Fix pagination in Content Delivery API Index Helper (#19606 )

* Refactor descendant enumeration in DeliveryApiContentIndexHelper Improved loop condition to allow for processing of more than 10.000 descendants for indexing. * Add failing test for original issue. * Renamed variable for clarity. --------- Co-authored-by: Brynjar Þorsteinsson <brynjar@vettvangur.is> Co-authored-by: Andy Butland <abutland73@gmail.com>
Preserve word boundaries when indexing RTE content with <br> tags (#19540 )
2025-07-01 08:11:00 +02:00 · 2025-06-23 09:34:51 +00:00 · 2025-06-13 07:20:11 +02:00 · 2025-06-13 07:15:19 +02:00 · 2025-06-10 09:56:08 +02:00 · 2025-06-10 08:19:52 +02:00
268 changed files with 18659 additions and 3867 deletions
@@ -35,7 +35,7 @@
    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
  </PropertyGroup>

-  <!-- Calculate version only once for the whole repository -->
+  <!-- Calculate version only once for the whole repository --> 
  <PropertyGroup>
    <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
  </PropertyGroup>
@@ -12,28 +12,28 @@
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.11" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.8" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.11" />
    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
-    <PackageVersion Include="System.Runtime.Caching" Version="8.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="8.0.1" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
@@ -45,13 +45,13 @@
    <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.1" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.3.0" />
-    <PackageVersion Include="Examine.Core" Version="3.3.0" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.11.64" />
+    <PackageVersion Include="Examine" Version="3.7.1" />
+    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.71" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.7.1.1" />
+    <PackageVersion Include="MailKit" Version="4.8.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="2.5.187" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
    <PackageVersion Include="ncrontab" Version="3.3.3" />
@@ -62,37 +62,42 @@
    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
    <PackageVersion Include="Serilog" Version="3.1.1" />
-    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.2" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="3.1.0" />
    <PackageVersion Include="Serilog.Expressions" Version="4.0.0" />
    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact" Version="2.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="3.0.0" />
-    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.2" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
    <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
    <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
    <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.5" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" />
    <PackageVersion Include="Smidge.InMemory" Version="4.4.0" />
-    <PackageVersion Include="Smidge.Nuglify" Version="4.4.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.7.1" />
+    <PackageVersion Include="Smidge.Nuglify" Version="4.5.1" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.9.0" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Azure.Identity" Version="1.12.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.13.1" />
    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.1" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.2" />
    <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
-
+    <!-- Examine.Lucene bring in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
    <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
  </ItemGroup>
 </Project>
@@ -71,8 +71,12 @@ stages:
      - job: A
        displayName: Build Umbraco CMS
        pool:
-          vmImage: 'ubuntu-latest'
+          vmImage: 'windows-latest'
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 500
          - task: NodeTool@0
            displayName: Use Node.js $(nodeVersion)
            retryCountOnTaskFailure: 3
@@ -198,6 +202,11 @@ stages:
        pool:
          vmImage: 'ubuntu-latest'
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
          - task: NodeTool@0
            displayName: Use Node.js 10.15.x
            retryCountOnTaskFailure: 3
@@ -249,6 +258,11 @@ stages:
        pool:
          vmImage: $(vmImage)
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
          - task: DownloadPipelineArtifact@2
            displayName: Download build artifacts
            inputs:
@@ -288,6 +302,11 @@ stages:
        variables:
          Tests__Database__DatabaseType: 'Sqlite'
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
          # Setup test environment
          - task: DownloadPipelineArtifact@2
            displayName: Download build artifacts
@@ -319,7 +338,9 @@ stages:
      # Integration Tests (SQL Server)
      - job:
        timeoutInMinutes: 120
-        condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerIntegrationTests}})
+        # We are currently encountering issues when running SQL Server Linux tests Microsoft.Data.SqlClient.SqlException (0x80131904)
+        # condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerIntegrationTests}})
+        condition: eq(${{parameters.sqlServerIntegrationTests}}, True)
        displayName: Integration Tests (SQL Server)
        strategy:
          matrix:
@@ -415,10 +436,24 @@ stages:
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
        strategy:
          matrix:
-            Linux:
-              vmImage: 'ubuntu-latest'
-            Windows:
-              vmImage: 'windows-latest'
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=3/3"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
@@ -496,12 +531,12 @@ stages:
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Test
-          - pwsh: npm run test --ignore-certificate-errors
+          - pwsh: $(testCommand)
            displayName: Run Playwright tests
            continueOnError: true
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
@@ -522,18 +557,28 @@ stages:
          # Copy artifacts
          - pwsh: |
              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
              }
            displayName: Copy Playwright results
            condition: succeededOrFailed()

-          # Publish
+          # Publish test artifacts
          - task: PublishPipelineArtifact@1
            displayName: Publish test artifacts
            condition: succeededOrFailed()
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"

      - job:
        displayName: E2E Tests (SQL Server)
@@ -544,12 +589,30 @@ stages:
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
        strategy:
          matrix:
-            Linux:
-              vmImage: 'ubuntu-latest'
+            LinuxPart1Of3:
+              testCommand: "npm run testSqlite -- --shard=1/3"
+              vmImage: "ubuntu-latest"
              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              CONNECTIONSTRINGS__UMBRACODBDSN: 'Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True'
-            Windows:
-              vmImage: 'windows-latest'
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart2Of3:
+              testCommand: "npm run testSqlite -- --shard=2/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart3Of3:
+              testCommand: "npm run testSqlite -- --shard=3/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
@@ -635,14 +698,13 @@ stages:
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Test
-          - pwsh: npm run test --ignore-certificate-errors
+          - pwsh: $(testCommand)
            displayName: Run Playwright tests
-            continueOnError: true
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
            env:
              CI: true
@@ -670,18 +732,28 @@ stages:
          # Copy artifacts
          - pwsh: |
              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
              }
            displayName: Copy Playwright results
            condition: succeededOrFailed()

-          # Publish
+          # Publish test artifacts
          - task: PublishPipelineArtifact@1
            displayName: Publish test artifacts
            condition: succeededOrFailed()
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"

  ###############################################
  ## Release
@@ -695,6 +767,8 @@ stages:
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.myGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to pre-release feed
        steps:
          - checkout: none
@@ -721,6 +795,8 @@ stages:
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to NuGet
        steps:
          - checkout: none
@@ -40,7 +40,9 @@ public static class UmbracoBuilderAuthExtensions
                    .SetLogoutEndpointUris(
                        Paths.MemberApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
                    .SetRevocationEndpointUris(
-                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));
+                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetUserinfoEndpointUris(
+                        Paths.MemberApi.UserinfoEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));

                // Enable authorization code flow with PKCE
                options
@@ -52,7 +54,8 @@ public static class UmbracoBuilderAuthExtensions
                options
                    .UseAspNetCore()
                    .EnableAuthorizationEndpointPassthrough()
-                    .EnableLogoutEndpointPassthrough();
+                    .EnableLogoutEndpointPassthrough()
+                    .EnableUserinfoEndpointPassthrough();

                // Enable reference tokens
                // - see https://documentation.openiddict.com/configuration/token-storage.html
@@ -14,6 +14,8 @@ public static class Paths

        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");

+        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
+
        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
        private static string EndpointPath(string relativePath) => $"/umbraco/delivery/api/v1/{relativePath}";
    }
@@ -145,6 +145,11 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
        path = DecodePath(path);
        path = path.Length == 0 ? "/" : path;

+        if (_apiContentPathResolver.IsResolvablePath(path) is false)
+        {
+            return NotFound();
+        }
+
        IPublishedContent? contentItem = GetContent(path);
        if (contentItem is not null)
        {
@@ -15,6 +15,7 @@ namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 [ApiExplorerSettings(GroupName = "Content")]
 [LocalizeFromAcceptLanguageHeader]
 [ValidateStartItem]
+[AddVaryHeader]
 [OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.ContentCachePolicy)]
 public abstract class ContentApiControllerBase : DeliveryApiControllerBase
 {
@@ -0,0 +1,28 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OpenIddict.Server.AspNetCore;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Security;
+
+[ApiVersion("1.0")]
+[ApiController]
+[VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
+[ApiExplorerSettings(IgnoreApi = true)]
+[Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
+public class CurrentMemberController : DeliveryApiControllerBase
+{
+    private readonly ICurrentMemberClaimsProvider _currentMemberClaimsProvider;
+
+    public CurrentMemberController(ICurrentMemberClaimsProvider currentMemberClaimsProvider)
+        => _currentMemberClaimsProvider = currentMemberClaimsProvider;
+
+    [HttpGet("userinfo")]
+    public async Task<IActionResult> Userinfo()
+    {
+        Dictionary<string, object> claims = await _currentMemberClaimsProvider.GetClaimsAsync();
+        return Ok(claims);
+    }
+}
@@ -60,6 +60,7 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IApiMediaQueryService, ApiMediaQueryService>();
        builder.Services.AddTransient<IMemberApplicationManager, MemberApplicationManager>();
        builder.Services.AddTransient<IRequestMemberAccessService, RequestMemberAccessService>();
+        builder.Services.AddTransient<ICurrentMemberClaimsProvider, CurrentMemberClaimsProvider>();

        builder.Services.ConfigureOptions<ConfigureUmbracoDeliveryApiSwaggerGenOptions>();
        builder.AddUmbracoApiOpenApiUI();
@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+public sealed class AddVaryHeaderAttribute : ActionFilterAttribute
+{
+    private const string Vary = "Accept-Language, Preview, Start-Item";
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+        => context.HttpContext.Response.Headers.Vary = context.HttpContext.Response.Headers.Vary.Count > 0
+            ? $"{context.HttpContext.Response.Headers.Vary}, {Vary}"
+            : Vary;
+}
@@ -1,6 +1,5 @@
 using Umbraco.Cms.Api.Delivery.Indexing.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Querying.Filters;

@@ -15,15 +14,15 @@ public sealed class ContentTypeFilter : IFilterHandler
    /// <inheritdoc/>
    public FilterOption BuildFilterOption(string filter)
    {
-        var alias = filter.Substring(ContentTypeSpecifier.Length);
+        var filterValue = filter.Substring(ContentTypeSpecifier.Length);
+        var negate = filterValue.StartsWith('!');
+        var aliases = filterValue.TrimStart('!').Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);

        return new FilterOption
        {
            FieldName = ContentTypeFilterIndexer.FieldName,
-            Values = alias.IsNullOrWhiteSpace() == false
-                ? new[] { alias.TrimStart('!') }
-                : Array.Empty<string>(),
-            Operator = alias.StartsWith('!')
+            Values = aliases,
+            Operator = negate
                ? FilterOperation.IsNot
                : FilterOperation.Is
        };
@@ -1,5 +1,7 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;
@@ -10,10 +12,21 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
 {
    private const string AncestorsSpecifier = "ancestors:";
    private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
+    private readonly IRequestPreviewService _requestPreviewService;

-    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService)
-        : base(publishedSnapshotAccessor, requestRoutingService) =>
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor,
+        IRequestRoutingService requestRoutingService)
+        : this(publishedSnapshotAccessor, requestRoutingService, StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>())
+    {
+    }
+
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService, IRequestPreviewService requestPreviewService)
+        : base(publishedSnapshotAccessor, requestRoutingService)
+    {
        _publishedSnapshotAccessor = publishedSnapshotAccessor;
+        _requestPreviewService = requestPreviewService;
+    }

    /// <inheritdoc />
    public bool CanHandle(string query)
@@ -37,10 +50,20 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
            };
        }

-        IPublishedSnapshot publishedSnapshot = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot();
+        IPublishedContentCache contentCache = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot()?.Content
+                                         ?? throw new InvalidOperationException("Could not obtain the content cache");

-        IPublishedContent contentItem = publishedSnapshot.Content?.GetById((Guid)id)
-                                        ?? throw new InvalidOperationException("Could not obtain the content cache");
+        IPublishedContent? contentItem = contentCache.GetById(_requestPreviewService.IsPreview(), id.Value);
+
+        if (contentItem is null)
+        {
+            // no such content item, make sure the selector does not yield any results
+            return new SelectorOption
+            {
+                FieldName = AncestorsSelectorIndexer.FieldName,
+                Values = Array.Empty<string>()
+            };
+        }

        var ancestorKeys = contentItem.Ancestors().Select(a => a.Key.ToString("D")).ToArray();

@@ -0,0 +1,44 @@
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+// NOTE: this is public and unsealed to allow overriding the default claims with minimal effort.
+public class CurrentMemberClaimsProvider : ICurrentMemberClaimsProvider
+{
+    private readonly IMemberManager _memberManager;
+
+    public CurrentMemberClaimsProvider(IMemberManager memberManager)
+        => _memberManager = memberManager;
+
+    public virtual async Task<Dictionary<string, object>> GetClaimsAsync()
+    {
+        MemberIdentityUser? memberIdentityUser = await _memberManager.GetCurrentMemberAsync();
+        return memberIdentityUser is not null
+            ? await GetClaimsForMemberIdentityAsync(memberIdentityUser)
+            : throw new InvalidOperationException("Could not retrieve the current member. This method should only ever be invoked when a member has been authorized.");
+    }
+
+    protected virtual async Task<Dictionary<string, object>> GetClaimsForMemberIdentityAsync(MemberIdentityUser memberIdentityUser)
+    {
+        var claims = new Dictionary<string, object>
+        {
+            [OpenIddictConstants.Claims.Subject] = memberIdentityUser.Key
+        };
+
+        if (memberIdentityUser.Name is not null)
+        {
+            claims[OpenIddictConstants.Claims.Name] = memberIdentityUser.Name;
+        }
+
+        if (memberIdentityUser.Email is not null)
+        {
+            claims[OpenIddictConstants.Claims.Email] = memberIdentityUser.Email;
+        }
+
+        claims[OpenIddictConstants.Claims.Role] = await _memberManager.GetRolesAsync(memberIdentityUser);
+
+        return claims;
+    }
+}
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Services;
@@ -11,5 +11,5 @@ internal sealed class RequestPreviewService : RequestHeaderHandler, IRequestPrev
    }

    /// <inheritdoc />
-    public bool IsPreview() => GetHeaderValue("Preview") == "true";
+    public bool IsPreview() => string.Equals(GetHeaderValue("Preview"), "true", StringComparison.OrdinalIgnoreCase);
 }
@@ -42,31 +42,42 @@ internal sealed class RequestRedirectService : RoutingServiceBase, IRequestRedir
    {
        requestedPath = requestedPath.EnsureStartsWith("/");

+        IPublishedContent? startItem = GetStartItem();
+
        // must append the root content url segment if it is not hidden by config, because
        // the URL tracking is based on the actual URL, including the root content url segment
-        if (_globalSettings.HideTopLevelNodeFromPath == false)
+        if (_globalSettings.HideTopLevelNodeFromPath == false && startItem?.UrlSegment != null)
        {
-            IPublishedContent? startItem = GetStartItem();
-            if (startItem?.UrlSegment != null)
-            {
-                requestedPath = $"{startItem.UrlSegment.EnsureStartsWith("/")}{requestedPath}";
-            }
+            requestedPath = $"{startItem.UrlSegment.EnsureStartsWith("/")}{requestedPath}";
        }

        var culture = _requestCultureService.GetRequestedCulture();

-        // append the configured domain content ID to the path if we have a domain bound request,
-        // because URL tracking registers the tracked url like "{domain content ID}/{content path}"
-        Uri contentRoute = GetDefaultRequestUri(requestedPath);
-        DomainAndUri? domainAndUri = GetDomainAndUriForRoute(contentRoute);
-        if (domainAndUri != null)
+        // important: redirect URLs are always tracked without trailing slashes
+        requestedPath = requestedPath.TrimEnd("/");
+        IRedirectUrl? redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath, culture);
+
+        // if a redirect URL was not found, try by appending the start item ID because URL tracking might have tracked
+        // a redirect with "{root content ID}/{content path}"
+        if (redirectUrl is null && startItem is not null)
        {
-            requestedPath = GetContentRoute(domainAndUri, contentRoute);
-            culture ??= domainAndUri.Culture;
+            redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl($"{startItem.Id}{requestedPath}", culture);
+        }
+
+        // still no redirect URL found - try looking for a configured domain if we have a domain bound request,
+        // because URL tracking might have tracked a redirect with "{domain content ID}/{content path}"
+        if (redirectUrl is null)
+        {
+            Uri contentRoute = GetDefaultRequestUri(requestedPath);
+            DomainAndUri? domainAndUri = GetDomainAndUriForRoute(contentRoute);
+            if (domainAndUri is not null)
+            {
+                requestedPath = GetContentRoute(domainAndUri, contentRoute);
+                culture ??= domainAndUri.Culture;
+                redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath, culture);
+            }
        }

-        // important: redirect URLs are always tracked without trailing slashes
-        IRedirectUrl? redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath.TrimEnd("/"), culture);
        IPublishedContent? content = redirectUrl != null
            ? _apiPublishedContentCache.GetById(redirectUrl.ContentKey)
            : null;
@@ -36,7 +36,7 @@ internal abstract class RoutingServiceBase
    }

    protected static string GetContentRoute(DomainAndUri domainAndUri, Uri contentRoute)
-        => $"{domainAndUri.ContentId}{DomainUtilities.PathRelativeToDomain(domainAndUri.Uri, contentRoute.AbsolutePath)}";
+        => $"{domainAndUri.ContentId}{DomainUtilities.PathRelativeToDomain(domainAndUri.Uri, contentRoute.LocalPath)}"; // Use LocalPath over AbsolutePath to keep the path decoded.

    protected DomainAndUri? GetDomainAndUriForRoute(Uri contentUrl)
    {
@@ -13,6 +13,9 @@
    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
      <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>
    </AssemblyAttribute>
+    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
+      <_Parameter1>Umbraco.Tests.Integration</_Parameter1>
+    </AssemblyAttribute>
    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
      <_Parameter1>DynamicProxyGenAssembly2</_Parameter1>
    </AssemblyAttribute>
@@ -1,3 +1,4 @@
+using System.Globalization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Headers;
 using Microsoft.Extensions.Options;
@@ -48,16 +49,26 @@ public sealed class ConfigureImageSharpMiddlewareOptions : IConfigureOptions<Ima
                return Task.CompletedTask;
            }

