Build: Updated nightly E2E test pipeline schedule in v16 (#22805 )

Updated nightly E2E test pipeline schedule
Build: Cherry pick #22164 for V16 (#22171 )
2026-05-12 15:36:39 +07:00 · 2026-03-19 21:19:45 +07:00 · 2026-03-10 06:36:50 +01:00 · 2026-03-10 05:11:16 +01:00 · 2026-03-10 05:10:31 +01:00 · 2026-03-10 05:07:41 +01:00
7376 changed files with 256788 additions and 142691 deletions
@@ -1,5 +1,7 @@
 # Umbraco CMS Build

+This guide will explain how you can build the Umbraco CMS from the source code. You will most likely want to do this if your are setting up a local development environment for contributing code updates to the project. You will need this in order to develop and test your fix or feature.
+
 ## Are you sure?

 In order to use Umbraco as a CMS and build your website with it, you should not build it yourself. If you're reading this then you're trying to contribute to Umbraco or you're debugging a complex issue.
@@ -13,7 +15,7 @@ If the answer is yes, please read on. Otherwise, make sure to head on over [to t

 ↖️ You can jump to any section by using the "table of contents" button ( ![Table of contents icon](img/tableofcontentsicon.svg) ) above.

-## Debugging source locally
+## Working with the Umbraco source code

 Did you read ["Are you sure"](#are-you-sure)?

@@ -21,75 +23,116 @@ Did you read ["Are you sure"](#are-you-sure)?

 If you want to run a build without debugging, see [Building from source](#building-from-source) below. This runs the build in the same way it is run on our build servers.

-> [!NOTE]
-> The caching for the back office has been described as 'aggressive' so we often find it's best when making back office changes to [disable caching in the browser (check "Disable cache" on the "Network" tab of developer tools)][disable browser caching] to help you to see the changes you're making.
+If you've got this far and are keen to get stuck in helping us fix a bug or implement a feature, great! Please read on...

-#### Debugging with VS Code
+### Prerequisites

-In order to build the Umbraco source code locally with Visual Studio Code, first make sure you have the following installed.
+In order to work with the Umbraco source code locally, first make sure you have the following installed.

-   [Visual Studio Code](https://code.visualstudio.com/)
+-   Your favourite IDE: [Visual Studio 2022 v17+ with .NET 7+](https://visualstudio.microsoft.com/vs/), [Rider](https://www.jetbrains.com/rider/) or [Visual Studio Code](https://code.visualstudio.com/)
 -   [dotnet SDK v9+](https://dotnet.microsoft.com/en-us/download)
 -   [Node.js v20+](https://nodejs.org/en/download/)
 -   npm v10+ (installed with Node.js)
 -   [Git command line](https://git-scm.com/download/)

-Open the root folder of the repository in Visual Studio Code.
+### Familiarizing yourself with the code

-To build the front end you'll need to open the command pallet (<kbd>Ctrl</kbd> + <kbd>Shift</kbd> + <kbd>P</kbd>) and run `>Tasks: Run Task` followed by `Client Build`.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.

-You can also run the tasks manually on the command line:
+There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.
+
+There are a few different ways to work locally when implementing features or fixing issues with the Umbraco CMS. Depending on whether you are working solely on the front-end, solely on the back-end, or somewhere in between, you may find different workflows work best for you.
+
+Here are some suggestions based on how we work on developing Umbraco at HQ.
+
+### First checkout
+
+When you first clone the source code, build the whole solution via your IDE. You can then start the `Umbraco.Web.UI` project via the IDE or the command line and should find everything across front and back-end is built and running.

 ```
-cd src\Umbraco.Web.UI.Client
-npm i
-npm run build:for:cms
+cd <solution root>\src\Umbraco.Web.UI
+dotnet run --no-build
 ```

-If you just want to watch the UI Client to `Umbraco.Web.UI` then instead of running `build:for:cms`, you can do: `npm run dev:mock`. This will launch the Vite dev server on http://localhost:5173 and watch for changes with mocked API responses.
+When the page loads in your web browser, you can follow the installer to set up a database for debugging. When complete, you will have an empty Umbraco installation to begin working with. You may also wish to install a [starter kit][https://marketplace.umbraco.com/category/themes-&-starter-kits] to ease your debugging.

-You can also run `npm run dev:server` to run the Vite server against a local Umbraco instance. In this case, you need to have the .NET project running and accept connections from the Vite server. Please see the Umbraco.Web.UI.Client README.md [Run against a local Umbraco instance](../src/Umbraco.Web.UI.Client/.github/README.md#run-against-a-local-umbraco-instance) for more information.
+### Back-end only changes

-The login screen is a different frontend build, for that one you can run it as follows:
+If you are working on back-end only features, when switching branches or pulling down the latest from GitHub, you will find the front-end getting rebuilt periodically when you look to build the back-end changes. This can take a while and slow you down. So if for a period of time you don't care about changes in the front-end, you can disable this build step.
+
+Go to `Umbraco.Cms.StaticAssets.csproj` and comment out the following lines of MsBuild by adding a REM statement in front:

 ```
-cd src\Umbraco.Web.UI.Login
-npm i
-npm run dev
+REM npm ci --no-fund --no-audit --prefer-offline
+REM npm run build:for:cms
 ```

-If you just want to build the Login screen to `Umbraco.Web.UI` then instead of running `dev`, you can do: `npm run build`.
+Just be careful not to include this change in your PR.

-To run the C# portion of the project, either hit <kbd>F5</kbd> to begin debugging, or manually using the command line:
+### Front-end only changes

