Skip to content

Commit c8ff381

Browse files
andr317candr317c
authored
Merge branch 'main' into v18/QA/manage-users-from-user-group-tests
2 parents 2729a5d + c77be76 commit c8ff381

785 files changed

Lines changed: 24002 additions & 5456 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.claude/skills/umb-update-server-dependencies-for-minor/SKILL.md‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
name: umb-update-server-dependencies-for-minor
3+
description: Update all server-side (NuGet) dependencies to their latest minor/patch versions for the current branch's version line, then open a PR. Runs dotnet-outdated, bumps minors and patches only (never majors; never moves a stable package onto a pre-release), syncs the template projects, builds and runs unit tests, commits, and creates a PR. Use when asked to update/bump backend/server/NuGet/.NET dependencies for a release (e.g. "update server dependencies for 17.6", "bump NuGet packages to latest minors").
4+
argument-hint: [base-branch] (optional; defaults to the current branch)
5+
---
6+
7+
# Update Server-Side Dependencies (minor & patch) - Umbraco CMS
8+
9+
Bumps every NuGet dependency that is behind to its latest available **minor or patch** version for a single version line (the current branch), then builds, tests, commits and opens a PR.
10+
11+
**Scope: one version line at a time.** This skill operates on the branch that is currently checked out (or the branch given as `$ARGUMENTS`). To update multiple release lines (e.g. `v17/dev` and `main`), run it once per line.
12+
13+
**Guardrails (non-negotiable):**
14+
- **Never** update a major version. Only minors and patches where a newer one exists.
15+
- **Never** move a stable package onto a pre-release. Packages already on a pre-release *may* be updated to a newer pre-release — this is what `--pre-release Auto` does.
16+
- **Never** update packages explicitly held back for compatibility (e.g. marked "HOLD"/"do not bump" in `Directory.Packages.props`). `TODO` comments there may also mark transitive security pins, which are in-scope to bump if needed (see step 3).
17+
18+
## Prerequisites
19+
20+
- `dotnet-outdated-tool` installed globally: `dotnet tool install --global dotnet-outdated-tool` (verify with `dotnet outdated --version`).
21+
- `gh` CLI authenticated (`gh auth status`).
22+
23+
## Where versions live
24+
25+
| File | Scope |
26+
|------|-------|
27+
| `Directory.Packages.props` (root) | Production packages + `GlobalPackageReference` build tooling + transitive security pins |
28+
| `tests/Directory.Packages.props` | Test-only packages (inherits the root file) |
29+
| `src/Umbraco.Web.UI/Umbraco.Web.UI.csproj` | Inline versions (opts out of central management) |
30+
| `templates/UmbracoExtension/Umbraco.Extension.csproj` and its `Directory.Packages.props` | **Not in `umbraco.sln`** — dotnet-outdated will NOT touch these; sync them by hand (step 4) |
31+
32+
## Instructions
33+
34+
### 1. Establish the branch
35+
36+
Read `version.json` and take the major version (e.g. `18` from `18.1.0-rc`) — call it `{major}`.
37+
38+
If the current branch is a long-lived line (`main`, `v{major}/dev`, a release branch) rather than a task branch, create and switch to a new branch:
39+
40+
```bash
41+
git switch -c v{major}/task/update-backend-dependencies
42+
```
43+
44+
(If `$ARGUMENTS` names a base branch, branch from that instead.) If you are already on a suitable task branch, stay on it. Confirm the working tree is clean before starting.
45+
46+
### 2. Discover what is outdated
47+
48+
Run dotnet-outdated restricted to within the current major. `--version-lock Major` keeps updates inside the current major version; `--pre-release Auto` (the default) offers a pre-release upgrade **only when the package is already on a pre-release** — so a stable package never jumps to a pre-release, while an existing pre-release can move to a newer pre-release:
49+
50+
```bash
51+
dotnet outdated --version-lock Major --pre-release Auto umbraco.sln
52+
```
53+
54+
Review the report. Everything listed is a legitimate minor/patch (or same-track pre-release) candidate. Note anything you intend to skip, and verify afterwards (via `git diff`) that no intentionally pinned/held versions were changed; revert any that were.
55+
56+
### 3. Apply the updates
57+
58+
Apply the same filter with `-u`:
59+
60+
```bash
61+
dotnet outdated --version-lock Major --pre-release Auto -u umbraco.sln
62+
```
63+
64+
`dotnet-outdated` restores per-package and may print `Failed to restore project after upgrading!` for the test projects — this is a known quirk with the multi-level `tests/Directory.Packages.props` merge; the version writes still land. Verify with `git diff` afterwards.