-            int width = context.Parser.ParseValue<int>(context.Commands.GetValueOrDefault(ResizeWebProcessor.Width), context.Culture);
-            if (width <= 0 || width > _imagingSettings.Resize.MaxWidth)
+            if (context.Commands.Contains(ResizeWebProcessor.Width))
            {
-                context.Commands.Remove(ResizeWebProcessor.Width);
+                if (!int.TryParse(context.Commands.GetValueOrDefault(ResizeWebProcessor.Width), NumberStyles.Integer,
+                    CultureInfo.InvariantCulture, out var width)
+                || width < 0
+                || width >= _imagingSettings.Resize.MaxWidth)
+                {
+                    context.Commands.Remove(ResizeWebProcessor.Width);
+                }
            }

-            int height = context.Parser.ParseValue<int>(context.Commands.GetValueOrDefault(ResizeWebProcessor.Height), context.Culture);
-            if (height <= 0 || height > _imagingSettings.Resize.MaxHeight)
+            if (context.Commands.Contains(ResizeWebProcessor.Height))
            {
-                context.Commands.Remove(ResizeWebProcessor.Height);
+                if (!int.TryParse(context.Commands.GetValueOrDefault(ResizeWebProcessor.Height), NumberStyles.Integer,
+                    CultureInfo.InvariantCulture, out var height)
+                || height < 0
+                || height >= _imagingSettings.Resize.MaxHeight)
+                {
+                    context.Commands.Remove(ResizeWebProcessor.Height);
+                }
            }

            return Task.CompletedTask;
@@ -5,7 +5,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="SixLabors.ImageSharp" VersionOverride="[2.1.9, 3)" />
+    <PackageReference Include="SixLabors.ImageSharp" VersionOverride="[2.1.10, 3)" />
    <PackageReference Include="SixLabors.ImageSharp.Web" VersionOverride="[2.0.2, 3)" />
  </ItemGroup>

@@ -7,6 +7,11 @@
  <ItemGroup>
    <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
    <PackageReference Include="Azure.Identity" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageReference Include="System.Text.Json" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageReference Include="Microsoft.Data.SqlClient" />
+
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />

    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
@@ -170,7 +170,9 @@ internal class SqlServerEFCoreDistributedLockingMechanism<T> : IDistributedLocki
                        "A transaction with minimum ReadCommitted isolation level is required.");
                }

+#pragma warning disable EF1002
                var rowsAffected = await dbContext.Database.ExecuteSqlRawAsync(@$"SET LOCK_TIMEOUT {(int)_timeout.TotalMilliseconds};UPDATE umbracoLock WITH (REPEATABLEREAD) SET value = (CASE WHEN (value=1) THEN -1 ELSE 1 END) WHERE id={LockId}");
+#pragma warning restore EF1002

                if (rowsAffected == 0)
                {
@@ -10,6 +10,10 @@

    <!-- Take top-level depedendency on Microsoft.Extensions.Caching.Memory, because Microsoft.EntityFrameworkCore.* depends on a vulnerable version -->
    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageReference Include="System.Text.Json" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageReference Include="Microsoft.Data.SqlClient" />

    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
@@ -7,6 +7,11 @@
  <ItemGroup>
    <!-- Take top-level depedendency on Azure.Identity, because NPoco.SqlServer depends on a vulnerable version -->
    <PackageReference Include="Azure.Identity" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageReference Include="System.Text.Json" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageReference Include="Microsoft.Data.SqlClient" />
+
    <PackageReference Include="NPoco.SqlServer" />

    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
@@ -30,13 +30,13 @@
  </Target>

  <Target Name="BuildBelle">
-    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Client\" Command="npm ci --no-fund --no-audit --prefer-offline" />
-    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Client\" Command="npm run build:skip-tests" />
+    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Client\" Command="npm ci --no-fund --no-audit --prefer-offline" Timeout="600000" />
+    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Client\" Command="npm run build:skip-tests" Timeout="600000" />
  </Target>

  <Target Name="BuildLogin">
-    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Login\" Command="npm ci --no-fund --no-audit --prefer-offline" />
-    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Login\" Command="npm run build" />
+    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Login\" Command="npm ci --no-fund --no-audit --prefer-offline" Timeout="600000" />
+    <Exec WorkingDirectory="$(ProjectDir)..\Umbraco.Web.UI.Login\" Command="npm run build" Timeout="600000" />
  </Target>

  <Target Name="CleanStaticAssetsPreconditions" AfterTargets="Clean" Condition="'$(UmbracoBuild)' == ''">
@@ -40,7 +40,7 @@
  <!-- Generate JSON schema on build (and before copying to project) -->
  <Target Name="GenerateAppsettingsSchema" BeforeTargets="Build;CopyUmbracoJsonSchemaFiles" Condition="!Exists('$(_UmbracoCmsJsonSchemaReference)')">
    <Message Text="Generating $(_UmbracoCmsJsonSchemaReference) because it doesn't exist" Importance="high" />
-    <Exec WorkingDirectory="$(MSBuildThisFileDirectory)..\..\tools\Umbraco.JsonSchema" Command="dotnet run --configuration $(Configuration) -- --outputFile &quot;$(MSBuildThisFileDirectory)$(_UmbracoCmsJsonSchemaReference)&quot;" />
+    <Exec WorkingDirectory="$(MSBuildThisFileDirectory)..\..\tools\Umbraco.JsonSchema" Command="dotnet run --configuration $(Configuration) -- --outputFile &quot;$(MSBuildThisFileDirectory)$(_UmbracoCmsJsonSchemaReference)&quot;" Timeout="600000" />
  </Target>

  <!-- Remove generated JSON schema on clean -->
@@ -43,7 +43,7 @@ public static class AppCacheExtensions
    public static T? GetCacheItem<T>(this IAppCache provider, string cacheKey)
    {
        var result = provider.Get(cacheKey);
-        if (result == null)
+        if (IsRetrievedItemNull(result))
        {
            return default;
        }
@@ -54,11 +54,13 @@ public static class AppCacheExtensions
    public static T? GetCacheItem<T>(this IAppCache provider, string cacheKey, Func<T> getCacheItem)
    {
        var result = provider.Get(cacheKey, () => getCacheItem());
-        if (result == null)
+        if (IsRetrievedItemNull(result))
        {
            return default;
        }

        return result.TryConvertTo<T>().Result;
    }
+
+    private static bool IsRetrievedItemNull(object? result) => result is null or (object)Cms.Core.Constants.Cache.NullRepresentationInCache;
 }
@@ -22,4 +22,6 @@ public static class CacheKeys

    public const string ContentRecycleBinCacheKey = "recycleBin_content";
    public const string MediaRecycleBinCacheKey = "recycleBin_media";
+
+    public const string MemberUserNameCachePrefix = "uRepo_userNameKey+";
 }
@@ -142,7 +142,9 @@ public static class DistributedCacheExtensions
            Id = x.Item.Id,
            Key = x.Item.Key,
            ChangeTypes = x.ChangeTypes,
-            Blueprint = x.Item.Blueprint
+            Blueprint = x.Item.Blueprint,
+            PublishedCultures = x.PublishedCultures?.ToArray(),
+            UnpublishedCultures = x.UnpublishedCultures?.ToArray()
        });

        dc.RefreshByPayload(ContentCacheRefresher.UniqueId, payloads);
@@ -0,0 +1,16 @@
+namespace Umbraco.Cms.Core.Cache.PartialViewCacheInvalidators;
+
+/// <summary>
+/// Defines behaviours for clearing of cached partials views that are configured to be cached individually by member.
+/// </summary>
+public interface IMemberPartialViewCacheInvalidator
+{
+    /// <summary>
+    /// Clears the partial view cache items for the specified member ids.
+    /// </summary>
+    /// <param name="memberIds">The member Ids to clear the cache for.</param>
+    /// <remarks>
+    /// Called from the <see cref="MemberCacheRefresher"/> when a member is saved or deleted.
+    /// </remarks>
+    void ClearPartialViewCacheItems(IEnumerable<int> memberIds);
+}
@@ -182,6 +182,10 @@ public sealed class ContentCacheRefresher : PayloadCacheRefresherBase<ContentCac
        public TreeChangeTypes ChangeTypes { get; init; }

        public bool Blueprint { get; init; }
+
+        public string[]? PublishedCultures { get; init; }
+
+        public string[]? UnpublishedCultures { get; init; }
    }

    #endregion
@@ -1,5 +1,8 @@
 // using Newtonsoft.Json;

+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.Cache.PartialViewCacheInvalidators;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Notifications;
@@ -15,10 +18,37 @@ public sealed class MemberCacheRefresher : PayloadCacheRefresherBase<MemberCache
    public static readonly Guid UniqueId = Guid.Parse("E285DF34-ACDC-4226-AE32-C0CB5CF388DA");

    private readonly IIdKeyMap _idKeyMap;
+    private readonly IMemberPartialViewCacheInvalidator _memberPartialViewCacheInvalidator;

-    public MemberCacheRefresher(AppCaches appCaches, IJsonSerializer serializer, IIdKeyMap idKeyMap, IEventAggregator eventAggregator, ICacheRefresherNotificationFactory factory)
-        : base(appCaches, serializer, eventAggregator, factory) =>
+    [Obsolete("Use the non obsoleted constructor instead. Scheduled for removal in v17")]
+    public MemberCacheRefresher(
+        AppCaches appCaches,
+        IJsonSerializer serializer,
+        IIdKeyMap idKeyMap,
+        IEventAggregator eventAggregator,
+        ICacheRefresherNotificationFactory factory)
+        : this(
+            appCaches,
+            serializer,
+            idKeyMap,
+            eventAggregator,
+            factory,
+            StaticServiceProvider.Instance.GetRequiredService<IMemberPartialViewCacheInvalidator>())
+    {
+    }
+
+    public MemberCacheRefresher(
+        AppCaches appCaches,
+        IJsonSerializer serializer,
+        IIdKeyMap idKeyMap,
+        IEventAggregator eventAggregator,
+        ICacheRefresherNotificationFactory factory,
+        IMemberPartialViewCacheInvalidator memberPartialViewCacheInvalidator)
+        : base(appCaches, serializer, eventAggregator, factory)
+    {
        _idKeyMap = idKeyMap;
+        _memberPartialViewCacheInvalidator = memberPartialViewCacheInvalidator;
+    }

    #region Indirect

@@ -67,17 +97,30 @@ public sealed class MemberCacheRefresher : PayloadCacheRefresherBase<MemberCache

    private void ClearCache(params JsonPayload[] payloads)
    {
-        AppCaches.ClearPartialViewCache();
+        // Clear the partial views cache for all partials that are cached by member, for the updates members.
+        _memberPartialViewCacheInvalidator.ClearPartialViewCacheItems(payloads.Select(p => p.Id));
+
        Attempt<IAppPolicyCache?> memberCache = AppCaches.IsolatedCaches.Get<IMember>();

        foreach (JsonPayload p in payloads)
        {
            _idKeyMap.ClearCache(p.Id);
-            if (memberCache.Success)
+            if (memberCache.Success is false)
            {
-                memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, int>(p.Id));
-                memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(p.Username));
+                continue;
            }
+
+            memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, int>(p.Id));
+            memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(p.Username));
+
+            // This specific cache key was introduced to fix an issue where the member username could not be the same as the member id, because the cache keys collided.
+            // This is done in a bit of a hacky way, because the cache key is created internally in the repository, but we need to clear it here.
+            // Ideally, we want to use a shared way of generating the key between this and the repository.
+            // Additionally, the RepositoryCacheKeys actually caches the string to avoid re-allocating memory; we would like to also use this in the repository
+            // See:
+            // https://github.com/umbraco/Umbraco-CMS/pull/17350
+            // https://github.com/umbraco/Umbraco-CMS/pull/17815
+            memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(CacheKeys.MemberUserNameCachePrefix + p.Username));
        }
    }
 }
@@ -11,6 +11,7 @@ public class RepositoryCachePolicyOptions
    public RepositoryCachePolicyOptions(Func<int> performCount)
    {
        PerformCount = performCount;
+        CacheNullValues = false;
        GetAllCacheValidateCount = true;
        GetAllCacheAllowZeroCount = false;
    }
@@ -21,6 +22,7 @@ public class RepositoryCachePolicyOptions
    public RepositoryCachePolicyOptions()
    {
        PerformCount = null;
+        CacheNullValues = false;
        GetAllCacheValidateCount = false;
        GetAllCacheAllowZeroCount = false;
    }
@@ -30,6 +32,11 @@ public class RepositoryCachePolicyOptions
    /// </summary>
    public Func<int>? PerformCount { get; set; }

+    /// <summary>
+    ///     True if the Get method will cache null results so that the db is not hit for repeated lookups
+    /// </summary>
+    public bool CacheNullValues { get; set; }
+
    /// <summary>
    ///     True/false as to validate the total item count when all items are returned from cache, the default is true but this
    ///     means that a db lookup will occur - though that lookup will probably be significantly less expensive than the
@@ -34,7 +34,7 @@ public class TypeFinder : ITypeFinder
        "ServiceStack.", "SqlCE4Umbraco,", "Superpower,", // used by Serilog
        "System.", "TidyNet,", "TidyNet.", "WebDriver,", "itextsharp,", "mscorlib,", "NUnit,", "NUnit.", "NUnit3.",
        "Selenium.", "ImageProcessor", "MiniProfiler.", "Owin,", "SQLite",
-        "ReSharperTestRunner", "ReSharperTestRunner32", "ReSharperTestRunner64", // These are used by the Jetbrains Rider IDE and Visual Studio ReSharper Extension
+        "ReSharperTestRunner", "ReSharperTestRunner32", "ReSharperTestRunner64", "ReSharperTestRunnerArm32", "ReSharperTestRunnerArm64", // These are used by the Jetbrains Rider IDE and Visual Studio ReSharper Extension
    };

    private static readonly ConcurrentDictionary<string, Type?> TypeNamesCache = new();
@@ -160,6 +160,7 @@ public class ContentSettings
    internal const bool StaticDisableUnpublishWhenReferenced = false;
    internal const bool StaticAllowEditInvariantFromNonDefault = false;
    internal const bool StaticShowDomainWarnings = true;
+    internal const bool StaticShowUnroutableContentWarnings = true;

    /// <summary>
    ///     Gets or sets a value for the content notification settings.
@@ -285,4 +286,10 @@ public class ContentSettings
    /// </summary>
    [DefaultValue(StaticShowDomainWarnings)]
    public bool ShowDomainWarnings { get; set; } = StaticShowDomainWarnings;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether to show unroutable content warnings.
+    /// </summary>
+    [DefaultValue(StaticShowUnroutableContentWarnings)]
+    public bool ShowUnroutableContentWarnings { get; set; } = StaticShowUnroutableContentWarnings;
 }
@@ -129,6 +129,7 @@ public class GlobalSettings
    /// <summary>
    ///     Gets or sets a value indicating whether to install the database when it is missing.
    /// </summary>
+    [Obsolete("This option will be removed in V16.")]
    [DefaultValue(StaticInstallMissingDatabase)]
    public bool InstallMissingDatabase { get; set; } = StaticInstallMissingDatabase;

@@ -16,6 +16,7 @@ public class ModelsBuilderSettings
    internal const string StaticModelsDirectory = "~/umbraco/models";
    internal const bool StaticAcceptUnsafeModelsDirectory = false;
    internal const int StaticDebugLevel = 0;
+    internal const bool StaticIncludeVersionNumberInGeneratedModels = true;
    private bool _flagOutOfDateModels = true;

    /// <summary>
@@ -78,4 +79,16 @@ public class ModelsBuilderSettings
    /// <remarks>0 means minimal (safe on live site), anything else means more and more details (maybe not safe).</remarks>
    [DefaultValue(StaticDebugLevel)]
    public int DebugLevel { get; set; } = StaticDebugLevel;
+
+    /// <summary>
+    ///     Gets or sets a value indicating whether the version number should be included in generated models.
+    /// </summary>
+    /// <remarks>
+    ///     By default this is written to the <see cref="System.CodeDom.Compiler.GeneratedCodeAttribute"/> output in
+    ///     generated code for each property of the model. This can be useful for debugging purposes but isn't essential,
+    ///     and it has the causes the generated code to change every time Umbraco is upgraded. In turn, this leads
+    ///     to unnecessary code file changes that need to be checked into source control. Default is <c>true</c>.
+    /// </remarks>
+    [DefaultValue(StaticIncludeVersionNumberInGeneratedModels)]
+    public bool IncludeVersionNumberInGeneratedModels { get; set; } = StaticIncludeVersionNumberInGeneratedModels;
 }
@@ -15,6 +15,7 @@ public class RequestHandlerSettings
 {
    internal const bool StaticAddTrailingSlash = true;
    internal const string StaticConvertUrlsToAscii = "try";
+    internal const string StaticConvertFileNamesToAscii = "false";
    internal const bool StaticEnableDefaultCharReplacements = true;

    internal static readonly CharItem[] DefaultCharCollection =
@@ -73,6 +74,22 @@ public class RequestHandlerSettings
    /// </summary>
    public bool ShouldTryConvertUrlsToAscii => ConvertUrlsToAscii.InvariantEquals("try");

