Skip to content

Performance: Micro-optimisation in UdiParser (eliminate closure, fix naming & formatting of exceptions)#22506

Merged
AndyButland merged 2 commits into
umbraco:mainfrom
Henr1k80:eliminate-closure
Apr 17, 2026
Merged

Performance: Micro-optimisation in UdiParser (eliminate closure, fix naming & formatting of exceptions)#22506
AndyButland merged 2 commits into
umbraco:mainfrom
Henr1k80:eliminate-closure

Conversation

@Henr1k80
Copy link
Copy Markdown
Contributor

@Henr1k80 Henr1k80 commented Apr 16, 2026

  • I have added steps to test this contribution in the description below

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 16, 2026

Hi there @Henr1k80, thank you for this contribution! 👍

While we wait for one of the Core Collaborators team to have a look at your work, we wanted to let you know about that we have a checklist for some of the things we will consider during review:

  • It's clear what problem this is solving, there's a connected issue or a description of what the changes do and how to test them
  • The automated tests all pass (see "Checks" tab on this PR)
  • The level of security for this contribution is the same or improved
  • The level of performance for this contribution is the same or improved
  • Avoids creating breaking changes; note that behavioral changes might also be perceived as breaking
  • If this is a new feature, Umbraco HQ provided guidance on the implementation beforehand
  • 💡 The contribution looks original and the contributor is presumably allowed to share it

Don't worry if you got something wrong. We like to think of a pull request as the start of a conversation, we're happy to provide guidance on improving your contribution.

If you realize that you might want to make some changes then you can do that by adding new commits to the branch you created for this work and pushing new commits. They should then automatically show up as updates to this pull request.

Thanks, from your friendly Umbraco GitHub bot 🤖 🙂

@AndyButland AndyButland changed the title Eliminate closure, fix naming & formatting of exceptions Performance: Micro-optimisation in UdiParser (eliminate closure, fix naming & formatting of exceptions) Apr 17, 2026
AndyButland
AndyButland approved these changes Apr 17, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@AndyButland AndyButland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a nice micro-optimisation here @Henr1k80. All looks good, but just for "belt and braces" I added a few unit tests around this method that we didn't previously have.

@AndyButland AndyButland enabled auto-merge (squash) April 17, 2026 05:11
@AndyButland AndyButland merged commit a98a6aa into umbraco:main Apr 17, 2026
27 of 28 checks passed
@Henr1k80 Henr1k80 deleted the eliminate-closure branch April 17, 2026 06:30
This was referenced May 18, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
Merged
Merged
Open
Closed
Open
Merged
Open
Open
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
@dependabot
Bump Umbraco.Cms and Umbraco.Cms.Persistence.Sqlite (#175)
0f8b6ba 
Updated [Umbraco.Cms](https://github.com/umbraco/Umbraco-CMS) from
17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Updated
[Umbraco.Cms.Persistence.Sqlite](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.Persistence.Sqlite's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot dependabot Bot mentioned this pull request May 21, 2026
Closed
alexsee pushed a commit to alexsee/umbraco-container that referenced this pull request May 21, 2026
@dependabot
Bump Umbraco.Cms.DevelopmentMode.Backoffice from 17.3.4 to 17.4.0 (#176)
aafb1ef 
Updated
[Umbraco.Cms.DevelopmentMode.Backoffice](https://github.com/umbraco/Umbraco-CMS)
from 17.3.4 to 17.4.0.

<details>
<summary>Release notes</summary>

_Sourced from [Umbraco.Cms.DevelopmentMode.Backoffice's
releases](https://github.com/umbraco/Umbraco-CMS/releases)._

## 17.4.0

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc3

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc3...release-17.4.0

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
 ... (truncated)

## 17.4.0-rc3

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-r2

### 📦 Dependencies

* Bump @​umbraco-ui/uui to 1.17.3 by @​iOvergaard in
umbraco/Umbraco-CMS#22753

### 🔒 Security

* Backoffice: Add `localize.htmlString()` helper to prevent XSS in
HTML-rendered translations by @​iOvergaard in
umbraco/Umbraco-CMS#22731

