Skip to content

Upgrading Umbraco.Cms.Web.Website 15 to 16

Breaking15.4.4 → 16.5.1Breaking33Security10Deprecated8New128Changed150Fixed436Other134

Full comparisonBack to Umbraco.Cms.Web.Website
BreakingUpgrade verdict

33 breaking changes and 10 security fixes.

In plain terms
  • Renames setBrowserTitle to setTitle in View Context.
  • The appearance and color of the current user action are removed.
  • The old TinyMCE rich text editor is no longer included on the client side.
  • The server-side TinyMCE integration is removed.
Must act Top 5 of 51 that need code or config changes

What you must change

Breaking33
Renames setBrowserTitle to setTitle in View Context.
setBrowserTitlesetTitle
16.3.0GitHub ReleaseSummarizedView source
Removes the current user action look and color.
16.0.0-rc3GitHub ReleaseSummarizedView source
Removes TinyMCE (client-side).
TinyMCE
16.0.0-rcGitHub ReleaseSummarizedView source
Removes TinyMCE (server-side).
TinyMCE
16.0.0-rcGitHub ReleaseSummarizedView source
Removes the UmbracoPath setting.
UmbracoPath
16.0.0-rcGitHub ReleaseSummarizedView source
Removes syslib003 and syslib0051 obsoleted code dependencies.
syslib003syslib0051
16.0.0-rcGitHub ReleaseSummarizedView source
Removes RTE Stylesheets (client-side).
RTE Stylesheets
16.0.0-rcGitHub ReleaseSummarizedView source
Removes the external base64-js module.
base64-js
16.0.0-rcGitHub ReleaseSummarizedView source
Moves and renames the input-collection-configuration element to input-content-type-collection-configuration.
input-collection-configurationinput-content-type-collection-configuration
16.0.0-rcGitHub ReleaseSummarizedView source
Splits Sort Children logic to remove an illegal import from core to packages.
16.0.0-rcGitHub ReleaseSummarizedView source
Removes all generic Created, Saved, and Deleted notifications.
16.0.0-rcGitHub ReleaseSummarizedView source
Removes non-controversial, straightforward obsoleted constructs for Umbraco 16.
16.0.0-rcGitHub ReleaseSummarizedView source
Removes deprecated client-side code in V16.
16.0.0-rcGitHub ReleaseSummarizedView source
Removes population of Urls on the document response model and obsoletes the property.
Urls
16.0.0-rcGitHub ReleaseSummarizedView source
Further fixes configuration classes using ISet, resolving a regression with custom 404 pages.
ISet
16.1.0GitHub ReleaseSummarizedView source
Adds an explicit Global Search extension point.
16.0.0-rc3GitHub ReleaseSummarizedView source
Logs language ISO codes instead of language names.
16.0.0-rc2GitHub ReleaseSummarizedView source
Corrects context tokens for menu structure based workspaces.
16.0.0-rc2GitHub ReleaseSummarizedView source
Replaces legacy/fetch with @hey-api/client-fetch.
legacy/fetch@hey-api/client-fetch
16.0.0-rcGitHub ReleaseSummarizedView source
Refactors settings arrays to ISet<T> to ensure unique values and make them easily mutable.
ISet<T>
16.0.0-rcGitHub ReleaseSummarizedView source
Allows MaxRequestLength to be specified as a long.
MaxRequestLength
16.0.0-rcGitHub ReleaseSummarizedView source
Adds AsyncMigrationBase, updates base classes and calls async methods.
AsyncMigrationBase
16.0.0-rcGitHub ReleaseSummarizedView source
Changes get context to resolve as undefined if not found.
16.0.0-rcGitHub ReleaseSummarizedView source
Moves public access files to the member-public-access module.
member-public-access
16.0.0-rcGitHub ReleaseSummarizedView source
Internalizes the uuid package.
uuid
16.0.0-rcGitHub ReleaseSummarizedView source
Adds server context to store information about paths.
16.0.0-rcGitHub ReleaseSummarizedView source
Moves router-slot exports to @umbraco-cms/backoffice/router.
@umbraco-cms/backoffice/router
16.0.0-rcGitHub ReleaseSummarizedView source
Introduces a content client package.
16.0.0-rcGitHub ReleaseSummarizedView source
Splits media handling from UmbDropzoneManager.
UmbDropzoneManager
16.0.0-rcGitHub ReleaseSummarizedView source
Refactors services to fully enable segments.
16.0.0-rcGitHub ReleaseSummarizedView source
Context API can now unprovide contexts.
16.0.0-rcGitHub ReleaseSummarizedView source
Retrofits ContentEditingBaseBuilder to match the new create/update models.
ContentEditingBaseBuilder
16.0.0-rcGitHub ReleaseSummarizedView source
Makes culture specific update dates work again.
16.0.0-rcGitHub ReleaseSummarizedView source
Security10
Fixes a privilege escalation issue relating to user group memberships.
16.5.1GitHub ReleaseSummarizedView source
Fixes an XSS vulnerability involving property type descriptions.
16.5.1GitHub ReleaseSummarizedView source
Fixes authorization checks on node domain access.
16.5.1GitHub ReleaseSummarizedView source
Marks the UMB-DEBUG cookie as HttpOnly and Secure in debug mode.
UMB-DEBUG
16.5.0GitHub ReleaseSummarizedView source
Moves backoffice access and refresh tokens to secure cookies, disabled by default for backwards compatibility.
Umbraco:Cms:Security:BackOfficeTokenCookie:Enabled
16.4.0GitHub ReleaseSummarizedView source
Redacts back-office PKCE codes from the server.
16.4.0GitHub ReleaseSummarizedView source
Fixes an issue where the Delivery API could return cached requests with an invalid API key.
Delivery API
16.1.1GitHub ReleaseSummarizedView source
Fixes code scanning alert no. 1719 for client-side cross-site scripting.
16.1.0GitHub ReleaseSummarizedView source
Bumps ImageSharp to prevent CVE-2025-27598.
ImageSharp
16.0.0-rcGitHub ReleaseSummarizedView source
Adds webhook log authorization and file system path checks.
16.0.0-rcGitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated8
Adds deprecation notices to AllowNonExistingSegmentsCreation.
AllowNonExistingSegmentsCreation
16.4.0GitHub ReleaseSummarizedView source
Marks MemberService.GetMembersByPropertyValue() methods as obsolete.
MemberService.GetMembersByPropertyValue()
16.3.0GitHub ReleaseSummarizedView source
Updates openapi-ts client and deprecates tryExecuteAndNotify.
tryExecuteAndNotify
16.0.0-rcGitHub ReleaseSummarizedView source
Adds obsoletion messages for unused interface and implementation for cache rebuilds.
16.0.0-rcGitHub ReleaseSummarizedView source
Deprecates UmbPropertyValueChangeEvent for v16.
UmbPropertyValueChangeEvent
16.0.0-rcGitHub ReleaseSummarizedView source
Obsoletes a few unused things.
16.0.0-rcGitHub ReleaseSummarizedView source
Deprecates the getManifest() methods.
getManifest()
16.0.0-rcGitHub ReleaseSummarizedView source
Removes population of Urls on the media response model and obsoletes the property.
Urls
16.0.0-rcGitHub ReleaseSummarizedView source