+    /// <summary>
+    ///     Gets or sets a value indicating whether to convert file names to ASCII (valid values: "true", "try" or "false").
+    /// </summary>
+    [DefaultValue(StaticConvertFileNamesToAscii)]
+    public string ConvertFileNamesToAscii { get; set; } = StaticConvertFileNamesToAscii;
+
+    /// <summary>
+    ///     Gets a value indicating whether URLs should be converted to ASCII.
+    /// </summary>
+    public bool ShouldConvertFileNamesToAscii => ConvertFileNamesToAscii.InvariantEquals("true");
+
+    /// <summary>
+    ///     Gets a value indicating whether URLs should be tried to be converted to ASCII.
+    /// </summary>
+    public bool ShouldTryConvertFileNamesToAscii => ConvertFileNamesToAscii.InvariantEquals("try");
+
    /// <summary>
    ///     Disable all default character replacements
    /// </summary>
@@ -8,7 +8,7 @@ namespace Umbraco.Cms.Core.Configuration.Models;
 public class RichTextEditorSettings
 {
    internal const string StaticValidElements =
-        "+a[id|style|rel|data-id|data-udi|rev|charset|hreflang|dir|lang|tabindex|accesskey|type|name|href|target|title|class|onfocus|onblur|onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup],-strong/-b[class|style],-em/-i[class|style],-strike[class|style],-s[class|style],-u[class|style],#p[id|style|dir|class|align],-ol[class|reversed|start|style|type],-ul[class|style],-li[class|style],br[class],img[id|dir|lang|longdesc|usemap|style|class|src|onmouseover|onmouseout|border|alt=|title|hspace|vspace|width|height|align|umbracoorgwidth|umbracoorgheight|onresize|onresizestart|onresizeend|rel|data-id],-sub[style|class],-sup[style|class],-blockquote[dir|style|class],-table[border=0|cellspacing|cellpadding|width|height|class|align|summary|style|dir|id|lang|bgcolor|background|bordercolor],-tr[id|lang|dir|class|rowspan|width|height|align|valign|style|bgcolor|background|bordercolor],tbody[id|class],thead[id|class],tfoot[id|class],#td[id|lang|dir|class|colspan|rowspan|width|height|align|valign|style|bgcolor|background|bordercolor|scope],-th[id|lang|dir|class|colspan|rowspan|width|height|align|valign|style|scope],caption[id|lang|dir|class|style],-div[id|dir|class|align|style],-span[class|align|style],-pre[class|align|style],address[class|align|style],-h1[id|dir|class|align|style],-h2[id|dir|class|align|style],-h3[id|dir|class|align|style],-h4[id|dir|class|align|style],-h5[id|dir|class|align|style],-h6[id|style|dir|class|align|style],hr[class|style],small[class|style],dd[id|class|title|style|dir|lang],dl[id|class|title|style|dir|lang],dt[id|class|title|style|dir|lang],object[class|id|width|height|codebase|*],param[name|value|_value|class],embed[type|width|height|src|class|*],map[name|class],area[shape|coords|href|alt|target|class],bdo[class],button[class],iframe[*],figure,figcaption,cite,video[*],audio[*],picture[*],source[*],canvas[*]";
+        "+a[id|style|rel|data-id|data-udi|rev|charset|hreflang|dir|lang|tabindex|accesskey|type|name|href|target|title|class|onfocus|onblur|onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup],-strong/-b[class|style],-em/-i[class|style],-strike[class|style],-s[class|style],-u[class|style],#p[id|style|dir|class|align],-ol[class|reversed|start|style|type],-ul[class|style],-li[class|style],br[class],img[id|dir|lang|longdesc|usemap|style|class|src|onmouseover|onmouseout|border|alt=|title|hspace|vspace|width|height|align|umbracoorgwidth|umbracoorgheight|onresize|onresizestart|onresizeend|rel|data-id],-sub[style|class],-sup[style|class],-blockquote[dir|style|class],-table[border=0|cellspacing|cellpadding|width|height|class|align|summary|style|dir|id|lang|bgcolor|background|bordercolor],-tr[id|lang|dir|class|rowspan|width|height|align|valign|style|bgcolor|background|bordercolor],tbody[id|class],thead[id|class],tfoot[id|class],#td[id|lang|dir|class|colspan|rowspan|width|height|align|valign|style|bgcolor|background|bordercolor|scope],-th[id|lang|dir|class|colspan|rowspan|width|height|align|valign|style|scope],caption[id|lang|dir|class|style],-div[id|dir|class|align|style],-span[class|align|style],-pre[class|align|style],address[class|align|style],-h1[id|dir|class|align|style],-h2[id|dir|class|align|style],-h3[id|dir|class|align|style],-h4[id|dir|class|align|style],-h5[id|dir|class|align|style],-h6[id|style|dir|class|align|style],hr[class|style],small[class|style],dd[id|class|title|style|dir|lang],dl[id|class|title|style|dir|lang],dt[id|class|title|style|dir|lang],object[class|id|width|height|codebase|*],param[name|value|_value|class],embed[type|width|height|src|class|*],map[name|class],area[shape|coords|href|alt|target|class],bdo[class],button[class],iframe[*],figure,figcaption,cite,video[*],audio[*],picture[*],source[*],canvas[*],code";

    internal const string StaticInvalidElements = "font";

@@ -2,6 +2,7 @@
 // See LICENSE for more details.

 using System.ComponentModel;
+using System.ComponentModel.DataAnnotations;

 namespace Umbraco.Cms.Core.Configuration.Models;

@@ -19,12 +20,16 @@ public class SecuritySettings
    internal const bool StaticAllowEditInvariantFromNonDefault = false;
    internal const bool StaticAllowConcurrentLogins = false;
    internal const string StaticAuthCookieName = "UMB_UCONTEXT";
+    internal const bool StaticUsernameIsEmail = true;
+    internal const bool StaticMemberRequireUniqueEmail = true;

    internal const string StaticAllowedUserNameCharacters =
        "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+\\";

    internal const int StaticMemberDefaultLockoutTimeInMinutes = 30 * 24 * 60;
    internal const int StaticUserDefaultLockoutTimeInMinutes = 30 * 24 * 60;
+    internal const long StaticUserDefaultFailedLoginDurationInMilliseconds = 1000;
+    internal const long StaticUserMinimumFailedLoginDurationInMilliseconds = 250;

    /// <summary>
    ///     Gets or sets a value indicating whether to keep the user logged in.
@@ -58,7 +63,14 @@ public class SecuritySettings
    /// <summary>
    ///     Gets or sets a value indicating whether the user's email address is to be considered as their username.
    /// </summary>
-    public bool UsernameIsEmail { get; set; } = true;
+    [DefaultValue(StaticUsernameIsEmail)]
+    public bool UsernameIsEmail { get; set; } = StaticUsernameIsEmail;
+
+    /// <summary>
+    ///     Gets or sets a value indicating whether the member's email address must be unique.
+    /// </summary>
+    [DefaultValue(StaticMemberRequireUniqueEmail)]
+    public bool MemberRequireUniqueEmail { get; set; } = StaticMemberRequireUniqueEmail;

    /// <summary>
    ///     Gets or sets the set of allowed characters for a username
@@ -116,4 +128,28 @@ public class SecuritySettings
    /// </summary>
    [DefaultValue(StaticAllowConcurrentLogins)]
    public bool AllowConcurrentLogins { get; set; } = StaticAllowConcurrentLogins;
+
+    /// <summary>
+    /// Gets or sets the default duration (in milliseconds) of failed login attempts.
+    /// </summary>
+    /// <value>
+    /// The default duration (in milliseconds) of failed login attempts.
+    /// </value>
+    /// <remarks>
+    /// The user login endpoint ensures that failed login attempts take at least as long as the average successful login.
+    /// However, if no successful logins have occurred, this value is used as the default duration.
+    /// </remarks>
+    [Range(0, int.MaxValue)] // TODO (V17): Change property type to short and update maximum range to short.MaxValue
+    [DefaultValue(StaticUserDefaultFailedLoginDurationInMilliseconds)]
+    public long UserDefaultFailedLoginDurationInMilliseconds { get; set; } = StaticUserDefaultFailedLoginDurationInMilliseconds;
+
+    /// <summary>
+    /// Gets or sets the minimum duration (in milliseconds) of failed login attempts.
+    /// </summary>
+    /// <value>
+    /// The minimum duration (in milliseconds) of failed login attempts.
+    /// </value>
+    [Range(0, int.MaxValue)] // TODO (V17): Change property type to short and update maximum range to short.MaxValue
+    [DefaultValue(StaticUserMinimumFailedLoginDurationInMilliseconds)]
+    public long UserMinimumFailedLoginDurationInMilliseconds { get; set; } = StaticUserMinimumFailedLoginDurationInMilliseconds;
 }
@@ -0,0 +1,15 @@
+namespace Umbraco.Cms.Core;
+
+public static partial class Constants
+{
+    public static class Cache
+    {
+        /// <summary>
+        /// Defines the string used to represent a null value in the cache.
+        /// </summary>
+        /// <remarks>
+        /// Used in conjunction with the option to cache null values on the repository caches, so we
+        /// can distinguish a true null "not found" value and a cached null value.</remarks>
+        public const string NullRepresentationInCache = "*NULL*";
+    }
+}
@@ -15,6 +15,27 @@ public class ApiContentPathResolver : IApiContentPathResolver
        _apiPublishedContentCache = apiPublishedContentCache;
    }

+    [Obsolete("No longer used in V15. Scheduled for removal in V15.")]
+    public virtual bool IsResolvablePath(string path)
+    {
+        // File requests will blow up with an downstream exception in GetRequiredPublishedSnapshot, which fails due to an UmbracoContext
+        // not being available for what's considered a static file request.
+        // See: https://github.com/umbraco/Umbraco-CMS/issues/19051
+        // Given a URL segment and hence route can't contain a period, we can safely assume that if the last segment of the path contains
+        // a period, it's a file request and should return null here.
+        if (IsFileRequest(path))
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    private static bool IsFileRequest(string path) => path
+        .Split('/', StringSplitOptions.RemoveEmptyEntries)
+        .LastOrDefault()?
+        .Contains('.') is true;
+
    public virtual IPublishedContent? ResolveContentPath(string path)
    {
        path = path.EnsureStartsWith("/");
@@ -4,5 +4,8 @@ namespace Umbraco.Cms.Core.DeliveryApi;

 public interface IApiContentPathResolver
 {
+    [Obsolete("No longer used in V15. Scheduled for removal in V15.")]
+    bool IsResolvablePath(string path) => true;
+
    IPublishedContent? ResolveContentPath(string path);
 }
@@ -0,0 +1,12 @@
+namespace Umbraco.Cms.Core.DeliveryApi;
+
+public interface ICurrentMemberClaimsProvider
+{
+    /// <summary>
+    /// Retrieves the claims for the currently logged in member.
+    /// </summary>
+    /// <remarks>
+    /// This is used by the OIDC user info endpoint to supply "current user" info.
+    /// </remarks>
+    Task<Dictionary<string, object>> GetClaimsAsync();
+}
@@ -0,0 +1,6 @@
+namespace Umbraco.Cms.Core.DeliveryApi;
+
+public class NoopCurrentMemberClaimsProvider : ICurrentMemberClaimsProvider
+{
+    public Task<Dictionary<string, object>> GetClaimsAsync() => Task.FromResult(new Dictionary<string, object>());
+}
@@ -27,7 +27,9 @@ public class RootDynamicRootOriginFinder : IDynamicRootOriginFinder
            return null;
        }

-        var entity = _entityService.Get(query.Context.ParentKey);
+        // when creating new content, CurrentKey will be null - fallback to using ParentKey
+        Guid entityKey = query.Context.CurrentKey ?? query.Context.ParentKey;
+        var entity = _entityService.Get(entityKey);

        if (entity is null || _allowedObjectTypes.Contains(entity.NodeObjectType) is false)
        {
@@ -20,12 +20,14 @@ public class SiteDynamicRootOriginFinder : RootDynamicRootOriginFinder

    public override Guid? FindOriginKey(DynamicRootNodeQuery query)
    {
-        if (query.OriginAlias != SupportedOriginType || query.Context.CurrentKey.HasValue is false)
+        if (query.OriginAlias != SupportedOriginType)
        {
            return null;
        }

-        IEntitySlim? entity = _entityService.Get(query.Context.CurrentKey.Value);
+        // when creating new content, CurrentKey will be null - fallback to using ParentKey
+        Guid entityKey = query.Context.CurrentKey ?? query.Context.ParentKey;
+        IEntitySlim? entity = _entityService.Get(entityKey);
        if (entity is null || entity.NodeObjectType != Constants.ObjectTypes.Document)
        {
            return null;
@@ -1469,6 +1469,7 @@ Mange hilsner fra Umbraco robotten
    <key alias="publishWithMissingDomain">Der er ikke noget domæne konfigureret for %0%, kontakt vensligst en
      administrator, se loggen for mere information
    </key>
+    <key alias="publishWithNoUrl">Dokumentet har ikke nogen URL, muligvis grundet en kollision med et andet dokuments navn. Flere detaljer kan ses under Info.</key>
    <key alias="copySuccessMessage">Dit systems information er blevet kopieret til udklipsholderen</key>
    <key alias="cannotCopyInformation">Kunne desværre ikke kopiere dit systems information til udklipsholderen</key>
    <key alias="webhookSaved">Webhook gemt</key>
@@ -167,6 +167,7 @@
    <key alias="move">Media moved</key>
    <key alias="copy">Media copied</key>
    <key alias="save">Media saved</key>
+    <key alias="new">Media created</key>
  </area>
  <area alias="auditTrails">
    <key alias="atViewingFor">Viewing for</key>
@@ -190,6 +191,7 @@
    <key alias="smallPublishVariant">Publish</key>
    <key alias="smallMove">Move</key>
    <key alias="smallSave">Save</key>
+    <key alias="smallNew">New</key>
    <key alias="smallSaveVariant">Save</key>
    <key alias="smallDelete">Delete</key>
    <key alias="smallUnpublish">Unpublish</key>
@@ -292,6 +294,7 @@
      Content.
    </key>
    <key alias="nestedContentDeleteAllItems">Are you sure you want to delete all items?</key>
+    <key alias="nestedContentDeleteItem">Are you sure you want to delete this item?</key>
    <key alias="nestedContentNoContentTypes">No Content Types are configured for this property.</key>
    <key alias="nestedContentAddElementType">Add Element Type</key>
    <key alias="nestedContentSelectElementTypeModalTitle">Select Element Type</key>
@@ -329,6 +332,7 @@
    <key alias="schedulePublishHelp">Select the date and time to publish and/or unpublish the content item.</key>
    <key alias="createEmpty">Create new</key>
    <key alias="createFromClipboard">Paste from clipboard</key>
+    <key alias="removeItem">Remove item</key>
    <key alias="nodeIsInTrash">This item is in the Recycle Bin</key>
    <key alias="noProperties">No content can be added for this item</key>
    <key alias="variantSaveNotAllowed">Save is not allowed</key>
@@ -1700,6 +1704,7 @@ To manage your website, simply open the Umbraco backoffice and start adding cont
    <key alias="publishWithMissingDomain">There is no domain configured for %0%, please contact an administrator, see
      log for more information
    </key>
+    <key alias="publishWithNoUrl">The document does not have a URL, possibly due to a naming collision with another document. More details can be found under Info.</key>
    <key alias="copySuccessMessage">Your system information has successfully been copied to the clipboard</key>
    <key alias="cannotCopyInformation">Could not copy your system information to the clipboard</key>
    <key alias="webhookSaved">Webhook saved</key>
@@ -165,6 +165,7 @@
    <key alias="move">Media moved</key>
    <key alias="copy">Media copied</key>
    <key alias="save">Media saved</key>
+    <key alias="new">Media created</key>
  </area>
  <area alias="auditTrails">
    <key alias="atViewingFor">Viewing for</key>
@@ -189,6 +190,7 @@
    <key alias="smallPublishVariant">Publish</key>
    <key alias="smallMove">Move</key>
    <key alias="smallSave">Save</key>
+    <key alias="smallNew">New</key>
    <key alias="smallSaveVariant">Save</key>
    <key alias="smallDelete">Delete</key>
    <key alias="smallUnpublish">Unpublish</key>
@@ -288,6 +290,7 @@
      <![CDATA[<a href="https://docs.umbraco.com/umbraco-cms/fundamentals/data/scheduled-publishing#timezones" target="_blank" rel="noopener">What does this mean?</a>]]></key>
    <key alias="nestedContentDeleteItem">Are you sure you want to delete this item?</key>
    <key alias="nestedContentDeleteAllItems">Are you sure you want to delete all items?</key>
+    <key alias="nestedContentDeleteItem">Are you sure you want to delete this item?</key>
    <key alias="nestedContentEditorNotSupported">Property %0% uses editor %1% which is not supported by Nested
      Content.
    </key>
@@ -328,6 +331,7 @@
    <key alias="schedulePublishHelp">Select the date and time to publish and/or unpublish the content item.</key>
    <key alias="createEmpty">Create new</key>
    <key alias="createFromClipboard">Paste from clipboard</key>
+    <key alias="removeItem">Remove item</key>
    <key alias="nodeIsInTrash">This item is in the Recycle Bin</key>
    <key alias="variantSaveNotAllowed">Save is not allowed</key>
    <key alias="variantPublishNotAllowed">Publish is not allowed</key>
@@ -1732,6 +1736,7 @@ To manage your website, simply open the Umbraco backoffice and start adding cont
    <key alias="publishWithMissingDomain">There is no domain configured for %0%, please contact an administrator, see
      log for more information
    </key>
+    <key alias="publishWithNoUrl">The document does not have a URL, possibly due to a naming collision with another document. More details can be found under Info.</key>
    <key alias="preventCleanupEnableError">An error occurred while enabling version cleanup for %0%</key>
    <key alias="preventCleanupDisableError">An error occurred while disabling version cleanup for %0%</key>
    <key alias="copySuccessMessage">Your system information has successfully been copied to the clipboard</key>
@@ -5,7 +5,7 @@
@using Umbraco.Extensions

@{
-    var isLoggedIn = Context.User?.Identity?.IsAuthenticated ?? false;
+    var isLoggedIn = Context.User.GetMemberIdentity()?.IsAuthenticated ?? false;
    var logoutModel = new PostRedirectModel();
    // You can modify this to redirect to a different URL instead of the current one
    logoutModel.RedirectUrl = null;
@@ -15,7 +15,7 @@
 {
    <div class="login-status">

-        <p>Welcome back <strong>@Context?.User?.Identity?.Name</strong>!</p>
+        <p>Welcome back <strong>@Context.User?.GetMemberIdentity()?.Name</strong>!</p>

        @using (Html.BeginUmbracoForm<UmbLoginStatusController>("HandleLogout", new { RedirectUrl = logoutModel.RedirectUrl }))
        {
@@ -330,7 +330,10 @@ public static class ClaimsIdentityExtensions
        var firstValue = identity.FindFirstValue(ClaimTypes.NameIdentifier);
        if (firstValue is not null)
        {
-            return int.Parse(firstValue, CultureInfo.InvariantCulture);
+            if (int.TryParse(firstValue, CultureInfo.InvariantCulture, out var id))
+            {
+                return id;
+            }
        }

        return null;
@@ -1,15 +1,17 @@
 // Copyright (c) Umbraco.
 // See LICENSE for more details.

