15.3.0-rc2

What's Changed Since 15.3.0-rc

🔒 Security updates

• Improper API access control allows low-privilege users access to data type functionality - Advisory GHSA-6ffg-mjg7-585x
• Restricted editor user can delete media item or access unauthorized content - Advisory GHSA-wx5h-wqfq-v698
• Updated ImageSharp dependency to patched version following CVE-2025-27598

🐛 Bug Fixes

• v15: Remove duplicate webhook registration by @Zeegaan in #18594
• Fixed issue with slider max validation using default 0 value by @AndyButland in #18616

Full Changelog: release-15.3.0-rc...release-15.3.0-rc2

What's Changed Since The Previous Release (15.2.3)

📦 Dependencies

• Bump @umbraco-cms/backoffice from 15.0.0 to 15.1.2 in /src/Umbraco.Web.UI.Login by @dependabot in #18064
• Bump vite from 5.4.11 to 5.4.14 in /src/Umbraco.Web.UI.Login by @dependabot in #18066
• Bump vite from 5.4.11 to 5.4.14 in /src/Umbraco.Web.UI.Client by @dependabot in #18193
• V15: Bump minimum required Node.js to V22 by @iOvergaard in #18274
• Bump dompurify from 3.2.3 to 3.2.4 in /src/Umbraco.Web.UI.Client by @dependabot in #18360
• Bump dompurify from 3.2.3 to 3.2.4 in /src/Umbraco.Web.UI.Login by @dependabot in #18362
• V15: update npm dependencies for login screen by @iOvergaard in #18373
• V15: Update Backoffice NPM dependencies by @iOvergaard in #18376

🚀 New Features

• Feature: Code Editor modal, adds pretty-print support by @leekelleher in #18123
• Feature: Tiptap: Generic markup support by @leekelleher in #18124
• Bugfix: Content Picker Search - support allowed content types config by @madsrasmussen in #18042
• V15: Show upload progress for dropped files in the Media Library by @iOvergaard in #18148
• V15: Client should validate maxFileSize and allowed/disallowed file types from server configuration by @iOvergaard in #18163
• Feature: workspace info app extension by @madsrasmussen in #18014
• Tiptap RTE: Add CSS support for extensions by @leekelleher in #18075
• V15/feature/notification-whitespace by @iOvergaard in #18190
• V15: Show server configuration when configuring the Upload Field by @iOvergaard in #18185
• Feature: Media Type Create Options by @madsrasmussen in #18196
• V15: Add progress UI to the Upload Field property editor by @iOvergaard in #18188
• Help Header App, popover placement + code tidy-up by @leekelleher in #18329
• Content dashboard, info box drop-shadow by @leekelleher in #18327
• V15: Show duration on time displays by @iOvergaard in #18341
• V15: Add a button to clear schedule by @iOvergaard in #18339
• V15: Save the variant before scheduling by @iOvergaard in #18344
• Tiptap RTE: Cascading Style Select Menu by @leekelleher in #18364
• Feature: Display current variant item name by @madsrasmussen in #18311
• Tiptap RTE: Table extension enhancements by @leekelleher in #18365
• Feature: Data mapping extension + aligning reference lists by @madsrasmussen in #18318
• Feature: Delete/Trash referenced by by @madsrasmussen in #18351
• Feature: Bulk Delete/Trash referenced by by @madsrasmussen in #18393
• Tiptap RTE: Font Family / Font Size toolbar items by @leekelleher in #18443
• V15: Adds validation on date from/to inputs in the schedule modal by @iOvergaard in #18437
• V15: Serverside Media Picker Validation by @nikolajlauridsen in #18429
• Feature: Property Value Preset by @nielslyngsoe in #18423
• Server side validation for property editors (integer, decimal and slider) by @AndyButland in #18428
• Tiptap RTE: configuration localizations by @leekelleher in #18125
• Tiptap RTE: Trailing Node extension by @leekelleher in #18446
• Tiptap RTE: Text Direction extension by @leekelleher in #18459
• Split force for publish descendants into separate options for publish unpublish and re-publish unedited by @AndyButland in #18270
• Warn when content is unroutable by @Zeegaan in #17837