-```
-dotnet watch --project .\src\Umbraco.Web.UI\Umbraco.Web.UI.csproj
+Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:
+
+```json
+"BackOfficeHost": "http://localhost:5173",
+"AuthorizeCallbackPathName": "/oauth_complete",
+"AuthorizeCallbackLogoutPathName": "/logout",
+"AuthorizeCallbackErrorPathName": "/error",
+"BackOfficeTokenCookie": {
+  "Enabled": true,
+  "SameSite": "None"
+}
 ```

-**The initial C# build might take a _really_ long time (seriously, go and make a cup of coffee!) - but don't worry, this will be faster on subsequent runs.**
+> [!NOTE]
+> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `BackOfficeTokenCookie` settings are correct. Namely, that `SameSite` should be set to `None` when running the front-end server separately.

-When the page eventually loads in your web browser, you can follow the installer to set up a database for debugging. You may also wish to install a [starter kit][starter kits] to ease your debugging.
+Then run Umbraco from the command line.

-#### Debugging with Visual Studio
+```
+cd <solution root>\src\Umbraco.Web.UI
+dotnet run --no-build
+```

-In order to build the Umbraco source code locally with Visual Studio, first make sure you have the following installed.
+In another terminal window, run the following to watch the front-end changes and launch Umbraco using the URL indicated from this task.

-   [Visual Studio 2022 v17+ with .NET 7+](https://visualstudio.microsoft.com/vs/) ([the community edition is free](https://www.visualstudio.com/thank-you-downloading-visual-studio/?sku=Community&rel=15) for you to use to contribute to Open Source projects)
-   [Node.js v20+](https://nodejs.org/en/download/)
-   npm v10+ (installed with Node.js)
-   [Git command line](https://git-scm.com/download/)
+```
+cd <solution root>\src\Umbraco.Web.UI.Client
+npm run dev:server
+```

-The easiest way to get started is to open `umbraco.sln` in Visual Studio.
+You'll find as you make changes to the front-end files, the updates will be picked up and your browser refreshed automatically.

-Umbraco is a C# based codebase, which is mostly ASP.NET Core MVC based. You can make changes, build them in Visual Studio, and hit <kbd>F5</kbd> to see the result. There are two web projects in the solution, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`. They each have their own build process and can be run separately. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes. It will automatically restore and build the client projects when you run it.
+> [!NOTE]
+> The caching for the back office has been described as 'aggressive' so we often find it's best when making back office changes to [disable caching in the browser (check "Disable cache" on the "Network" tab of developer tools)][disable browser caching] to help you to see the changes you're making.

-If you want to watch the UI Client to `Umbraco.Web.UI` then you can open a terminal in `src/Umbraco.Web.UI.Client` where you can run `npm run dev:mock` manually. This will launch the Vite dev server on http://localhost:5173 and watch for changes with mocked API responses.
+Whilst most of the backoffice code lives in `Umbraco.Web.UI.Client`, the login screen is in a separate project. If you do any work with that you can build with:

-You can also run `npm run dev:server` to run the Vite server against a local Umbraco instance. In this case, you need to have the .NET project running and accept connections from the Vite server. Please see the Umbraco.Web.UI.Client README.md [Run against a local Umbraco instance](../src/Umbraco.Web.UI.Client/.github/README.md#run-against-a-local-umbraco-instance) for more information.
+```
+cd <solution root>\src\Umbraco.Web.UI.Login
+npm run build
+```

-**The initial C# build might take a _really_ long time (seriously, go and make a cup of coffee!) - but don't worry, this will be faster on subsequent runs.**
+In both front-end projects, if you've refreshed your branch from the latest on GitHub you may need to update front-end dependencies.

-When the page eventually loads in your web browser, you can follow the installer to set up a database for debugging. You may also wish to install a [starter kit][starter kits] to ease your debugging.
+To do that, run:
+
+```
+npm ci --no-fund --no-audit --prefer-offline
+```
+
+### Full-stack changes
+
+If working across both front and back-end, follow both methods and use `dotnet watch`, or re-run `dotnet run` (or `dotnet build` followed by `dotnet run --no-build`) whenever you need to update the back-end code.
+
+Request and response models used by the management APIs are made available client-side as generated code. If you make changes to the management API, you can re-generate the typed client code with:
+
+```
+cd <solution root>\src\Umbraco.Web.UI.Client
+npm run generate:server-api-dev
+```
+
+Please also update the `OpenApi.json` file held in the solution by copying and pasting the output from `/umbraco/swagger/management/swagger.json`.

 ## Building from source

@@ -150,5 +193,4 @@ The produced artifacts are published in a container that can be downloaded from
 Git might have issues dealing with long file paths during build. You may want/need to enable `core.longpaths` support (see [this page](https://github.com/msysgit/msysgit/wiki/Git-cannot-create-a-file-or-directory-with-a-long-path) for details).

 [ contribution guidelines]: CONTRIBUTING.md "Read the guide to contributing for more details on contributing to Umbraco"
-[ starter kits ]: https://our.umbraco.com/packages/?category=Starter%20Kits&version=9 "Browse starter kits available for v9 on Our "
 [ disable browser caching ]: https://techwiser.com/disable-cache-google-chrome-firefox "Instructions on how to disable browser caching in Chrome and Firefox"
@@ -1,58 +1,67 @@
 # Contributing to Umbraco CMS

-👍🎉 First off, thanks for taking the time to contribute! 🎉👍
+👍🎉 First of all, thanks for taking the time to contribute! 🎉👍

-These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgement, and feel free to propose changes to this document in a pull request.
+These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgment, and feel free to propose changes to this document in a pull request.

-## Getting Started
 We have a guide on [what to consider before you start](contributing-before-you-start.md) and more detailed guides at the end of this article.

-The following steps are a quick-start guide:
+## Contribution guide
+
+This guide describes each step to make your first contribution:

 1. **Fork**

-    Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
-    
-    ![Fork the repository](img/forkrepository.png)
-    
+   Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
+
+   ![Fork the repository](img/forkrepositorynew.png)
+
 2. **Clone**

-    When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
-    
-    ![Clone the fork](img/clonefork.png) 
-    
+   When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
+
+   ![Clone the fork](img/cloneforknew.png)
+
 3. **Switch to the correct branch**

-    Switch to the `contrib` branch
+   Switch to the `main` branch

-4. **Build**
+4. **Branch out**

-    Build your fork of Umbraco locally [as described in the build documentation](BUILD.md), you can build with any IDE that supports dotnet or the command line.
+   Create a new branch based on `main` and name it after the issue you're fixing. For example: `v15/bugfix/18132-rte-tinymce-onchange-value-check`.

-5. **Branch**
+   Please follow this format for branches: `v{major}/{feature|bugfix|task}/{issue}-{description}`.

-    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp/12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
+   This is a development branch for the particular issue you're working on, in this case, a bug-fix for issue number `18132` that affects Umbraco v.15.
+
+   Don't commit to `main`, create a new branch first.
+
+5. **Build or run a Development Server**
+
+   You can build or run a Development Server with any IDE that supports .NET or the command line.
+
+   Read [Build or run a Development Server](BUILD.md) for the right approach to your needs.

 6. **Change**

-    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).
+   Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).

 7. **Commit and push**

-    Done? Yay! 🎉
+   Done? Yay! 🎉

-    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
+   Remember to commit to your branch. When it's ready, push the changes to your fork on GitHub.

 8. **Create pull request**

-    On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`) you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instuctions.
+   On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`), you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instructions.

-    Want to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).
+   Would you like to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).

 ## Further contribution guides

 - [Before you start](contributing-before-you-start.md)
- [Finding your first issue: Up for grabs](contributing-before-you-start.md)
+- [Finding your first issue](contributing-first-issue.md)
 - [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
 - [Unwanted changes](contributing-unwanted-changes.md)
 - [Other ways to contribute](contributing-other-ways-to-contribute.md)
@@ -6,8 +6,8 @@ body:
 - type: input
  id: "version"
  attributes:
-    label: "Which Umbraco version are you using? (Please write the *exact* version, example: 10.1.0)"
-    description: "Use the help icon in the Umbraco backoffice to find the version you're using"
+    label: "Which Umbraco version are you using?"
+    description: "Please write the *exact* version, example: `10.1.0`. Use the help icon in the Umbraco backoffice to find the version you're using"
  validations:
    required: true
 - type: textarea
@@ -4,11 +4,11 @@ contact_links:
      url: https://github.com/umbraco/Umbraco-CMS/discussions/new?category=features-and-ideas
      about: Start a new discussion when you have ideas or feature requests, eventually discussions can turn into plans
    - name: ⁉️ Support Question
-      url: https://our.umbraco.com
+      url: https://forum.umbraco.com
      about: This issue tracker is NOT meant for support questions. If you have a question, please join us on the forum.
    - name: 📖 Documentation Issue
      url: https://github.com/umbraco/UmbracoDocs/issues
      about: Documentation issues should be reported on the Umbraco documentation repository.
    - name: 🔐 Security Issue
-      url: https://umbraco.com/about-us/trust-center/security-and-umbraco/how-to-report-a-vulnerability-in-umbraco/
+      url: https://umbraco.com/trust-center/security-and-umbraco/how-to-report-a-vulnerability-in-umbraco/
      about: Discovered a Security Issue in Umbraco?
@@ -1,11 +1,12 @@
 # [Umbraco CMS](https://umbraco.com)

 [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) 
-[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) 
-![Mastodon Follow](https://img.shields.io/mastodon/follow/110661369750014952?domain=https%3A%2F%2Fumbracocommunity.social)
-[![Chat about Umbraco on Discord](https://img.shields.io/discord/869656431308189746?logo=discord&logoColor=fff)](https://discord.gg/umbraco) 
-[![Read what's going on in the Umbraco Discord chat now](https://img.shields.io/badge/read-discord-blue)](https://discord-chats.umbraco.com) 
+[![NuGet Version](https://img.shields.io/nuget/v/Umbraco.Cms)](https://www.nuget.org/packages/Umbraco.Cms)
 [![Build status](https://img.shields.io/azure-devops/build/umbraco/Umbraco%2520Cms/301?logo=azurepipelines&label=Azure%20Pipelines)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=301) 
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) 
+[![Forum](https://img.shields.io/badge/help-forum-blue)](https://forum.umbraco.com) 
+[![Chat about Umbraco on Discord](https://img.shields.io/discord/869656431308189746?logo=discord&logoColor=fff)](https://discord.gg/umbraco) 
+![Mastodon Follow](https://img.shields.io/mastodon/follow/110661369750014952?domain=https%3A%2F%2Fumbracocommunity.social)


 ### Umbraco is a free and open source .NET content management system. Our mission is to help you deliver delightful digital experiences by making Umbraco friendly, simpler and social. 
@@ -37,9 +38,17 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)

+## Backoffice Preview
+
+Want to see the latest backoffice UI in action? Check out our live preview:
+
+**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
+
+This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
+
 ## Get help

-If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves both a social space but also has channels for questions and answers. Feel free to lurk or join in with your own questions. Or just post your daily Wordle score, up to you!
+If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 

 ## Looking to contribute back to Umbraco?

@@ -51,3 +60,4 @@ You came to the right place! Our GitHub repository is available for all kinds of
 Umbraco is contribution-focused and community-driven. If you want to contribute back to the Umbraco source code, please check out our [guide to contributing](CONTRIBUTING.md).

 ### Tip: You should not run Umbraco from source code found here. Umbraco is extremely extensible and can do whatever you need. Instead, [install Umbraco as noted above](#looking-to-install-umbraco) and then [extend it any way you want to](https://docs.umbraco.com/umbraco-cms/extending/).
+
@@ -114,7 +114,7 @@ To declare the Published Cache Status Dashboard as a new manifest, we need to ad
 	},
 	conditions: [
 		{
-			alias: 'Umb.Condition.SectionAlias',
+			alias: UMB_SECTION_ALIAS_CONDITION_ALIAS,
 			match: 'Umb.Section.Settings',
 		},
 	],
@@ -7,9 +7,26 @@ We recommend you to [sync with our repository][sync fork] before you submit your
 GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
 ![Create a pull request](img/createpullrequest.png)

-We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `main`. This is the branch you should be targeting.

-Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
+We welcome PRs for features and bugfixes for different versions according to the [published support and EOL schedule][support-and-eol].
+
+We don't have rules for naming PRs - so name them as you prefer. At HQ we do have a best practice on clear and concise PR naming, so if you would like to use the format feel free to do so. 
+
+Our convention of doing it is:
+
+_Area: Description (closes #IssueID)_
+
+1. Start by specifying the area. Fx the feature name(UFM, Tiptap etc.) or specific section (migrations, relations, segmentation).
+
+2. In your description, where applicable, mention type of PR (Build, Bump, Fix, Refactor etc.).
+   
+4. Good practise is to make sure you describe specifically the change and/or impact of change.<br>
+   Example: Writing "Extension Insights: Fixes CSS alignment" instead of "Fixed issue".
+
+6. Add (closes #IssueID) behind description, if your PR resolves an issue. 
+
+That's it! 
  
 ## The review process
 [review process]: #the-review-process
@@ -48,4 +65,5 @@ There will be times that we really like your proposed changes and we’ll finish

 [making larger changes]: contributing-before-you-start.md#making-large-changes
 [pr or package]: contributing-before-you-start.md#pull-request-or-package
-[Core collabs]: contributing-core-collabs-team.md
+[Core collabs]: contributing-core-collabs-team.md
+[support-and-eol]: https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/
@@ -1,6 +1,8 @@
-## Finding your first issue: Up for grabs
+## Finding your first issue

-Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. In adding the label we will endeavour to provide some guidelines on how to go about the implementation, such that it aligns with the project. We encourage anyone to pick them up and help out.
+
+You don't need to restrict yourselves to issues that are specifically marked as "up for grabs" though. If you are running into a bug you have reported or found on the [issue tracker][issue tracker], it's not necessary to wait for HQ response. Feel free to dive in and try to provide a fix, raising questions as you need if you have concerns about the modifications necessary to resolve the problem.

 If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.

@@ -11,15 +13,15 @@ Great question! The short version goes like this:
 1. **Fork**

    Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
-    
+
    ![Fork the repository](img/forkrepository.png)
-    
+
 1. **Clone**

    When GitHub has created your fork, you can clone it in your favorite Git tool
-    
-    ![Clone the fork](img/clonefork.png) 
-    
+
+    ![Clone the fork](img/clonefork.png)
+
 1. **Switch to the correct branch**

