paths are returned for both overloads.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
src/Umbraco.Infrastructure/Persistence/Repositories/Implement/EntityRepository.cs Batches WhereIn queries for large ID/key sets to stay below SQL Server parameter limits.
tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/EntityServiceGetAllPathsTests.cs Adds explicit integration tests to validate batched GetAllPaths retrieval for IDs and keys.

@AndyButland AndyButland merged commit ba5ec20 into main Apr 15, 2026
33 of 34 checks passed
@AndyButland AndyButland deleted the v17/bugfix/22470-get-all-paths-ids-fix branch April 15, 2026 12:55
This was referenced May 18, 2026
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
Updated [Umbraco.Cms](https://github.com/umbraco/Umbraco-CMS) from
17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Updated
[Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.Persistence.Sqlite's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
Updated
[Umbraco.Cms.DevelopmentMode.Backoffice](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.DevelopmentMode.Backoffice's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants