Upgrading Umbraco.Cms.Web.Website 14 to 15
Breaking14.3.4 → 15.4.4Breaking64Security14Platform1Deprecated7New159Changed137Fixed480Other125
SecurityFixes an issue where the Delivery API could return cached requests even when an invalid API key was supplied.GHSA-75vq-qvhr-7ffr ↗
BreakingUpgrade verdict
64 breaking changes and a platform requirement change and 14 security fixes.
In plain terms
- Removes the showOpenButton configuration.
- Removes collection action state.
- Adds Default Workspace Kind and Collection Workspace View Kind.
- Removes the last remains of GetAll versus GetMany.
Must act Top 5 of 86 that need code or config changes
Target frameworks requirement changed in 15.0.0-rc1: net8.0 → net9.0.
What you must change
Breaking64
Removes the showOpenButton configuration.
showOpenButtonRemoves collection action state.
Adds Default Workspace Kind and Collection Workspace View Kind.
Removes the last remains of GetAll versus GetMany.
GetAllGetManyRenames the condition config map.
Removes obsolete code as a breaking change.
Removes the dashboard collection manifest type.
Removes Nucache.
NucacheRemoves a series of obsolete attributes.
Adds API access with client credentials as core functionality.
Adds IAsyncComponent to allow async initialize and terminate.
IAsyncComponentAdds user client credentials.
Adds member client credentials.
Adds a dynamic global extension manifest map.
Adds global condition types.
Adds Extension Manifest Map support for collections.
Adds an extension insights package.
Moves menu conditions.
Adds Extension Manifest Map support for search.
Cleans up block conditions.
Moves user permission conditions.
Moves the multiple language condition to the language package.
Adds Extension Manifest Map support for trees.
Moves section conditions to the section package.
Uses the Extension Manifest Map and moves workspace extensions to the workspace package.
Moves the workspace modal token to the workspace module.
Moves the icon picker modal token.
Moves the code editor modal.
Moves the debug modal token.
Moves the user permission settings token.
Moves the property editor UI picker modal.
Adds the embedded media package.
Moves the change password token.
Adds discard changes functionality.
Implements UmbEntityDetailWorkspaceContextBase across all non content workspaces.
UmbEntityDetailWorkspaceContextBaseAdds folder workspace.
Adds modal to the extension manifest map.
Adds package view to the extension manifest map.
Adds property action to the extension manifest map.
Adds Theme extension to the extension manifest map.
Adds property editor to the extension manifest map.
Adds Section to the extension manifest map.
Adds localization to the extension manifest map.
Adds icons to the extension manifest map.
Adds dashboard to the extension manifest map.
Updates the extension manifest map for the Picker Search Result Item.
Updates the extension manifest map for Health Check.
Updates the extension manifest map for User Permissions.
Updates the extension manifest map for Markdown Editor Action.
Updates the extension manifest map for Tiny MCE Plugin.
Updates the extension manifest map for User Profile App and Current User Action.
Updates the extension manifest map for Auth Provider.
Updates the extension manifest map for Dynamic Root.
Updates the extension manifest map for File Upload Preview.
Updates the extension manifest map for Ufm.
Adds a translation package feature.
Updates the extension manifest map for Menu.
Updates the extension manifest map for Entity Actions.
Fixes previews for V15.
Adds search indexing for block level variants.
Adds validation for block level variation.
Adds ContentKey to IBlockReference and obsoletes ContentUdi.
IBlockReferenceContentKeyContentUdiDeprecates manifest types type in a V15 hotfix.
Front-end validation for variant blocks is introduced as a breaking change in the 15 release candidate.
Security14
Fixes an issue where the Delivery API could return cached requests even when an invalid API key was supplied.
Delivery APIPrevents bypassing the configured allowed extensions for file uploads.
Adds authorization and file system path checks to the webhook log.
Resolves a management API path traversal vulnerability affecting authenticated users.
Adds authorization to save operations.
Enforces user start nodes for media uploads made through the Rich Text Editor.
Adds Management API authorization for rollback requests.
HTML encodes the user's name in the invite email.
Fixes improper API access control that allowed low-privilege users access to data type functionality.
Fixes a restricted editor being able to delete a media item or access unauthorized content.
Updates the ImageSharp dependency to a patched version following CVE-2025-27598.
ImageSharpUpdates ImageSharp to a non vulnerable version.
ImageSharpUpdates the Lucene package to address CVE-2024-43383.
Security patch release addressing three advisories: GHSA-69cg-w8vm-h229, GHSA-hmg4-wwm5-p999, and GHSA-wv8v-rmw2-25wc.
Platform1
Bumps the minimum required Node.js version to V22.
Node.jsDeprecations to plan for
Deprecated7
Adds obsoletion messages for unused interface and implementation for cache rebuilds.
Obsoletes a few unused things.
Deprecates the get unique parameter on UmbPickerInputContext and UmbRepositoryItemsManager.
UmbPickerInputContextUmbRepositoryItemsManagerAdds obsoletion methods for extension methods to be removed in Umbraco 16.
Updates the obsoletion message for IPublishedContent.Parent and IPublishedContent.Children to point to better alternatives.
IPublishedContent.ParentIPublishedContent.ChildrenReintroduces many extension methods as obsolete to avoid a breaking change.
Obsoletes content dashboard settings.