    Switch to the `contrib` branch
@@ -90,4 +92,5 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
 [contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
-[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues
@@ -0,0 +1,223 @@
+# **Contributing to Localization in the Backoffice**
+
+Do you want to help keep our translations accurate and up to standard? 🌍✨
+
+Your input makes a real difference! By reviewing, refining, or suggesting improvements, you ensure that our translations remain clear, consistent, and user-friendly for everyone.
+
+
+## **How Can I Contribute?**
+
+To contribute to localization in the Backoffice, follow this step-by-step guide:
+
+
+### **1. Change the Language in Backoffice**
+
+
+
+1. Open the Backoffice, click on your profile icon in the top-right corner, and select "Edit." 
+
+
+
+![Menubar profile image](/.github/img/contributing/ProfileImage.png "Menubar profile image")
+
+
+
+![Edit button inside profile](/.github/img/contributing/editBtn.png "Edit button inside profile")
+
+
+2. Under "UI Culture," select the language you want to review from the dropdown menu. 
+
+
+
+![Dropdown of languages in Umbraco](/.github/img/contributing/uiCulture.png "Dropdown of languages in Umbraco")
+
+
+
+### **2. Find a Translation Error**
+
+
+
+1. Navigate through the Backoffice and check if everything is translated correctly. 
+
+2. When you find a translation error, right-click on it and select "Inspect." 
+
+3. Look for the nearest element that starts with `umb-` and has a name indicating something specific to the given location. 
+ 
+    **Example:**  
+
+    * The closest parent element should be specific, such as `umb-document-type-workspace-view-settings` instead of a generic element like `umb-property-layout.`
+
+
+### **3. Find the Code in VS Code**
+
+
+
+1. Open VS Code and search for the nearest `umb-` element you identified. 
+
+
+
+![Search for nearest umb element in code](/.github/img/contributing/searchInVsCode.png "Search for nearest umb element in code")
+
+2. Scroll down to find `render() {` and look for the element label that needs updating. 
+
+
+![Find render and label in code](/.github/img/contributing/renderCode.png "Find render and label in code")
+
+3. If the label is hardcoded, it must be updated. 
+ 
+    **Example:**  
+    `label="Vary by culture"`
+
+
+### **4. Find the Correct Translation**
+
+
+
+1. Open the `en.ts` or `en-us.ts` file and search for relevant keywords. \
+ \
+    **Example:** 
+
+    * If the text is "Vary by culture," search for `vary`, `culture`, or `Vary by culture`. 
+
+
+2. Once you find the translation, take the element name and search for it in the target language file (e.g., `da-dk.ts` for Danish). 
+
+
+![Search for translation in language files](/.github/img/contributing/searchingThroughLanguageFiles.png "Search for translation in language files")
+
+3. If a translation exists, insert it into the label element found earlier. 
+
+
+
+### **5. Insert the Translation**
+
+To display the new translation correctly, insert the following code inside the label element:
+
+`${this.localize.term('action_key')}`
+
+Replace `action_key` with the correct translation key.
+
+**Example:**
+
+`${this.localize.term('contentTypeEditor_allowVaryByCulture')}`
+
+![Localization code snippet](/.github/img/contributing/localizationCodeSnippetInCode.png "Localization code snippet")
+
+
+Save the changes and return to the Backoffice to see the update.
+
+
+![Changes in backoffice after changes in code](/.github/img/contributing/changedBackofficeAfterLocalization.png "Changes in backoffice after changes in code")
+
+
+
+### **6. Commit and Push**
+
+
+
+1. Commit your changes to a new temporary branch (avoid committing directly to `contrib`). 
+
+2. Push the changes to your fork on GitHub.
+
+
+### **7. Create a Pull Request**
+
+
+
+1. In your forked repository on GitHub (`https://github.com/[YourUsername]/Umbraco-CMS`), a banner will appear stating that you pushed a new branch. 
+
+2. Click the button to create a pull request and follow the instructions.
+
+
+## **I Can’t Find the Correct Translation**
+
+If you can’t find the translation you need, it may not exist yet. In this case, you can create a new action with related keys.
+
+
+### **1. Ensure It Doesn’t Already Exist**
+
+Search thoroughly in `en.ts` or `en-us.ts` for all relevant keywords.
+
+
+### **2. Create an Action**
+
+
+
+1. Choose a meaningful name for the action to avoid confusion. \
+ \
+ **Example:** Translation for the Data Type "Color Picker." 
+
+    * **Good name:** `colorPickerConfigurations`
+    * **Bad name:** `colorpicker`
+2. A specific action name prevents unnecessarily long key names. 
+
+3. Define the action: 
+
+
+
+### **3. Create Keys**
+
+
+
+1. Use clear and descriptive key names. \
+ \
+ **Example:**
+    * **Good name:** `colorsTitle`
+    * **Bad name:** `colors`
+2. Add the necessary keys inside the action with proper translations. 
+
+
+
+![Action and related Keys in language files](/.github/img/contributing/actionAndKeys.png "Action and related Keys in language files")
+
+
+
+## **I Can’t Find a <code>render()</code> Code in VS Code**
+
+In some cases, such as Data Types, the label might not be inside `render()`. Instead, it may be in a manifest file.
+
+
+### 1. Search for the Text
+
+Copy the text from the Backoffice and search for it in the code.
+
+
+### 2. Open the Manifest File
+
+Once you find the relevant manifest file, open it to confirm you’re in the right place.
+
+
+### 3. Change the Label
+
+In Markdown files, localization is slightly different. Instead of:
+`${this.localize.term('action_key')}`
+
+Use: `#action_key`
+
+**Example:**
+`#colorPickerConfigurations_showLabelTitle`
+
+### 4. Change the Description
+
+For descriptions in Markdown files, use:
+`{umbLocalize: action_key}`
+
+**Example:**
+`{umbLocalize: colorPickerConfigurations_showLabelDescription}`
+
+
+### 5. Save and Verify
+
+Once all changes are made, your manifest should look something like this:
+
+
+![Localization changes to manifest files](/.github/img/contributing/finishedManifestAfterLocalizatonChanges.png "Localization changes to manifest files")
+
+
+
+---
+
+
+### Thank you 
+
+Following these steps ensures that the Umbraco Backoffice remains accessible and user-friendly in all supported languages. Thanks for contributing! 🎉
@@ -0,0 +1,198 @@
+# Umbraco CMS Development Guide
+
+Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
+
+## Working Effectively
+
+Bootstrap, build, and test the repository:
+
+- Install .NET SDK (version specified in global.json):
+  - `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
+  - `export PATH="/home/runner/.dotnet:$PATH"`
+- Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
+  - `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
+  - `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
+  - `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
+- Fix shallow clone issue (required for GitVersioning):
+  - `git fetch --unshallow`
+- Restore packages:
+  - `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
+- Build the solution:
+  - `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
+- Install and build frontend:
+  - `cd src/Umbraco.Web.UI.Client`
+  - `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
+  - `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
+- Install and build Login
+  - `cd src/Umbraco.Web.UI.Login`
+  - `npm ci --no-fund --no-audit --prefer-offline`
+  - `npm run build`
+- Run the application:
+  - `cd src/Umbraco.Web.UI`
+  - `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
+
+## Validation
+
+- ALWAYS run through at least one complete end-to-end scenario after making changes.
+- Build and unit tests must pass before committing changes.
+- Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
+- Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
+- For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
+- For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
+- Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
+
+## Testing
+
+### Unit Tests (.NET)
+- Location: tests/Umbraco.Tests.UnitTests/
+- Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
+- Duration: ~1 minute with 3,343 tests
+- NEVER CANCEL: Set timeout to 5+ minutes
+
+### Integration Tests (.NET)
+- Location: tests/Umbraco.Tests.Integration/
+- Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
+- NEVER CANCEL: Set timeout to 10+ minutes
+
+### Frontend Tests
+- Location: src/Umbraco.Web.UI.Client/
+- Run: `npm test` (requires `npx playwright install` first)
+- Frontend tests use Web Test Runner with Playwright
+
+### Acceptance Tests (E2E)
+- Location: tests/Umbraco.Tests.AcceptanceTest/
+- Requires running Umbraco application and configuration
+- See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
+
+## Project Structure
+
+The solution contains 30 C# projects organized as follows:
+
+### Main Application Projects
+- **Umbraco.Web.UI**: Main web application project (startup project)
+- **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
+- **Umbraco.Web.UI.Login**: Separate login screen frontend
+- **Umbraco.Core**: Core domain models and interfaces
+- **Umbraco.Infrastructure**: Data access and infrastructure
+- **Umbraco.Cms**: Main CMS package
+
+### API Projects
+- **Umbraco.Cms.Api.Management**: Management API
+- **Umbraco.Cms.Api.Delivery**: Content Delivery API
+- **Umbraco.Cms.Api.Common**: Shared API components
+
+### Persistence Projects
+- **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
+- **Umbraco.Cms.Persistence.Sqlite**: SQLite support
+- **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
+
+### Test Projects
+- **Umbraco.Tests.UnitTests**: Unit tests
+- **Umbraco.Tests.Integration**: Integration tests
+- **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
+- **Umbraco.Tests.Common**: Shared test utilities
+
+## Common Tasks
+
+### Running Umbraco in Different Modes
+
+**Production Mode (Standard Development)**
+Use this for backend development, testing full builds, or when you don't need hot reloading:
+1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Access backoffice: `https://localhost:44339/umbraco`
+4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
+
+**Vite Dev Server Mode (Frontend Development with Hot Reload)**
+Use this for frontend-only development with hot module reloading:
+1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
+   ```json
+   "BackOfficeHost": "http://localhost:5173",
+   "AuthorizeCallbackPathName": "/oauth_complete",
+   "AuthorizeCallbackLogoutPathName": "/logout",
+   "AuthorizeCallbackErrorPathName": "/error",
+   "BackOfficeTokenCookie": {
+     "Enabled": true,
+     "SameSite": "None"
+   }
+   ```
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
+4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
+5. Changes to TypeScript/Lit files hot reload automatically
+
+**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
+
+### Backend-Only Development
+For backend-only changes, disable frontend builds:
+- Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
+  ```
+  <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
+    [...]
+  </Target>-->
+  ```
+- Remember to uncomment before committing
+
+### Building NuGet Packages
+To build custom NuGet packages for testing:
+```bash
+dotnet pack -c Release -o Build.Out
+dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
+```
+
+### Regenerating Frontend API Types
+When changing Management API:
+```bash
+cd src/Umbraco.Web.UI.Client
+npm run generate:server-api-dev
+```
+Also update OpenApi.json from /umbraco/swagger/management/swagger.json
+
+## Database Setup
+
+Default configuration supports SQLite for development. For production-like testing:
+- Use SQL Server/LocalDb for better performance
+- Configure connection string in src/Umbraco.Web.UI/appsettings.json
+
+## Clean Up / Reset
+
+To reset development environment:
+```bash
+# Remove configuration and database
+rm src/Umbraco.Web.UI/appsettings.json
+rm -rf src/Umbraco.Web.UI/umbraco/Data
+
+# Full clean (removes all untracked files)
+git clean -xdf .
+```
+
+## Version Information
+
+- Target Framework: .NET (version specified in global.json)
+- Current Version: (specified in version.json)
+- Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
+- npm Requirement: Latest compatible version
+
+## Known Issues
+
+- Build requires full git history (not shallow clone) due to GitVersioning
+- Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
+- Frontend tests require Playwright browser installation: `npx playwright install`
+- Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
+
+## Timing Expectations
+
+**NEVER CANCEL** these operations - they are expected to take time:
+
+| Operation | Expected Time | Timeout Setting |
+|-----------|--------------|-----------------|
+| `dotnet restore` | 50 seconds | 90+ seconds |
+| `dotnet build` | 4.5 minutes | 10+ minutes |
+| `npm ci` | 11 seconds | 30+ seconds |
+| `npm run build:for:cms` | 1.25 minutes | 5+ minutes |
+| `npm test` | 2 minutes | 5+ minutes |
+| `npm run lint` | 1 minute | 5+ minutes |
+| Unit tests | 1 minute | 5+ minutes |
+| Integration tests | Variable | 10+ minutes |
+
+Always wait for commands to complete rather than canceling and retrying.
@@ -7,7 +7,7 @@ changelog:
      - duplicate
      - wontfix
  categories:
-    - title: 🙌 Notable Changes
+    - title: 🙌 Notable Changes 
      labels:
        - category/notable
    - title: 💥 Breaking Changes
@@ -23,7 +23,7 @@ changelog:
    - title: 📦 Dependencies
      labels:
        - dependencies
-    - title: 🌈 A11Y
+    - title: 🌈 Accessibility Improvements
      labels:
        - accessibility
        - category/accessibility
@@ -0,0 +1,58 @@
+name: Backoffice Static Web Apps CI/CD
+
+on:
+  push:
+    branches:
+      - main
+      - v*/dev
+      - v*/main
+    paths:
+      - src/Umbraco.Web.UI.Client/package.json
+      - src/Umbraco.Web.UI.Client/package-lock.json
+      - src/Umbraco.Web.UI.Client/src/**
+      - .github/workflows/azure-backoffice.yml
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+    branches:
+      - main
+      - v*/dev
+      - v*/main
+  workflow_dispatch:
+
+jobs:
+  build_and_deploy_job:
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/backoffice') && github.repository == github.event.pull_request.head.repo.full_name)
+    runs-on: ubuntu-latest
+    name: Build and Deploy Job
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Build And Deploy
+        id: builddeploy
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          production_branch: main
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_VICTORIOUS_GROUND_017B08103 }}
+          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
+          action: "upload"
+          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
+          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
+          app_location: "src/Umbraco.Web.UI.Client" # App source code path
+          app_build_command: "npm run build:for:static"
+          output_location: "dist" # Built app content directory - optional
+          skip_api_build: true # Set to true if you do not have an Azure Functions API in your repo
+          ###### End of Repository/Build Configurations ######
+
+  close_pull_request_job:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/backoffice') && github.repository == github.event.pull_request.head.repo.full_name
+    runs-on: ubuntu-latest
+    name: Close Pull Request Job
+    steps:
+      - name: Close Pull Request
+        id: closepullrequest
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          app_location: "src/Umbraco.Web.UI.Client"
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_VICTORIOUS_GROUND_017B08103 }}
+          action: "close"
@@ -0,0 +1,59 @@
+name: Storybook CI/CD
+
+on:
+  push:
+    branches:
+      - main
+      - v*/dev
+      - v*/main
+    paths:
+      - src/Umbraco.Web.UI.Client/package.json
+      - src/Umbraco.Web.UI.Client/package-lock.json
+      - src/Umbraco.Web.UI.Client/src/**
+      - .github/workflows/azure-storybook.yml
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+    branches:
+      - main
+      - v*/dev
+      - v*/main
+  workflow_dispatch:
+
+env:
+  NODE_OPTIONS: --max_old_space_size=16384
+
+jobs:
+  build_and_deploy_job:
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/storybook') && github.repository == github.event.pull_request.head.repo.full_name)
+    runs-on: ubuntu-latest
+    name: Build and Deploy Job
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build And Deploy
+        id: builddeploy
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          production_branch: main
