Skip to content

Upgrading Umbraco.Cms.Web.Website 13 to 14

Breaking13.16.4 → 14.3.4Breaking13Security6Deprecated1New66Changed45Fixed114Other73

Full comparisonBack to Umbraco.Cms.Web.Website
BreakingUpgrade verdict

13 breaking changes and 6 security fixes.

In plain terms
  • WebP images are now encoded with lossy compression by default, which can change image output quality and size.
  • Rich text editor settings are no longer read from the appsettings file.
  • Removes UI settings from BackOfficeExternalLoginProviderOptions.
  • The member list view is no longer available.
Must act Top 5 of 20 that need code or config changes

What you must change

Breaking13
Configures the ImageSharp WebP encoder to use Lossy by default.
14.3.0GitHub ReleaseSummarizedView source
Removes all Rich Text Editor configuration from appsettings.
14.0.0-rc3GitHub ReleaseSummarizedView source
Removes UI settings from BackOfficeExternalLoginProviderOptions.
BackOfficeExternalLoginProviderOptions
14.0.0-rc2GitHub ReleaseSummarizedView source
Removes the member list view.
14.0.0-rc1GitHub ReleaseSummarizedView source
RTE and media picker now route medias the same way in the Delivery API.
14.1.0GitHub ReleaseSummarizedView source
Bellissima replaces Belle with new Web Component technology in the Backoffice.
14.0.0GitHub ReleaseSummarizedView source
An all-new Management API replaces the Backoffice API controllers.
14.0.0GitHub ReleaseSummarizedView source
Uses runtime mode to determine cache TTL for manifest files.
14.0.0-rc5GitHub ReleaseSummarizedView source
Refactors users and user groups to use a reference-by-id model.
14.0.0-rc4GitHub ReleaseSummarizedView source
Merges the user/current/logins and user/current/login-providers endpoints.
user/current/loginsuser/current/login-providers
14.0.0-rc4GitHub ReleaseSummarizedView source
Ensures migrations persist the executed key when executed.
14.0.0-rc2GitHub ReleaseSummarizedView source
Cleans up V13 related and obsoleted system directory constants.
14.0.0-rc2GitHub ReleaseSummarizedView source
Changes MediaPicker/MNTP StartNodeId from a Udi to a Guid.
StartNodeIdUdiGuid
14.0.0-rc1GitHub ReleaseSummarizedView source
Security6
Resolves a management API path traversal vulnerability affecting authenticated users.
14.3.4GitHub ReleaseSummarizedView source
Fixes improper API access control that allowed low-privilege users access to data type functionality.
14.3.3GitHub ReleaseSummarizedView source
Fixes an issue where a restricted editor user could delete a media item or access unauthorized content.
14.3.3GitHub ReleaseSummarizedView source
Updates the ImageSharp dependency to a patched version following CVE-2025-27598.
ImageSharp
14.3.3GitHub ReleaseSummarizedView source
Adds sanitization to the dictionary in the backoffice.
14.3.1GitHub ReleaseSummarizedView source
Denies access to the login screen.
14.0.0-rc1GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated1
Obsoletes runtime minification settings.
14.0.0-rc2GitHub ReleaseSummarizedView source