+using System.Diagnostics.CodeAnalysis;
+
 namespace Umbraco.Extensions;

 public static class IntExtensions
 {
    /// <summary>
-    ///     Does something 'x' amount of times
+    ///     Does something 'x' amount of times.
    /// </summary>
-    /// <param name="n"></param>
-    /// <param name="action"></param>
+    /// <param name="n">Number of times to execute the action.</param>
+    /// <param name="action">The action to execute.</param>
    public static void Times(this int n, Action<int> action)
    {
        for (var i = 0; i < n; i++)
@@ -19,11 +21,11 @@ public static class IntExtensions
    }

    /// <summary>
-    ///     Creates a Guid based on an integer value
+    ///     Creates a Guid based on an integer value.
    /// </summary>
-    /// <param name="value"><see cref="int" /> value to convert</param>
+    /// <param name="value">The <see cref="int" /> value to convert.</param>
    /// <returns>
-    ///     <see cref="Guid" />
+    ///     The converted <see cref="Guid" />.
    /// </returns>
    public static Guid ToGuid(this int value)
    {
@@ -31,4 +33,28 @@ public static class IntExtensions
        BitConverter.GetBytes(value).CopyTo(bytes, 0);
        return new Guid(bytes);
    }
+
+    /// <summary>
+    ///     Restores a GUID previously created from an integer value using <see cref="ToGuid" />.
+    /// </summary>
+    /// <param name="value">The <see cref="Guid" /> value to convert.</param>
+    /// <param name="result">The converted <see cref="int" />.</param>
+    /// <returns>
+    ///     True if the <see cref="int" /> value could be created, otherwise false.
+    /// </returns>
+    /// <remarks>
+    ///     This is used with Umbraco entities that only have integer references in the database (e.g. users).
+    /// </remarks>
+    public static bool TryParseFromGuid(Guid value, [NotNullWhen(true)] out int? result)
+    {
+        if (value.ToString().EndsWith("-0000-0000-0000-000000000000") is false)
+        {
+            // We have a proper GUID, not one converted from an integer.
+            result = null;
+            return false;
+        }
+
+        result = BitConverter.ToInt32(value.ToByteArray());
+        return true;
+    }
 }
@@ -358,7 +358,7 @@ namespace Umbraco.Cms.Core.IO

            // nothing prevents us to reach the file, security-wise, yet it is outside
            // this filesystem's root - throw
-            throw new UnauthorizedAccessException($"File original: [{originalPath}] full: [{path}] is outside this filesystem's root.");
+            throw new UnauthorizedAccessException($"Requested path {originalPath} is outside this filesystem's root.");
        }

        /// <summary>
@@ -7,6 +7,21 @@ public sealed class AuditItem : EntityBase, IAuditItem
    /// <summary>
    ///     Initializes a new instance of the <see cref="AuditItem" /> class.
    /// </summary>
+    public AuditItem(int objectId, AuditType type, int userId, string? entityType, DateTime createDate, string? comment = null, string? parameters = null)
+    {
+        DisableChangeTracking();
+
+        Id = objectId;
+        Comment = comment;
+        AuditType = type;
+        UserId = userId;
+        EntityType = entityType;
+        Parameters = parameters;
+        CreateDate = createDate;
+
+        EnableChangeTracking();
+    }
+
    public AuditItem(int objectId, AuditType type, int userId, string? entityType, string? comment = null, string? parameters = null)
    {
        DisableChangeTracking();
@@ -1,69 +1,69 @@
 namespace Umbraco.Cms.Core.Models.ContentEditing;

 /// <summary>
-///     The action associated with saving a content item
+///     The action associated with saving a content item.
 /// </summary>
 public enum ContentSaveAction
 {
    /// <summary>
-    ///     Saves the content item, no publish
+    ///     Saves the content item, no publish.
    /// </summary>
    Save = 0,

    /// <summary>
-    ///     Creates a new content item
+    ///     Creates a new content item.
    /// </summary>
    SaveNew = 1,

    /// <summary>
-    ///     Saves and publishes the content item
+    ///     Saves and publishes the content item.
    /// </summary>
    Publish = 2,

    /// <summary>
-    ///     Creates and publishes a new content item
+    ///     Creates and publishes a new content item.
    /// </summary>
    PublishNew = 3,

    /// <summary>
-    ///     Saves and sends publish notification
+    ///     Saves and sends publish notification.
    /// </summary>
    SendPublish = 4,

    /// <summary>
-    ///     Creates and sends publish notification
+    ///     Creates and sends publish notification.
    /// </summary>
    SendPublishNew = 5,

    /// <summary>
-    ///     Saves and schedules publishing
+    ///     Saves and schedules publishing.
    /// </summary>
    Schedule = 6,

    /// <summary>
-    ///     Creates and schedules publishing
+    ///     Creates and schedules publishing.
    /// </summary>
    ScheduleNew = 7,

    /// <summary>
-    ///     Saves and publishes the content item including all descendants that have a published version
+    ///     Saves and publishes the content item including all descendants that have a published version.
    /// </summary>
    PublishWithDescendants = 8,

    /// <summary>
-    ///     Creates and publishes the content item including all descendants that have a published version
+    ///     Creates and publishes the new content item including all descendants that have a published version.
    /// </summary>
    PublishWithDescendantsNew = 9,

    /// <summary>
    ///     Saves and publishes the content item including all descendants regardless of whether they have a published version
-    ///     or not
+    ///     or not.
    /// </summary>
    PublishWithDescendantsForce = 10,

    /// <summary>
-    ///     Creates and publishes the content item including all descendants regardless of whether they have a published
-    ///     version or not
+    ///     Creates and publishes the new content item including all descendants regardless of whether they have a published
+    ///     version or not.
    /// </summary>
    PublishWithDescendantsForceNew = 11,
 }
@@ -25,6 +25,7 @@ public class PropertyTypeBasic

    [Required]
    [RegularExpression(@"^([a-zA-Z]\w.*)$", ErrorMessage = "Invalid alias")]
+    [MaxLength(255, ErrorMessage = "Alias is too long")]
    [DataMember(Name = "alias")]
    public string Alias { get; set; } = null!;

@@ -0,0 +1,28 @@
+namespace Umbraco.Cms.Core.Models;
+
+/// <summary>
+/// Describes the options available with publishing a content branch for force publishing.
+/// </summary>
+[Flags]
+public enum PublishBranchFilter
+{
+    /// <summary>
+    /// The default behavior is to publish only the published content that has changed.
+    /// </summary>
+    Default = 0,
+
+    /// <summary>
+    /// For publishing a branch, publish all changed content, including content that is not published.
+    /// </summary>
+    IncludeUnpublished = 1,
+
+    /// <summary>
+    /// For publishing a branch, force republishing of all published content, including content that has not changed.
+    /// </summary>
+    ForceRepublish = 2,
+
+    /// <summary>
+    /// For publishing a branch, publish all content, including content that is not published and content that has not changed.
+    /// </summary>
+    All = IncludeUnpublished | ForceRepublish,
+}
@@ -0,0 +1,28 @@
+namespace Umbraco.Cms.Core.Models;
+
+/// <summary>
+/// Specifies options for publishing notifcations when saving.
+/// </summary>
+[Flags]
+public enum PublishNotificationSaveOptions
+{
+    /// <summary>
+    /// Do not publish any notifications.
+    /// </summary>
+    None = 0,
+
+    /// <summary>
+    /// Only publish the saving notification.
+    /// </summary>
+    Saving = 1,
+
+    /// <summary>
+    /// Only publish the saved notification.
+    /// </summary>
+    Saved = 2,
+
+    /// <summary>
+    /// Publish all the notifications.
+    /// </summary>
+    All = Saving | Saved,
+}
@@ -32,4 +32,14 @@ public class ContentTreeChangeNotification : TreeChangeNotification<IContent>
        : base(new TreeChange<IContent>(target, changeTypes), messages)
    {
    }
+
+    public ContentTreeChangeNotification(
+        IContent target,
+        TreeChangeTypes changeTypes,
+        IEnumerable<string>? publishedCultures,
+        IEnumerable<string>? unpublishedCultures,
+        EventMessages messages)
+        : base(new TreeChange<IContent>(target, changeTypes, publishedCultures, unpublishedCultures), messages)
+    {
+    }
 }
@@ -3,23 +3,29 @@ using Umbraco.Cms.Core.Security;
 namespace Umbraco.Cms.Core.Persistence.Repositories;

 /// <summary>
-///     Repository for external logins with Guid as key, so it can be shared for members and users
+///     Repository for external logins with Guid as key, so it can be shared for members and users.
 /// </summary>
 public interface IExternalLoginWithKeyRepository : IReadWriteQueryRepository<int, IIdentityUserLogin>,
    IQueryRepository<IIdentityUserToken>
 {
    /// <summary>
-    ///     Replaces all external login providers for the user/member key
+    ///     Replaces all external login providers for the user/member key.
    /// </summary>
    void Save(Guid userOrMemberKey, IEnumerable<IExternalLogin> logins);

    /// <summary>
-    ///     Replaces all external login provider tokens for the providers specified for the user/member key
+    ///     Replaces all external login provider tokens for the providers specified for the user/member key.
    /// </summary>
    void Save(Guid userOrMemberKey, IEnumerable<IExternalLoginToken> tokens);

    /// <summary>
-    ///     Deletes all external logins for the specified the user/member key
+    ///     Deletes all external logins for the specified the user/member key.
    /// </summary>
    void DeleteUserLogins(Guid userOrMemberKey);
+
+    /// <summary>
+    ///     Deletes external logins that aren't associated with the current collection of providers.
+    /// </summary>
+    /// <param name="currentLoginProviders">The names of the currently configured providers.</param>
+    void DeleteUserLoginsForRemovedProviders(IEnumerable<string> currentLoginProviders) { }
 }
@@ -38,4 +38,11 @@ public interface IMemberRepository : IContentRepository<int, IMember>
    /// <param name="query"></param>
    /// <returns></returns>
    int GetCountByQuery(IQuery<IMember>? query);
+
+    /// <summary>
+    /// Saves only the properties related to login for the member, using an optimized, non-locking update.
+    /// </summary>
+    /// <param name="member">The member to update.</param>
+    /// <returns>Used to avoid the full save of the member object after a login operation.</returns>
+    Task UpdateLoginPropertiesAsync(IMember member) => Task.CompletedTask;
 }
@@ -1,4 +1,4 @@
-using System.Linq.Expressions;
+using System.Linq.Expressions;
 using Umbraco.Cms.Core.Models.Membership;
 using Umbraco.Cms.Core.Persistence.Querying;

@@ -109,5 +109,26 @@ public interface IUserRepository : IReadWriteQueryRepository<int, IUser>

    void ClearLoginSession(Guid sessionId);

+    /// <summary>
+    ///    Gets a page of users, ordered by Id and starting from the provided Id.
+    /// </summary>
+    /// <param name="id">The user Id to start retrieving users from.</param>
+    /// <param name="count">The number of users to return.</param>
+    /// <returns>A page of <see cref="IUser"/> instances.</returns>
+    [Obsolete("No longer used in Umbraco. Scheduled for removal in Umbraco 18.")]
    IEnumerable<IUser> GetNextUsers(int id, int count);
+
+    /// <summary>
+    ///    Gets a page of approved users, ordered by Id and starting from the provided Id.
+    /// </summary>
+    /// <param name="id">The user Id to start retrieving users from.</param>
+    /// <param name="count">The number of users to return.</param>
+    /// <returns>A page of <see cref="IUser"/> instances.</returns>
+    IEnumerable<IUser> GetNextApprovedUsers(int id, int count) => Enumerable.Empty<IUser>();
+
+    /// <summary>
+    ///     Invalidates sessions for users that aren't associated with the current collection of providers.
+    /// </summary>
+    /// <param name="currentProviderKeys">The keys for the currently configured providers.</param>
+    void InvalidateSessionsForRemovedProviders(IEnumerable<string> currentProviderKeys) { }
 }
@@ -31,6 +31,12 @@ public interface IPublishedSnapshotService : IDisposable
    /// </remarks>
    IPublishedSnapshot CreatePublishedSnapshot(string? previewToken);

+    /// <summary>
+    /// Indicates if the database cache is in the process of being rebuilt.
+    /// </summary>
+    /// <returns></returns>
+    bool IsRebuilding() => false;
+
    /// <summary>
    ///     Rebuilds internal database caches (but does not reload).
    /// </summary>
@@ -61,6 +67,38 @@ public interface IPublishedSnapshotService : IDisposable
        IReadOnlyCollection<int>? mediaTypeIds = null,
        IReadOnlyCollection<int>? memberTypeIds = null);

+    /// <summary>
+    ///     Rebuilds internal database caches (but does not reload).
+    /// </summary>
+    /// <param name="contentTypeIds">
+    ///     If not null will process content for the matching content types, if empty will process all
+    ///     content
+    /// </param>
+    /// <param name="mediaTypeIds">
+    ///     If not null will process content for the matching media types, if empty will process all
+    ///     media
+    /// </param>
+    /// <param name="memberTypeIds">
+    ///     If not null will process content for the matching members types, if empty will process all
+    ///     members
+    /// </param>
+    /// <param name="useBackgroundThread">Flag indicating whether to use a background thread for the operation and immediately return to the caller.</param>
+    /// <remarks>
+    ///     <para>
+    ///         Forces the snapshot service to rebuild its internal database caches. For instance, some caches
+    ///         may rely on a database table to store pre-serialized version of documents.
+    ///     </para>
+    ///     <para>
+    ///         This does *not* reload the caches. Caches need to be reloaded, for instance via
+    ///         <see cref="DistributedCache" /> RefreshAllPublishedSnapshot method.
+    ///     </para>
+    /// </remarks>
+    void Rebuild(
+        bool useBackgroundThread,
+        IReadOnlyCollection<int>? contentTypeIds = null,
+        IReadOnlyCollection<int>? mediaTypeIds = null,
+        IReadOnlyCollection<int>? memberTypeIds = null) => Rebuild(contentTypeIds, mediaTypeIds, memberTypeIds);
+

    /// <summary>
    ///     Rebuilds all internal database caches (but does not reload).
@@ -77,6 +115,22 @@ public interface IPublishedSnapshotService : IDisposable
    /// </remarks>
    void RebuildAll() => Rebuild(Array.Empty<int>(), Array.Empty<int>(), Array.Empty<int>());

+    /// <summary>
+    ///     Rebuilds all internal database caches (but does not reload).
+    /// </summary>
+    /// <param name="useBackgroundThread">Flag indicating whether to use a background thread for the operation and immediately return to the caller.</param>
+    /// <remarks>
+    ///     <para>
+    ///         Forces the snapshot service to rebuild its internal database caches. For instance, some caches
+    ///         may rely on a database table to store pre-serialized version of documents.
+    ///     </para>
+    ///     <para>
+    ///         This does *not* reload the caches. Caches need to be reloaded, for instance via
+    ///         <see cref="DistributedCache" /> RefreshAllPublishedSnapshot method.
+    ///     </para>
+    /// </remarks>
+    void RebuildAll(bool useBackgroundThread) => Rebuild(useBackgroundThread, Array.Empty<int>(), Array.Empty<int>(), Array.Empty<int>());
+
    /* An IPublishedCachesService implementation can rely on transaction-level events to update
     * its internal, database-level data, as these events are purely internal. However, it cannot
     * rely on cache refreshers CacheUpdated events to update itself, as these events are external
@@ -33,7 +33,7 @@ public interface ITagQuery
    /// <summary>
    ///     Gets all document tags.
    /// </summary>
-    ///   /// <remarks>
+    /// <remarks>
    ///     If no culture is specified, it retrieves tags with an invariant culture.
    ///     If a culture is specified, it only retrieves tags for that culture.
    ///     Use "*" to retrieve tags for all cultures.
@@ -148,7 +148,10 @@ public class UmbracoRequestPaths
    /// <summary>
    ///     Checks if the current uri is an install request
    /// </summary>
-    public bool IsInstallerRequest(string absPath) => absPath.InvariantStartsWith(_installPath);
+    public bool IsInstallerRequest(string absPath) =>
+        absPath.InvariantEquals(_installPath)
+        || absPath.InvariantStartsWith(_installPath.EnsureEndsWith('/'))
+        || absPath.InvariantStartsWith(_installPath.EnsureEndsWith('?'));

    /// <summary>
    ///     Rudimentary check to see if it's not a server side request
@@ -111,6 +111,12 @@ public sealed class UriUtility
        if (path != "/")
        {
            path = path.TrimEnd(Constants.CharArrays.ForwardSlash);
+
+            // perform fallback to root if the path was all slashes (i.e. https://some.where//////)
+            if (path == string.Empty)
+            {
+                path = "/";
+            }
        }

        return uri.Rewrite(path);
@@ -8,10 +8,22 @@ public class TreeChange<TItem>
        ChangeTypes = changeTypes;
    }

+    public TreeChange(TItem changedItem, TreeChangeTypes changeTypes, IEnumerable<string>? publishedCultures, IEnumerable<string>? unpublishedCultures)
+    {
+        Item = changedItem;
+        ChangeTypes = changeTypes;
+        PublishedCultures = publishedCultures;
+        UnpublishedCultures = unpublishedCultures;
+    }
+
    public TItem Item { get; }

    public TreeChangeTypes ChangeTypes { get; }

+    public IEnumerable<string>? PublishedCultures { get; }
+
+    public IEnumerable<string>? UnpublishedCultures { get; }
+
    public EventArgs ToEventArgs() => new EventArgs(this);

    public class EventArgs : System.EventArgs
@@ -1595,7 +1595,12 @@ public class ContentService : RepositoryService, IContentService
                // events and audit
                scope.Notifications.Publish(
                    new ContentUnpublishedNotification(content, eventMessages).WithState(notificationState));
-                scope.Notifications.Publish(new ContentTreeChangeNotification(content, TreeChangeTypes.RefreshBranch, eventMessages));
+                scope.Notifications.Publish(new ContentTreeChangeNotification(
+                    content,
+                    TreeChangeTypes.RefreshBranch,
+                    variesByCulture ? culturesPublishing.IsCollectionEmpty() ? null : culturesPublishing : null,
+                    variesByCulture ? culturesUnpublishing.IsCollectionEmpty() ? null : culturesUnpublishing : ["*"],
+                    eventMessages));

                if (culturesUnpublishing != null)
                {
@@ -1654,7 +1659,12 @@ public class ContentService : RepositoryService, IContentService
                if (!branchOne)
                {
                    scope.Notifications.Publish(
-                        new ContentTreeChangeNotification(content, changeType, eventMessages));
+                        new ContentTreeChangeNotification(
+                            content,
+                            changeType,
+                            variesByCulture ? culturesPublishing.IsCollectionEmpty() ? null : culturesPublishing : ["*"],
+                            variesByCulture ? culturesUnpublishing.IsCollectionEmpty() ? null : culturesUnpublishing : null,
+                            eventMessages));
                    scope.Notifications.Publish(
                        new ContentPublishedNotification(content, eventMessages).WithState(notificationState));
                }
@@ -1953,17 +1963,14 @@ public class ContentService : RepositoryService, IContentService
    }