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ORANGE_SEA_0C7411A03 }}
+          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
+          action: "upload"
+          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
+          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
+          app_location: "src/Umbraco.Web.UI.Client" # App source code path
+          app_build_command: "npm run storybook:build"
+          output_location: "/storybook-static" # Built app content directory - optional
+          skip_api_build: true # Set to true if you do not have an Azure Functions API in your repo
+          ###### End of Repository/Build Configurations ######
+
+  close_pull_request_job:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview/storybook') && github.repository == github.event.pull_request.head.repo.full_name
+    runs-on: ubuntu-latest
+    name: Close Pull Request Job
+    steps:
+      - name: Close Pull Request
+        id: closepullrequest
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          app_location: "src/Umbraco.Web.UI.Client"
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ORANGE_SEA_0C7411A03 }}
+          action: "close"
@@ -4,15 +4,15 @@ on:
  push:
    branches:
      - "*/dev"
-      - "*/contrib"
-      - "contrib"
+      - "*/main"
+      - "main"
      - "release/*"
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
      - "*/dev"
-      - "*/contrib"
-      - "contrib"
+      - "*/main"
+      - "main"
      - "release/*"
  schedule:
    - cron: "33 2 * * 1"
@@ -0,0 +1,163 @@
+name: Create a release discussions for each new version label
+
+on:
+  schedule:
+    - cron: "0 * * * *" # every hour
+  workflow_dispatch:    # allow manual runs
+permissions:
+  contents: read
+  discussions: write
+  issues: read
+  pull-requests: read
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reconcile release/* labels → discussions
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const categoryName = "Releases";
+
+            // 24h cutoff
+            const since = new Date(Date.now() - 24*60*60*1000).toISOString();
+            core.info(`Scanning issues/PRs updated since ${since}`);
+
+            // fetch repo + discussion categories
+            const repoData = await github.graphql(`
+              query($owner:String!, $repo:String!){
+                repository(owner:$owner, name:$repo){
+                  id
+                  discussionCategories(first:100){ nodes { id name } }
+                }
+              }
+            `, { owner, repo });
+            const repoId = repoData.repository.id;
+            const category = repoData.repository.discussionCategories.nodes.find(c => c.name === categoryName);
+            if (!category) {
+              core.setFailed(`Discussion category "${categoryName}" not found`);
+              return;
+            }
+            const categoryId = category.id;
+
+            // paginate issues/PRs updated in last 24h
+            for await (const { data: items } of github.paginate.iterator(
+              github.rest.issues.listForRepo,
+              { owner, repo, state: "all", since, per_page: 100 }
+            )) {
+              for (const item of items) {
+                const releaseLabels = (item.labels || [])
+                  .map(l => (typeof l === "string" ? l : l.name)) // always get the name
+                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
+                if (releaseLabels.length === 0) continue;
+
+                core.info(`#${item.number}: ${releaseLabels.join(", ")}`);
+
+                for (const labelName of releaseLabels) {
+                  const version = labelName.substring("release/".length);
+                  const titleTarget = `Release: ${version}`;
+
+                  // search discussions
+                  let discussionId = null;
+                  let cursor = null;
+                  while (true) {
+                    const page = await github.graphql(`
+                      query($owner:String!, $repo:String!, $cursor:String){
+                        repository(owner:$owner, name:$repo){
+                          discussions(first:50, after:$cursor){
+                            nodes{
+                              id
+                              title
+                              url
+                              category{ name }
+                              labels(first:50){ nodes{ name } }
+                            }
+                            pageInfo{ hasNextPage endCursor }
+                          }
+                        }
+                      }
+                    `, { owner, repo, cursor });
+                    const nodes = page.repository.discussions.nodes;
+                    const byLabel = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.labels?.nodes?.some(l => l.name === labelName)
+                    );
+                    if (byLabel) { discussionId = byLabel.id; break; }
+                    const byTitle = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.title === titleTarget
+                    );
+                    if (byTitle) { discussionId = byTitle.id; break; }
+                    if (!page.repository.discussions.pageInfo.hasNextPage) break;
+                    cursor = page.repository.discussions.pageInfo.endCursor;
+                  }
+
+                  if (!discussionId) {
+                    core.info(`→ Creating discussion for ${labelName}`);
+                    const body =
+                      `**Release date:** TODO (YYYY-MM-DD)\n\n` +
+                      `### Links\n` +
+                      `- [Issues and pull requests marked for version ${version}](https://github.com/${owner}/${repo}/issues?q=label%3A${encodeURIComponent(labelName)})\n`;
+
+                    const created = await github.graphql(`
+                      mutation($repoId:ID!, $catId:ID!, $title:String!, $body:String!){
+                        createDiscussion(input:{
+                          repositoryId:$repoId,
+                          categoryId:$catId,
+                          title:$title,
+                          body:$body
+                        }){ discussion{ id url } }
+                      }
+                    `, { repoId, catId: categoryId, title: titleTarget, body });
+
+                    discussionId = created.createDiscussion.discussion.id;
+
+                    // lock the discussion to prevent replies
+                    await github.graphql(`
+                      mutation($id:ID!){
+                        lockLockable(input:{ lockableId:$id }) {
+                          clientMutationId
+                        }
+                      }
+                    `, { id: discussionId });
+                    core.info(`🔒 Locked discussion ${discussionId}`);
+                  } else {
+                    core.info(`→ Found existing discussion for ${labelName}`);
+                  }
+
+                  // ensure label exists
+                  let labelId;
+                  try {
+                    await github.rest.issues.getLabel({ owner, repo, name: labelName });
+                  } catch (e) {
+                    if (e.status === 404) {
+                      await github.rest.issues.createLabel({
+                        owner, repo, name: labelName, color: "0E8A16"
+                      });
+                    } else { throw e; }
+                  }
+                  const labelNode = await github.graphql(`
+                    query($owner:String!, $repo:String!, $name:String!){
+                      repository(owner:$owner, name:$repo){ label(name:$name){ id } }
+                    }
+                  `, { owner, repo, name: labelName });
+                  labelId = labelNode.repository.label?.id;
+                  if (!labelId) continue;
+
+                  // add label to discussion
+                  await github.graphql(`
+                    mutation($id:ID!, $labels:[ID!]!){
+                      addLabelsToLabelable(input:{ labelableId:$id, labelIds:$labels }) {
+                        clientMutationId
+                      }
+                    }
+                  `, { id: discussionId, labels: [labelId] });
+
+                  core.info(`✓ ${labelName} attached to discussion`);
+                }
+              }
+            }
@@ -3,16 +3,18 @@ name: Test Backoffice
 on:
  push:
    branches:
-      - contrib
+      - main
      - release/*
      - v*/dev
+      - v*/main
    paths:
      - src/Umbraco.Web.UI.Client/**
  pull_request:
    branches:
-      - contrib
+      - main
      - release/*
      - v*/dev
+      - v*/main
    paths:
      - src/Umbraco.Web.UI.Client/**

@@ -40,7 +42,11 @@ jobs:
          cache: npm
          cache-dependency-path: ./src/Umbraco.Web.UI.Client/package-lock.json
      - run: npm ci --no-audit --no-fund --prefer-offline
+      - name: Check for circular dependencies
+        run: node devops/circular/index.js src
      - run: npm run lint:errors
+      - run: npm run generate:tsconfig
+      - run: npm run generate:icons
      - run: npm run build:for:cms
      - run: npm run check:paths
      - run: npm run generate:jsonschema:dist
@@ -1,35 +1,129 @@
 {
-    "version": "0.2.0",
-    "configurations": [
-        {
-            // Use IntelliSense to find out which attributes exist for C# debugging
-            // Use hover for the description of the existing attributes
-            // For further information visit https://github.com/OmniSharp/omnisharp-vscode/blob/master/debugger-launchjson.md
-            "name": ".NET Core Launch (web)",
-            "type": "coreclr",
-            "request": "launch",
-            "program": "dotnet",
-            "args": ["run"],
-            "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
-            "stopAtEntry": false,
-            "requireExactSource": false,
-            // Enable launching a web browser when ASP.NET Core starts. For more information: https://aka.ms/VSCode-CS-LaunchJson-WebBrowser
-            "serverReadyAction": {
-                "action": "openExternally",
-                "pattern": "\\\\bNow listening on:\\\\s+(https?://\\\\S+)"
-            },
-            "env": {
-                "ASPNETCORE_ENVIRONMENT": "Development"
-            },
-            "sourceFileMap": {
-                "/Views": "${workspaceFolder}/Views"
-            }
-        },
-        {
-            "name": ".NET Core Attach",
-            "type": "coreclr",
-            "request": "attach",
-            "processId": "${command:pickProcess}"
-        }
-    ]
+  "version": "0.2.0",
+  "compounds": [
+    {
+      "name": "Backoffice Launch (Vite + .NET Core)",
+      "configurations": [
+        "Backoffice Launch Vite (Chrome)",
+        ".NET Core Serve with External Auth (web)"
+      ],
+      "stopAll": true,
+      "presentation": {
+        "group": "1"
+      }
+    }
+  ],
+  "configurations": [
+    {
+      "name": "Backoffice Launch Vite (Chrome)",
+      "request": "launch",
+      "env": {
+        "VITE_UMBRACO_USE_MSW": "${input:AskForMockServer}"
+      },
+      "runtimeExecutable": "npx",
+      "runtimeArgs": ["vite"],
+      "type": "node",
+      "cwd": "${workspaceFolder}/src/Umbraco.Web.UI.Client",
+      "skipFiles": ["<node_internals>/**", "node_modules/**"],
+      "smartStep": true,
+      "autoAttachChildProcesses": true,
+      "serverReadyAction": {
+        "killOnServerStop": true,
+        "action": "debugWithChrome",
+        "pattern": "Local:   http://localhost:([0-9]+)",
+        "uriFormat": "http://localhost:%s",
+        "webRoot": "${workspaceFolder}/src/Umbraco.Web.UI.Client"
+      },
+      "presentation": {
+        "group": "2"
+      }
+    },
+    {
+      "name": "Backoffice Attach Vite (Chrome)",
+      "request": "launch",
+      "type": "chrome",
+      "smartStep": true,
+      "url": "http://localhost:5173/",
+      "skipFiles": ["<node_internals>/**", "node_modules/**"],
+      "webRoot": "${workspaceFolder}/src/Umbraco.Web.UI.Client",
+      "presentation": {
+        "group": "2"
+      }
+    },
+    {
+      // Use IntelliSense to find out which attributes exist for C# debugging
+      // Use hover for the description of the existing attributes
+      // For further information visit https://github.com/OmniSharp/omnisharp-vscode/blob/master/debugger-launchjson.md
+      "name": ".NET Core Launch (web)",
+      "type": "coreclr",
+      "request": "launch",
+      "program": "dotnet",
+      "args": ["run"],
+      "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
+      "stopAtEntry": false,
+      "requireExactSource": false,
+      "postDebugTask": "kill-umbraco-web-ui",
+      // Enable launching a web browser when ASP.NET Core starts. For more information: https://aka.ms/VSCode-CS-LaunchJson-WebBrowser
+      "serverReadyAction": {
+        "action": "openExternally",
+        "pattern": "\\\\bNow listening on:\\\\s+(https?://\\\\S+)"
+      },
+      "env": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      },
+      "sourceFileMap": {
+        "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"
+      },
+      "presentation": {
+        "group": "3"
+      }
+    },
+    {
+      "name": ".NET Core Attach",
+      "type": "coreclr",
+      "request": "attach",
+      "processId": "${command:pickProcess}",
+      "presentation": {
+        "group": "3"
+      }
+    },
+    {
+      "name": ".NET Core Serve with External Auth (web)",
+      "type": "coreclr",
+      "request": "launch",
+      "program": "dotnet",
+      "args": ["run"],
+      "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
+      "stopAtEntry": false,
+      "requireExactSource": false,
+      "checkForDevCert": true,
+      "postDebugTask": "kill-umbraco-web-ui",
+      "env": {
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "ASPNETCORE_URLS": "https://localhost:44339",
+        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
+        "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
+        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__ENABLED": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
+      },
+      "sourceFileMap": {
+        "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"
+      },
+      "presentation": {
+        "group": "3"
+      }
+    }
+  ],
+  "inputs": [
+    {
+      "id": "AskForMockServer",
+      "type": "promptString",
+      "description": "Use Mock Service Worker (MSW) for Backoffice API calls (off requires a running server)?",
+      "default": "off"
+    }
+  ]
 }
@@ -0,0 +1 @@
+../src/Umbraco.Web.UI.Client/.vscode/lit.code-snippets
@@ -0,0 +1,11 @@
+{
+  "cSpell.words": [
+    "unprovide",
+    "Unproviding"
+  ],
+  "eslint.useFlatConfig": true,
+  "eslint.workingDirectories": [
+    "./src/Umbraco.Web.UI.Client/",
+    "./src/Umbraco.Web.UI.Login/"
+  ]
+}
@@ -1,76 +1,87 @@
 {
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "Build",
-            "detail": "Builds the client and SLN",
-            "promptOnClose": true,
-            "group": "build",
-            "dependsOn": [
-                "Client Build",
-                "Dotnet build"
-            ],
-            "problemMatcher": []
-        },
-        {
-            "label": "Client Install",
-            "detail": "install npm for Umbraco.Web.UI.Client",
-            "promptOnClose": true,
-            "type": "npm",
-            "script": "install",
-            "path": "src/Umbraco.Web.UI.Client/",
-            "problemMatcher": []
-        },
-        {
-            "label": "Client Build",
-            "detail": "runs npm run build for Umbraco.Web.UI.Client",
-            "promptOnClose": true,
-            "group": "build",
-            "type": "npm",
-            "script": "build:for:cms",
-            "path": "src/Umbraco.Web.UI.Client/",
-            "problemMatcher": []
-        },
-        {
-            "label": "Client Watch",
-            "detail": "runs npm run dev for Umbraco.Web.UI.Client",
-            "promptOnClose": true,
-            "group": "build",
-            "type": "npm",
-            "script": "dev",
-            "path": "src/Umbraco.Web.UI.Client/",
-            "problemMatcher": []
-        },
-        {
-            "label": "Dotnet build",
-            "detail": "Dotnet build of SLN",
-            "promptOnClose": true,
-            "group": "build",
-            "command": "dotnet",
-            "type": "process",
-            "args": [
-                "build",
-                "${workspaceFolder}/umbraco.sln",
-                "/property:GenerateFullPaths=true",
-                "/consoleloggerparameters:NoSummary"
-            ],
-            "problemMatcher": "$msCompile"
-        },
-        {
-            "label": "Dotnet watch",
