LoginSign Up
← Back to all sparks
U

Umbraco CMS

MARKETING
Velocity6.3

Open-source .NET content management system

umbraco.com ↗

Umbraco 19 reaches its first release candidate on .NET 11 GA.

cmsdotnetreusable-contentsearchsecurity-fixesmajor-release
◆Current state
Umbraco 19.0.0-rc1 arrived on 12 November, two weeks after the first beta, and moves the release onto .NET 11 GA. The beta brought reusable Library content to every block editor and search into core; rc1 adds Entra ID SQL authentication, action groups in menus, an API switch that lets code block schema changes per environment, and a fix that admits one request per process into the content write path on load-balanced sites. The 18.3 and 17.8 candidates are still on rc2, which resolved seven security advisories.
◆Where it's heading
The 19 cycle is moving quickly from beta to candidate, and rc1 is about hardening rather than new editor features: dependencies on GA, environment-level permissions and load-balancing performance. The 17 and 18 lines are kept in step on security fixes while 19 matures.
◆Prediction
Expect 18.3 and 17.8 to go stable, followed by further 19 release candidates and a 19.0.0 stable release built on .NET 11.

◆Recent moves

  1. 1d ago

    Umbraco 19 RC1: .NET 11 GA, Entra ID SQL auth, schema locks

    The first 19 candidate follows the beta by two weeks and is mostly hardening: .NET 11 GA, Entra ID authentication for SQL, a Management API switch to deny schema changes per environment, and less lock contention on load-balanced content writes. The feature set announced in the beta stays the story.

    View source ↗
  2. 17d ago

    Umbraco 19 beta: .NET 11 and reusable content in every block editor

    ⚡ SPARK

    The first beta of Umbraco 19 ends a run of stabilization candidates and opens a major-version cycle. It takes the search abstraction shipped as a package for 17 and 18 into core and adds .NET 11.

    View source ↗
  3. 18d ago

    18.3 rc2 resolves seven security advisories

    The second 18.3 candidate exists mainly for security: seven advisories resolved, including start-node bypasses, stored XSS chained with path traversal, and a logout that left the auth cookie valid.

    View source ↗
  4. 18d ago

    17.8 rc2 carries the same seven security fixes

    The same seven advisories reach the 17 line in a candidate published alongside 18.3 rc2, which keeps the two supported tracks level on security.

    View source ↗
  5. 29d ago

    18.3 rc: ImageSharp update can fail Release builds

    The first 18.3 candidate takes Six Labors' security fixes, and with them a build-time licence check. Projects with a direct ImageSharp reference can see Release builds fail while Debug builds only warn, a trap that surfaces in CI rather than on a developer's machine.

    View source ↗
  6. 2mo ago

    Umbraco 18.2.0 release candidate

    18.2.0-rc fixes the installer's connection string write target to respect appsettings.*.json fallback order and updates npm dependencies. A routine pre-release candidate with no new user-facing features.

    View source ↗