    // utility 'ShouldPublish' func used by SaveAndPublishBranch
-    private HashSet<string>? SaveAndPublishBranch_ShouldPublish(ref HashSet<string>? cultures, string c, bool published, bool edited, bool isRoot, bool force)
+    private HashSet<string>? SaveAndPublishBranch_ShouldPublish(ref HashSet<string>? cultures, string c, bool published, bool edited, bool isRoot, PublishBranchFilter publishBranchFilter)
    {
        // if published, republish
        if (published)
        {
-            if (cultures == null)
-            {
-                cultures = new HashSet<string>(); // empty means 'already published'
-            }
+            cultures ??= []; // empty means 'already published'

-            if (edited)
+            if (edited || publishBranchFilter.HasFlag(PublishBranchFilter.ForceRepublish))
            {
                cultures.Add(c); // <culture> means 'republish this culture'
            }
@@ -1972,15 +1979,12 @@ public class ContentService : RepositoryService, IContentService
        }

        // if not published, publish if force/root else do nothing
-        if (!force && !isRoot)
+        if (!publishBranchFilter.HasFlag(PublishBranchFilter.IncludeUnpublished) && !isRoot)
        {
            return cultures; // null means 'nothing to do'
        }

-        if (cultures == null)
-        {
-            cultures = new HashSet<string>();
-        }
+        cultures ??= [];

        cultures.Add(c); // <culture> means 'publish this culture'
        return cultures;
@@ -1988,6 +1992,10 @@ public class ContentService : RepositoryService, IContentService

    /// <inheritdoc />
    public IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, bool force, string culture = "*", int userId = Constants.Security.SuperUserId)
+        => SaveAndPublishBranch(content, force ? PublishBranchFilter.IncludeUnpublished : PublishBranchFilter.Default, culture, userId);
+
+    /// <inheritdoc />
+    public IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, PublishBranchFilter publishBranchFilter, string culture = "*", int userId = Constants.Security.SuperUserId)
    {
        // note: EditedValue and PublishedValue are objects here, so it is important to .Equals()
        // and not to == them, else we would be comparing references, and that is a bad thing
@@ -2006,13 +2014,13 @@ public class ContentService : RepositoryService, IContentService
            // invariant content type
            if (!c.ContentType.VariesByCulture())
            {
-                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, "*", c.Published, c.Edited, isRoot, force);
+                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, "*", c.Published, c.Edited, isRoot, publishBranchFilter);
            }

            // variant content type, specific culture
            if (culture != "*")
            {
-                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, culture, c.IsCulturePublished(culture), c.IsCultureEdited(culture), isRoot, force);
+                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, culture, c.IsCulturePublished(culture), c.IsCultureEdited(culture), isRoot, publishBranchFilter);
            }

            // variant content type, all cultures
@@ -2022,23 +2030,27 @@ public class ContentService : RepositoryService, IContentService
                // others will have to 'republish this culture'
                foreach (var x in c.AvailableCultures)
                {
-                    SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, x, c.IsCulturePublished(x), c.IsCultureEdited(x), isRoot, force);
+                    SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, x, c.IsCulturePublished(x), c.IsCultureEdited(x), isRoot, publishBranchFilter);
                }

                return culturesToPublish;
            }

-            // if not published, publish if force/root else do nothing
-            return force || isRoot
+            // if not published, publish if forcing unpublished/root else do nothing
+            return publishBranchFilter.HasFlag(PublishBranchFilter.IncludeUnpublished) || isRoot
                ? new HashSet<string> { "*" } // "*" means 'publish all'
                : null; // null means 'nothing to do'
        }

-        return SaveAndPublishBranch(content, force, ShouldPublish, SaveAndPublishBranch_PublishCultures, userId);
+        return SaveAndPublishBranch(content, ShouldPublish, SaveAndPublishBranch_PublishCultures, userId);
    }

    /// <inheritdoc />
    public IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, bool force, string[] cultures, int userId = Constants.Security.SuperUserId)
+        => SaveAndPublishBranch(content, force ? PublishBranchFilter.IncludeUnpublished : PublishBranchFilter.Default, cultures, userId);
+
+    /// <inheritdoc />
+    public IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, PublishBranchFilter publishBranchFilter, string[] cultures, int userId = Constants.Security.SuperUserId)
    {
        // note: EditedValue and PublishedValue are objects here, so it is important to .Equals()
        // and not to == them, else we would be comparing references, and that is a bad thing
@@ -2054,7 +2066,7 @@ public class ContentService : RepositoryService, IContentService
            // invariant content type
            if (!c.ContentType.VariesByCulture())
            {
-                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, "*", c.Published, c.Edited, isRoot, force);
+                return SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, "*", c.Published, c.Edited, isRoot, publishBranchFilter);
            }

            // variant content type, specific cultures
@@ -2064,24 +2076,23 @@ public class ContentService : RepositoryService, IContentService
                // others will have to 'republish this culture'
                foreach (var x in cultures)
                {
-                    SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, x, c.IsCulturePublished(x), c.IsCultureEdited(x), isRoot, force);
+                    SaveAndPublishBranch_ShouldPublish(ref culturesToPublish, x, c.IsCulturePublished(x), c.IsCultureEdited(x), isRoot, publishBranchFilter);
                }

                return culturesToPublish;
            }

-            // if not published, publish if force/root else do nothing
-            return force || isRoot
+            // if not published, publish if forcing unpublished/root else do nothing
+            return publishBranchFilter.HasFlag(PublishBranchFilter.IncludeUnpublished) || isRoot
                ? new HashSet<string>(cultures) // means 'publish specified cultures'
                : null; // null means 'nothing to do'
        }

-        return SaveAndPublishBranch(content, force, ShouldPublish, SaveAndPublishBranch_PublishCultures, userId);
+        return SaveAndPublishBranch(content, ShouldPublish, SaveAndPublishBranch_PublishCultures, userId);
    }

    internal IEnumerable<PublishResult> SaveAndPublishBranch(
        IContent document,
-        bool force,
        Func<IContent, HashSet<string>?> shouldPublish,
        Func<IContent, HashSet<string>, IReadOnlyCollection<ILanguage>, bool> publishCultures,
        int userId = Constants.Security.SuperUserId)
@@ -2118,7 +2129,8 @@ public class ContentService : RepositoryService, IContentService
            }

            // deal with the branch root - if it fails, abort
-            PublishResult? result = SaveAndPublishBranchItem(scope, document, shouldPublish, publishCultures, true, publishedDocuments, eventMessages, userId, allLangs, out IDictionary<string, object?> notificationState);
+            HashSet<string>? culturesToPublish = shouldPublish(document);
+            PublishResult? result = SaveAndPublishBranchItem(scope, document, culturesToPublish, publishCultures, true, publishedDocuments, eventMessages, userId, allLangs, out IDictionary<string, object?> notificationState);
            if (result != null)
            {
                results.Add(result);
@@ -2128,6 +2140,8 @@ public class ContentService : RepositoryService, IContentService
                }
            }

+            HashSet<string> culturesPublished = culturesToPublish ?? [];
+
            // deal with descendants
            // if one fails, abort its branch
            var exclude = new HashSet<int>();
@@ -2153,12 +2167,14 @@ public class ContentService : RepositoryService, IContentService
                    }

                    // no need to check path here, parent has to be published here
-                    result = SaveAndPublishBranchItem(scope, d, shouldPublish, publishCultures, false, publishedDocuments, eventMessages, userId, allLangs, out _);
+                    culturesToPublish = shouldPublish(d);
+                    result = SaveAndPublishBranchItem(scope, d, culturesToPublish, publishCultures, false, publishedDocuments, eventMessages, userId, allLangs, out _);
                    if (result != null)
                    {
                        results.Add(result);
                        if (result.Success)
                        {
+                            culturesPublished.UnionWith(culturesToPublish ?? []);
                            continue;
                        }
                    }
@@ -2175,8 +2191,14 @@ public class ContentService : RepositoryService, IContentService

            // trigger events for the entire branch
            // (SaveAndPublishBranchOne does *not* do it)
+            var variesByCulture = document.ContentType.VariesByCulture();
            scope.Notifications.Publish(
-                new ContentTreeChangeNotification(document, TreeChangeTypes.RefreshBranch, eventMessages));
+                new ContentTreeChangeNotification(
+                    document,
+                    TreeChangeTypes.RefreshBranch,
+                    variesByCulture ? culturesPublished.IsCollectionEmpty() ? null : culturesPublished : ["*"],
+                    null,
+                    eventMessages));
            scope.Notifications.Publish(new ContentPublishedNotification(publishedDocuments, eventMessages).WithState(notificationState));

            scope.Complete();
@@ -2191,7 +2213,7 @@ public class ContentService : RepositoryService, IContentService
    private PublishResult? SaveAndPublishBranchItem(
        ICoreScope scope,
        IContent document,
-        Func<IContent, HashSet<string>?> shouldPublish,
+        HashSet<string>? culturesToPublish,
        Func<IContent, HashSet<string>, IReadOnlyCollection<ILanguage>,
            bool> publishCultures,
        bool isRoot,
@@ -2202,7 +2224,6 @@ public class ContentService : RepositoryService, IContentService
        out IDictionary<string, object?> notificationState)
    {
        notificationState = new Dictionary<string, object?>();
-        HashSet<string>? culturesToPublish = shouldPublish(document);

        // null = do not include
        if (culturesToPublish == null)
@@ -2448,22 +2469,26 @@ public class ContentService : RepositoryService, IContentService
    /// <param name="content">The <see cref="IContent" /> to move</param>
    /// <param name="parentId">Id of the Content's new Parent</param>
    /// <param name="userId">Optional Id of the User moving the Content</param>
-    public void Move(IContent content, int parentId, int userId = Constants.Security.SuperUserId)
+    public void Move(IContent content, int parentId, int userId = Constants.Security.SuperUserId) =>
+        AttemptMove(content, parentId, userId);
+
+    /// <inheritdoc/>
+    [Obsolete("Adds return type to Move method. Will be removed in V14, as the original method will be adjusted.")]
+    public OperationResult AttemptMove(IContent content, int parentId, int userId = Constants.Security.SuperUserId)
    {
+        EventMessages eventMessages = EventMessagesFactory.Get();
+
        if (content.ParentId == parentId)
        {
-            return;
+            return OperationResult.Succeed(eventMessages);
        }

        // if moving to the recycle bin then use the proper method
        if (parentId == Constants.System.RecycleBinContent)
        {
-            MoveToRecycleBin(content, userId);
-            return;
+            return MoveToRecycleBin(content, userId);
        }

-        EventMessages eventMessages = EventMessagesFactory.Get();
-
        var moves = new List<(IContent, string)>();

        using (ICoreScope scope = ScopeProvider.CreateCoreScope())
@@ -2482,7 +2507,7 @@ public class ContentService : RepositoryService, IContentService
            if (scope.Notifications.PublishCancelable(movingNotification))
            {
                scope.Complete();
-                return; // causes rollback
+                return OperationResult.Cancel(eventMessages);// causes rollback
            }

            // if content was trashed, and since we're not moving to the recycle bin,
@@ -2517,6 +2542,8 @@ public class ContentService : RepositoryService, IContentService

            scope.Complete();
        }
+
+        return OperationResult.Succeed(eventMessages);
    }

    // MUST be called from within WriteLock
@@ -2754,6 +2781,9 @@ public class ContentService : RepositoryService, IContentService
                        descendantCopy.CreatorId = userId;
                        descendantCopy.WriterId = userId;

+                        // since the repository relies on the dirty state to figure out whether it needs to update the sort order, we mark it dirty here
+                        descendantCopy.SortOrder = descendantCopy.SortOrder;
+
                        // save and flush (see above)
                        _documentRepository.Save(descendantCopy);

@@ -3597,6 +3627,7 @@ public class ContentService : RepositoryService, IContentService

    private static readonly string?[] ArrayOfOneNullString = { null };

+    /// <inheritdoc />
    public IContent CreateContentFromBlueprint(IContent blueprint, string name, int userId = Constants.Security.SuperUserId)
    {
        if (blueprint == null)
@@ -108,7 +108,7 @@ public class DomainService : RepositoryService, IDomainService
        EventMessages eventMessages = EventMessagesFactory.Get();

        IDomain[] domains = items.ToArray();
-        if (domains.Length == 0)
+        if (domains.Length == 0 || AreDomainsAlreadySorted(domains))
        {
            return OperationResult.Attempt.NoOperation(eventMessages);
        }
@@ -144,4 +144,18 @@ public class DomainService : RepositoryService, IDomainService

        return OperationResult.Attempt.Succeed(eventMessages);
    }
+
+    private static bool AreDomainsAlreadySorted(IDomain[] domains)
+    {
+        // Check if the domains are already sorted by comparing the current sort order with what we'll set to be the new sort order.
+        for (int i = 0; i < domains.Length; i++)
+        {
+            if (domains[i].SortOrder != i)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }
@@ -80,4 +80,14 @@ public class ExternalLoginService : RepositoryService, IExternalLoginWithKeyServ
            scope.Complete();
        }
    }
+
+    /// <inheritdoc />
+    public void DeleteUserLoginsForRemovedProviders(IEnumerable<string> currentLoginProviders)
+    {
+        using (ICoreScope scope = ScopeProvider.CreateCoreScope())
+        {
+            _externalLoginRepository.DeleteUserLoginsForRemovedProviders(currentLoginProviders);
+            scope.Complete();
+        }
+    }
 }
@@ -1,3 +1,4 @@
+using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Membership;
 using Umbraco.Cms.Core.Persistence.Querying;
@@ -55,6 +56,9 @@ public interface IContentService : IContentServiceBase<IContent>
    /// <summary>
    ///     Creates a new content item from a blueprint.
    /// </summary>
+    /// <remarks>Warning: If you intend to save the resulting <c>IContent</c> as a content node, you must trigger a
+    /// <see cref="Notifications.ContentScaffoldedNotification"/> notification to ensure that the block ids are regenerated.
+    /// Failing to do so could lead to caching issues.</remarks>
    IContent CreateContentFromBlueprint(IContent blueprint, string name, int userId = Constants.Security.SuperUserId);

    /// <summary>
@@ -315,6 +319,21 @@ public interface IContentService : IContentServiceBase<IContent>
    /// </summary>
    void Move(IContent content, int parentId, int userId = Constants.Security.SuperUserId);

+    /// <summary>
+    /// Attempts to move the <see cref="IContent"/> <paramref name="content"/> to under the node with id <paramref name="parentId"/>.
+    /// </summary>
+    /// <param name="content">The <see cref="IContent"/> that shall be moved.</param>
+    /// <param name="parentId">The id of the new parent node.</param>
+    /// <param name="userId">Id of the user attempting to move <paramref name="content"/>.</param>
+    /// <returns>Success if moving succeeded, otherwise Failed.</returns>
+    [Obsolete("Adds return type to Move method. Will be removed in V14, as the original method will be adjusted.")]
+    OperationResult
+        AttemptMove(IContent content, int parentId, int userId = Constants.Security.SuperUserId)
+    {
+        Move(content, parentId, userId);
+        return OperationResult.Succeed(new EventMessages());
+    }
+
    /// <summary>
    ///     Copies a document.
    /// </summary>
@@ -415,6 +434,7 @@ public interface IContentService : IContentServiceBase<IContent>
    ///         published. The root of the branch is always published, regardless of <paramref name="force" />.
    ///     </para>
    /// </remarks>
+    [Obsolete("This method is not longer used as the 'force' parameter has been extended into options for publishing unpublished and re-publishing changed content. Please use the overload containing the parameter for those options instead.")]
    IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, bool force, string culture = "*", int userId = Constants.Security.SuperUserId);

    /// <summary>
@@ -431,8 +451,47 @@ public interface IContentService : IContentServiceBase<IContent>
    ///         published. The root of the branch is always published, regardless of <paramref name="force" />.
    ///     </para>
    /// </remarks>
+    [Obsolete("This method is not longer used as the 'force' parameter has been extended into options for publishing unpublished and re-publishing changed content. Please use the overload containing the parameter for those options instead.")]
    IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, bool force, string[] cultures, int userId = Constants.Security.SuperUserId);