65+
66+
This updates the two `Directory.Packages.props` files, the inline `Umbraco.Web.UI.csproj` versions, and any in-solution project. It also handles `GlobalPackageReference` entries (e.g. `Nerdbank.GitVersioning`).
67+
68+
You can also update transitive **security pins** if a new minor or patch is available.
69+
70+
### 4. Sync the template projects by hand
71+
72+
`templates/UmbracoExtension/` is not part of `umbraco.sln`, so its versions are not updated automatically. For any package that (a) was bumped in the root `Directory.Packages.props` **and** (b) appears in the template, update it to match:
73+
74+
```bash
75+
grep -rnE "Version=\"[0-9]" templates/UmbracoExtension/
76+
```
77+
78+
Typically this is `Microsoft.AspNetCore.OpenApi` and/or `Swashbuckle.AspNetCore*` in both `templates/UmbracoExtension/Umbraco.Extension.csproj` and `templates/UmbracoExtension/Directory.Packages.props`. Keep them aligned with the root file.
79+
80+
### 5. Build and run unit tests
81+
82+
Build the full solution in Release, skipping the frontend/npm steps (these are gated for CI/non-VS builds):
83+
84+
```bash
85+
dotnet build umbraco.sln -c Release -p:UmbracoBuild=true
86+
```
87+
88+
Then run the unit test suite:
89+
90+
```bash
91+
dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj -c Release -p:UmbracoBuild=true --no-build
92+
```
93+
94+
Both build and tests must be green before continuing.
95+
96+
Confirm the bumps did not leave (or introduce) a known-vulnerable transitive version:
97+
98+
```bash
99+
dotnet list umbraco.sln package --vulnerable --include-transitive
100+
```
101+
102+
Pre-existing, unrelated advisories are out of scope for a routine bump — but if a bump you made is the cause, resolve it (raise the pin, or add an inline reference for `Umbraco.Web.UI`).
103+
104+
### 6. Review and commit
105+
106+
Confirm `git status` shows only the intended package files (the two `Directory.Packages.props`, `Umbraco.Web.UI.csproj`, and any template files) — no stray build output, logs, or the schema placeholder. Stage those files explicitly (do not `git add -A`) and commit:
107+
108+
```
109+
Update NuGet packages to latest minor and patch versions
110+
111+
Bump all NuGet dependencies that were behind to their latest available
112+
minor or patch release, as reported by dotnet-outdated. No major-version
113+
updates are included.
114+
```
115+
116+
### 7. Push and open the PR
117+
118+
```bash
119+
git push -u origin <branch>
120+
```
121+
122+
Generate the PR body from the actual `git diff` of the package files (do not invent versions). Use tables grouping the changes, and keep the **Testing** section to a single line — CI is the source of truth, do not paste build/test counts.
123+
124+
Fill in the template below and **write it to a temp file** (e.g. `/tmp/pr-body.md`), then create the PR against the line's dev branch (`v{major}/dev` for a v-line, `main` for the current major):
125+
126+
```bash
127+
gh pr create --base <dev-branch> --head <branch> \
128+
--title "Dependencies: Update NuGet packages to latest minor and patch versions" \
129+
--body-file /tmp/pr-body.md
130+
```
131+
132+
**PR body template:**
133+
134+
```markdown
135+
## Description
136+
137+
Routine dependency maintenance for the **{version}** release. Updates all NuGet packages that were behind to their latest available **minor or patch** version, as reported by `dotnet-outdated`. No major-version updates are included.
138+
139+
### Production packages (`Directory.Packages.props`)
140+
141+
| Package | From | To |
142+
|---|---|---|
143+
| … | … | … |
144+
145+
### Test packages (`tests/Directory.Packages.props`)
146+
147+
| Package | From | To |
148+
|---|---|---|
149+
| … | … | … |
150+
151+
### Inline / template versions
152+
153+
- `src/Umbraco.Web.UI/Umbraco.Web.UI.csproj`: …
154+
- `templates/UmbracoExtension`: …
155+
156+
### Deliberately left unchanged
157+
158+
- Any package where only a **major** update is available (out of scope for this PR).
159+
- Intentionally-held packages carrying a `HOLD`/`do not bump` comment (e.g. `Umbraco.Code`).
160+
161+
## Testing
162+
163+
Solution should build and CI checks pass.
164+
```
165+
166+
### 8. Report
167+
168+
Output the PR URL, the branch name, and a short summary of what was bumped (and anything deliberately skipped or any pin that had to be raised).
169+
170+
## Notes
171+
172+
- If `dotnet-outdated` reports nothing outdated, say so and stop — do not create an empty PR.
173+
- No `OpenApi.json` regeneration is needed for pure dependency bumps (no Management API controllers/models change).