🐛 Bug Fixes

• Allow skipSelect blueprints only when one blueprint exists by @callumbwhyte in #17818
• Health Check items "back to overview" link omits backoffice url segment by @matthewcare in #17828
• Add NoopCurrentMemberClaimsProvider so Umbraco can boot without the Delivery API enabled by @kjac in #18049
• Fix create child issue in list view with infinite editor (#13355). by @mvennevold in #17637
• Replaced deprecated navigator.platform with navigator.userAgent for platform detection. by @manutdkid77 in #17373
• Fix settings value begin indifference (17989) by @nielslyngsoe in #18022
• Feature: make areas optional by @nielslyngsoe in #18057
• Numeric property editor range and misconfiguration validation by @AndyButland in #17991
• 15: Convert pagesize properly to skip and take by @Zeegaan in #18069
• Handles migration case where an expected constraint is renamed but the constraint does not exist by @AndyButland in #18063
• Fix: 17764 by @nielslyngsoe in #18093
• Add clientside validation to webhook events by @kjac in #18089
• Allowed retrieval of current user configuration when accessing user profile as a non-admin user by @AndyButland in #18099
• V15/bugfix/Reset image crop button fix by @jonat123 in #18106
• V15: Add authorization to saves by @nikolajlauridsen in #18111
• Make it possible to reset media picker crops by @kjac in #18110
• Redirect to the published URL when exiting preview by @kjac in #18114
• Fix: stop using redirects in collections by @nielslyngsoe in #18112
• Bugfix: Remove sidebar bottom space by @nielslyngsoe in #18087
• Avoid wasting a whole thread watching for a filesystem change 😬 by @JasonElkin in #18119
• Updated the dialog label for User -> Assign Access -> Media Start nodes by @jonat123 in #18043
• updated the link picker modal and the property editors using it. by @jonat123 in #18059
• Bugfix: Align collection item entity actions with menu item entity actions by @madsrasmussen in #18118
• Refreshed display of check results after all checks are complete by @AndyButland in #18131
• Feature: Clean up validation messages by @nielslyngsoe in #18092
• V15: Media library crashes when uploading large files by @iOvergaard in #18113
• Added a check that we have a route before attempting to include it in the other URLs for a published document by @AndyButland in #18135
• Fix: Mandatory for Image Cropper (17372) by @nielslyngsoe in #18108
• Fix: media picker mandatory validation by @nielslyngsoe in #18109
• V13: remove unused parameters and documentation by @iOvergaard in #18095
• Fixes rollback of variant page name by @AndyButland in #18136
• Set document to readonly when a user is not allowed to create / update by @madsrasmussen in #18076
• Pass user Id to audit when saving and deleting members by @AndyButland in #18120
• Added Resharper test assemblies to exclude list on TypeFinder by @AndyButland in #18145
• Do not allow editing read-only properties by clicking their labels by @kjac in #18152
• Fix task return and apply correct disposal pattern for FileSystemMainDomLock by @JasonElkin in #18147
• Provides an option to remove the inessential version number from the generated models by @AndyButland in #18081
• V15: Fix Url Preview by @nikolajlauridsen in #18072
• Excluded tags from trashed content by @AndyButland in #18164
• Bugfix: show notification when offline by @madsrasmussen in #18094
• V15: Add authorization to create by @nikolajlauridsen in #18169
• Fixed name of True/False property editor schema manifest by @AndyButland in #18179
• V15 QA added fixes for flaky/failing acceptance tests by @andr317c in #18149
• Nonbreaking performance tweaks by @Henr1k80 in #17106
• Don't assume HtmlString when inserting default values in templates by @kjac in #18144
• Feature: hide icons by @nielslyngsoe in #18162
• ensure default in Infinity by @nielslyngsoe in #18189
• Rollback as entity action + Picker data updates by @madsrasmussen in #18154
• User Group picker modal: adds filter input by @leekelleher in #18159
• Ensure min/max property editor settings are valid before rendering for content editing by @AndyButland in #17881
• V15/sort by selected icons by @Welander1994 in #18158
• More robust resolving of Delivery API redirects by @kjac in #18160
• Fix out of memory file upload of 2gb+ files introduced by #14657 SVG xss by @TimBoonstra in #17421
• Update auth.element.ts by @garpunkal in #18192
• Less parsing, allocation & LINQ when splitting strings by @Henr1k80 in #18048
• v14: Async healthchecks by @mattbrailsford in #17090
• Enforce user start nodes for media uploads through the RTE by @kjac in #18204
• Corrects filename label on the Upload File component by @leekelleher in #18205
• Show notifications menu only to users with permission for the feature by @AndyButland in #18184
• V15/feature/toggle property editor UI by @Welander1994 in #18171
• Localize reference block labels and properties in the block editing experience by @AndyButland in #18201