+    /// <summary>
+    ///     Saves and publishes a document branch.
+    /// </summary>
+    /// <param name="content">The root document.</param>
+    /// <param name="publishBranchFilter">A value indicating options for force publishing unpublished or re-publishing unchanged content.</param>
+    /// <param name="culture">A culture, or "*" for all cultures.</param>
+    /// <param name="userId">The identifier of the user performing the operation.</param>
+    /// <remarks>
+    ///     <para>
+    ///         Unless specified, all cultures are re-published. Otherwise, one culture can be specified. To act on more
+    ///         than one culture, see the other overloads of this method.
+    ///     </para>
+    ///     <para>
+    ///         The root of the branch is always published, regardless of <paramref name="publishBranchFilter" />.
+    ///     </para>
+    /// </remarks>
+    IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, PublishBranchFilter publishBranchFilter, string culture = "*", int userId = Constants.Security.SuperUserId)
+#pragma warning disable CS0618 // Type or member is obsolete
+        => SaveAndPublishBranch(content, publishBranchFilter.HasFlag(PublishBranchFilter.IncludeUnpublished), culture, userId);
+#pragma warning restore CS0618 // Type or member is obsolete
+
+    /// <summary>
+    ///     Saves and publishes a document branch.
+    /// </summary>
+    /// <param name="content">The root document.</param>
+    /// <param name="publishBranchFilter">A value indicating options for force publishing unpublished or re-publishing unchanged content.</param>
+    /// <param name="cultures">The cultures to publish.</param>
+    /// <param name="userId">The identifier of the user performing the operation.</param>
+    /// <remarks>
+    ///     <para>
+    ///         The root of the branch is always published, regardless of <paramref name="publishBranchFilter" />.
+    ///     </para>
+    /// </remarks>
+    IEnumerable<PublishResult> SaveAndPublishBranch(IContent content, PublishBranchFilter publishBranchFilter, string[] cultures, int userId = Constants.Security.SuperUserId)
+#pragma warning disable CS0618 // Type or member is obsolete
+        => SaveAndPublishBranch(content, publishBranchFilter.HasFlag(PublishBranchFilter.IncludeUnpublished), cultures, userId);
+#pragma warning restore CS0618 // Type or member is obsolete
+
    ///// <summary>
    ///// Saves and publishes a document branch.
    ///// </summary>
@@ -5,47 +5,53 @@ namespace Umbraco.Cms.Core.Services;
 public interface IExternalLoginWithKeyService : IService
 {
    /// <summary>
-    ///     Returns all user logins assigned
+    ///     Returns all user logins assigned.
    /// </summary>
    IEnumerable<IIdentityUserLogin> GetExternalLogins(Guid userOrMemberKey);

    /// <summary>
-    ///     Returns all user login tokens assigned
+    ///     Returns all user login tokens assigned.
    /// </summary>
    IEnumerable<IIdentityUserToken> GetExternalLoginTokens(Guid userOrMemberKey);

    /// <summary>
    ///     Returns all logins matching the login info - generally there should only be one but in some cases
-    ///     there might be more than one depending on if an administrator has been editing/removing members
+    ///     there might be more than one depending on if an administrator has been editing/removing members.
    /// </summary>
    IEnumerable<IIdentityUserLogin> Find(string loginProvider, string providerKey);

    /// <summary>
-    ///     Saves the external logins associated with the user
+    ///     Saves the external logins associated with the user.
    /// </summary>
    /// <param name="userOrMemberKey">
-    ///     The user or member key associated with the logins
+    ///     The user or member key associated with the logins.
    /// </param>
    /// <param name="logins"></param>
    /// <remarks>
-    ///     This will replace all external login provider information for the user
+    ///     This will replace all external login provider information for the user.
    /// </remarks>
    void Save(Guid userOrMemberKey, IEnumerable<IExternalLogin> logins);

    /// <summary>
-    ///     Saves the external login tokens associated with the user
+    ///     Saves the external login tokens associated with the user.
    /// </summary>
    /// <param name="userOrMemberKey">
-    ///     The user or member key associated with the logins
+    ///     The user or member key associated with the logins.
    /// </param>
    /// <param name="tokens"></param>
    /// <remarks>
-    ///     This will replace all external login tokens for the user
+    ///     This will replace all external login tokens for the user.
    /// </remarks>
    void Save(Guid userOrMemberKey, IEnumerable<IExternalLoginToken> tokens);

    /// <summary>
-    ///     Deletes all user logins - normally used when a member is deleted
+    ///     Deletes all user logins - normally used when a member is deleted.
    /// </summary>
    void DeleteUserLogins(Guid userOrMemberKey);
+
+    /// <summary>
+    ///     Deletes external logins that aren't associated with the current collection of providers.
+    /// </summary>
+    /// <param name="currentLoginProviders">The names of the currently configured providers.</param>
+    void DeleteUserLoginsForRemovedProviders(IEnumerable<string> currentLoginProviders) { }
 }
@@ -210,6 +210,21 @@ public interface IMemberService : IMembershipMemberService
    /// </returns>
    IMember? GetById(int id);

+    /// <summary>
+    ///     Get an list of <see cref="IMember"/> for all members with the specified email.
+    /// </summary>
+    //// <param name="email">Email to use for retrieval</param>
+    /// <returns>
+    ///     <see cref="IEnumerable{IMember}" />
+    /// </returns>
+    IEnumerable<IMember> GetMembersByEmail(string email)
+        =>
+        // TODO (V16): Remove this default implementation.
+        // The following is very inefficient, but will return the correct data, so probably better than throwing a NotImplementedException
+        // in the default implentation here, for, presumably rare, cases where a custom IMemberService implementation has been registered and
+        // does not override this method.
+        GetAllMembers().Where(x => x.Email.Equals(email));
+
    /// <summary>
    ///     Gets all Members for the specified MemberType alias
    /// </summary>
@@ -328,4 +343,11 @@ public interface IMemberService : IMembershipMemberService
    ///     <see cref="IEnumerable{IMember}" />
    /// </returns>
    IEnumerable<IMember>? GetMembersByPropertyValue(string propertyTypeAlias, DateTime value, ValuePropertyMatchType matchType = ValuePropertyMatchType.Exact);
+
+    /// <summary>
+    /// Saves only the properties related to login for the member, using an optimized, non-locking update.
+    /// </summary>
+    /// <param name="member">The member to update.</param>
+    /// <returns>Used to avoid the full save of the member object after a login operation.</returns>
+    Task UpdateLoginPropertiesAsync(IMember member) => Task.CompletedTask;
 }
@@ -135,6 +135,14 @@ public interface IMembershipMemberService<T> : IService
    /// <param name="entity"><see cref="IMember" /> or <see cref="IUser" /> to Save</param>
    void Save(T entity);

+    /// <summary>
+    ///     Saves an <see cref="IMembershipUser" />
+    /// </summary>
+    /// <remarks>An <see cref="IMembershipUser" /> can be of type <see cref="IMember" /> or <see cref="IUser" /></remarks>
+    /// <param name="entity"><see cref="IMember" /> or <see cref="IUser" /> to Save</param>
+    /// <param name="publishNotificationSaveOptions"> Enum for deciding which notifications to publish.</param>
+    void Save(T entity, PublishNotificationSaveOptions publishNotificationSaveOptions) => Save(entity);
+
    /// <summary>
    ///     Saves a list of <see cref="IMembershipUser" /> objects
    /// </summary>
@@ -231,8 +231,29 @@ public interface IUserService : IMembershipUserService
    /// </returns>
    IEnumerable<IUser> GetAllNotInGroup(int groupId);

+    /// <summary>
+    ///    Gets a page of users, ordered by Id and starting from the provided Id.
+    /// </summary>
+    /// <param name="id">The user Id to start retrieving users from.</param>
+    /// <param name="count">The number of users to return.</param>
+    /// <returns>A page of <see cref="IUser"/> instances.</returns>
+    [Obsolete("No longer used in Umbraco. Scheduled for removal in Umbraco 18.")]
    IEnumerable<IUser> GetNextUsers(int id, int count);

+    /// <summary>
+    ///    Gets a page of approved users, ordered by Id and starting from the provided Id.
+    /// </summary>
+    /// <param name="id">The user Id to start retrieving users from.</param>
+    /// <param name="count">The number of users to return.</param>
+    /// <returns>A page of <see cref="IUser"/> instances.</returns>
+    IEnumerable<IUser> GetNextApprovedUsers(int id, int count) => Enumerable.Empty<IUser>();
+
+    /// <summary>
+    ///     Invalidates sessions for users that aren't associated with the current collection of providers.
+    /// </summary>
+    /// <param name="currentLoginProviders">The keys for the currently configured providers.</param>
+    void InvalidateSessionsForRemovedProviders(IEnumerable<string> currentLoginProviders) { }
+
    #region User groups

    /// <summary>
@@ -418,7 +418,7 @@ namespace Umbraco.Cms.Core.Services
            }

            using ICoreScope scope = ScopeProvider.CreateCoreScope(autoComplete: true);
-            scope.ReadLock(Constants.Locks.ContentTree);
+            scope.ReadLock(Constants.Locks.MediaTree);
            return _mediaRepository.GetPage(Query<IMedia>()?.Where(x => x.ContentTypeId == contentTypeId), pageIndex, pageSize, out totalRecords, filter, ordering);
        }

@@ -441,7 +441,7 @@ namespace Umbraco.Cms.Core.Services
            }

            using ICoreScope scope = ScopeProvider.CreateCoreScope(autoComplete: true);
-            scope.ReadLock(Constants.Locks.ContentTree);
+            scope.ReadLock(Constants.Locks.MediaTree);
            return _mediaRepository.GetPage(
                Query<IMedia>()?.Where(x => contentTypeIds.Contains(x.ContentTypeId)), pageIndex, pageSize, out totalRecords, filter, ordering);
        }
@@ -389,16 +389,23 @@ namespace Umbraco.Cms.Core.Services
        }

        /// <summary>
-        /// Get an <see cref="IMember"/> by email
+        /// Get an <see cref="IMember"/> by email. If RequireUniqueEmailForMembers is set to false, then the first member found with the specified email will be returned.
        /// </summary>
        /// <param name="email">Email to use for retrieval</param>
        /// <returns><see cref="IMember"/></returns>
-        public IMember? GetByEmail(string email)
+        public IMember? GetByEmail(string email) => GetMembersByEmail(email).FirstOrDefault();
+
+        /// <summary>
+        /// Get an list of <see cref="IMember"/> for all members with the specified email.
+        /// </summary>
+        /// <param name="email">Email to use for retrieval</param>
+        /// <returns><see cref="IEnumerable{IMember}"/></returns>
+        public IEnumerable<IMember> GetMembersByEmail(string email)
        {
            using ICoreScope scope = ScopeProvider.CreateCoreScope(autoComplete: true);
            scope.ReadLock(Constants.Locks.MemberTree);
            IQuery<IMember> query = Query<IMember>().Where(x => x.Email.Equals(email));
-            return _memberRepository.Get(query)?.FirstOrDefault();
+            return _memberRepository.Get(query);
        }

        /// <summary>
@@ -736,7 +743,9 @@ namespace Umbraco.Cms.Core.Services
        public void SetLastLogin(string username, DateTime date) => throw new NotImplementedException();

        /// <inheritdoc />
-        public void Save(IMember member)
+        public void Save(IMember member) => Save(member, PublishNotificationSaveOptions.All);
+
+        public void Save(IMember member, PublishNotificationSaveOptions publishNotificationSaveOptions)
        {
            // trimming username and email to make sure we have no trailing space
            member.Username = member.Username.Trim();
@@ -745,11 +754,15 @@ namespace Umbraco.Cms.Core.Services
            EventMessages evtMsgs = EventMessagesFactory.Get();

            using ICoreScope scope = ScopeProvider.CreateCoreScope();
-            var savingNotification = new MemberSavingNotification(member, evtMsgs);
-            if (scope.Notifications.PublishCancelable(savingNotification))
+            MemberSavingNotification? savingNotification = null;
+            if (publishNotificationSaveOptions.HasFlag(PublishNotificationSaveOptions.Saving))
            {
-                scope.Complete();
-                return;
+                savingNotification = new MemberSavingNotification(member, evtMsgs);
+                if (scope.Notifications.PublishCancelable(savingNotification))
+                {
+                    scope.Complete();
+                    return;
+                }
            }

            if (string.IsNullOrWhiteSpace(member.Name))
@@ -761,7 +774,13 @@ namespace Umbraco.Cms.Core.Services

            _memberRepository.Save(member);

-            scope.Notifications.Publish(new MemberSavedNotification(member, evtMsgs).WithStateFrom(savingNotification));
+            if (publishNotificationSaveOptions.HasFlag(PublishNotificationSaveOptions.Saved))
+            {
+                scope.Notifications.Publish(
+                    savingNotification is null
+                    ? new MemberSavedNotification(member, evtMsgs)
+                    : new MemberSavedNotification(member, evtMsgs).WithStateFrom(savingNotification));
+            }

            Audit(AuditType.Save, 0, member.Id);

@@ -801,6 +820,48 @@ namespace Umbraco.Cms.Core.Services
            scope.Complete();
        }

+        /// <inheritdoc/>
+        /// <remarks>
+        /// <para>
+        ///     Note that in this optimized member save operation for use in the login process, where we only handle login related
+        ///     properties, we aren't taking any locks. If we were updating "content" properties, that could have relations between each
+        ///     other, we should following what we do for documents and lock.
+        ///     But here we are just updating these system fields, and it's fine if they work in a "last one wins" fashion without locking.
+        /// </para>
+        /// <para>
+        ///      Note also that we aren't calling "Audit" here (as well as to optimize performance, this is deliberate, because this is not
+        ///      a full save operation on the member that we'd want to audit who made the changes via the backoffice or API; rather it's
+        ///      just the member logging in as themselves).
+        /// </para>
+        /// <para>
+        ///      We are though publishing notifications, to maintain backwards compatibility for any solutions using these for
+        ///      processing following a member login.
+        /// </para>
+        /// <para>
+        ///      These notification handlers will ensure that the records to umbracoLog are also added in the same way as they
+        ///      are for a full save operation.
+        /// </para>
+        /// </remarks>
+        public async Task UpdateLoginPropertiesAsync(IMember member)
+        {
+            EventMessages evtMsgs = EventMessagesFactory.Get();
+
+            using ICoreScope scope = ScopeProvider.CreateCoreScope();
+            var savingNotification = new MemberSavingNotification(member, evtMsgs);
+            savingNotification.State.Add("LoginPropertiesOnly", true);
+            if (scope.Notifications.PublishCancelable(savingNotification))
+            {
+                scope.Complete();
+                return;
+            }
+
+            await _memberRepository.UpdateLoginPropertiesAsync(member);
+
+            scope.Notifications.Publish(new MemberSavedNotification(member, evtMsgs).WithStateFrom(savingNotification));
+
+            scope.Complete();
+        }
+
        #endregion

        #region Delete
@@ -96,7 +96,7 @@ public class NotificationService : INotificationService

        // see notes above
        var id = Constants.Security.SuperUserId;
-        const int pagesz = 400; // load batches of 400 users
+        const int UserBatchSize = 400; // load batches of 400 users
        do
        {
            var notifications = GetUsersNotifications(new List<int>(), action, Enumerable.Empty<int>(), Constants.ObjectTypes.Document)?.ToList();
@@ -106,10 +106,10 @@ public class NotificationService : INotificationService
            }

            // users are returned ordered by id, notifications are returned ordered by user id
-            var users = _userService.GetNextUsers(id, pagesz).Where(x => x.IsApproved).ToList();
-            foreach (IUser user in users)
+            var approvedUsers = _userService.GetNextApprovedUsers(id, UserBatchSize).ToList();
+            foreach (IUser approvedUser in approvedUsers)
            {
-                Notification[] userNotifications = notifications.Where(n => n.UserId == user.Id).ToArray();
+                Notification[] userNotifications = notifications.Where(n => n.UserId == approvedUser.Id).ToArray();
                foreach (Notification notification in userNotifications)
                {
                    // notifications are inherited down the tree - find the topmost entity
@@ -130,14 +130,14 @@ public class NotificationService : INotificationService
                    }

                    // queue notification
-                    NotificationRequest req = CreateNotificationRequest(operatingUser, user, entityForNotification, prevVersionDictionary[entityForNotification.Id], actionName, siteUri, createSubject, createBody);
+                    NotificationRequest req = CreateNotificationRequest(operatingUser, approvedUser, entityForNotification, prevVersionDictionary[entityForNotification.Id], actionName, siteUri, createSubject, createBody);
                    Enqueue(req);
                    break;
                }
            }

            // load more users if any
-            id = users.Count == pagesz ? users.Last().Id + 1 : -1;
+            id = approvedUsers.Count == UserBatchSize ? approvedUsers.Last().Id + 1 : -1;
        }
        while (id > 0);
    }
@@ -712,6 +712,7 @@ internal class UserService : RepositoryService, IUserService
        }
    }

+    /// <inheritdoc/>
    public IEnumerable<IUser> GetNextUsers(int id, int count)
    {
        using (ICoreScope scope = ScopeProvider.CreateCoreScope(autoComplete: true))
@@ -720,6 +721,25 @@ internal class UserService : RepositoryService, IUserService
        }
    }

+    /// <inheritdoc/>
+    public IEnumerable<IUser> GetNextApprovedUsers(int id, int count)
+    {
+        using (ICoreScope scope = ScopeProvider.CreateCoreScope(autoComplete: true))
+        {
+            return _userRepository.GetNextApprovedUsers(id, count);
+        }
+    }
+
+    /// <inheritdoc />
+    public void InvalidateSessionsForRemovedProviders(IEnumerable<string> currentLoginProviders)
+    {
+        using (ICoreScope scope = ScopeProvider.CreateCoreScope())
+        {
+            _userRepository.InvalidateSessionsForRemovedProviders(currentLoginProviders);
+            scope.Complete();
+        }
+    }
+
    /// <summary>
    ///     Gets a list of <see cref="IUser" /> objects associated with a given group
    /// </summary>
@@ -74,12 +74,21 @@ public class DefaultShortStringHelperConfig
        {
            urlSegmentConvertTo = CleanStringType.Ascii;
        }
-
-        if (requestHandlerSettings.ShouldTryConvertUrlsToAscii)
+        else if (requestHandlerSettings.ShouldTryConvertUrlsToAscii)
        {
            urlSegmentConvertTo = CleanStringType.TryAscii;
        }