-            "detail": "Dotnet run and watch of Web.UI",
-            "promptOnClose": true,
-            "command": "dotnet",
-            "type": "process",
-            "args": [
-                "watch",
-                "run",
-                "--project",
-                "${workspaceFolder}/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj",
-                "/property:GenerateFullPaths=true",
-                "/consoleloggerparameters:NoSummary"
-            ],
-            "problemMatcher": "$msCompile"
-        }
-    ]
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Build",
+      "detail": "Builds the client and SLN",
+      "promptOnClose": true,
+      "group": "build",
+      "dependsOn": ["Client Build", "Dotnet build"],
+      "problemMatcher": []
+    },
+    {
+      "label": "Client Install",
+      "detail": "install npm for Umbraco.Web.UI.Client",
+      "promptOnClose": true,
+      "type": "npm",
+      "script": "install",
+      "path": "src/Umbraco.Web.UI.Client/",
+      "problemMatcher": []
+    },
+    {
+      "label": "Client Build",
+      "detail": "runs npm run build for Umbraco.Web.UI.Client",
+      "promptOnClose": true,
+      "group": "build",
+      "type": "npm",
+      "script": "build:for:cms",
+      "path": "src/Umbraco.Web.UI.Client/",
+      "problemMatcher": []
+    },
+    {
+      "label": "Client Watch",
+      "detail": "runs npm run dev for Umbraco.Web.UI.Client",
+      "promptOnClose": true,
+      "group": "build",
+      "type": "npm",
+      "script": "dev",
+      "path": "src/Umbraco.Web.UI.Client/",
+      "problemMatcher": []
+    },
+    {
+      "label": "Dotnet build",
+      "detail": "Dotnet build of SLN",
+      "promptOnClose": true,
+      "group": "build",
+      "command": "dotnet",
+      "type": "process",
+      "args": [
+        "build",
+        "${workspaceFolder}/umbraco.sln",
+        "/property:GenerateFullPaths=true",
+        "/consoleloggerparameters:NoSummary"
+      ],
+      "problemMatcher": "$msCompile"
+    },
+    {
+      "label": "Dotnet watch",
+      "detail": "Dotnet run and watch of Web.UI",
+      "promptOnClose": true,
+      "command": "dotnet",
+      "type": "process",
+      "args": [
+        "watch",
+        "run",
+        "--project",
+        "${workspaceFolder}/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj",
+        "/property:GenerateFullPaths=true",
+        "/consoleloggerparameters:NoSummary"
+      ],
+      "problemMatcher": "$msCompile"
+    },
+    {
+      "label": "kill-umbraco-web-ui",
+      "type": "shell",
+      "problemMatcher": [],
+      "osx": {
+        "command": "pkill -f Umbraco.Web.UI"
+      },
+      "linux": {
+        "command": "pkill -f Umbraco.Web.UI"
+      },
+      "windows": {
+        "command": "taskkill /IM Umbraco.Web.UI.exe /F"
+      }
+    }
+  ]
 }
@@ -14,19 +14,20 @@
    <NeutralLanguage>en-US</NeutralLanguage>
    <Nullable>enable</Nullable>
    <WarningsAsErrors>nullable</WarningsAsErrors>
-    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
    <ImplicitUsings>enable</ImplicitUsings>
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
  </PropertyGroup>

+
  <PropertyGroup>
    <!--
      TODO: Fix and remove overrides:
      [NU5104] Warning As Error: A stable release of a package should not have a prerelease dependency. Either modify the version spec of dependency
    -->
-    <NoWarn>$(NoWarn),NU5104</NoWarn>
-    <WarningsNotAsErrors>$(WarningsNotAsErrors),NU5104</WarningsNotAsErrors>
+    <NoWarn>$(NoWarn),NU5104,SA1309</NoWarn>
+    <WarningsNotAsErrors>$(WarningsNotAsErrors),NU5104,SA1600</WarningsNotAsErrors>
  </PropertyGroup>

  <!-- SourceLink -->
@@ -40,7 +41,7 @@
  <PropertyGroup>
    <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
    <EnablePackageValidation>true</EnablePackageValidation>
-    <PackageValidationBaselineVersion>15.0.0</PackageValidationBaselineVersion>
+    <PackageValidationBaselineVersion>16.0.0</PackageValidationBaselineVersion>
    <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
  </PropertyGroup>
@@ -5,97 +5,99 @@
  </PropertyGroup>
  <!-- Global packages (private, build-time packages for all projects) -->
  <ItemGroup>
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.146" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.7.115" />
    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <GlobalPackageReference Include="Umbraco.Code" Version="2.2.0" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.3.0" />
    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.0.0-preview.9.24556.5" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.4.0" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
-    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
  </ItemGroup>
  <!-- Third-party packages -->
  <ItemGroup>
    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.0" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.5.0" />
-    <PackageVersion Include="Examine.Core" Version="3.5.0" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.11.71" />
-    <PackageVersion Include="JsonPatch.Net" Version="3.1.1" />
+    <PackageVersion Include="Examine" Version="3.7.1" />
+    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.12.1" />
+    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.8.0" />
+    <PackageVersion Include="MailKit" Version="4.11.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="2.5.192" />
-    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
-    <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
+    <PackageVersion Include="MessagePack" Version="3.1.3" />
+    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
+    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.3.3" />
    <PackageVersion Include="NPoco" Version="5.7.1" />
    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="6.0.0-preview3.24551.41" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="6.0.0-preview3.24551.41" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="6.0.0-preview3.24551.41" />
-    <PackageVersion Include="Serilog" Version="4.1.0" />
-    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="6.2.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="6.2.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="6.2.1" />
+    <PackageVersion Include="Serilog" Version="4.2.0" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
    <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
-    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
+    <PackageVersion Include="Serilog.Extensions.Hosting" Version="9.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
-    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="9.0.0" />
    <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
    <PackageVersion Include="Serilog.Sinks.File" Version="6.0.0" />
    <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.6" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="7.1.0" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.11" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.1" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
    <!-- Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer brings in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Azure.Identity" Version="1.13.1" />
+    <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
    <!-- Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of System.Runtime.Caching -->
-    <PackageVersion Include="System.Runtime.Caching" Version="9.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="9.0.4" />
    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.4" />
    <!-- Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc brings in a vulnerable version of System.Text.RegularExpressions -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
    <!-- OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
-    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.2.1" />
+    <!-- Take top-level depedendency on Microsoft.IdentityModel.JsonWebTokens, because OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.8.0" />
    <!-- Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer and Dazinator.Extensions.FileProviders brings in a legacy version of System.Text.Encodings.Web -->
-    <PackageVersion Include="System.Text.Encodings.Web" Version="9.0.0" />
+    <PackageVersion Include="System.Text.Encodings.Web" Version="9.0.4" />
    <!-- NPoco.SqlServer brings in a vulnerable version of Microsoft.Data.SqlClient  -->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.1" />
    <!-- Examine.Lucene brings in a vulnerable version of Lucene.Net.Replicator -->
    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
  </ItemGroup>
-</Project>
+</Project>
@@ -0,0 +1,533 @@
+Third-Party Notices
+===================
+
+This file contains notices and attributions for third-party software used in the Umbraco CMS project.
+
+Third-party software may contain dependencies that are not explicitly listed here.
+
+This notice is not a license and does not grant any rights to use the third-party software.
+
+Umbraco CMS is licensed under the MIT License, which can be found in the LICENSE file.
+
+---
+
+@openid/AppAuth-JS: An OpenID Connect and OAuth 2.0 client library for JavaScript
+
+URL: https://github.com/openid/AppAuth-JS
+License: Apache License, Version 2.0
+Copyright: 2017 Google Inc.
+
+---
+
+AutoFixture: Write maintainable unit tests, faster
+
+URL: https://github.com/AutoFixture/AutoFixture
+License: MIT License
+Copyright: 2013 Mark Seemann
+
+---
+
+Asp.Versioning.Mvc: A library for ASP.NET Core versioning
+
+URL: https://github.com/dotnet/aspnet-api-versioning
+License: MIT License
+Copyright: .NET Foundation and contributors
+
+---
+
+Babel: A JavaScript compiler
+
+URL: https://babeljs.io/
+License: MIT License
+Copyright: 2014-present Sebastian McKenzie and other contributors
+
+---
+
+BenchmarkDotNet: Powerful .NET library for benchmarking
+
+URL: https://github.com/dotnet/BenchmarkDotNet
+License: MIT License
+Copyright: .NET Foundation and Contributors
+
+---
+
+Bogus: A simple and sane data generator for populating objects that supports different locales.
+
+URL: https://github.com/bchavez/Bogus
+License: MIT License
+Copyright: 2015 Brian Chavez
+
+---
+
+CommandLineParser: Terse syntax C# command line parser for .NET
+
+URL: https://github.com/commandlineparser/commandline
+License: MIT License
+Copyright: 2005-2015 Giacomo Stelluti Scala & Contributors
+
+---
+
+cross-env: A CLI tool to set environment variables across platforms
+
+URL: https://github.com/kentcdodds/cross-env
+License: MIT License
+Copyright: 2017 Kent C. Dodds
+
+---
+
+Dazinator.Extensions.FileProviders: A library for file provider extensions
+
+URL: https://github.com/dazinator/Dazinator.Extensions.FileProviders
+License: MIT License
+Copyright: 2016 Darrell
+
+---
+
+DOMPurify: A DOM-only XSS sanitizer for HTML, MathML and SVG
+
+URL: https://github.com/cure53/DOMPurify
+License: Apache License, Version 2.0
+Copyright: 2025 Dr.-Ing. Mario Heiderich, Cure53
+
+---
+
+Element Internals Polyfill: A polyfill for the Element Internals API
+
+URL: https://github.com/calebdwilliams/element-internals-polyfill
+License: MIT License
+Copyright: 2021 Caleb Williams
+
+---
+
+Eslint: A tool for identifying and reporting on patterns in JavaScript
+
+URL: https://eslint.org/
+License: MIT License
+Copyright: OpenJS Foundation and other contributors
+
+---
+
+Examine: A search and indexing library for .NET
+
+URL: https://github.com/Shazwazza/Examine
+License: Microsoft Public License (Ms-PL)
+Copyright: 2023 Shannon Deminick
+
+---
+
+Globals: A library for managing global variables in JavaScript
+
+URL: https://github.com/sindresorhus/globals
+License: MIT License
+Copyright: Sindre Sorhus
+
+---
+
+Html Agility Pack: An HTML parser for .NET
+
+URL: https://html-agility-pack.net/
+License: MIT License
+Copyright: ZZZ Projects Inc.
+
+---
+
+ImageSharp: A cross-platform library for processing images in .NET
+
+URL: https://github.com/SixLabors/ImageSharp
+License: Apache License, Version 2.0 under the Six Labors Split License
+Copyright: Six Labors
+
+---
+
+jsdiff: A JavaScript text differencing implementation
+
+URL: https://github.com/kpdecker/jsdiff
+License: BSD 3-Clause License
+Copyright: 2009-2015 Kevin Decker <kpdecker@gmail.com>
+
+---
+
+JsonPatch.Net: A library for JSON Patch (RFC 6902) in .NET
+
+URL: https://github.com/json-everything/json-everything
+License: MIT License
+Copyright: .NET Foundation and Contributors
+
+---
+
+K4os.Compression.LZ4: A fast LZ4 compression library for .NET
+
+URL: https://github.com/MiloszKrajewski/K4os.Compression.LZ4
+License: MIT License
+Copyright: 2017 Milosz Krajewski
+
+---
+
+Lit: A simple library for building fast, lightweight web components
+
+URL: https://lit.dev
+License: BSD 3-Clause License
+Copyright: 2020 Google LLC. All rights reserved.
+
+---
+
+Lucide: Beautiful & consistent icons for the web
+
+URL: https://lucide.dev/
+License: ISC License
+Copyright: 2013-2022 Cole Bemis
+Copyright: 2022 Lucide Contributors
+
+---
+
+Madge: A dependency graph generator for JavaScript
+
+URL: https://github.com/pahen/madge
+License: MIT License
+Copyright: 2017 Patrik Henningsson
+
+---
+
+MailKit: A library for sending email in .NET
+
+URL: https://github.com/jstedfast/MailKit
+License: MIT License
+Copyright: 2013-2024 .NET Foundation and Contributors
+
+---
+
+Markdown: A library for parsing and compiling Markdown
+
+URL: https://github.com/hey-red/Markdown
+License: MIT License
+Copyright: 2018 red
+
+---
+
+marked: A markdown parser and compiler
+
+URL: https://marked.js.org/
+License: MIT License
+Copyright: 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+Copyright: 2018+, MarkedJS (https://github.com/markedjs/)
+
+---
+
+Message Pack: The extremely fast MessagePack serializer for C#
+
+URL: https://github.com/MessagePack-CSharp/MessagePack-CSharp
+License: MIT License
+Copyright: 2017 Yoshifumi Kawai and contributors
+
+---
+
+Miniprofiler: A mini profiler for .NET
+
+URL: https://github.com/MiniProfiler/dotnet
+License: MIT License
+Copyright: .NET MiniProfiler Contributors
+
+---
+
+Monaco Editor: A browser-based code editor
+
+URL: https://microsoft.github.io/monaco-editor/
+License: MIT License
+Copyright: 2016-present Microsoft Corporation
+
+---
+
+Moq: A mocking library for .NET
+
+URL: https://github.com/moq/moq
+License: BSD 3-Clause License
+Copyright: 2007 Clarius Consulting, Manas Technology Solutions, InSTEDD, and Contributors.
+
+---
+
+Mock Service Worker (MSW): A library for mocking API requests in JavaScript
+
+URL: https://mswjs.io/
+License: MIT License
+Copyright: 2018–present Artem Zakharchenko
+
+---
+
+NCrontab: A cron schedule parser for .NET
+
+URL: https://github.com/atifaziz/NCrontab
+License: Apache License, Version 2.0
+Copyright: 2001 The OpenSymphony Group
+Copyright: 2008 Atif Aziz
+
+---
+
+Nerdbank.GitVersioning: A library for versioning .NET projects
+
+URL: https://github.com/dotnet/Nerdbank.GitVersioning
+License: MIT License
+Copyright: .NET Foundation and Contributors
+
+---
+
+NJsonSchema: A JSON schema validator for .NET
+
+URL: https://github.com/RicoSuter/NJsonSchema
+License: MIT License
+Copyright: 2022 Rico Suter
+
+---
+
+NPoco: A micro ORM for .NET
+
+URL: https://github.com/schotime/NPoco
+License: Apache License, Version 2.0
+Copyright: Schotime
+
+---
+
+NUnit: A unit testing framework for .NET
+
+URL: https://github.com/nunit/nunit
+License: MIT License
+Copyright: Charlie Poole, Rob Prouse and Contributors
+
+---
+
+Open Web Components: A set of standards and libraries for building web components
+
+URL: https://open-wc.org/
+License: MIT License
+Copyright: 2018 open-wc
+
+---
+
+Openapi-ts: The OpenAPI to TypeScript codegen
+
+URL: https://github.com/hey-api/openapi-ts
+License: MIT License
+Copyright: Hey API
+
+---
+
+OpenIddict: A simple and flexible OpenID Connect server for ASP.NET Core
+
+URL: https://github.com/openiddict/openiddict-core
+License: Apache License, Version 2.0
+Copyright: Kévin Chalet
+
+---
+
+Playwright: A Node.js library to automate browser testing
+
+URL: https://playwright.dev/
+License: Apache License, Version 2.0
+Copyright: 2025 Microsoft Corporation
+
+---
+
+Playwright-msw: A library to wrap Mock Service Worker with Playwright
+
+URL: https://github.com/valendres/playwright-msw
+License: MIT License
+Copyright: 2022 Peter Weller
+
+---
+
+Prettier: An opinionated code formatter
+
+URL: https://prettier.io/
+License: MIT License
+Copyright: James Long and contributors
+
+---
+
+Remark-gfm: A GitHub Flavored Markdown plugin for Remark
+
+URL: https://github.com/remarkjs/remark-gfm
+License: MIT License
+Copyright: Titus Wormer
+
+---
+