### 🐛 Bug Fixes

* Auth: Un-deprecate getLatestToken and route per-request fetches
through it by @​iOvergaard in
umbraco/Umbraco-CMS#22736
* Color Picker: Refresh stored label when data type label changes
(closes #​22741) by @​AndyButland in
umbraco/Umbraco-CMS#22761
* Published Content: Fix Fallback.ToAncestors with no match throwing
exception at property level (closes #​22759) by @​AndyButland in
umbraco/Umbraco-CMS#22763

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc2...release-17.4.0-rc3

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

 ... (truncated)

## 17.4.0-rc2

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed Since 17.4.0-rc

### 🐛 Bug Fixes

* Block permissions: Correction of read-only inheritance and language
access (closes #​22472, #​21973) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22522
* Redirect Tracker: Prevent creation of redirects from unrouteable URLs
(closes #​22652, #​22256) by @​AndyButland in
umbraco/Umbraco-CMS#22657
* [Blueprints: Fix intermittent blank workspace when creating documents
from blueprints (closes
#​21996)](umbraco/Umbraco-CMS#22422 (comment)) by
@​AndyButland in umbraco/Umbraco-CMS#22422

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.4.0-rc...release-17.4.0-rc2

## What's Changed Since the Previous Version (17.3.5)

### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
 ... (truncated)

## 17.4.0-rc

## Upgrade Notes

Be aware of a change to behaviour for detecting the Umbraco application
URL. Previously, `ApplicationMainUrl` was automatically set from the
Host header of incoming HTTP requests. In environments where Umbraco is
not behind a reverse proxy that validates the Host header, this could
allow a forged Host header to overwrite the URL used in password reset
links, user invitations, and other email notifications. While this is
normally mitigated by proper hosting configuration and setting
`UmbracoApplicationUrl` explicitly, we felt that the auto-detection
behaviour should be hardened up and become an opt-in rather than the
default. You can read more about this under "Breaking Changes" below,
the [linked PR](umbraco/Umbraco-CMS#22307) and
the
[documentation](https://docs.umbraco.com/umbraco-cms/reference/configuration/webroutingsettings#application-url-detection).

There are a few updates related to performance in this release that are
worth investigating for larger sites. Using output cache in your
projects, with intelligent and customisable detection of page
invalidation, is now a [configuration option for templated
websites](https://docs.umbraco.com/umbraco-cms/reference/website-output-caching),
with extension points also [applied for the Delivery
API](https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/output-caching).
We have optimised content cache rebuild after schema updates, with an
option for [deferred rebuild in the
background](https://docs.umbraco.com/umbraco-cms/reference/configuration/cache-settings#contenttyperebuildmode).
If considering a project with significant expected concurrency for
member login and registration, and you prefer to use an external service
for member management, the new option for [lightweight external
members](https://docs.umbraco.com/umbraco-cms/reference/security/lightweight-external-members)
will be worth reviewing.

If working with AI tools such as Umbraco MCP, additions to management
API endpoints that expose JSON schema for data types and allow for patch
updates of specific properties, should improve accuracy and reliability.

As usual please find the full list of PRs that have contributed to
Umbraco 17.4 as follows.

## What's Changed
### 🙌 Notable Changes
* Management API: Add JSON Schema support for data types and content
types by @​Migaroez in umbraco/Umbraco-CMS#21771
* Media Picker: Add Cards/Table view switcher (closes #​22005) by
@​madsrasmussen in umbraco/Umbraco-CMS#22138
* Management API: Add document patch endpoint by @​Migaroez in
umbraco/Umbraco-CMS#22104
* Website Rendering: Add configurable output caching for template
rendered pages by @​AndyButland in
umbraco/Umbraco-CMS#22338
* Basic Authentication: Standalone login page for frontend-only
deployments (closes #​22144) by @​AndyButland in
umbraco/Umbraco-CMS#22168
* Icons: extends icon data + improved search by @​nielslyngsoe in
umbraco/Umbraco-CMS#22436
* Members: Add lightweight external-only members (closes #​12741) by
@​AndyButland in umbraco/Umbraco-CMS#22162
* Cache: Add deferred content type rebuild mode with de-duplication by
@​AndyButland in umbraco/Umbraco-CMS#22194

### 💥 Breaking Changes
* Application URL: Add `ApplicationUrlDetection` setting to control
application URL auto-detection by @​AndyButland in
umbraco/Umbraco-CMS#22307

