September 2025: the MCP server moved in-house and Smidge needed a patch

· JD + AI · Umbraco

September 2025: the MCP server moved in-house and Smidge needed a patch

If you still maintain an Umbraco 13 site, September 2025 left exactly one thing on your list: patch it. Everything else the month produced was interesting rather than urgent, and most of it was AI plumbing.

The shape of the month is worth stating before the items, because the shape is the story. Eleven Umbraco items cleared our floor across thirty days, and six of them came from umbraco.com — 55% of the month's record written by the company that sells the product. Three more were about MCP, the protocol for wiring AI assistants into applications. A month that is half vendor communications and a quarter AI tooling does not have much operational news in it, and this post is not going to pretend it does.

The vulnerability was in Smidge, not in Umbraco

Security Advisory, September 23, 2025 — Andy Butland, writing on Umbraco's own blog about Umbraco's own product

The bug sat in Smidge, the runtime bundling and minification library that Umbraco 13 uses by default. Butland describes the impact as the potential to enumerate usernames on the web server or to exhaust available disk space, graded by Umbraco as moderate and low. Versions 13.0.0 to 13.10.0 are affected. 13.10.1 carries the fix, and the only difference between the two releases is the Smidge dependency bump.

That last detail is the useful one. If a version move is not on the table this quarter, add direct references to Smidge.InMemory and Smidge.Nuglify at 4.6.0 in your .csproj and you are done. Cloud sites already on the latest minor were patched the same day; anything on an older minor needed the minor-upgrade path first. On older majors the advisory is blunt: unsupported versions "can be subject to the vulnerability, but will not receive a patch."

Umbraco adopted the community's MCP server

Announcing the Beta Release of the Developer MCP Server for Umbraco CMS — Phil Whittaker, on Umbraco's blog

The Umbraco MCP server moved out of Matthew Wise's personal GitHub account into the umbraco organisation, with the package renamed to @umbraco-cms/mcp-dev. Whittaker credits Wise for hosting it until then. The package now tracks Umbraco's own major numbers: this beta adds Umbraco 16 support, and Umbraco 15 stays behind on the old NPM location.

The part that matters when you point this at a client environment is the scoping. Four environment variables (UMBRACO_INCLUDE_TOOLS, UMBRACO_EXCLUDE_TOOLS, and their _TOOL_COLLECTIONS equivalents) switch whole management-API areas on and off: document, media, member, template, webhook and a dozen more. On top of that, the tools an assistant can see are filtered by the API user's own Umbraco permissions. That is the right design, and it is also the warning. An assistant's blast radius is the blast radius of the API user you hand it, so hand it a narrow one.

Experimenting with an MCP Server for Umbraco Engage — Corné Hoskam

A proof of concept that puts Engage's analytics and A/B testing endpoints behind the same MCP, with the TypeScript client generated from the Engage 16 management API's Swagger using Orval. Hoskam asks Claude for the top five pages by views over three time windows, then for a guess at which content difference explains a variant winning. Our source record carried no commercial interest for this post; the post itself says otherwise, and we would rather correct the record than let it read as independent commentary. Hoskam writes as an Umbraco employee: "Within Umbraco we will continue our research into what's possible with MCP support."

Data Migrations using MCP — Dennis Adolfi

Adolfi's post is 71 words and a link; the argument lives in a LinkedIn piece called "Rethinking Data Migrations using MCP". Useful to know it exists if migrations are your current pain, but the blog entry is a pointer rather than a piece.

uSync patched two majors in three days

uSync v16.0.5 and uSync v13.3.2 — Kevin Jump, release notes for the package he maintains

16.0.5 on 22 September fixes a topological sort where a key was not matching internally, adds block item converters, reworks v16 trash handling and puts a waiting state on the import upload button. 13.3.2 on 24 September is mostly null-reference fixes in the community datatype serializers, with dynamic-root and group-checker work alongside.

Two majors patched inside three days tells you where the installed base actually sits. If your deployment story runs through uSync and you are still on 13, someone is still fixing your bugs. That is more than most of this ecosystem's tooling can say.

The 2026 price list, read after the fact

Annual price updates 2026 — Mats Persson, Umbraco's own pricing announcement

Persson frames the changes as "mainly based on price indexing", and most lines fit: Cloud Starter €42 → €45 a month, Standard €268 → €280, Professional €700 → €730, Gold partnership €17,500 → €18,500.

Several lines are not indexing. Deploy on-premises lost its one-time fee and became a €2,800 yearly subscription for new customers, against €970 yearly before. The Cloud dedicated-resource plans quietly changed their annual arithmetic: the old yearly prices were ten times the monthly rate and the 2026 ones are twelve, so Standard dedicated 1 moves from €2,500 to €3,120 a year. That is close to 25%, presented as €10 a month. Training moved in both directions, with the Cloud Developer course down from €1,250 to €500 and the Certified Master bundle down from €7,390 to €5,500, while an onsite day went from €7,390 to €8,000.

These prices took effect on 1 January 2026, and the post itself was last updated on 30 September 2025. We are publishing this month from the archive, so read the numbers as a record of what was announced rather than as today's price sheet, and check umbraco.com before any of it reaches a proposal.

One person's automation, published in full

UMB.FYI Gets a New Workflow Engine — Matt Brailsford, whose source record flags a commercial interest in Umbraco, writing about his own newsletter

The most transferable engineering in the month. A C# fluent-builder workflow engine registered through IComposer, wired into DI so tasks can use the solution's existing services, structured as stages → tasks → subtasks, streaming progress to a backoffice UI over Server-Sent Events, and aborting the run when a task marked critical fails. No branching, no approvals. If you have ever wanted a "run these fifteen checks over this content set and show me the log" button in the backoffice, the shape of it is in his composer.

The rest was the company talking about itself

Three items carry nothing operational, and saying so is more useful than padding them out. Introducing the Autumn Contribution Challenge 2025 (Sebastiaan Janssen, Umbraco) replaces the old Hacktoberfest-style month with a September-to-November push to fill a samples section on a new community site, later extended to 31 December. uProfile September 2025 - Paul Seal is a community profile written by Seal himself for the vendor's blog; he is Technical Lead at ClerksWell and a long-standing MVP, and it is a good read that is not product news. Umbraco Recognized as a G2 Leader (Niels Christian Laursen, Umbraco) is marketing. It can be useful in a procurement pack. It is not information.

What September was actually worth

Strip out the vendor's own communications and the month comes down to a dependency patch, two uSync releases and a price list. The AI story was real, and it was plumbing: a repository moving into an official namespace, an environment-variable scheme for scoping tools, a proof of concept against Engage.

The ratio is the uncomfortable part. Three posts about AI tooling, one piece of production risk, and that risk arrived through a transitive minification library almost nobody thinks about, which is where risk normally lives. If your picture of this ecosystem comes mostly from umbraco.com, you are reading a communications calendar and calling it a technology.

One caveat on the 55%. This is a backfilled month, reached through feed archives rather than harvested live, so the sample is thinner than a current month and skews toward sources with durable feeds — vendor blogs and GitHub releases, precisely. The concentration is real and it is also partly an artefact of how we got here.

Sources

umbraco · umbraco-cms · umbraco-cloud · product · community · release · sitecore-search · ai

2026 © Umbracolombia - All rights reserved.