Skip to content

[Snyk] Security upgrade Umbraco.Cms from 17.0.0 to 18.0.0 - #206

Closed
jcdc-bot wants to merge 1 commit into
dev/v17from
snyk-fix-99b1d6a59b1a1eec58e912b8b76d763d
Closed

[Snyk] Security upgrade Umbraco.Cms from 17.0.0 to 18.0.0#206
jcdc-bot wants to merge 1 commit into
dev/v17from
snyk-fix-99b1d6a59b1a1eec58e912b8b76d763d

Conversation

@jcdc-bot

@jcdc-bot jcdc-bot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the nuget dependencies of this project.

Snyk changed the following file(s):

  • src/jcdcdev.Umbraco.ReadingTime.TestSite/jcdcdev.Umbraco.ReadingTime.TestSite.csproj

Vulnerabilities that will be fixed with an upgrade:

Issue
high severity Uncontrolled Recursion
SNYK-DOTNET-MICROSOFTOPENAPI-17816696

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Recursion

…Time.TestSite.csproj to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DOTNET-MICROSOFTOPENAPI-17816696
@jcdc-bot

jcdc-bot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator Author

Merge Risk: High

The upgrade to Umbraco.Cms v18.0.0 is a major version with significant breaking changes, including mandatory data migrations and API replacements. Developer action is required before and after the upgrade.

Key Breaking Changes:

  • Single Block Migration: A data migration for Block List property editors, which was optional in v17, now runs automatically. If you use custom property editors that nest block list values, you must implement and register an ITypedSingleBlockListProcessor before upgrading to prevent data loss.
  • OpenAPI/Swagger API Changes: The method for registering OpenAPI documents has been changed. You must replace IConfigureOptions<SwaggerGenOptions> with the new AddOpenApi() method. Several related interfaces for handling schema and operation IDs have been removed entirely.
  • Media Recycle Bin: The EnableMediaRecycleBinProtection setting is now enabled by default, which renames deleted media files. It is recommended to empty the media recycle bin before upgrading to avoid potential issues.
  • Database Time Zone Migration: The upgrade will automatically migrate all system dates in the database from server time to UTC.

Recommendation:

This upgrade requires careful planning. Review the official breaking changes documentation thoroughly. Ensure you have a complete backup of your database and files before proceeding. Pay special attention to the required implementation of ITypedSingleBlockListProcessor if your project is affected.

Source: Umbraco Breaking Changes Overview, Umbraco 18 Release Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@github-actions
github-actions Bot requested a review from jcdcdev July 5, 2026 23:24
@jcdc-bot

jcdc-bot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator Author

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@jcdcdev jcdcdev closed this Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants