[Snyk] Security upgrade Umbraco.Cms from 13.12.1 to 14.0.0

[jcdc-bot]

Snyk has created this PR to fix 2 vulnerabilities in the nuget dependencies of this project.

Snyk changed the following file(s):

• src/TestSite.13/TestSite.13.csproj

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Directory Traversal SNYK-DOTNET-LUCENENETREPLICATOR-17816708
	Directory Traversal SNYK-DOTNET-LUCENENETREPLICATOR-17816710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[jcdc-bot]

The upgrade from Umbraco.Cms v13 to v14 is a major and high-impact release with fundamental architectural changes and numerous breaking changes. The entire backoffice has been rebuilt, and several legacy features have been completely removed, requiring significant migration effort.

Key Breaking Changes:

• Complete Backoffice Rewrite: The backoffice no longer uses AngularJS. It has been rebuilt from the ground up using Web Components, TypeScript, and Lit. [11] This means all existing custom backoffice extensions, property editors, and plugins built with AngularJS are incompatible and must be rewritten using the new Extension API. [4, 11]
• Removal of Macros: Macros have been completely removed from the CMS. [10, 11] Any content or functionality relying on macros will break. This is considered the single biggest blocker for the upgrade, and a migration strategy to convert macros to alternatives like Block List/Grid components or Partial Views is essential. [1, 2]
• Removal of Legacy Property Editors: Several older property editors have been removed in favor of modern alternatives. These include:
  • Grid Layout (replaced by the Block Grid editor) [11]
  • Nested Content (replaced by the Block List editor) [11]
  • The legacy Media Picker [11]
• API and Configuration Changes: There are numerous changes to backend APIs and startup configuration. For example, event handling for notifications has changed, and methods like UseInstallerEndpoints have been removed. [2, 7] The introduction of a new Management API also changes how developers can interact with the CMS programmatically. [4]
• Asset Management: The Smidge asset manager has been removed. Any direct references, such as @inject Smidge.SmidgeHelper, must be removed from view files. [1]

Recommendation: This upgrade cannot be treated as a simple dependency bump. It requires a dedicated migration project. Developers must plan for a complete rewrite of all custom backoffice code and create a strategy for migrating content away from macros and other removed legacy features. Thoroughly review the official documentation and test the migration on a local copy of the production database before proceeding. [2]

Source: Umbraco 14 Release Notes, Breaking Changes Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[jcdc-bot]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.