‎Directory.Packages.props‎

Lines changed: 42 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -6,56 +6,57 @@
66
</PropertyGroup>
77
<!-- Global packages (private, build-time packages for all projects) -->
88
<ItemGroup>
9-
<GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.9.50" />
9+
<GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.10.85" />
1010
<GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
1111
<!-- TODO (V18): Bump Umbraco.Code to 3.0.0 stable before release of 18.0.0 -->
1212
<GlobalPackageReference Include="Umbraco.Code" Version="3.0.0-beta" />
1313
<GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
1414
</ItemGroup>
1515
<!-- Microsoft packages -->
1616
<ItemGroup>
17-
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.7" />
17+
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.9" />
1818
<!-- When updating this version, also update templates/UmbracoExtension/Umbraco.Extension.csproj -->
19-
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.7" />
19+
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
2020
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.3.0" />
2121
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.3.0" />
22-
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
23-
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.7" />
24-
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.7" />
25-
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.7" />
26-
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.7" />
27-
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.7" />
28-
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.7" />
29-
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
30-
<PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.7" />
31-
<PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.7" />
32-
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
33-
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
34-
<PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.7" />
35-
<PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.7" />
36-
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
37-
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
38-
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
39-
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.7" />
40-
<PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.5.0" />
22+
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.9" />
23+
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
24+
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
25+
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.9" />
26+
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
27+
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.9" />
28+
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.9" />
29+
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
30+
<PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.9" />
31+
<PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.9" />
32+
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
33+
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.9" />
34+
<PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.9" />
35+
<PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.9" />
36+
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.9" />
37+
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.9" />
38+
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.9" />
39+
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.9" />
40+
<PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.7.0" />
4141
<PackageVersion Include="System.Linq.Async" Version="7.0.1" />
4242
</ItemGroup>
4343
<!-- Umbraco packages -->
4444
<ItemGroup>
45-
<PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.4.0" />
45+
<PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.4.3" />
4646
</ItemGroup>
4747
<!-- Third-party packages -->
4848
<ItemGroup>
4949
<PackageVersion Include="Asp.Versioning.Mvc" Version="10.0.0" />
5050
<PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.0.0" />
51+
<PackageVersion Include="BitFaster.Caching" Version="2.6.0" />
5152
<PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
52-
<PackageVersion Include="Examine" Version="3.8.0" />
53-
<PackageVersion Include="Examine.Core" Version="3.8.0" />
53+
<PackageVersion Include="Examine" Version="3.9.0" />
54+
<PackageVersion Include="Examine.Core" Version="3.9.0" />
5455
<PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
5556
<PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
5657
<PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
57-
<PackageVersion Include="MailKit" Version="4.16.0" />
58-
<PackageVersion Include="Markdig" Version="1.1.3" />
58+
<PackageVersion Include="MailKit" Version="4.17.0" />
59+
<PackageVersion Include="Markdig" Version="1.3.2" />
5960
<PackageVersion Include="Markdown" Version="2.2.1" />
6061
<PackageVersion Include="MessagePack" Version="3.1.7" />
6162
<PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
@@ -74,13 +75,13 @@
7475
<PackageVersion Include="Serilog.Extensions.Hosting" Version="10.0.0" />
7576
<PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
7677
<PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
77-
<PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.0" />
78+
<PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.1" />
7879
<PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
7980
<PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
8081
<PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
8182
<PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
8283
<PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
83-
<PackageVersion Include="Swashbuckle.AspNetCore.SwaggerUI" Version="10.1.7" />
84+
<PackageVersion Include="Swashbuckle.AspNetCore.SwaggerUI" Version="10.2.3" />
8485
</ItemGroup>
8586
<!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
8687
<ItemGroup>
@@ -91,8 +92,17 @@
9192
<!-- Markdown references vulnerable version of the following: -->
9293
<!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
9394
<PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
94-
<!-- Examine (via Microsoft.AspNetCore.DataProtection 8.0.4) references a vulnerable version of the following: -->
95-
<!-- TODO: Remove this pinned dependency when Examine updates its Microsoft.AspNetCore.DataProtection reference. -->
96-
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.7" />
95+
<!--
96+
Examine (via Microsoft.AspNetCore.DataProtection) and OpenIddict's *.DataProtection packages otherwise
97+
resolve System.Security.Cryptography.Xml down to a vulnerable 8.0.0 (GHSA-37gx-xxp4-5rgx, GHSA-w3x6-4m5h-cxqf).
98+
Pin it forward until both of those dependencies reference a fixed version.
99+
-->
100+
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.9" />
101+
<!--
102+
Microsoft.AspNetCore.OpenApi and Swashbuckle only require Microsoft.OpenApi >= 2.0.0, which otherwise
103+
resolves to a vulnerable 2.0.0 (CVE-2026-49451, GHSA-v5pm-xwqc-g5wc). Pin forward to a patched 2.x
104+
until the referencing packages raise their floor.
105+
-->
106+
<PackageVersion Include="Microsoft.OpenApi" Version="2.9.0" />
97107
</ItemGroup>
98108
</Project>