+rxjs: Reactive Extensions for JavaScript
+
+URL: https://rxjs.dev/
+License: Apache License, Version 2.0
+Copyright: 2015-present Ben Lesh <ben@benlesh.com>, Google, Inc., Netflix, Inc., Microsoft Corp., and contributors
+
+---
+
+Serilog: A diagnostic logging library for .NET
+
+URL: https://github.com/serilog/serilog
+License: Apache License, Version 2.0
+Copyright: Serilog Contributors
+
+---
+
+Simple Icons: A set of SVG icons for popular brands
+
+URL: https://simpleicons.org/
+License: CC0 1.0 Universal License
+Copyright: Simple Icons Contributors
+
+---
+
+Storybook: A UI component explorer for Web Components
+
+URL: https://storybook.js.org/
+License: MIT License
+Copyright: 2024 Storybook
+
+---
+
+StyleCop.Analyzers: Analyzers for StyleCop
+
+URL: https://github.com/DotNetAnalyzers/StyleCopAnalyzers
+License: MIT License
+Copyright: Tunnel Vision Laboratories, LLC
+
+---
+
+SVGO: A tool for optimizing SVG files
+
+URL: https://svgo.dev/
+License: MIT License
+Copyright: Kir Belevich
+
+---
+
+Swashbuckle.AspNetCore: A library for generating Swagger documentation for ASP.NET Core APIs
+
+URL: https://github.com/domaindrivendev/Swashbuckle.AspNetCore
+License: MIT License
+Copyright: 2016 Richard Morris
+
+---
+
+Tiny Glob: A tiny globbing library for Node.js
+
+URL: https://github.com/terkelg/tiny-glob
+License: MIT License
+Copyright: 2018 Terkel
+
+---
+
+Tiptap: A renderless rich-text editor for the web
+
+URL: https://tiptap.dev/
+License: MIT License
+Copyright: 2025 Tiptap GmbH
+
+---
+
+Tsc-alias: A TypeScript compiler plugin for aliasing module paths
+
+URL: https://github.com/justkey007/tsc-alias
+License: MIT License
+Copyright: 2018 Justkey
+
+---
+
+Typedoc: A documentation generator for TypeScript projects
+
+URL: https://typedoc.org/
+License: Apache License, Version 2.0
+Copyright: Gerrit Birkeland and Contributors
+
+---
+
+Typescript: A typed superset of JavaScript that compiles to plain JavaScript
+
+URL: https://www.typescriptlang.org/
+License: Apache License, Version 2.0
+Copyright: 2012-present Microsoft Corporation
+
+---
+
+Typescript-eslint: A set of tools for linting TypeScript code
+
+URL: https://github.com/typescript-eslint/typescript-eslint
+License: MIT License
+Copyright: 2019 typescript-eslint and other contributors
+
+---
+
+Typescript-json-schema: A library for generating JSON schema from TypeScript types
+
+URL: https://github.com/YousefED/typescript-json-schema
+License: BSD 3-Clause License
+Copyright: 2016 typescript-json-schema contributors
+
+---
+
+Umbraco.Code: Provides code-level tools for Umbraco
+
+URL: https://github.com/umbraco/Umbraco-Code
+License: MIT License
+Copyright: 2005-present Umbraco A/S
+
+---
+
+Umbraco.GitVersioning.Extensions: Utilities for Nerdbank.GitVersioning
+
+URL: https://github.com/umbraco/Umbraco.GitVersioning.Extensions
+License: MIT License
+Copyright: 2005-present Umbraco A/S
+
+---
+
+Umbraco.JsonSchema.Extensions: Utilities for JSON schema generation
+
+URL: https://github.com/umbraco/Umbraco.JsonSchema.Extensions
+License: MIT License
+Copyright: 2005-present Umbraco A/S
+
+---
+
+Umbraco UI Library: A set of UI components for building web applications
+
+URL: https://uui.umbraco.com/
+License: MIT License
+Copyright: 2005-present Umbraco A/S
+
+---
+
+uuid: A library for generating unique identifiers
+
+URL: https://github.com/uuidjs/uuid
+License: MIT License
+Copyright: 2010-2020 Robert Kieffer and other contributors
+
+---
+
+Vite: A fast build tool and development server for modern web projects
+
+URL: https://vite.dev/
+License: MIT License
+Copyright: 2019-present VoidZero Inc. and Vite contributors
+
+---
+
+Vite-plugin-static-copy: A Vite plugin for copying static files
+
+URL: https://github.com/sapphi-red/vite-plugin-static-copy
+License: MIT License
+Copyright: 2021 sapphi-red
+
+---
+
+Vite-tsconfig-paths: A Vite plugin for resolving TypeScript paths
+
+URL: https://github.com/aleclarson/vite-tsconfig-paths
+License: MIT License
+Copyright: Alec Larson
+
+---
+
+Web Component Analyzer: A tool for analyzing web components
+
+URL: https://github.com/runem/web-component-analyzer
+License: MIT License
+Copyright: 2019 Rune Mehlsen
@@ -0,0 +1,10 @@
+{
+	"folders": [
+		{
+			"path": "src/Umbraco.Web.UI.Client"
+		},
+		{
+			"path": "src/Umbraco.Web.UI.Login"
+		}		
+	]
+}
@@ -9,6 +9,11 @@ parameters:
    displayName: Run SQL Server Linux Acceptance Tests
    type: boolean
    default: false
+    # Skipped due to DB locks, the tests are still being run on the Nightly build
+  - name: sqliteAcceptanceTests
+    displayName: Run SQLite Acceptance Tests
+    type: boolean
+    default: false
  - name: myGetDeploy
    displayName: Deploy to MyGet
    type: boolean
@@ -29,6 +34,10 @@ parameters:
    displayName: Upload API docs
    type: boolean
    default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
  - name: forceReleaseTestFilter
    displayName: Force to use the release test filters
    type: boolean
@@ -98,6 +107,15 @@ stages:
              command: build
              projects: $(solution)
              arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
          - task: PublishPipelineArtifact@1
            displayName: Publish nupkg
            inputs:
@@ -108,6 +126,11 @@ stages:
            inputs:
              targetPath: $(Build.SourcesDirectory)
              artifactName: build_output
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Backend BOM
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-backend

      - job: B
        displayName: Build Bellissima Package
@@ -119,6 +142,11 @@ stages:
            lfs: false,
            fetchDepth: 500
          - template: templates/backoffice-install.yml
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
          - script: npm run build:for:npm
            displayName: Run build:for:npm
            workingDirectory: src/Umbraco.Web.UI.Client
@@ -135,6 +163,35 @@ stages:
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)/npm
              artifactName: npm
+          - publish: $(Build.ArtifactStagingDirectory)/bom
+            artifact: bom-frontend
+            displayName: 'Publish Frontend BOM'
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          submodules: false
+          lfs: false,
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'

  - stage: Build_Docs
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -427,6 +484,33 @@ stages:
            displayName: Start SQL Server Docker image (Linux)
            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))

+          - powershell: |
+              $maxAttempts = 12
+              $attempt = 0
+              $status = ""
+
+              while (($status -ne 'running') -and ($attempt -lt $maxAttempts)) {
+                Start-Sleep -Seconds 5
+                # We use the docker inspect command to check the status of the container. If the container is not running, we wait 5 seconds and try again. And if reaches 12 attempts, we fail the build.
+                $status = docker inspect -f '{{.State.Status}}' mssql
+
+                if ($status -ne 'running') {
+                  Write-Host "Waiting for SQL Server to be ready... Attempt $($attempt + 1)"
+                  $attempt++
+                }
+              }
+
+              if ($status -eq 'running') {
+                Write-Host "SQL Server container is running"
+                docker ps -a
+              } else {
+                Write-Host "SQL Server did not become ready in time. Last known status: $status"
+                docker logs mssql
+                exit 1
+              }
+            displayName: Wait for SQL Server to be ready (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
          - pwsh: SqlLocalDB start MSSQLLocalDB
            displayName: Start SQL Server LocalDB (Windows)
            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
@@ -481,316 +565,188 @@ stages:
      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
      ASPNETCORE_URLS: https://localhost:44331
    jobs:
-      # E2E Tests
+      # E2E Smoke Tests
      - job:
-        displayName: E2E Tests (SQLite)
+        displayName: E2E Smoke Tests (SQLite)
+        # currently disabled due to DB locks randomly occuring.
+        condition: eq(${{parameters.sqliteAcceptanceTests}}, True)
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
              vmImage: "ubuntu-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke"--shard=1/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=1/3"
            LinuxPart2Of3:
              vmImage: "ubuntu-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --shard=2/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=2/3"
            LinuxPart3Of3:
              vmImage: "ubuntu-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --shard=3/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=3/3"
            WindowsPart1Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --shard=1/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --shard=2/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --shard=3/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTestSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

      - job:
-        displayName: E2E Tests (SQL Server)
+        displayName: E2E Smoke Tests (SQL Server)
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+          DatabaseType: SQLServer
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            ${{ if eq(parameters.sqlServerLinuxAcceptanceTests, True) }}:
              LinuxPart1Of3:
-                testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=1/3'
+                testCommand: "npm run smokeTest -- --shard=1/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
              LinuxPart2Of3:
-                testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=2/3'
+                testCommand: "npm run smokeTest -- --shard=2/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
              LinuxPart3Of3:
-                testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=3/3'
+                testCommand: "npm run smokeTest -- --shard=3/3"
                vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
            WindowsPart1Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=1/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTest -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=2/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTest -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
-              testCommand: 'npx playwright test DefaultConfig --grep "@smoke" --grep-invert "Users" --shard=3/3'
+              testFolder: "DefaultConfig"
+              testCommand: "npm run smokeTest -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-backend"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-backend"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-frontend"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"

  ###############################################
  ## Release
@@ -800,10 +756,12 @@ stages:
    dependsOn:
      - Unit
      - Integration
-    #      - E2E
+      - E2E
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.myGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to pre-release feed
        steps:
          - checkout: none
@@ -865,6 +823,8 @@ stages:
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to NuGet
        steps:
          - checkout: none
@@ -994,3 +954,4 @@ stages:
              ContainerName: "$web"
              BlobPrefix: v$(umbracoMajorVersion)/ui-api
              CleanTargetBeforeCopy: true
+
@@ -0,0 +1,74 @@
+parameters:
+  - name: testFolder
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+steps:
+  - pwsh: |
+      dotnet restore UmbracoProject
+      cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
+    displayName: Restore project
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary app settings
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $jsonFiles = Get-ChildItem -Path $sourcePath -Filter "*.json"
+      if ($jsonFiles) {
+      $jsonFiles | ForEach-Object {
+        Write-Host "Copying: $($_.FullName)"
+        Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+      }
+      } else {
+      Write-Host "No JSON files found."
+      }
+    displayName: Update application to use necessary app settings
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary App_Plugins
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $appPluginsFolders = Get-ChildItem -Path $sourcePath -Directory -Filter "App_Plugins"
+      if ($appPluginsFolders) {
+        foreach ($folder in $appPluginsFolders) {
+          Write-Host "Copying folder: $($folder.FullName)"
+          Copy-Item -Path $folder.FullName -Destination $destinationPath -Recurse -Force
+          }
+      } else {
+        Write-Host "No App_Plugins found."
+      }
+    displayName: Update application to use necessary app plugins
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary classes
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $csharpFiles = Get-ChildItem -Path $sourcePath -Filter "*.cs"
+      if ($csharpFiles) {
+        $csharpFiles | ForEach-Object {
+          Write-Host "Copying: $($_.FullName)"
+          Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+        }
+      } else {
+        Write-Host "No C# files found."
+      }
+    displayName: Update application to use necessary classes
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  - pwsh: |
+      dotnet build UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-restore
+      dotnet dev-certs https
+    displayName: Build application
+    workingDirectory: $(Agent.BuildDirectory)/app
+    condition: and(succeeded(), eq(variables['additionalEnvironmentVariables'], 'false'))
@@ -0,0 +1,45 @@
+parameters:
+  - name: SA_PASSWORD
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Skips the SQLServer setup if the databaseType does not match
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Start SQL Server Linux
+      - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=${{ parameters.SA_PASSWORD }}" mcr.microsoft.com/mssql/server:2022-latest
+        displayName: Start SQL Server Docker image (Linux)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+      # Start SQL Server LocalDB Windows
+      - pwsh: SqlLocalDB start MSSQLLocalDB
+        displayName: Start SQL Server LocalDB (Windows)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Run application for Linux
+  - bash: |
+      nohup dotnet run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+      echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+    displayName: Run application (Linux)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Run application for Windows
+  - pwsh: |
+      $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+      Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+    displayName: Run application (Windows)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app
@@ -0,0 +1,105 @@
+parameters:
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: testCommand
+    type: string
+    default: ''
+
+  - name: port
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSEREMAIL
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSERPASSWORD
+    type: string
+    default: ''
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Ensures we have the package wait-on installed
+  - pwsh: npm install wait-on
+    displayName: Install wait-on package
+
+  # Wait for either the port of the aspnetcore url
+  - pwsh: |
+      $Port = "${{ parameters.port }}"
+      $Url  = "${{ parameters.ASPNETCORE_URLS }}"
+
+      if ($Port -ne "") {
+          Write-Host "Waiting on TCP port $Port"
+          npx wait-on -v --interval 1000 --timeout 120000 "tcp:$Port"
+      } else {
+          Write-Host "Waiting on URL $Url"
+          npx wait-on -v --interval 1000 --timeout 120000 "$Url"
+      }
+    displayName: Wait for application
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Install Playwright and dependencies
+  - pwsh: npx playwright install chromium
+    displayName: Install Playwright only with Chromium browser
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Test
+  - pwsh: ${{ parameters.testCommand }}
+    displayName: Run Playwright tests
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+    env:
+      CI: true
+      CommitId: $(Build.SourceVersion)
+      AgentOs: $(Agent.OS)
+      AZUREADB2CTESTUSEREMAIL: ${{ parameters.AZUREB2CTESTUSEREMAIL }}
+      AZUREADB2CTESTUSERPASSWORD: ${{ parameters.AZUREB2CTESTUSERPASSWORD }}
+
+  # Stop application
+  - bash: kill -15 $(AcceptanceTestProcessId)
+    displayName: Stop application (Linux)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+
