Flamingo Marine is a startup that designs and builds modern electric boats. They needed a new website that was both easy to update and flexible in layout. To make that happen, they chose Orchard Core as the CMS and brought us in to build a modular, widget-based solution.

How do you manage a musical archive with 75,000+ tracks, complex metadata, and a mission to keep every recording available forever? For Smithsonian Folkways, the answer began over a decade ago with Orchard 1.x, and today runs on a fully customized Orchard Core platform.

Orchard Core updatesWarn against unsafe Liquid output in SQL queriesA SQL query is actually a Liquid template. This allows your queries to be shaped based on the parameters it gets. But you could srew up with SQL and Liquid if you start by injecting Liquid in a value, as you can see below. Because in that case, you can inject any SQL and expose all your databases. So, do not inject user-provided values directly with Liquid output expressions, as this can lead to SQL injection.

Orchard Core updatesIndependent Render Liquid and Sanitize HTML settings for HTML and Markdown componentsThe current SanitizeHtml settings' hint could be a little bit misleading, and enabling or disabling it causes potentially unwanted behavior because the hint only refers to preventing custom scripts, which is true, but it does much more by default. This, in itself, is trivial to fix. However, the SanitizeHtml setting also governs whether Liquid markup is rendered. If SanitizeHtml is false, that means Liquid is rendered. This prevents a simple use case where (script) sanitization is desired, but Liquid should still be rendered.

Orchard Core updatesNew OrchardCore.ContentFields.Core moduleEvery time you want to use any content field, for example, creating your own migrations, you have to reference the OrchardCore.ContentFields project. But it's unnecessary because in this case, you don't really need anything more than the class derived from ContentField and the corresponding settings.

The DotNest homepage was starting to show its age. Not just visually, but also in day-to-day site management UX. So we took a step back and rebuilt the frontend from the ground up.

Orchard Core updatesRemove implicit CancelAsync from ValidateAsyncThis change means the code won't cancel the current session if an issue occurs during validation in the DefaultContentManager.ValidateAsync() method. It's up to the caller of the validation, because this can discard unrelated pending changes from other components sharing the session.

From shock to acceptance — every developer goes through a grieving process when AI agents enter their workflow. Here are the 7 stages, what you gain, what you risk losing, and what remains irreplaceable.