Bring UmBootstrap from Umbraco 17.2.2 to 17.5.3, with every dependency moved to its latest 17-compatible release.
Full plan with per-sprint checkboxes: planning/UMBRACO_17_LTS_UPGRADE.md
Staying on 17 LTS, not 18
The literal latest Umbraco is 18.0.2. We are deliberately staying on the LTS line.
Every community package now publishes two lines, one per Umbraco major, and the higher version number is always the Umbraco 18 one. Taking "latest" on any of them silently moves the project off LTS.
| Package |
17-compatible (target) |
18 line (avoid) |
| BlockPreview |
5.5.0 |
6.1.0 |
| Contentment |
6.2.1 |
7.0.1 |
| UmbNav |
4.1.8 |
5.0.0 |
| uSync |
17.3.6 |
18.0.2 |
| uSync.Complete |
17.3.11 |
18.0.2 |
| Umbraco.AI |
17.1.1 |
18.1.1 |
| Umbraco.AI.Anthropic |
17.0.0 |
18.0.0 |
| Umbraco.AI.Prompt |
17.1.0 |
18.1.0 |
Sprints
Ordering is forced
Umbraco.AI 17.x hard-requires Umbraco.Cms.Core >= 17.4.0, so the CMS must move first or the restore fails.
The MimeKit pin can be removed
The pin exists because MimeKit 4.14.0 carried CVE-2026-30227, fixed in 4.15.1. MimeKit is pulled transitively via MailKit:
|
MailKit |
resolves MimeKit |
| Umbraco 17.2.2 |
4.14.1 |
4.14.0 (vulnerable) |
| Umbraco 17.5.3 |
4.16.0 |
4.16.0 (fixed) |
17.5.3 resolves above the fix on its own, so the manual pin and its TODO become dead weight.
Dependabot PRs are both wrong
Close both rather than merging.
Risks
- Contentment is the highest risk despite the smallest bump.
FeatureBlockDataSource depends on IContentmentDataSource and on reading the document GUID from the API POST body via EnableBuffering() in Program.cs. Custom integration, undocumented upstream.
- Database migrations cannot be reverted by git. Umbraco and Umbraco.AI both migrate on first boot. Database backed up before starting.
Bring UmBootstrap from Umbraco 17.2.2 to 17.5.3, with every dependency moved to its latest 17-compatible release.
Full plan with per-sprint checkboxes:
planning/UMBRACO_17_LTS_UPGRADE.mdStaying on 17 LTS, not 18
The literal latest Umbraco is 18.0.2. We are deliberately staying on the LTS line.
Every community package now publishes two lines, one per Umbraco major, and the higher version number is always the Umbraco 18 one. Taking "latest" on any of them silently moves the project off LTS.
Sprints
Umbraco.Cms17.2.2 → 17.5.3, remove the MimeKit pinOrdering is forced
Umbraco.AI17.x hard-requiresUmbraco.Cms.Core >= 17.4.0, so the CMS must move first or the restore fails.The MimeKit pin can be removed
The pin exists because MimeKit 4.14.0 carried CVE-2026-30227, fixed in 4.15.1. MimeKit is pulled transitively via MailKit:
17.5.3 resolves above the fix on its own, so the manual pin and its TODO become dead weight.
Dependabot PRs are both wrong
Umbraco.Cms17.4.0, already superseded by 17.5.3Umbraco.AI1.14.0, which is the dead 1.x line — the maintained line is now 17.xClose both rather than merging.
Risks
FeatureBlockDataSourcedepends onIContentmentDataSourceand on reading the document GUID from the API POST body viaEnableBuffering()inProgram.cs. Custom integration, undocumented upstream.