### 📦 Dependencies
* Bump lodash from 4.17.23 to 4.18.1 in /src/Umbraco.Web.UI.Login by
@​dependabot[bot] in umbraco/Umbraco-CMS#22334
* Dependencies: Update minor and patch versions by @​AndyButland in
umbraco/Umbraco-CMS#22498
* Update npm dependencies for v17.4.0-rc by @​NguyenThuyLan in
umbraco/Umbraco-CMS#22464
* Bump the npm_and_yarn group across 3 directories with 4 updates by
@​dependabot[bot] in umbraco/Umbraco-CMS#22537
* Dependencies: Update Microsoft packages to latest patch and fix
HybridCache ParseFault with Redis by @​AndyButland in
umbraco/Umbraco-CMS#22278
* Dependencies: Pin `System.Security.Cryptography.Xml` to resolve
vulnerability warning by @​AndyButland in
umbraco/Umbraco-CMS#22514

### 🚤 Performance
* Performance: Batch backoffice media thumbnail URL requests to reduce
N+1 API calls by @​AndyButland in
umbraco/Umbraco-CMS#22329
* Performance: Optimize `FullDataSetRepositoryCachePolicy` usage across
all repositories by @​AndyButland in
umbraco/Umbraco-CMS#22264
* Performance: Optimize `ContentTypeRepository` deep-clone on cache
reads (closes #​22250) by @​AndyButland in
umbraco/Umbraco-CMS#22263
* Performance: Use `GeneratedRegex` instead of generating at runtime in
string extensions by @​Henr1k80 in
umbraco/Umbraco-CMS#22534
* Performance: Avoid allocating a string if `_publishedContentCache` has
a cached version in `MediaCacheService` by @​Henr1k80 in
umbraco/Umbraco-CMS#22535
* Performance: Micro-optimisation in `UdiParser` (eliminate closure, fix
naming & formatting of exceptions) by @​Henr1k80 in
umbraco/Umbraco-CMS#22506
* Micro-optimization: Use Array.ConvertAll instead of LINQ .Select
.ToArray by @​Henr1k80 in
umbraco/Umbraco-CMS#20292
* Entity Service: Batch GetAllPaths queries to avoid SQL Server
parameter limit (closes #​22470) by @​AndyButland in
umbraco/Umbraco-CMS#22471
* Document URL Service: Batch delete of obsolete URL segment records to
avoid SQL Server parameter limit (closes #​22339) by @​AndyButland in
umbraco/Umbraco-CMS#22340
* Content Version Cleanup: Optimize for large datasets (closes #​22224)
by @​AndyButland in umbraco/Umbraco-CMS#22239
* Migrations: Optimise sortable value population for date properties by
@​AndyButland in umbraco/Umbraco-CMS#22547
* Migrations: Fix potential `OptimizeInvariantUrlRecords` timeout on SQL
Server (closes #​22377) by @​AndyButland in
umbraco/Umbraco-CMS#22382
* Umb-icon color setting optimization by @​nielslyngsoe in
umbraco/Umbraco-CMS#22433

### 🌈 Accessibility Improvements
* Accessibility: Fix missing labels on uui-select elements causing
console warnings by @​andreaslborg in
umbraco/Umbraco-CMS#22385
* Accessibility: Include visible initials in name displayed on account
menu button (closes #​21942) by @​andreaslborg in
umbraco/Umbraco-CMS#22117
 ... (truncated)

## 17.3.5

## What's Changed

### 🐛 Bug Fixes

* Revert fix for making block editors read-only in trashed documents
which causes a regression in certain multi-lingual block editing
scenarios (closes #​22472, re-opens #​21982) by @​nielslyngsoe in
umbraco/Umbraco-CMS#22656

**Full Changelog**:
umbraco/Umbraco-CMS@release-17.3.4...release-17.3.5

Commits viewable in [compare
view](umbraco/Umbraco-CMS@release-17.3.4...release-17.4.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced May 21, 2026
Open
Open
Open
Open
Closed
Open
Open
Closed
Merged
Merged
This was referenced May 31, 2026
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AndyButland AndyButland AndyButland approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Henr1k80 @AndyButland