• Fixes #17206 by @nielslyngsoe in #18194
• Corrected rendering of member type icons on create button and picker by @AndyButland in #18203
• Fixes #18000 - Unsupported Block by @nielslyngsoe in #18182
• V13: Fix members while using basic auth. by @nikolajlauridsen in #18206
• Added deliveries workspace view to the webhook details workspace by @AndyButland in #18175
• V15 QA Added acceptance tests to verify the SVG thumbnail by @nhudinh0309 in #17966
• Set Smidge cachebuster type by @SimonHartfield in #18198
• Deprecate get unique param on UmbPickerInputContext and UmbRepositoryItemsManager by @madsrasmussen in #18216
• Cache null dictionary values by key by @callumbwhyte in #15576
• RTE TinyMCE: Compares previous value in #onChange event by @leekelleher in #18219
• Bugfix: Reload recycle bin on trashed entity by @madsrasmussen in #18228
• Entity permission translation for US, UK and DK by @ainokarita in #18225
• Review: Allow Duplicate Email for Members by @jasont0101 in #16202
• Decimal umb-property-editor-ui-number fixes by @leekelleher in #18233
• Renamed URL picker document link to content (more familiar to editors). by @AndyButland in #18236
• Update build and contributing docs by @AndyButland in #18223
• Correct icon and label for media type create option by @nielslyngsoe in #18237
• Update README.md by @nielslyngsoe in #18238
• Management API authorization for requests to rollback. by @AndyButland in #18240
• Fixes new "Document Type with Template" filename casing by @leekelleher in #18247
• Granular permissions translation DK, EN, US by @ainokarita in #18251
• Fix issues in newly added buttongroup localization by @Migaroez in #18254
• Remove the hard upper limit for SQL write lock timeout by @kjac in #18260
• Fix 11643 by @nielslyngsoe in #18257
• Tree: replace temporary event hack with context and skipHost by @madsrasmussen in #18242
• Property editor settings translation for DK&US by @ainokarita in #18264
• V15 QA Fixing the acceptance tests for Create Option due to UI changes by @nhudinh0309 in #18262
• Adds name and description to webhooks by @AndyButland in #18217
• Add validation to prevent update of a user or member to an invalid username (13) by @AndyButland in #18261
• Add validation to prevent update of a user or member to an invalid username (15) by @AndyButland in #18263
• V15 QA Updated acceptance tests for Link Picker by @nhudinh0309 in #18231
• Avoid an exception on sign out when the principal is populated from an incomplete external login by @AndyButland in #18078
• Feature: Fewer redirects by @nielslyngsoe in #18271
• Fix: #18209 by @nielslyngsoe in #18276
• Picker search result item icons for Documents and Members by @leekelleher in #18250
• V15 QA Added acceptance tests for the content with block list and block grid by @nhudinh0309 in #18026
• Prevents folder selection in media picker when used from the multi URL picker by @AndyButland in #18288
• Fixing the background color of the "re-login" screen when your session has timed out. by @readingdancer in #18284
• URL encodes member user names when passing information for public access setting such that those with user names as emails containing a plus will be included in the rule by @AndyButland in #18142
• V15 QA added clipboard acceptance tests by @andr317c in #18245
• V15/feature/history cleanup localization by @AnnicaF in #18295
• Added $type to ReferenceResponseModels by @Migaroez in #18293
• Fixed userResource request to get all users by @AndyButland in #18105
• Backport use of thread delay over sleep and handle dispose in FileSystemMainDomLock by @AndyButland in #18151
• Fix: #18272 by @nielslyngsoe in #18300
• Feature: workspace action additional options ellipsis by @nielslyngsoe in #18299
• Fix: #17676 by @nielslyngsoe in #18298
• Feature: reworking error toast notifications by @nielslyngsoe in #18172
• Split force for publish descendants into separate options for publish unpublish and re-publish unedited (15) by @AndyButland in #18270
• Feature: block type element not found by @nielslyngsoe in #18221
• Split force for publish descendants into separate options for publish unpublish and re-publish unedited (13) by @AndyButland in #18249
• V13: Introduce publishNotifications method on IMembershipMemberService by @Zeegaan in #18207
• fix peek error circular reference by @nielslyngsoe in #18307
• Prevent saving or publishing not created variants by @nielslyngsoe in #18312
• V15 QA Added acceptance tests for Create options by @nhudinh0309 in #18314
• V15 QA disabled SQLite test workers for acceptance tests by @andr317c in #18306
• Feature: Entity Item Ref Extension by @madsrasmussen in #18265
• Resolves issues related to the setting of a schedule for content publishing by @AndyButland in #17868
• V15 QA Fixed the npm command by @nhudinh0309 in #18316
• Removes collection action state by @madsrasmussen in #18212