+  - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
+    displayName: Stop application (Windows)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Stop SQL Server
+      - pwsh: docker stop mssql
+        displayName: Stop SQL Server Docker image (Linux)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Linux'))
+
+      - pwsh: SqlLocalDB stop MSSQLLocalDB
+        displayName: Stop SQL Server LocalDB (Windows)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Copy artifacts
+  - pwsh: |
+      if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
+        Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
+      }
+    displayName: Copy Playwright results
+    condition: succeededOrFailed()
+
+  # Publish
+  - task: PublishPipelineArtifact@1
+    displayName: Publish test artifacts
+    condition: succeededOrFailed()
+    inputs:
+      targetPath: $(Build.ArtifactStagingDirectory)
+      artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+  # Publish test results
+  - task: PublishTestResults@2
+    displayName: "Publish test results"
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: '*.xml'
+      searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+      testRunTitle: "$(Agent.JobName)"
@@ -0,0 +1,50 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+steps:
+  - task: DownloadPipelineArtifact@2
+    displayName: Download NuGet artifacts
+    inputs:
+      artifact: nupkg
+      path: $(Agent.BuildDirectory)/app/nupkg
+
+  - task: UseDotNet@2
+    displayName: Use .NET SDK from global.json
+    inputs:
+      useGlobalJson: true
+
+  - template: templates/e2e-install.yml
+    parameters:
+      nodeVersion: ${{ parameters.nodeVersion }}
+      npm_config_cache: ${{ parameters.npm_config_cache }}
+      PlaywrightUserEmail: ${{ parameters.PlaywrightUserEmail }}
+      PlaywrightPassword: ${{ parameters.PlaywrightPassword }}
+      ASPNETCORE_URLS: ${{ parameters.ASPNETCORE_URLS }}
+
+  # Install Template
+  - pwsh: |
+      $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
+      dotnet new nugetconfig
+      dotnet nuget add source ./nupkg --name Local
+      dotnet new install Umbraco.Templates::$cmsVersion
+      dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+    displayName: Install Template
+    workingDirectory: $(Agent.BuildDirectory)/app
@@ -4,12 +4,27 @@ pr: none
 trigger: none

 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 6 * * *'
+    displayName: Daily 6 AM build (v16/dev)
    branches:
      include:
-        - v14/dev
-        - v15/dev
+        - v16/dev
+
+parameters:
+  - name: skipIntegrationTests
+    displayName: Skip integration tests
+    type: boolean
+    default: false
+
+  - name: differentAppSettingsAcceptanceTests
+    displayName: Run acceptance tests with different app settings
+    type: boolean
+    default: false
+
+  - name: skipDefaultConfigAcceptanceTests
+    displayName: Skip tests with DefaultConfig
+    type: boolean
+    default: false

 variables:
  nodeVersion: 20
@@ -32,25 +47,17 @@ stages:
      - job: A
        displayName: Build Umbraco CMS
        pool:
-          vmImage: 'ubuntu-latest'
+          vmImage: "windows-latest"
        steps:
          - checkout: self
-            fetchDepth: 0
-            submodules: true
+            submodules: false
+            lfs: false,
+            fetchDepth: 500
+          - template: templates/backoffice-install.yml
          - task: UseDotNet@2
            displayName: Use .NET SDK from global.json
            inputs:
              useGlobalJson: true
-          - template: templates/backoffice-install.yml
-          - script: npm run build:for:cms
-            displayName: Run build (Bellissima)
-            workingDirectory: src/Umbraco.Web.UI.Client
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            displayName: Run npm ci (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
-          - script: npm run build
-            displayName: Run npm build (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
          - task: DotNetCoreCLI@2
            displayName: Run dotnet restore
            inputs:
@@ -62,7 +69,7 @@ stages:
            inputs:
              command: build
              projects: $(solution)
-              arguments: '--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg'
+              arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
          - task: PublishPipelineArtifact@1
            displayName: Publish nupkg
            inputs:
@@ -74,9 +81,220 @@ stages:
              targetPath: $(Build.SourcesDirectory)
              artifactName: build_output

-  - stage: E2E
-    displayName: E2E Tests
+      - job: B
+        displayName: Build Bellissima Package
+        pool:
+          vmImage: "ubuntu-latest"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 500
+          - template: templates/backoffice-install.yml
+          - script: npm run build:for:npm
+            displayName: Run build:for:npm
+            workingDirectory: src/Umbraco.Web.UI.Client
+          - bash: |
+              echo "##[command]Running npm pack"
+              echo "##[debug]Output directory: $(Build.ArtifactStagingDirectory)"
+              mkdir $(Build.ArtifactStagingDirectory)/npm
+              npm pack --pack-destination $(Build.ArtifactStagingDirectory)/npm
+              mv .npmrc $(Build.ArtifactStagingDirectory)/npm/
+            displayName: Run npm pack
+            workingDirectory: src/Umbraco.Web.UI.Client
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Bellissima npm artifact
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/npm
+              artifactName: npm
+
+  - stage: Integration
+    displayName: Integration Tests
    dependsOn: Build
+    condition: ${{ eq(parameters.skipIntegrationTests, false) }}
+    jobs:
+      # Integration Tests (SQLite)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQLite)
+        strategy:
+          matrix:
+            #            Windows:
+            #              vmImage: 'windows-latest'
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            macOSPart1Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            macOSPart2Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            macOSPart3Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+        pool:
+          vmImage: $(vmImage)
+        variables:
+          Tests__Database__DatabaseType: "Sqlite"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQLite - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+      # Integration Tests (SQL Server)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQL Server)
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+        strategy:
+          matrix:
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Start SQL Server
+          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
+            displayName: Start SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - powershell: |
+              $maxAttempts = 12
+              $attempt = 0
+              $status = ""
+
+              while (($status -ne 'running') -and ($attempt -lt $maxAttempts)) {
+                Start-Sleep -Seconds 5
+                # We use the docker inspect command to check the status of the container. If the container is not running, we wait 5 seconds and try again. And if reaches 12 attempts, we fail the build.
+                $status = docker inspect -f '{{.State.Status}}' mssql
+
+                if ($status -ne 'running') {
+                  Write-Host "Waiting for SQL Server to be ready... Attempt $($attempt + 1)"
+                  $attempt++
+                }
+              }
+
+              if ($status -eq 'running') {
+                Write-Host "SQL Server container is running"
+                docker ps -a
+              } else {
+                Write-Host "SQL Server did not become ready in time. Last known status: $status"
+                docker logs mssql
+                exit 1
+              }
+            displayName: Wait for SQL Server to be ready (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB start MSSQLLocalDB
+            displayName: Start SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQL Server - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+          # Stop SQL Server
+          - pwsh: docker stop mssql
+            displayName: Stop SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB stop MSSQLLocalDB
+            displayName: Stop SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - stage: DefaultConfigE2E
+    displayName: Default Config E2E Tests
+    dependsOn: Integration
+    condition: always()
    variables:
      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
      # Enable console logging in Release mode
@@ -103,318 +321,358 @@ stages:
      - job:
        displayName: E2E Tests (SQLite)
        timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
              vmImage: "ubuntu-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=1/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=1/3"
            LinuxPart2Of3:
              vmImage: "ubuntu-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=2/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=2/3"
            LinuxPart3Of3:
              vmImage: "ubuntu-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=3/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=3/3"
            WindowsPart1Of3:
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=1/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=1/3"
            WindowsPart2Of3:
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=2/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=2/3"
            WindowsPart3Of3:
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --shard=3/3"
+              testFolder: "DefaultConfig"
+              testCommand: "npm run testSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

      - job:
        displayName: E2E Tests (SQL Server)
        timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          DatabaseType: SQLServer
+          SA_PASSWORD: UmbracoAcceptance123!
+          additionalEnvironmentVariables: false
        strategy:
          matrix:
            LinuxPart1Of3:
-              testCommand: "npx playwright test DefaultConfig --grep-invert \"Users\" --shard=1/3"
+              testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            LinuxPart2Of3:
-              testCommand: "npx playwright test DefaultConfig --grep-invert \"Users\" --shard=2/3"
+              testCommand: "npm run test -- --shard=2/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            LinuxPart3Of3:
-              testCommand: "npx playwright test DefaultConfig  --grep-invert \"Users\" --shard=3/3"
+              testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
              vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
            WindowsPart1Of3:
+              testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --grep-invert \"Users\" --shard=1/3"
            WindowsPart2Of3:
+              testCommand: "npm run test -- --shard=2/3"
+              testFolder: "DefaultConfig"
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --grep-invert \"Users\" --shard=2/3"
            WindowsPart3Of3:
+              testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
              vmImage: "windows-latest"
-              testCommand: "npx playwright test DefaultConfig --grep-invert \"Users\" --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}

          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
              dotnet restore UmbracoProject
              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
              dotnet dev-certs https
            displayName: Build application
            workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()

-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}

-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}

-          # Run application
+  - stage: AdditionalConfigE2E
+    displayName: Additional Config E2E Tests
+    dependsOn: DefaultConfigE2E
+    condition: always()
+    variables:
+      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
+      ASPNETCORE_URLS: https://localhost:44331
+      PlaywrightPassword: UmbracoAcceptance123!
+      PlaywrightUserEmail: playwright@umbraco.com
+    jobs:
+      - job:
+        displayName: E2E Tests with Different App settings (SQL Server)
+        condition: ${{ or(eq(parameters.differentAppSettingsAcceptanceTests, true), eq(parameters.skipDefaultConfigAcceptanceTests, true)) }}
+        timeoutInMinutes: 180
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+          DatabaseType: SQLServer
+        strategy:
+          matrix:
+            # UnattendedInstallConfig
+            WindowsUnattendedInstallConfig:
+              vmImage: "windows-latest"
+              testFolder: "UnattendedInstallConfig"
+              testCommand: "npx playwright test --project=unattendedInstallConfig --grep=InstallSQLServer"
+              port: 44331
+              additionalEnvironmentVariables: false
+            # DeliveryApiConfig
+            WindowsDeliveryApiConfig:
+              vmImage: "windows-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxDeliveryApiConfig:
+              vmImage: "ubuntu-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            # ExternalLogin AzureADB2C
+            WindowsExternalLoginAzureADB2C:
+              vmImage: "windows-latest"
+              testFolder: "ExternalLogin\\AzureADB2C"
+              testCommand: "npx playwright test --project=externalLoginAzureADB2C"
+              port: 44331
+              packageName: "Microsoft.AspNetCore.Authentication.OpenIdConnect"
+              packageVersion: "9.0.8"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: true
+            # ExtensionRegistry
+            WindowsExtensionRegistry:
+              vmImage: "windows-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxExtensionRegistry:
+              vmImage: "ubuntu-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.PlaywrightUserEmail }}
+              PlaywrightPassword: ${{ variables.PlaywrightPassword }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
+
+          # Install NuGet package if specified in the matrix
+          - pwsh: |
+              Write-Host "Installing package $(packageName) version $(packageVersion)"
+              dotnet add package $(packageName) --version $(packageVersion)
+            displayName: "Install NuGet package: $(packageName)"
+            workingDirectory: $(Agent.BuildDirectory)/app/UmbracoProject
+            condition: and(succeeded(), ne(variables['packageName'], ''), ne(variables['packageVersion'], ''))
+
+          # Build application Template
+          - template: nightly-E2E-build-template.yml
+            parameters:
+              testFolder: $(testFolder)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+
+          # Build application for AzureADB2C
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
+              dotnet dev-certs https
+            displayName: Build application for AzureADB2C
+            workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
+            condition: and(succeeded(), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
+
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+
+          # Run application for Linux with additional Environment Variables for Azure AD
          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+              nohup dotnet run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
            workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)

+          # Run application for Windows with additional Environment Variables for Azure AD
          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+              $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)

-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              port: $(port)
+              AZUREB2CTESTUSEREMAIL: $(AZUREB2CTESTUSEREMAIL)
+              AZUREB2CTESTUSERPASSWORD: $(AZUREB2CTESTUSERPASSWORD)
+              DatabaseType: ${{ variables.DatabaseType }}

-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+  - stage: NotifySlackBot
+    displayName: Notify Slack on Failure
+    dependsOn: DefaultConfigE2E
+    # This stage will only run if the E2E tests fail or succeed with issues
+    condition: or(eq(dependencies.DefaultConfigE2E.result, 'failed'), eq(dependencies.DefaultConfigE2E.result, 'succeededWithIssues'))
+    jobs:
+      - job: PostToSlack
+        displayName: Send Slack Notification
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          # We send a payload to the Slack webhook URL, which will post a message to a specific channel