+        CleanStringType fileNameSegmentConvertTo = CleanStringType.Utf8;
+        if (requestHandlerSettings.ShouldConvertFileNamesToAscii)
+        {
+            fileNameSegmentConvertTo = CleanStringType.Ascii;
+        }
+        else if (requestHandlerSettings.ShouldTryConvertFileNamesToAscii)
+        {
+            fileNameSegmentConvertTo = CleanStringType.TryAscii;
+        }
+
        return WithConfig(CleanStringType.UrlSegment, new Config
        {
            PreFilter = ApplyUrlReplaceCharacters,
@@ -92,7 +101,7 @@ public class DefaultShortStringHelperConfig
        {
            PreFilter = ApplyUrlReplaceCharacters,
            IsTerm = (c, leading) => char.IsLetterOrDigit(c) || c == '_', // letter, digit or underscore
-            StringType = CleanStringType.Utf8 | CleanStringType.LowerCase,
+            StringType = fileNameSegmentConvertTo | CleanStringType.LowerCase,
            BreakTermsOnUpper = false,
            Separator = '-',
        }).WithConfig(CleanStringType.Alias, new Config
@@ -0,0 +1,166 @@
+namespace Umbraco.Cms.Core;
+
+/// <summary>
+/// Makes a code block timed (take at least a certain amount of time). This class cannot be inherited.
+/// </summary>
+public sealed class TimedScope : IDisposable, IAsyncDisposable
+{
+    private readonly TimeSpan _duration;
+    private readonly TimeProvider _timeProvider;
+    private readonly CancellationTokenSource _cancellationTokenSource;
+    private readonly long _startingTimestamp;
+
+    /// <summary>
+    /// Gets the elapsed time.
+    /// </summary>
+    /// <value>
+    /// The elapsed time.
+    /// </value>
+    public TimeSpan Elapsed
+        => _timeProvider.GetElapsedTime(_startingTimestamp);
+
+    /// <summary>
+    /// Gets the remaining time.
+    /// </summary>
+    /// <value>
+    /// The remaining time.
+    /// </value>
+    public TimeSpan Remaining
+        => TryGetRemaining(out TimeSpan remaining) ? remaining : TimeSpan.Zero;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="millisecondsDuration">The number of milliseconds the scope should at least take.</param>
+    public TimedScope(long millisecondsDuration)
+        : this(TimeSpan.FromMilliseconds(millisecondsDuration))
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="millisecondsDuration">The number of milliseconds the scope should at least take.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    public TimedScope(long millisecondsDuration, CancellationToken cancellationToken)
+        : this(TimeSpan.FromMilliseconds(millisecondsDuration), cancellationToken)
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="millisecondsDuration">The number of milliseconds the scope should at least take.</param>
+    /// <param name="timeProvider">The time provider.</param>
+    public TimedScope(long millisecondsDuration, TimeProvider timeProvider)
+        : this(TimeSpan.FromMilliseconds(millisecondsDuration), timeProvider)
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="millisecondsDuration">The number of milliseconds the scope should at least take.</param>
+    /// <param name="timeProvider">The time provider.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    public TimedScope(long millisecondsDuration, TimeProvider timeProvider, CancellationToken cancellationToken)
+        : this(TimeSpan.FromMilliseconds(millisecondsDuration), timeProvider, cancellationToken)
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope"/> class.
+    /// </summary>
+    /// <param name="duration">The duration the scope should at least take.</param>
+    public TimedScope(TimeSpan duration)
+        : this(duration, TimeProvider.System)
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="duration">The duration the scope should at least take.</param>
+    /// <param name="timeProvider">The time provider.</param>
+    public TimedScope(TimeSpan duration, TimeProvider timeProvider)
+        : this(duration, timeProvider, new CancellationTokenSource())
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="duration">The duration the scope should at least take.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    public TimedScope(TimeSpan duration, CancellationToken cancellationToken)
+        : this(duration, TimeProvider.System, cancellationToken)
+    { }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TimedScope" /> class.
+    /// </summary>
+    /// <param name="duration">The duration the scope should at least take.</param>
+    /// <param name="timeProvider">The time provider.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    public TimedScope(TimeSpan duration, TimeProvider timeProvider, CancellationToken cancellationToken)
+        : this(duration, timeProvider, CancellationTokenSource.CreateLinkedTokenSource(cancellationToken))
+    { }
+
+    private TimedScope(TimeSpan duration, TimeProvider timeProvider, CancellationTokenSource cancellationTokenSource)
+    {
+        _duration = duration;
+        _timeProvider = timeProvider;
+        _cancellationTokenSource = cancellationTokenSource;
+        _startingTimestamp = timeProvider.GetTimestamp();
+    }
+
+    /// <summary>
+    /// Cancels the timed scope.
+    /// </summary>
+    public void Cancel()
+        => _cancellationTokenSource.Cancel();
+
+    /// <summary>
+    /// Cancels the timed scope asynchronously.
+    /// </summary>
+    public async Task CancelAsync()
+        => await _cancellationTokenSource.CancelAsync().ConfigureAwait(false);
+
+    /// <summary>
+    /// Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.
+    /// </summary>
+    /// <remarks>
+    /// This will block using <see cref="Thread.Sleep(TimeSpan)" /> until the remaining time has elapsed, if not cancelled.
+    /// </remarks>
+    public void Dispose()
+    {
+        if (_cancellationTokenSource.IsCancellationRequested is false &&
+            TryGetRemaining(out TimeSpan remaining))
+        {
+            Thread.Sleep(remaining);
+        }
+
+        _cancellationTokenSource.Dispose();
+    }
+
+    /// <summary>
+    /// Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources asynchronously.
+    /// </summary>
+    /// <returns>
+    /// A task that represents the asynchronous dispose operation.
+    /// </returns>
+    /// <remarks>
+    /// This will delay using <see cref="Task.Delay(TimeSpan, TimeProvider, CancellationToken)" /> until the remaining time has elapsed, if not cancelled.
+    /// </remarks>
+    public async ValueTask DisposeAsync()
+    {
+        if (_cancellationTokenSource.IsCancellationRequested is false &&
+            TryGetRemaining(out TimeSpan remaining))
+        {
+            await Task.Delay(remaining, _timeProvider, _cancellationTokenSource.Token).ConfigureAwait(false);
+        }
+
+        _cancellationTokenSource.Dispose();
+    }
+
+    private bool TryGetRemaining(out TimeSpan remaining)
+    {
+        remaining = _duration.Subtract(Elapsed);
+
+        return remaining > TimeSpan.Zero;
+    }
+}
@@ -9,6 +9,15 @@ namespace Umbraco.Cms.Core.DependencyInjection;
 /// </summary>
 public static class WebhookEventCollectionBuilderCmsExtensions
 {
+    private static readonly Type[] _defaultTypes =
+    [
+        typeof(ContentDeletedWebhookEvent),
+        typeof(ContentPublishedWebhookEvent),
+        typeof(ContentUnpublishedWebhookEvent),
+        typeof(MediaDeletedWebhookEvent),
+        typeof(MediaSavedWebhookEvent),
+    ];
+
    /// <summary>
    /// Adds the default webhook events.
    /// </summary>
@@ -21,12 +30,24 @@ public static class WebhookEventCollectionBuilderCmsExtensions
    /// </remarks>
    public static WebhookEventCollectionBuilderCms AddDefault(this WebhookEventCollectionBuilderCms builder)
    {
-        builder.Builder
-            .Add<ContentDeletedWebhookEvent>()
-            .Add<ContentPublishedWebhookEvent>()
-            .Add<ContentUnpublishedWebhookEvent>()
-            .Add<MediaDeletedWebhookEvent>()
-            .Add<MediaSavedWebhookEvent>();
+        builder.Builder.Add(_defaultTypes);
+
+        return builder;
+    }
+
+    /// <summary>
+    /// Removes the default webhook events.
+    /// </summary>
+    /// <param name="builder">The builder.</param>
+    /// <returns>
+    /// The builder.
+    /// </returns>
+    public static WebhookEventCollectionBuilderCms RemoveDefault(this WebhookEventCollectionBuilderCms builder)
+    {
+        foreach (Type type in _defaultTypes)
+        {
+            builder.Builder.Remove(type);
+        }

        return builder;
    }
@@ -10,6 +10,8 @@
    <PackageReference Include="Examine" />
    <!-- Take top-level depedendency on System.Security.Cryptography.Xml, because Examine depends on a vulnerable version -->
    <PackageReference Include="System.Security.Cryptography.Xml" />
+    <!-- Take top-level depedendency on Lucene.Net.Replicator-->
+    <PackageReference Include="Lucene.Net.Replicator" />
  </ItemGroup>

  <ItemGroup>
@@ -51,6 +51,12 @@ public class WebhookFiring : IRecurringBackgroundJob

    public async Task RunJobAsync()
    {
+        if (_webhookSettings.Enabled is false)
+        {
+            _logger.LogInformation("WebhookFiring task will not run as it has been globally disabled via configuration");
+            return;
+        }
+
        IEnumerable<WebhookRequest> requests;
        using (ICoreScope scope = _coreScopeProvider.CreateCoreScope())
        {
@@ -116,6 +116,7 @@ public class DefaultRepositoryCachePolicy<TEntity, TId> : RepositoryCachePolicyB
        {
            // whatever happens, clear the cache
            var cacheKey = GetEntityCacheKey(entity.Id);
+
            Cache.Clear(cacheKey);

            // if there's a GetAllCacheAllowZeroCount cache, ensure it is cleared
@@ -127,20 +128,34 @@ public class DefaultRepositoryCachePolicy<TEntity, TId> : RepositoryCachePolicyB
    public override TEntity? Get(TId? id, Func<TId?, TEntity?> performGet, Func<TId[]?, IEnumerable<TEntity>?> performGetAll)
    {
        var cacheKey = GetEntityCacheKey(id);
+
        TEntity? fromCache = Cache.GetCacheItem<TEntity>(cacheKey);

-        // if found in cache then return else fetch and cache
-        if (fromCache != null)
+        // If found in cache then return immediately.
+        if (fromCache is not null)
        {
            return fromCache;
        }

+        // If we've cached a "null" value, return null.
+        if (_options.CacheNullValues && Cache.GetCacheItem<string>(cacheKey) == Constants.Cache.NullRepresentationInCache)
+        {
+            return null;
+        }
+
+        // Otherwise go to the database to retrieve.
        TEntity? entity = performGet(id);

        if (entity != null && entity.HasIdentity)
        {
+            // If we've found an identified entity, cache it for subsequent retrieval.
            InsertEntity(cacheKey, entity);
        }
+        else if (entity is null && _options.CacheNullValues)
+        {
+            // If we've not found an entity, and we're caching null values, cache a "null" value.
+            InsertNull(cacheKey);
+        }

        return entity;
    }
@@ -248,6 +263,15 @@ public class DefaultRepositoryCachePolicy<TEntity, TId> : RepositoryCachePolicyB
    protected virtual void InsertEntity(string cacheKey, TEntity entity)
        => Cache.Insert(cacheKey, () => entity, TimeSpan.FromMinutes(5), true);

+    protected virtual void InsertNull(string cacheKey)
+    {
+        // We can't actually cache a null value, as in doing so wouldn't be able to distinguish between
+        // a value that does exist but isn't yet cached, or a value that has been explicitly cached with a null value.
+        // Both would return null when we retrieve from the cache and we couldn't distinguish between the two.
+        // So we cache a special value that represents null, and then we can check for that value when we retrieve from the cache.
+        Cache.Insert(cacheKey, () => Constants.Cache.NullRepresentationInCache, TimeSpan.FromMinutes(5), true);
+    }
+
    protected virtual void InsertEntities(TId[]? ids, TEntity[]? entities)
    {
        if (ids?.Length == 0 && entities?.Length == 0 && _options.GetAllCacheAllowZeroCount)
@@ -0,0 +1,39 @@
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Infrastructure.Scoping;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Core.Cache;
+
+public class MemberRepositoryUsernameCachePolicy : DefaultRepositoryCachePolicy<IMember, string>
+{
+    public MemberRepositoryUsernameCachePolicy(IAppPolicyCache cache, IScopeAccessor scopeAccessor, RepositoryCachePolicyOptions options) : base(cache, scopeAccessor, options)
+    {
+    }
+
+    public IMember? GetByUserName(string key, string? username, Func<string?, IMember?> performGetByUsername, Func<string[]?, IEnumerable<IMember>?> performGetAll)
+    {
+        var cacheKey = GetEntityCacheKey(key + username);
+        IMember? fromCache = Cache.GetCacheItem<IMember>(cacheKey);
+
+        // if found in cache then return else fetch and cache
+        if (fromCache != null)
+        {
+            return fromCache;
+        }
+
+        IMember? entity = performGetByUsername(username);
+
+        if (entity != null && entity.HasIdentity)
+        {
+            InsertEntity(cacheKey, entity);
+        }
+
+        return entity;
+    }
+
+    public void DeleteByUserName(string key, string? username)
+    {
+        var cacheKey = GetEntityCacheKey(key + username);
+        Cache.ClearByKey(cacheKey);
+    }
+}
@@ -1,13 +1,10 @@
-using HtmlAgilityPack;
-using Microsoft.Extensions.DependencyInjection;
+using HtmlAgilityPack;
 using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.Blocks;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.PublishedCache;
-using Umbraco.Cms.Core.Routing;
 using Umbraco.Cms.Infrastructure.Extensions;
 using Umbraco.Extensions;

@@ -101,8 +98,9 @@ internal sealed class ApiRichTextElementParser : ApiRichTextParserBase, IApiRich
        // - non-#comment nodes
        // - non-#text nodes
        // - non-empty #text nodes
+        // - empty #text between inline elements (see #17037) but not #text with only newlines (see #19388)
        HtmlNode[] childNodes = element.ChildNodes
-            .Where(c => c.Name != CommentNodeName && (c.Name != TextNodeName || string.IsNullOrWhiteSpace(c.InnerText) is false))
+            .Where(c => c.Name != CommentNodeName && (c.Name != TextNodeName || IsNonEmptyElement(c)))
            .ToArray();

        var tag = TagName(element);
@@ -123,6 +121,9 @@ internal sealed class ApiRichTextElementParser : ApiRichTextParserBase, IApiRich
        return createElement(tag, attributes, childElements);
    }

+    private static bool IsNonEmptyElement(HtmlNode htmlNode) =>
+        string.IsNullOrWhiteSpace(htmlNode.InnerText) is false || htmlNode.InnerText.Any(c => c != '\n' && c != '\r');
+
    private string TagName(HtmlNode htmlNode) => htmlNode.Name;

    private void ReplaceLocalLinks(IPublishedSnapshot publishedSnapshot, Dictionary<string, object> attributes)
@@ -240,6 +240,7 @@ public static partial class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IBlockEditorElementTypeCache, BlockEditorElementTypeCache>();

        builder.Services.AddSingleton<IRichTextRequiredValidator, RichTextRequiredValidator>();
+        builder.Services.AddSingleton<IRichTextRegexValidator, RichTextRegexValidator>();

        return builder;
    }
@@ -454,6 +455,7 @@ public static partial class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IRequestRedirectService, NoopRequestRedirectService>();
        builder.Services.AddSingleton<IRequestPreviewService, NoopRequestPreviewService>();
        builder.Services.AddSingleton<IRequestMemberAccessService, NoopRequestMemberAccessService>();
+        builder.Services.AddTransient<ICurrentMemberClaimsProvider, NoopCurrentMemberClaimsProvider>();
        builder.Services.AddSingleton<IApiAccessService, NoopApiAccessService>();
        builder.Services.AddSingleton<IApiContentQueryService, NoopApiContentQueryService>();
        builder.Services.AddSingleton<IApiMediaQueryService, NoopApiMediaQueryService>();
@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Persistence.Querying;
@@ -28,21 +28,28 @@ internal sealed class DeliveryApiContentIndexHelper : IDeliveryApiContentIndexHe
    public void EnumerateApplicableDescendantsForContentIndex(int rootContentId, Action<IContent[]> actionToPerform)
    {
        const int pageSize = 10000;
-        var pageIndex = 0;
+        EnumerateApplicableDescendantsForContentIndex(rootContentId, actionToPerform, pageSize);
+    }
+
+    internal void EnumerateApplicableDescendantsForContentIndex(int rootContentId, Action<IContent[]> actionToPerform, int pageSize)
+    {
+        var itemIndex = 0;
+        long total;
+
+        IQuery<IContent> query = _umbracoDatabaseFactory.SqlContext.Query<IContent>().Where(content => content.Trashed == false);

        IContent[] descendants;
-        IQuery<IContent> query = _umbracoDatabaseFactory.SqlContext.Query<IContent>().Where(content => content.Trashed == false);
        do
        {
            descendants = _contentService
-                .GetPagedDescendants(rootContentId, pageIndex, pageSize, out _, query, Ordering.By("Path"))
+                .GetPagedDescendants(rootContentId, itemIndex / pageSize, pageSize, out total, query, Ordering.By("Path"))
                .Where(descendant => _deliveryApiSettings.IsAllowedContentType(descendant.ContentType.Alias))
                .ToArray();

-            actionToPerform(descendants.ToArray());
+            actionToPerform(descendants);

