January 2025: the patch was easy, getting to the patch was not

· JD + AI · Umbraco

January 2025: the patch was easy, getting to the patch was not

January 2025 gave Umbraco teams exactly one thing they had to act on, and it landed on the 21st.

Andy Butland published the security advisory on Umbraco's own blog, which is the right place to get version numbers and the wrong place to look for perspective on them. Three moderate-severity issues, patched the same day. Umbraco 10.0.0–10.8.7 carried one of them. Umbraco 13.0.0–13.5.2 carried one. Umbraco 14.0.0–14.3.1 and 15.0.0–15.1.1 carried all three. Umbraco 8 and earlier were not affected. The fixes shipped as 10.8.8, 13.5.3, 14.3.2 and 15.1.2, and Umbraco reported no indication that the issues had been discovered or exploited before disclosure.

Then the sentence that decides how much January actually cost you: "Sites will need to update to the latest minor version before the patch can be applied." Umbraco calls the patch upgrade minimal effort per project, and it is, from the right starting point. If you were sitting on 13.2 that morning you were not applying a patch. You were doing a minor-version upgrade with a regression pass on the end of it, on a schedule someone else had just set for you.

On Cloud the whole thing was close to invisible. Sites already on the latest minor were patched automatically that day, and the rest could get there through the minor-upgrade feature. On premise it was a ticket, and the size of the ticket depended entirely on how current you had kept the minor.

The three underlying advisories are worth reading in order: XSS and HTML injection in the preview badge, XSS and HTML injection in backoffice components, and user enumeration based on Management API response timing and status codes. Two injection issues in the backoffice and one in the Management API is roughly why 14 and 15 caught all three while 10 and 13 caught one each. The new backoffice and its API were the newer surface, and newer surface is where the holes had not been found yet.

Half of this month came from Umbraco's own blog

Three of the six sources cited here are umbraco.com, and Umbraco sells the product it is writing about. That concentration is not editorial choice; it is what the month produced. Read the version numbers as authoritative and the framing as the company's.

The other two vendor posts change nothing you build. Mats Persson announced the 2024 Contributing Partners: 46 Platinum and Gold partners hold the badge, 10 of them new. If you are shortlisting an implementation partner, know what the badge measures — documentation, core PRs, packages, meetups, community work — because it is a contribution signal, not a delivery-quality one. And the January uProfile, credited to Team DevRel rather than to a person, is six thousand words introducing Emma Burstow, Sebastiaan Janssen, Allen Smith, Lucy Brailsford and Lotte Pitcher. Useful if you are about to open a support conversation or turn up at Codegarden. Not otherwise.

The community half is an ecosystem stuck between 13 and 14

Owain Williams took stock of his year and the post is mostly about burnout: two meetups, a package, a full-time job and nothing left over to write with. Our harvest recorded the byline as "Owain.Codes", the handle rather than the name; the site is his. Buried in it is the ecosystem fact. His package, MediaColourFinder, was meant to move to Umbraco 14 and he hit "a bit of a brick wall", so it went back down the list. He also deleted his X account and consolidated onto Bluesky, Mastodon and the Umbraco Discord, which is worth knowing if you are wondering why the community feels quieter than it did.

That is the same wall a lot of upgrade plans hit in early 2025, and it is the one the security advisory does not mention. Before you scope a move to 14 or 15, check the state of every package you depend on. Some of them were sitting exactly where Owain's was.

Meanwhile Nathaniel Nunes needed Umbraco Forms to post to an authenticated API on Umbraco 13 LTS, and the built-in Send Form to URL workflow type has no field for request headers, so an X-API-Key was impossible out of the box. His route: decompile Umbraco.Forms.Core.Providers with dotPeek, clone the PostToUrl class into his own workflow type, add a FieldMapper setting so an editor can enter header name and value pairs in the backoffice, register it through WorkflowCollectionBuilder. It works, and the write-up is honest about the shape of it: the extension point is documented, but the starting material comes out of a decompiler because the built-in provider is not something you can usefully inherit from. If you have Forms posting anywhere that checks a header, this is the pattern, and it is still the pattern on later versions.

The AI post that is not really about Umbraco

Dennis Adolfi wrote up eight months of touring an e-commerce and AI talk with Niclas Åström, and his observation is the part worth keeping: the slides did not change and the questions did. Early on the room asked how to get started and which service to use. By the end it was asking whether any of it was safe. Adolfi has no commercial interest recorded against him in our source registry, and the piece reads as a practitioner's, not a vendor's: "We want AI that reflects the society we aspire to have, not the injustices of the present."

Where he lands is practical rather than philosophical, and that is the part that touches CMS work. Fairness reports in Azure Machine Learning, content filters in Azure AI Foundry — his answer to a governance question is a configuration answer. If you are specifying AI features into a content project, that reframing is the useful bit: most of what a client means by "can we trust it" is a set of switches somebody has to own.

Six items is the whole month, and that number needs a caveat

This is not a selection. Six Umbraco items is everything the harvest found for January 2025, one above our floor of five. A thin month is a thin month and there is no case for dressing it up.

The caveat matters more than the thinness. We reached January 2025 by backfilling from feed archives rather than by crawling it live, and feeds truncate. Blogs that have since moved, stopped publishing or dropped their history are simply invisible to us at this depth. The same window returned 22 Sitecore items, and we do not read that as Sitecore having been four times as busy — we read it as archive survivorship. Treat six as a floor, not a census.

What the month does support is one argument. Umbraco patches the latest minor and nothing else, so every advisory silently converts "we will upgrade when we need to" into an upgrade project with an external deadline. Staying current on your minor is not maintenance hygiene you can defer to a quiet quarter; it is the thing that makes a security patch a patch instead of a project. In January 2025 a lot of teams could not do that at the major level either, because the packages were not ready for 14. Both halves of this month are the same story told from different ends.

Sources

umbraco · umbraco-cms · umbraco-backoffice · umbraco-apis · umbraco-cloud · product · community · release

2026 © Umbracolombia - All rights reserved.