‎build/nightly-build-trigger.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ schedules:
99
branches:
1010
include:
1111
- v13/dev
12-
- v16/dev
13-
- v18/dev
12+
- v17/dev
1413
- main
1514

1615
steps:

‎build/templates/backoffice-install.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
11
steps:
2+
# The Microsoft-hosted Linux agents can run low on disk space, which causes the cache
3+
# save step below to fail while writing its archive. The pre-installed Android SDK is
4+
# unused by any Umbraco job, so removing it reclaims the space.
5+
- bash: |
6+
df -h /
7+
sudo rm -rf /usr/local/lib/android
8+
df -h /
9+
displayName: Free up disk space
10+
condition: eq(variables['Agent.OS'], 'Linux')
11+
212
- task: NodeTool@0
313
displayName: Use Node.js
414
retryCountOnTaskFailure: 3

‎build/templates/npm-publish.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,18 @@ steps:
1515
- checkout: none
1616
- download: current
1717
artifact: ${{ parameters.artifactName }}
18-
- script: npm config set @umbraco-cms:registry ${{ parameters.registry }} --location=project
18+
- bash: npm config set @umbraco-cms:registry "$REGISTRY_URL" --location=project
1919
displayName: Add scoped registry to .npmrc
2020
workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
21+
env:
22+
REGISTRY_URL: ${{ parameters.registry }}
2123
- task: npmAuthenticate@0
2224
displayName: Authenticate with npm
2325
inputs:
2426
workingFile: $(Pipeline.Workspace)/${{ parameters.artifactName }}/.npmrc
2527
customEndpoint: ${{ parameters.customEndpoint }}
26-
- script: npm publish *.tgz --tag ${{ parameters.npmTag }}
28+
- bash: npm publish *.tgz --tag "$NPM_TAG"
2729
displayName: ${{ parameters.displayName }}
2830
workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
31+
env:
32+
NPM_TAG: ${{ parameters.npmTag }}

‎src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderApiExtensions.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ internal static void AddUmbracoOpenApiDocument<TConfigureOptions>(
5959
string? jsonOptionsName = null)
6060
where TConfigureOptions : ConfigureUmbracoOpenApiOptionsBase
6161
{
62+
apiName = apiName.ToLowerInvariant();
6263
builder.Services.AddOpenApi(apiName);
6364
builder.Services.ConfigureOptions<TConfigureOptions>();
6465
builder.Services.AddOpenApiDocumentToUi(apiName, apiTitle);

0 commit comments

Comments
 (0)