-            pageIndex++;
+            itemIndex += pageSize;
        }
-        while (descendants.Length == pageSize);
+        while (descendants.Length > 0 && itemIndex < total);
    }
 }
@@ -187,8 +187,7 @@ public class ExamineIndexRebuilder : IIndexRebuilder
            {
                // If an index exists but it has zero docs we'll consider it empty and rebuild
                IIndex[] indexes = (onlyEmptyIndexes
-                    ? _examineManager.Indexes.Where(x =>
-                        !x.IndexExists() || (x is IIndexStats stats && stats.GetDocumentCount() == 0))
+                    ? _examineManager.Indexes.Where(ShouldRebuild)
                    : _examineManager.Indexes).ToArray();

                if (indexes.Length == 0)
@@ -228,4 +227,17 @@ public class ExamineIndexRebuilder : IIndexRebuilder
            }
        }
    }
+
+    private bool ShouldRebuild(IIndex index)
+    {
+        try
+        {
+            return !index.IndexExists() || (index is IIndexStats stats && stats.GetDocumentCount() == 0);
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "An error occured trying to get determine index shouldRebuild status for index {IndexName}. The index will NOT be considered for rebuilding", index.Name);
+            return false;
+        }
+    }
 }
@@ -1,5 +1,9 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Exceptions;
 using Umbraco.Cms.Core.Logging;
@@ -23,19 +27,39 @@ public class UnattendedUpgrader : INotificationAsyncHandler<RuntimeUnattendedUpg
    private readonly IProfilingLogger _profilingLogger;
    private readonly IRuntimeState _runtimeState;
    private readonly IUmbracoVersion _umbracoVersion;
+    private readonly UnattendedSettings _unattendedSettings;

    public UnattendedUpgrader(
        IProfilingLogger profilingLogger,
        IUmbracoVersion umbracoVersion,
        DatabaseBuilder databaseBuilder,
        IRuntimeState runtimeState,
-        PackageMigrationRunner packageMigrationRunner)
+        PackageMigrationRunner packageMigrationRunner,
+        IOptions<UnattendedSettings> unattendedSettings)
    {
        _profilingLogger = profilingLogger ?? throw new ArgumentNullException(nameof(profilingLogger));
        _umbracoVersion = umbracoVersion ?? throw new ArgumentNullException(nameof(umbracoVersion));
        _databaseBuilder = databaseBuilder ?? throw new ArgumentNullException(nameof(databaseBuilder));
        _runtimeState = runtimeState ?? throw new ArgumentNullException(nameof(runtimeState));
        _packageMigrationRunner = packageMigrationRunner;
+        _unattendedSettings = unattendedSettings.Value;
+    }
+
+    [Obsolete("Use constructor that takes IOptions<UnattendedSettings>, this will be removed in V16")]
+    public UnattendedUpgrader(
+        IProfilingLogger profilingLogger,
+        IUmbracoVersion umbracoVersion,
+        DatabaseBuilder databaseBuilder,
+        IRuntimeState runtimeState,
+        PackageMigrationRunner packageMigrationRunner)
+    : this(
+        profilingLogger,
+        umbracoVersion,
+        databaseBuilder,
+        runtimeState,
+        packageMigrationRunner,
+        StaticServiceProvider.Instance.GetRequiredService<IOptions<UnattendedSettings>>())
+    {
    }

    public Task HandleAsync(RuntimeUnattendedUpgradeNotification notification, CancellationToken cancellationToken)
@@ -46,55 +70,26 @@ public class UnattendedUpgrader : INotificationAsyncHandler<RuntimeUnattendedUpg
            {
                case RuntimeLevelReason.UpgradeMigrations:
                {
-                    var plan = new UmbracoPlan(_umbracoVersion);
-                    using (!_profilingLogger.IsEnabled(Core.Logging.LogLevel.Verbose) ? null : _profilingLogger.TraceDuration<UnattendedUpgrader>(
-                               "Starting unattended upgrade.",
-                               "Unattended upgrade completed."))
-                    {
-                        DatabaseBuilder.Result? result = _databaseBuilder.UpgradeSchemaAndData(plan);
-                        if (result?.Success == false)
-                        {
-                            var innerException = new UnattendedInstallException(
-                                "An error occurred while running the unattended upgrade.\n" + result.Message);
-                            _runtimeState.Configure(RuntimeLevel.BootFailed, RuntimeLevelReason.BootFailedOnException, innerException);
-                        }
+                    RunUpgrade(notification);

-                        notification.UnattendedUpgradeResult =
-                            RuntimeUnattendedUpgradeNotification.UpgradeResult.CoreUpgradeComplete;
+                    // If we errored out when upgrading don't do anything.
+                    if (notification.UnattendedUpgradeResult is RuntimeUnattendedUpgradeNotification.UpgradeResult.HasErrors)
+                    {
+                        return Task.CompletedTask;
+                    }
+
+                    // It's entirely possible that there's both a core upgrade and package migrations to run, so try and run package migrations too.
+                    // but only if upgrade unattended is enabled.
+                    if (_unattendedSettings.PackageMigrationsUnattended)
+                    {
+                        RunPackageMigrations(notification);
                    }
                }

                break;
                case RuntimeLevelReason.UpgradePackageMigrations:
                {
-                    if (!_runtimeState.StartupState.TryGetValue(
-                        RuntimeState.PendingPackageMigrationsStateKey,
-                        out var pm)
-                        || pm is not IReadOnlyList<string> pendingMigrations)
-                    {
-                        throw new InvalidOperationException(
-                            $"The required key {RuntimeState.PendingPackageMigrationsStateKey} does not exist in startup state");
-                    }
-
-                    if (pendingMigrations.Count == 0)
-                    {
-                        throw new InvalidOperationException(
-                            "No pending migrations found but the runtime level reason is " +
-                            RuntimeLevelReason.UpgradePackageMigrations);
-                    }
-
-                    try
-                    {
-                        _packageMigrationRunner.RunPackagePlans(pendingMigrations);
-                        notification.UnattendedUpgradeResult = RuntimeUnattendedUpgradeNotification.UpgradeResult
-                            .PackageMigrationComplete;
-                    }
-                    catch (Exception ex)
-                    {
-                        SetRuntimeError(ex);
-                        notification.UnattendedUpgradeResult =
-                            RuntimeUnattendedUpgradeNotification.UpgradeResult.HasErrors;
-                    }
+                    RunPackageMigrations(notification);
                }

                break;
@@ -106,6 +101,64 @@ public class UnattendedUpgrader : INotificationAsyncHandler<RuntimeUnattendedUpg
        return Task.CompletedTask;
    }

+    private void RunPackageMigrations(RuntimeUnattendedUpgradeNotification notification)
+    {
+        if (_runtimeState.StartupState.TryGetValue(
+                RuntimeState.PendingPackageMigrationsStateKey,
+                out var pm) is false
+            || pm is not IReadOnlyList<string> pendingMigrations)
+        {
+            throw new InvalidOperationException(
+                $"The required key {RuntimeState.PendingPackageMigrationsStateKey} does not exist in startup state");
+        }
+
+        if (pendingMigrations.Count == 0)
+        {
+            // If we determined we needed to run package migrations but there are none, this is an error
+            if (_runtimeState.Reason is RuntimeLevelReason.UpgradePackageMigrations)
+            {
+                throw new InvalidOperationException(
+                    "No pending migrations found but the runtime level reason is " +
+                    RuntimeLevelReason.UpgradePackageMigrations);
+            }
+
+            return;
+        }
+
+        try
+        {
+            _packageMigrationRunner.RunPackagePlans(pendingMigrations);
+            notification.UnattendedUpgradeResult = RuntimeUnattendedUpgradeNotification.UpgradeResult
+                .PackageMigrationComplete;
+        }
+        catch (Exception ex)
+        {
+            SetRuntimeError(ex);
+            notification.UnattendedUpgradeResult =
+                RuntimeUnattendedUpgradeNotification.UpgradeResult.HasErrors;
+        }
+    }
+
+    private void RunUpgrade(RuntimeUnattendedUpgradeNotification notification)
+    {
+        var plan = new UmbracoPlan(_umbracoVersion);
+        using (!_profilingLogger.IsEnabled(Core.Logging.LogLevel.Verbose) ? null : _profilingLogger.TraceDuration<UnattendedUpgrader>(
+                   "Starting unattended upgrade.",
+                   "Unattended upgrade completed."))
+        {
+            DatabaseBuilder.Result? result = _databaseBuilder.UpgradeSchemaAndData(plan);
+            if (result?.Success == false)
+            {
+                var innerException = new UnattendedInstallException(
+                    "An error occurred while running the unattended upgrade.\n" + result.Message);
+                _runtimeState.Configure(RuntimeLevel.BootFailed, RuntimeLevelReason.BootFailedOnException, innerException);
+            }
+
+            notification.UnattendedUpgradeResult =
+                RuntimeUnattendedUpgradeNotification.UpgradeResult.CoreUpgradeComplete;
+        }
+    }
+
    private void SetRuntimeError(Exception exception)
        => _runtimeState.Configure(
            RuntimeLevel.BootFailed,
@@ -70,6 +70,11 @@ public abstract class MigrationExpressionBase : IMigrationExpression
                    }
                    else
                    {
+                        if (stmtBuilder.Length > 0)
+                        {
+                            stmtBuilder.Append(Environment.NewLine);
+                        }
+
                        stmtBuilder.Append(line);
                    }
                }
@@ -92,7 +92,6 @@ public class MigrationPlanExecutor : IMigrationPlanExecutor
    /// <para>Each migration in the plan, may or may not run in a scope depending on the type of plan.</para>
    /// <para>A plan can complete partially, the changes of each completed migration will be saved.</para>
    /// </remarks>
-    [Obsolete("This will return an ExecutedMigrationPlan in V13")]
    public ExecutedMigrationPlan ExecutePlan(MigrationPlan plan, string fromState)
    {
        plan.Validate();
@@ -1,4 +1,4 @@
-using NPoco;
+using NPoco;
 using Umbraco.Cms.Infrastructure.Persistence;
 using Umbraco.Cms.Infrastructure.Persistence.Dtos;
 using ColumnInfo = Umbraco.Cms.Infrastructure.Persistence.SqlSyntax.ColumnInfo;
@@ -153,16 +153,26 @@ SELECT obj_Constraint.NAME AS 'constraintName'
 ");
        var currentConstraintName = Database.ExecuteScalar<string>(constraintNameQuery);

-
-        // only rename the constraint if necessary
+        // Only rename the constraint if necessary.
        if (currentConstraintName == expectedConstraintName)
        {
            return;
        }

-        Sql<ISqlContext> renameConstraintQuery = Database.SqlContext.Sql(
-            $"EXEC sp_rename N'{currentConstraintName}', N'{expectedConstraintName}', N'OBJECT'");
-        Database.Execute(renameConstraintQuery);
+        if (currentConstraintName is null)
+        {
+            // Constraint does not exist, so we need to create it.
+            Sql<ISqlContext> createConstraintStatement = Database.SqlContext.Sql(@$"
+ALTER TABLE umbracoContentVersion ADD CONSTRAINT [DF_umbracoContentVersion_versionDate] DEFAULT (getdate()) FOR [versionDate]");
+            Database.Execute(createConstraintStatement);
+        }
+        else
+        {
+            // Constraint exists, and differs from the expected name, so we need to rename it.
+            Sql<ISqlContext> renameConstraintQuery = Database.SqlContext.Sql(
+                $"EXEC sp_rename N'{currentConstraintName}', N'{expectedConstraintName}', N'OBJECT'");
+            Database.Execute(renameConstraintQuery);
+        }
    }

    private void UpdateExternalLoginIndexes(IEnumerable<Tuple<string, string, string, bool>> indexes)
@@ -51,7 +51,15 @@ public class TextBuilder : Builder
    ///     Outputs an "auto-generated" header to a string builder.
    /// </summary>
    /// <param name="sb">The string builder.</param>
-    public static void WriteHeader(StringBuilder sb) => TextHeaderWriter.WriteHeader(sb);
+    [Obsolete("Please use the overload taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public static void WriteHeader(StringBuilder sb) => WriteHeader(sb, true);
+
+    /// <summary>
+    ///     Outputs an "auto-generated" header to a string builder.
+    /// </summary>
+    /// <param name="sb">The string builder.</param>
+    /// <param name="includeVersion">Flag indicating whether the tool version number should be included in the output.</param>
+    public static void WriteHeader(StringBuilder sb, bool includeVersion) => TextHeaderWriter.WriteHeader(sb, includeVersion);

    /// <summary>
    ///     Outputs a generated model to a string builder.
@@ -60,7 +68,7 @@ public class TextBuilder : Builder
    /// <param name="typeModel">The model to generate.</param>
    public void Generate(StringBuilder sb, TypeModel typeModel)
    {
-        WriteHeader(sb);
+        WriteHeader(sb, Config.IncludeVersionNumberInGeneratedModels);

        foreach (var t in TypesUsing)
        {
@@ -83,7 +91,7 @@ public class TextBuilder : Builder
    /// <param name="typeModels">The models to generate.</param>
    public void Generate(StringBuilder sb, IEnumerable<TypeModel> typeModels)
    {
-        WriteHeader(sb);
+        WriteHeader(sb, Config.IncludeVersionNumberInGeneratedModels);

        foreach (var t in TypesUsing)
        {
@@ -143,14 +151,17 @@ public class TextBuilder : Builder
    //
    // note that the blog post above clearly states that "Nor should it be applied at the type level if the type being generated is a partial class."
    // and since our models are partial classes, we have to apply the attribute against the individual members, not the class itself.
-    private static void WriteGeneratedCodeAttribute(StringBuilder sb, string tabs) => sb.AppendFormat(
+    private void WriteGeneratedCodeAttribute(StringBuilder sb, string tabs) => sb.AppendFormat(
        "{0}[global::System.CodeDom.Compiler.GeneratedCodeAttribute(\"Umbraco.ModelsBuilder.Embedded\", \"{1}\")]\n",
-        tabs, ApiVersion.Current.Version);
+        tabs,
+        Config.IncludeVersionNumberInGeneratedModels ? ApiVersion.Current.Version : null);

    // writes an attribute that specifies that an output may be null.
    // (useful for consuming projects with nullable reference types enabled)
    private static void WriteMaybeNullAttribute(StringBuilder sb, string tabs, bool isReturn = false) =>
-        sb.AppendFormat("{0}[{1}global::System.Diagnostics.CodeAnalysis.MaybeNull]\n", tabs,
+        sb.AppendFormat(
+            "{0}[{1}global::System.Diagnostics.CodeAnalysis.MaybeNull]\n",
+            tabs,
            isReturn ? "return: " : string.Empty);

    private static string MixinStaticGetterName(string clrName) => string.Format("Get{0}", clrName);
@@ -8,13 +8,30 @@ internal static class TextHeaderWriter
    ///     Outputs an "auto-generated" header to a string builder.
    /// </summary>
    /// <param name="sb">The string builder.</param>
-    public static void WriteHeader(StringBuilder sb)
+    [Obsolete("Please use the overload taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public static void WriteHeader(StringBuilder sb) => WriteHeader(sb, true);
+
+    /// <summary>
+    ///     Outputs an "auto-generated" header to a string builder.
+    /// </summary>
+    /// <param name="sb">The string builder.</param>
+    /// <param name="includeVersion">Flag indicating whether the tool version number should be included in the output.</param>
+    public static void WriteHeader(StringBuilder sb, bool includeVersion)
    {
        sb.Append("//------------------------------------------------------------------------------\n");
        sb.Append("// <auto-generated>\n");
        sb.Append("//   This code was generated by a tool.\n");
        sb.Append("//\n");
-        sb.AppendFormat("//    Umbraco.ModelsBuilder.Embedded v{0}\n", ApiVersion.Current.Version);
+
+        if (includeVersion)
+        {
+            sb.AppendFormat("//    Umbraco.ModelsBuilder.Embedded v{0}\n", ApiVersion.Current.Version);
+        }
+        else
+        {
+            sb.Append("//    Umbraco.ModelsBuilder.Embedded\n");
+        }
+
        sb.Append("//\n");
        sb.Append("//   Changes to this file will be lost if the code is regenerated.\n");
        sb.Append("// </auto-generated>\n");
@@ -29,7 +29,7 @@ internal class AuditRepository : EntityRepositoryBase<int, IAuditItem>, IAuditRe

        List<LogDto>? dtos = Database.Fetch<LogDto>(sql);

-        return dtos.Select(x => new AuditItem(x.NodeId, Enum<AuditType>.Parse(x.Header), x.UserId ?? Constants.Security.UnknownUserId, x.EntityType, x.Comment, x.Parameters)).ToList();
+        return dtos.Select(x => new AuditItem(x.NodeId, Enum<AuditType>.Parse(x.Header), x.UserId ?? Constants.Security.UnknownUserId, x.EntityType, x.Datestamp, x.Comment, x.Parameters)).ToList();
    }

    public void CleanLogs(int maximumAgeOfLogsInMinutes)
@@ -104,7 +104,7 @@ internal class AuditRepository : EntityRepositoryBase<int, IAuditItem>, IAuditRe
        totalRecords = page.TotalItems;

        var items = page.Items.Select(
-            dto => new AuditItem(dto.NodeId, Enum<AuditType>.ParseOrNull(dto.Header) ?? AuditType.Custom, dto.UserId ?? Constants.Security.UnknownUserId, dto.EntityType, dto.Comment, dto.Parameters)).ToList();
+            dto => new AuditItem(dto.NodeId, Enum<AuditType>.ParseOrNull(dto.Header) ?? AuditType.Custom, dto.UserId ?? Constants.Security.UnknownUserId, dto.EntityType, dto.Datestamp, dto.Comment, dto.Parameters)).ToList();

        // map the DateStamp
        for (var i = 0; i < items.Count; i++)
@@ -144,12 +144,12 @@ internal class AuditRepository : EntityRepositoryBase<int, IAuditItem>, IAuditRe
    protected override IAuditItem? PerformGet(int id)
    {
        Sql<ISqlContext> sql = GetBaseQuery(false);
-        sql.Where(GetBaseWhereClause(), new { Id = id });
+        sql.Where(GetBaseWhereClause(), new { id = id });

        LogDto? dto = Database.First<LogDto>(sql);
        return dto == null
            ? null
-            : new AuditItem(dto.NodeId, Enum<AuditType>.Parse(dto.Header), dto.UserId ?? Constants.Security.UnknownUserId, dto.EntityType, dto.Comment, dto.Parameters);
+            : new AuditItem(dto.NodeId, Enum<AuditType>.Parse(dto.Header), dto.UserId ?? Constants.Security.UnknownUserId, dto.EntityType, dto.Datestamp, dto.Comment, dto.Parameters);
    }

    protected override IEnumerable<IAuditItem> PerformGetAll(params int[]? ids) => throw new NotImplementedException();
@@ -162,7 +162,7 @@ internal class AuditRepository : EntityRepositoryBase<int, IAuditItem>, IAuditRe

        List<LogDto>? dtos = Database.Fetch<LogDto>(sql);

-        return dtos.Select(x => new AuditItem(x.NodeId, Enum<AuditType>.Parse(x.Header), x.UserId ?? Constants.Security.UnknownUserId, x.EntityType, x.Comment, x.Parameters)).ToList();
+        return dtos.Select(x => new AuditItem(x.NodeId, Enum<AuditType>.Parse(x.Header), x.UserId ?? Constants.Security.UnknownUserId, x.EntityType, x.Datestamp,  x.Comment, x.Parameters)).ToList();
    }

    protected override Sql<ISqlContext> GetBaseQuery(bool isCount)
@@ -184,7 +184,7 @@ internal class AuditRepository : EntityRepositoryBase<int, IAuditItem>, IAuditRe
        return sql;
    }

-    protected override string GetBaseWhereClause() => "id = @id";
+    protected override string GetBaseWhereClause() => "umbracoLog.id = @id";

    protected override IEnumerable<string> GetDeleteClauses() => throw new NotImplementedException();
 }
--- a/Show More
+++ b/Show More