Having created my first umbraco package 📦 - it dawned on me how easy it would be to exploit vulnerabilities. Is there any form of security checks on packages before they are put in the marketplace? Or maybe a disclaimer is required, or that codebase should be made public?

Not that I am aware off. It is indeed something that people could easily abuse currently

There are free security scan things from GitHub that you can install to your repo that scans and checks for vulnerabilities. GitHub also can verify your releases for you

I’m thinking more malicious stuff. Like using the content service to delete ya home-node. I guess it’s a a general flaw with all nuget packages. You just never know what to trust.

No currently there is no check. But most packages are open source ofcourse. I think that so far Umbraco was pretty niche and we'd be happy with any package in the marketplace at all. But especially with AI now, we might come to a point where we need more security. Maybe you should need an account for the marketplace to post. Or we should scan for malware by default. I don't know yet what I feel is appropriate.

Hey folks, figured i've link to the Alt Text Support thread as I've just added an update, in case anyone is interested 🙂 https://discord.com/channels/869656431308189746/1493169827647459449

Hello, I would like to ask here, as no documentation for Umbraco 18 is uploaded yet. I would like to create elements programmatically in the new Library section, including folder structure. I saw that there are multiple services available: IElementEditingService, IElementContainerService, IElementPublishingService, and ElementService. At the moment, I am having problems with caching — specifically, elements created via IElementEditingService and then published via IElementPublishingService aren't found in the same session by IElementNavigationQueryService. What I'm wondering is: what is the planned/best-practice approach for querying and creating elements in the new Library section?

Hi folks, I'm after a bit of architecture advice. We've built a portal on V17, that is also used as an IOT device hub, so we have 1 section serving up pages as per a normal website, but we also have a hub section that holds all the Device Families & Devices. Over the top of this is an API that can be called to get Device Families / Lists of Devices etc. We are now expanding the API so that it can be called from different "providers", and we want to limit what Device Families can be returned to each "provider". Now I could just add a property (say Allowed Provider) to each Device Family to say which provider it should show for. BUT some of the properties on each Device Family could also change per provider. A bit like when you publish in a different language variant, you can change properties per langauge. Any ideas how we might achieve this? https://cdn.discordapp.com/attachments/1443515195891646537/1522197330982338600/Screenshot_2026-07-02_at_12.01.26.png?ex=6a47983c&is=6a4646bc&hm=9a446a7a8717af2bad90f43a83f4f64668cfdfbe4bc02e005a87fa4d62ef750a&

Umbraco also support segments. It's exactly like language variants (they are also just a specific type of segment). Maybe that's useful to you. https://kjac.dev/posts/umbraco-16-brings-back-segments/

Thanks @Luuk Peters (Proud Nerds) I was looking at segments yesterday, but we don't need all the "extras" of Engage. I'll give this a go later

I was playing around with Segments last night, and I think it might do want we want. Is there a way to know what segments have been created/published for a node?

I honestly haven't worked with segments myself, so I don't know they manifest in the UI 😄

You can use segmentation without engage I know @Matt Bliss might have some thoughts but getting his time is always the trick

I’ve don’t bits and bobs with it but not had a real world chance to experiment and play with it so that learning is directly part of what I know

is there any umbraco mcp available?

Yes - https://docs.umbraco.com/umbraco-in-ai/mcp/cms-developer-mcp

Also there is a post on linked in today by the wonderful @Sotiris Filippidis on a dot see plugin that might help with your segmentation thingies ..

Thanks for the mention @Ravi - not sure how Discipline could help our friend here though. He's looking for something very specific.

Maybe go down the classic route? Meaning providers could not be a field, but compositions? The "generic" composition could be including all common properties, while provider-specific compositions (one per provider) could contain the extra fields. You could identify the provider based on the composition. Not exactly super straightforward, but just a thought.

well you have a little bit more than me .. just trying to get ppeople to connect etc

Hey @Ian Houghton, my use case was different, but I’d be happy to share in a call next week if that would be helpful

Wondering if anyone can give me some guidance. So our company uses Umbraco for e-commerce. So we get a lot of order confirmations through email and we have to continously manually submit them to sage. Is there any way of linking the 2 together so that it's automatically generating the sales invoices? Completely new to Umbraco myself. my dev team have used it for 3 years but are stumpted and potentiall reluctant to gander at this because of how busy they are. i just wondered if anyone knew if it could be connected or not. Thanks

Hands up if you think the "Redirect Management" should be in "Settings" and not "Content" ?

Yo here! If there is anyone who has v13 -> v17 upgrade ahead for the upcoming times and wants to help me and get some help with it - let me know. I did utilise some of my spare time recently to combine 15+ years of my Umbraco experience with healthchecks, solutions, these good and bad ones - and built an MCP with a set of service checks for the solution to streamline the upgrade process a little bit. Both with and/or without LLM involved. Some more details I dropped here: https://www.linkedin.com/feed/update/urn:li:activity:7483152226157445121/ - generally looking for some "independent" (not mine and my ex-employees) company projects to prove the point of turning it into a little bit more structured offering. If anyone wants to help - you know where to find me 🙂 🫡

Any reason that OpenIddict logging isn't set to "Warning" by default Umbraco installs? when running locally (and on a server i don't know). you just get a load of junk in the logs about tokens etc, that 99% of the time you don't need to know anything about.

Just wanted to ask here to make sure I'm not missing something and I launch into a cache rabbit hole... We have a v13 solution that uses redis for caching product info from shopify. We are just going through an upgrade to v17 and have discovered this has meant that the umbraco cache switched over to use redis too. I presume there's no setting available to change this as we just want to use the standard in memory cache whilst retaining distributed cache for products?

Hey @.leo please post looking for work only in the #887257473336107018 channel

Just a random one - anyone seeing malformed urls (arabic / hebrew / unicode) in Azure self hosted webapps suddenly? https://forum.umbraco.com/t/azure-webapp-arabic-unicode-urls-becoming-malformed-on-response-redirect/8390

Q; in git hub we have a way to report bugs and issues , and feature requests .. / Is there an obvious way place to report things that don’t fall into one of those category.. ?

what's up with forums, lots of old posts getting redirected to the forum's front page?