Sitecore

Sitecore 10.5 Whats new?

Balaji Kandasamy

• 5 min read
Share
Sitecore 10.5 Whats new?

Sitecore 10.5 shipped on August 5, 2026, with new XM and XP builds. Spent some time going through the release notes, the breaking changes page and the compatibility tables to figure out what actually matters if you're planning an upgrade.

Short version: this isn't a features release. It's an infrastructure and security release with a new UI.

The New look

Open the Content Editor and the black-and-red chrome that's been there since early days of Sitecore is gone. More modern UI with flat colrs like purple accent. If you've spent any time in SitecoreAI (XM Cloud), you'll recognize it immediately Sitecore is moving toward one design language the Blok https://blok.sitecore.com/across the whole product line, cloud or on-prem.

What's actually in 10.5

Four of the eight highlights in the release notes are infrastructure changes. I have summarized points from the release notes.

  • Platform support:
    • Windows Server 2025
    • SQL Server 2025
    • Solr 10 across on-prem, containers and AKS
  • Security hardening: Sitecore's mentioned "significant security hardening," and they name four specific fixes
    • pre-auth XAML cache poisoning,
    • a post-auth RCE chain,
    • SPEAK path traversal,
    • Hard-coded credentials removed.
    • 26 security references total in the notes.
  • 61 resolved issues documented in 10.5 alone, plus everything rolled up from the 10.3 and 10.4.
  • Performance fixes: cache eviction without global locks, batched Recycle Bin deletion, no more automatic Solr optimize after indexing.
  • Publishing fixes: the incremental publish race condition is gone, and live pages no longer get deleted when other languages have non-final workflow versions sitting around.
  • Identity Server 9 now ships as its own module. Deploys separately from the platform ARM templates in Azure, runs on .NET 10, supports 10.3+, adds Entra ID for SQL auth.

If you were looking for new authoring, personalization or marketing features there isn't much here. This one's about getting the platform current and stable.

Requirements

  • Windows Server 2022 or 2025
  • SQL Server 2022 or 2025
  • Solr 10.0.0 mandatory Basic Auth now, so connection strings carry embedded credentials
  • .NET Framework 4.8.1 for the platform (up from 4.8), Identity Server 9 on .NET 10
  • SIF 2.4.1, Installation Assistant 1.7.0-r13

Having both 2022 and 2025 supported for Windows/SQL gives some flexibility on sizing if you're still on 2019.

What got dropped

  • Solr 8 and 9 unsupported, Solr 10 only, and the schema field types changed
  • SQL Server 2019 removed
  • Windows Server 2019 container images gone, LTSC2022/2025 only now
  • GraphQL Playground removed, use Postman/Insomnia/GraphiQL instead
  • Package Installer and Package Designer disabled by default

The Package Installer thing is worth flagging

Sitecore.Packages.Disabled now defaults to true on XP. It used to default to false. Turn it back on, deploy the patch file that ships with the install:

App_Config/Include/zSitecore.InstallPackage.Enable.config

That sets Sitecore.Packages.Disabled back to false. Given there are real exploits around uploading executable code through the installer, disabling it by default is the right thing but your instance is in private network like most of us then this should be fine.

Breaking changes

Sitecore documents sixteen. A handful can actually stop a build; most are config, infra or runtime behavior changes you'll just need to account for.

The ones worth double-checking against your solution:

  • Solr 10 upgrade SolrV8SchemaPopulate and SolrV9SchemaPopulate are gone, replaced by a single SchemaPopulateHelper. No back-compat path. managed-schema is renamed to managed-schema.xml if you've got deployment scripts copying that file by name, they'll break.
  • Telerik UI for ASP.NET AJAX bumped from 2020.3 to 2025.2. New NuGet package identities, a licensing runtime assembly in bin, and Sitecore.Kernel no longer references Telerik at all.
  • BinaryFormatter replaced with JSON. ObjectToBase64 and Base64ToHashtable now return null. FileUtil.LoadObject/SaveObject are deprecated. Scoped to package user accounts, serialized users, ClientData.
  • Computed index fields now preserve the calling thread's site context and security state. If you've got a custom IComputedIndexField relying on security being disabled during indexing, expect different behavior.
  • MVC rendering profiling RenderPlaceholder and RenderRendering profiling processors are disabled on CD servers. You get throughput back, but anything reading those stats in production stops reporting.
  • Toggle duplicate name checking on publish on by default now. Items that would create duplicate siblings get skipped at publish time.
  • Application Insights an instrumentation key alone isn't enough anymore, needs a full connection string.

There are a few more (Item Service Search API, device detection profile defaults, security DB schema tied to Identity Server 8, legacy JS/CSS library removal, messaging DB connectivity changes) worth a full pass against the official breaking changes page before you commit to a date.

Modules aren't upgraded yet

As of release, these are still going through 10.5 compatibility verification:

  • Stream
  • Security database scripts
  • SXA
  • Codeless Schema Extensions
  • Azure Blob Storage
  • Publishing Service Module
  • Sitecore Headless Rendering
  • Sitecore Connect for Content Hub

Sitecore's guidance is "before end of September," rolling through the quarter no firm dates. If your upgrade depends on any of these, plan for late September/October, not day one. Didn't find explicit 10.5 listings yet for Sitecore CLI or Management Services either; they're generally cross-compatible across 10.x, but I'd still test rather than assume.

Check the module compatibility table before you set a date.

Support lifecycle

  • Mainstream: through Dec 31, 2029
  • Extended: through Dec 31, 2032
  • Sustaining: through Dec 31, 2034

Same pattern as always mainstream through the third calendar year, +3 extended, +2 sustaining.

Also worth knowing: since June 1, production incident support and security updates in Extended Support are paid, not included. If you're on 10.2/10.3, that's you now. And Dec 31, 2026 is when 10.0 and 10.1 fall out of Extended entirely.

Should you upgrade?

  • On 10.4 no rush, mainstream through Dec 2027. Wait for the modules you need, then move.
  • On 10.3 - mainstream already ended (Dec 2025), you're paying for Extended support now. 10.5 is the clean way back into mainstream, once the security DB scripts are released.
  • On 10.2 or earlier - yes, get moving. 10.1 drops out of Extended at the end of 2026. If you're on 9.x you're already unpatched. Good news: you can jump straight from 10.2 to 10.5 without stepping through 10.3/10.4 one project instead of three.
  • Migrating to SitecoreAI within 12 months - skip the interim upgrade, that's money spent twice. Further out than 18 months, you still need to be on a supported platform in the meantime.

On new features, 10.5 is a quiet release. On security debt, it's the longest support runway you'll get right now.