16.0.7-alpha0003 (released)

[jcdc-bot]

Snyk has created this PR to upgrade @umbraco-cms/backoffice from 16.3.3 to 16.4.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 4 versions ahead of your current version.

• The recommended version was released a month ago.

Release notes

Package name: @umbraco-cms/backoffice

• 16.4.0 - 2025-11-26
  

  What's Changed Since 16.4.0-rc2

  🐛 Bug Fixes

  • Block Editors: avoid discard changes for no changes (Fixes #20680) by @ nielslyngsoe in #20941
  • Localization: Restores region-specific cultures (#20939) by @ iOvergaard in #20942

  Full Changelog: release-16.4.0-rc2...release-16.4.0

  Changes in 16.4.0-rc2 Since 16.4.0-rc

  🙌 Notable Changes

  • Backoffice Login: Move access/refresh tokens to secure cookies by @ kjac in #20779
  • Backoffice Login: Redact back-office PKCE codes from the server (V16) by @ kjac in #20851
    As an added security feature used by default in Umbraco 17, user authentication tokens can be returned in secure cookies from the server's authentication requests. For backwards compatibility reasons, the feature is disabled by default, but can be enabled via the boolean configuration at Umbraco:Cms:Security:BackOfficeTokenCookie:Enabled. Read more in the Umbraco documentation.

  Full Changelog: release-16.4.0-rc...release-16.4.0-rc2

  Changes in in 16.4.0-rc

  📦 Dependencies

  • Bump tar-fs from 3.1.0 to 3.1.1 in /src/Umbraco.Web.UI.Client by @ dependabot[bot] in #20260
  • Dependencies: Updates all npm dependencies for Client, Login, and UmbracoExtension by @ iOvergaard in #20386
  • build(deps): bumps @ umbraco-ui/uui from 1.15.0 to 1.16.0-rc.0 by @ iOvergaard in #20402
  • Dependencies: Fixed dependency conflicts when installing Microsoft.EntityFrameworkCore.Design (closes #20421) by @ lauraneto in #20474
  • build(deps): bumps @ umbraco-ui/uui from 1.16.0-rc.0 to 1.16.0 by @ iOvergaard in #20535
  • Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Client by @ dependabot[bot] in #20580
  • Bump vite from 7.1.9 to 7.1.11 in /src/Umbraco.Web.UI.Login by @ dependabot[bot] in #20621
  • Dependencies: Update dotnet sdk and node development dependency to latest secure version of current major (16) by @ AndyButland in #20734

  🌈 Accessibility Improvements

  • Login form: Improves accessibility by removing duplicate label and aria-label by @ MrHutmat in #20232
  • Add accessibility label for splitview divider by @ OskarKruger in #20380
  • Announce newest notification using live region by @ engijlr in #19979
  • Entity Actions: Create button discernible text (fixes #20205) by @ OskarKruger in #20434
  • Entity Actions: More create button discernible text, extension of #20434 by @ OskarKruger in #20458

  🚀 New Features

  • Add more icons correct Content Type Designer Icons by @ nielslyngsoe in #20252
  • Segments: Auto unfold the culture variant in non-culture-variant mode by @ nielslyngsoe in #20189
  • Loader bar: Implement loader for Content Workspaces by @ nielslyngsoe in #20288
  • Segments: Adds deprecation notices to AllowNonExistingSegmentsCreation by @ iOvergaard in #20413
  • Backoffice: Add Entity Signs (overlay icons) to tree items. by @ engijlr in #20328
  • Permissions: Added User fallback permission condition (closes #20097) by @ madsrasmussen in #20224

  🚤 Performance

  • Performance: Added request cache to media type retrieval in media picker validation by @ AndyButland in #20405
  • Performance: Reduce number of database calls in save and publish operations by @ AndyButland in #20485
  • Performance: Request cache referenced entities when saving documents with block editors by @ kjac in #20590