• LinkedIn icon, adds currentColor fill by @leekelleher in #18322
• Property actions: adds localization support by @leekelleher in #18323
• Code Editor Modal, adds localization support by @leekelleher in #18325
• V15 QA fixed failing nightly acceptance tests by @andr317c in #18340
• Data Type create option description by @leekelleher in #18338
• Fixing adding properties to inherited Group #17695 by @nielslyngsoe in #18285
• Allow for multiple backoffice hosts by @kjac in #18302
• HTML encodes the user's name in the invite email by @AndyButland in #18343
• Adding additional document collection properties to align model with item response by @AndyButland in #18309
• Only filter post retrieval of entities for start nodes if working with entities that support start nodes by @AndyButland in #18287
• Avoid exception when attempting to find member by Id when Id is not an expected Guid or integer, as can be the case with external member providers by @AndyButland in #18320
• V15: Only cache items if all ancestors are published by @nikolajlauridsen in #18337
• Relax block data contract by @Migaroez in #18349
• Markdown Editor: adds "Default value" support by @leekelleher in #18326
• Limit referenced-by document and media endpoints to references only by @AndyButland in #18354
• Fix dialogs in Safari #18215 by @nielslyngsoe in #18363
• On retrieving other URLs, don't attempt to walk up the navigation structure to find parents when content is trashed by @AndyButland in #18355
• Modified AspNetCoreRequestAccessor to gracefully handle the absence of an HttpContext by @AndyButland in #18369
• Disable webhook firing if disable in configuration (15) by @AndyButland in #18386
• Feature: block grid block type area/root validation by @nielslyngsoe in #18224
• Fix: #17500 by @nielslyngsoe in #18303
• Toggle property Value labels and validation by @nielslyngsoe in #18333
• Feature: Support Handle Selector in Sorter by @nielslyngsoe in #18356
• V15: Fall back to emptry string if null, migrate #17024 by @nikolajlauridsen in #18395
• Add Localization to Document Type - Settings - Vary by Culture and Segments by @DitteKKoustrup in #18397
• V15: Dont delete when referenced setting is enabled by @Zeegaan in #18359
• Ported changes from Umbraco 13 around not throwing exceptions with identity IDs that can't be parsed to an integer or GUID by @AndyButland in #18389
• Add localization for Approved color/Color Picker Data type by @DitteKKoustrup in #18411
• V15: A user cannot switch back to the default language by @iOvergaard in #18414
• Adds warning to publish descendants dialog when force re-publish is selected (15) by @AndyButland in #18410
• Blocklist can count not only count but also do subtraction by @AndyButland in #18418
• Fix: #18350 by @nielslyngsoe in #18425
• Added obsoletion methods for extension methods to be removed in Umbraco 16 by @AndyButland in #18394
• Removed unused href by @madsrasmussen in #18413
• Implement create options for Member Types + Fix issue when single option is a link by @madsrasmussen in #18310
• Fix validation for blocks in variant block editors by @kjac in #18438
• Fix: remember validation state when creating by @nielslyngsoe in #18432
• Fix #18431 by @nielslyngsoe in #18445
• Add Localization to Documentation Types - Structure - Collection by @DitteKKoustrup in #18396
• Restored minimal default permissions for the writer user group by @AndyButland in #18449
• Published status filtering by @kjac in #18281
• V15 QA fixed flaky language tests by @andr317c in #18451
• Feature: Simpler app language request by @nielslyngsoe in #18278
• Feature: enforce block variations to be present in all mandatory languages by @nielslyngsoe in #18280
• implement pagination in Media Picker by @madsrasmussen in #18441
• V15: Schedule only languages you have access to by @iOvergaard in #18433
• Fix: Front-end/UX of #18402 by @nielslyngsoe in #18462
• Feature: RTE blocks validation by @nielslyngsoe in #18453
• V15: Fix draft being seeded by @Zeegaan in #18470
• 15.3: Hotfix: Content type discard changes by @madsrasmussen in #18490
• 15.3: Hotfix: block grid custom views by @madsrasmussen in #18558
• v15: Update nuget packages by @Zeegaan in #18559
• Fix custom views for block list and block rte by @madsrasmussen in #18565
• Fix Rich text block validation path by @Migaroez in #18578
• Match source block both on culture and alias by @kjac in #18582

New Contributors

• @mvennevold made their first contribution in #17637
• @Welander1994 made their first contribution in #18158
• @TimBoonstra made their first contribution in #17421
• @SimonHartfield made their first contribution in #18198
• @ainokarita made their first contribution in #18225
• @jasont0101 made their first contribution in #16202
• @AnnicaF made their first contribution in #18295
• @DitteKKoustrup made their first contribution in #18397

Full Changelog: release-15.2.3...release-15.3.0-rc