  🐛 Bug Fixes

  • Tiptap: QA Added acceptance tests for regression issue #19763 by @ andr317c in #20226
  • UX: Make approved colour picker remove button consistent with other multi value item remove buttons by @ bjarnef in #20257
  • Update Readme to signpost the Forum by @ OwainWilliams in #20268
  • QA Skip the known failing smoke test to avoid blocking other PRs by @ nhudinh0309 in #20269
  • UX: Add slightly more padding at top so user card outline is not cutoff by @ bjarnef in #20258
  • NuGet vulnerability warnings: Warn in non-Release mode, Error in non-Release mode by @ emmagarland in #17244
  • AllowEditInvariantFromNonDefault : Fix property write guard to use correct variant ID (closes #20250) by @ madsrasmussen in #20277
  • Layout header top custom property by @ floede in #20080
  • Micro-optimization: Move compilation of some Regex generation to compile time instead of runtime, make some static ones compiled by @ Henr1k80 in #20287
  • E2E nightly pipeline: QA Fix failing acceptance tests for invalid cases by @ nhudinh0309 in #20289
  • Media Workspace Path: add parent path to support absolute path generation by @ nielslyngsoe in #20302
  • Models: PropertyType constructor sets the DataTypeKey if IDataType has identity by @ psot in #20301
  • Log Viewer: Fixes continuous polling (closes #20274) by @ leekelleher in #20310
  • Localization: Fixed message in block group delete confirm modal (closes #20308) by @ bjarnef in #20312
  • Migrations: Create missing tabs on content types when referenced by both composition and content type groups (closes #20058) by @ lauraneto in #20303
  • Extend logging (add delay and period) by @ erikjanwestendorp in #20333
  • UX: Removed the dot "." in front of the jpg file extension example by @ andersreus in #20334
  • Refactoring: Add extension method for retrieval of language ISO codes if that's all we need by @ AndyButland in #20324
  • Media: Prevent svg image to extend outside the editor bounds by @ ardelean94 in #20346
  • Exception handling: Improve error messaging on invalid umbraco-package.json file by @ AndyButland in #20332
  • Handle vary by segment variant-entires by @ nielslyngsoe in #20191
  • Data Type: Improve missing property editor and property editor UI feedback by @ lauraneto in #20339
  • Caching: Fixes regression of the caching of null representations for missing dictionary items (closes #20336 for 16) by @ AndyButland in #20349
  • Switch container to use SQL 2022 instead of SQL Edge by @ CarlSargunar in #17262
  • Color Picker: Set initial hex value for picker (closes #20326) by @ bjarnef in #20357
  • Color Picker: Styling for drag handle at swatch items by @ bjarnef in #20360
  • Localization: Added translations for area validation property labels by @ bjarnef in #20362
  • E2E Pipeline: QA Remove continue on error condition by @ andr317c in #20365
  • Change to layout of default Content area dashboard by @ dalyUSN in #20355
  • Block Grid: Add icon to allowed block types in area by @ bjarnef in #20364
  • Management API: Use EndpointMetadata to check for MapToApiAttribute at runtime to include Controller in Swagger document by @ mdubbelv in #20144
  • Block Grid: Add more spacing in combobox group header by @ bjarnef in #20373
  • Block Grid: Add a bit more spacing and align button in block grid areas config by @ bjarnef in #20374
  • Slider: improved value fallback handling + validation by @ nielslyngsoe in #20228
  • Entity-Action Bundle: Ensure First Action are updated in rendering by @ nielslyngsoe in #20351
  • Extension Registry: QA Added acceptance tests for readOnlyGuards rule, entity action and custom property editor by @ nhudinh0309 in #19939
  • Content: QA Add acceptance tests for regression issue #17735 by @ nhudinh0309 in #20330
  • Value Presets: also run value presets on load by @ nielslyngsoe in #20239
  • Block Grid: Configure minimum one column for areas by @ bjarnef in #20363
  • Block Grid: Styling of group drag with handle by @ bjarnef in #20361
  • Delivery API: QA Add acceptance test for media delivery api by @ nhudinh0309 in #20182
  • User Profile: QA Add acceptance tests for the regression issue #18084 by @ nhudinh0309 in #20329
  • UFM: Fixes the truncate filter to only add ellipsis when text is actually truncated (closes #20395) by @ Copilot in #20396
  • Repositories: Retrieve users for groups in batches to fix UserService.GetAllInGroup failing on too many users in a group by @ piers-taylor-1994 in #20298
  • Icon Picker: Deselect current icon & add “No icon” tile inside the modal. by @ engijlr in #20342
  • Validation context uncaught promise (closes #20035) by @ enkelmedia in #20036
  • Content Workspace: Invariant Breadcrumbs does not work (fix #20423) by @ nielslyngsoe in #20428
  • Adjust styling for inherited content type property by @ bjarnef in #20261
  • Block Workspace: dynamic headline & browser title by @ nielslyngsoe in #20424
  • Content Type Designer: Fix moving a group to an inherited tab by @ nielslyngsoe in #20138
  • Migrations: Adjust the JsonBlockValueConverter to handle conflicts with 'values' property by @ lauraneto in #20429
  • Color Picker: Validate uniqueness of selected colors by @ Programeerik in #20431
  • Emails: Add Expires header by @ rickbutterfield in #20285
  • Members: Forward port of fix for member lockout issue #16988 from PR #17007 for...

[jcdc-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.