+          - bash: |
+              PROJECT_NAME_ENCODED=$(echo -n "$SYSTEM_TEAMPROJECT" | jq -s -R -r @uri)
+              PIPELINE_URL="${SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${PROJECT_NAME_ENCODED}/_build/results?buildId=${BUILD_BUILDID}&view=ms.vss-test-web.build-test-results-tab"

-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+              PAYLOAD="{
+                \"attachments\": [
+                  {
+                    \"color\": \"#ff0000\",
+                    \"pretext\": \"Nightly E2E pipeline *${BUILD_DEFINITIONNAME}* (#${BUILD_BUILDNUMBER}) failed!\",
+                    \"title\": \"View Failed E2E Test Results\",
+                    \"title_link\": \"$PIPELINE_URL\",
+                    \"fields\": [
+                      {
+                        \"title\": \"Pipeline\",
+                        \"value\": \"${BUILD_DEFINITIONNAME}\",
+                        \"short\": true
+                      },
+                      {
+                        \"title\": \"Build ID\",
+                        \"value\": \"${BUILD_BUILDID}\",
+                        \"short\": true
+                      }
+                    ]
+                  }
+                ]
+              }"

-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+              echo "Sending Slack message to: $PIPELINE_URL"
+              curl -X POST -H 'Content-type: application/json' \
+                --data "$PAYLOAD" \
+                "$SLACK_WEBHOOK_URL"
+            env:
+              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)
@@ -8,10 +8,9 @@ schedules:
  displayName: Daily midnight build
  branches:
    include:
-    - v10/dev
-    - v12/dev
    - v13/dev
-    - v14/dev
+    - v17/dev
+    - main

 steps:
 - checkout: none
@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track
@@ -0,0 +1,49 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}
+      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages
@@ -1,6 +1,6 @@
 {
  "sdk": {
-    "version": "9.0.100",
+    "version": "9.0.306",
    "rollForward": "latestFeature",
    "allowPrerelease": false
  }
@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
+{
+    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}
@@ -0,0 +1,20 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public abstract class RequestContextServiceAccessorBase<T>
+    where T : class
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
+    {
+        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
+        return requestStartNodeService is not null;
+    }
+}
@@ -4,7 +4,7 @@ using Umbraco.Cms.Core.Configuration.Models;

 namespace Umbraco.Cms.Api.Common.Configuration;

-internal class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
+internal sealed class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
 {
    private readonly IOptions<GlobalSettings> _globalSettings;

@@ -1,4 +1,5 @@
 using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
 using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.DependencyInjection;
@@ -6,7 +7,6 @@ using Microsoft.Extensions.Options;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Configuration;
@@ -17,13 +17,6 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
    private readonly ISchemaIdSelector _schemaIdSelector;
    private readonly ISubTypesSelector _subTypesSelector;

-    [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 16.")]
-    public ConfigureUmbracoSwaggerGenOptions(
-        IOperationIdSelector operationIdSelector,
-        ISchemaIdSelector schemaIdSelector)
-        : this(operationIdSelector, schemaIdSelector, StaticServiceProvider.Instance.GetRequiredService<ISubTypesSelector>())
-    { }
-
    public ConfigureUmbracoSwaggerGenOptions(
        IOperationIdSelector operationIdSelector,
        ISchemaIdSelector schemaIdSelector,
@@ -48,17 +41,15 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
        swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description));
        swaggerGenOptions.DocInclusionPredicate((name, api) =>
        {
-            if (string.IsNullOrWhiteSpace(api.GroupName))
+            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
+                && controllerActionDescriptor.HasMapToApiAttribute(name))
            {
-                return false;
+                return true;
            }

-            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
-            {
-                return controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name);
-            }
-
-            return false;
+            ApiVersionMetadata apiVersionMetadata = api.ActionDescriptor.GetApiVersionMetadata();
+            return apiVersionMetadata.Name == name
+                   || (string.IsNullOrEmpty(apiVersionMetadata.Name) && name == DefaultApiConfiguration.ApiName);
        });
        swaggerGenOptions.TagActionsBy(api => new[] { api.GroupName });
        swaggerGenOptions.OrderActionsBy(ActionOrderBy);
@@ -70,5 +61,5 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt

    // see https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting
    private static string ActionOrderBy(ApiDescription apiDesc)
-        => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{apiDesc.ActionDescriptor.RouteValues["action"]}_{apiDesc.HttpMethod}";
+        => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{(apiDesc.ActionDescriptor.RouteValues.TryGetValue("action", out var action) ? action : null)}_{apiDesc.HttpMethod}";
 }
@@ -0,0 +1,230 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+using OpenIddict.Validation;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Web.Common.Security;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+internal sealed class HideBackOfficeTokensHandler
+    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
+        INotificationHandler<UserLogoutSuccessNotification>
+{
+    private const string RedactedTokenValue = "[redacted]";
+    private const string AccessTokenCookieKey = "__Host-umbAccessToken";
+    private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
+    private const string PkceCodeCookieKey = "__Host-umbPkceCode";
+
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+    private readonly GlobalSettings _globalSettings;
+
+    public HideBackOfficeTokensHandler(
+        IHttpContextAccessor httpContextAccessor,
+        IDataProtectionProvider dataProtectionProvider,
+        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+        IOptions<GlobalSettings> globalSettings)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _dataProtectionProvider = dataProtectionProvider;
+        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
+        _globalSettings = globalSettings.Value;
+    }
+
+    /// <summary>
+    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
+    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
+    /// tokens from the response, so they are not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        if (context.Response.AccessToken is not null)
+        {
+            SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
+            context.Response.AccessToken = RedactedTokenValue;
+        }
+
+        if (context.Response.RefreshToken is not null)
+        {
+            SetCookie(httpContext, RefreshTokenCookieKey, context.Response.RefreshToken);
+            context.Response.RefreshToken = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when a PKCE code is issued to the client. For the back-office client, we will intercept the
+    /// response, write the PKCE code from the response into a HTTP-only cookie, and redact the code from the response,
+    /// so it's not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyAuthorizationResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        if (context.Response.Code is not null)
+        {
+            SetCookie(GetHttpContext(), PkceCodeCookieKey, context.Response.Code);
+            context.Response.Code = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when requesting new tokens.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        // Handle when the PKCE code is being exchanged for an access token.
+        if (context.Request.Code == RedactedTokenValue
+            && TryGetCookie(PkceCodeCookieKey, out var code))
+        {
+            context.Request.Code = code;
+
+            // We won't need the PKCE cookie after this, let's remove it.
+            RemoveCookie(GetHttpContext(), PkceCodeCookieKey);
+        }
+        else
+        {
+            // PCKE codes should always be redacted. If we got here, someone might be trying to pass another PKCE
+            // code. For security reasons, explicitly discard the code (if any) to be on the safe side.
+            context.Request.Code = null;
+        }
+
+        // Handle when a refresh token is being exchanged for a new access token.
+        if (context.Request.RefreshToken == RedactedTokenValue
+            && TryGetCookie(RefreshTokenCookieKey, out var refreshToken))
+        {
+            context.Request.RefreshToken = refreshToken;
+        }
+        else
+        {
+            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
+            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
+            context.Request.RefreshToken = null;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when extracting the auth context for a client request.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
+    {
+        // For the back-office client, this only happens when an access token is sent to the API.
+        if (context.AccessToken != RedactedTokenValue)
+        {
+            return ValueTask.CompletedTask;
+        }
+
+        if (TryGetCookie(AccessTokenCookieKey, out var accessToken))
+        {
+            context.AccessToken = accessToken;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    public void Handle(UserLogoutSuccessNotification notification)
+    {
+        HttpContext? context = _httpContextAccessor.HttpContext;
+        if (context is null)
+        {
+            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
+            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
+            // so the cookie clean-up is mostly cosmetic.
+            return;
+        }
+
+        context.Response.Cookies.Delete(AccessTokenCookieKey);
+        context.Response.Cookies.Delete(RefreshTokenCookieKey);
+    }
+
+    private HttpContext GetHttpContext()
+        => _httpContextAccessor.GetRequiredHttpContext();
+
+    private void SetCookie(HttpContext httpContext, string key, string value)
+    {
+        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
+
+        RemoveCookie(httpContext, key);
+        httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
+    }
+
+    private void RemoveCookie(HttpContext httpContext, string key)
+        => httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
+
+    private CookieOptions GetCookieOptions(HttpContext httpContext) =>
+        new()
+        {
+            // Prevent the client-side scripts from accessing the cookie.
+            HttpOnly = true,
+
+            // Mark the cookie as essential to the application, to enforce it despite any
+            // data collection consent options. This aligns with how ASP.NET Core Identity
+            // does when writing cookies for cookie authentication.
+            IsEssential = true,
+
+            // Cookie path must be root for optimal security.
+            Path = "/",
+
+            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
+            // environments over HTTP, so we need to take that into account here.
+            // Thus, we will make the cookie secure if:
+            // - HTTPS is explicitly enabled by config (default for production environments), or
+            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
+            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
+
+            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
+            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
+        };
+
+    private bool TryGetCookie(string key, [NotNullWhen(true)] out string? value)
+    {
+        if (GetHttpContext().Request.Cookies.TryGetValue(key, out var cookieValue))
+        {
+            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+            return true;
+        }
+
+        value = null;
+        return false;
+    }
+
+    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
+        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
+            ? result
+            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
+}
@@ -18,7 +18,7 @@ public class ProcessRequestContextHandler
        var backOfficePathSegment = Constants.System.DefaultUmbracoPath.TrimStart(Constants.CharArrays.Tilde)
            .EnsureStartsWith('/')
            .EnsureEndsWith('/');
-        _pathsToHandle = [backOfficePathSegment, "/.well-known/openid-configuration"];
+        _pathsToHandle = [backOfficePathSegment, "/.well-known/openid-configuration", "/.well-known/jwks"];
    }

    public ValueTask HandleAsync(OpenIddictServerEvents.ProcessRequestContext context)
@@ -9,6 +9,7 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
 using Umbraco.Extensions;

@@ -28,6 +29,11 @@ public static class UmbracoBuilderAuthExtensions

    private static void ConfigureOpenIddict(IUmbracoBuilder builder)
    {
+        // Optionally hide tokens from the back-office.
+        var hideBackOfficeTokens = (builder.Config
+            .GetSection(Constants.Configuration.ConfigBackOfficeTokenCookie)
+            .Get<BackOfficeTokenCookieSettings>() ?? new BackOfficeTokenCookieSettings()).Enabled;
+
        builder.Services.AddOpenIddict()
            // Register the OpenIddict server components.
            .AddServer(options =>
@@ -46,7 +52,9 @@ public static class UmbracoBuilderAuthExtensions
                        Paths.BackOfficeApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
                    .SetRevocationEndpointUris(
                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),
-                        Paths.BackOfficeApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));
+                        Paths.BackOfficeApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetUserInfoEndpointUris(
+                        Paths.MemberApi.UserinfoEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));

                // Enable authorization code flow with PKCE
                options
@@ -62,7 +70,8 @@ public static class UmbracoBuilderAuthExtensions
                    .UseAspNetCore()
                    .EnableAuthorizationEndpointPassthrough()
                    .EnableTokenEndpointPassthrough()
-                    .EnableEndSessionEndpointPassthrough();
+                    .EnableEndSessionEndpointPassthrough()
+                    .EnableUserInfoEndpointPassthrough();

                // Enable reference tokens
                // - see https://documentation.openiddict.com/configuration/token-storage.html
@@ -110,6 +119,28 @@ public static class UmbracoBuilderAuthExtensions
                {
                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                });
+
+                if (hideBackOfficeTokens)
+                {
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
+                    });
+                }
            })

            // Register the OpenIddict validation components.
@@ -134,9 +165,25 @@ public static class UmbracoBuilderAuthExtensions
                {
                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                });
+
+                if (hideBackOfficeTokens)
+                {
+                    options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
+                            .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
+                    });
+                }
            });

        builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
        builder.Services.ConfigureOptions<ConfigureOpenIddict>();
+
+        if (hideBackOfficeTokens)
+        {
+            builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
+        }
    }
 }
@@ -0,0 +1,36 @@
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.Configuration;
+
+namespace Umbraco.Extensions;
+
+/// <summary>
+/// Provides extension methods for <see cref="ActionDescriptor"/> to work with <see cref="MapToApiAttribute"/>.
+/// </summary>
+public static class ActionDescriptorApiCommonExtensions
+{
+    /// <summary>
+    /// Determines whether the <see cref="ActionDescriptor"/> has a <see cref="MapToApiAttribute"/> with the specified API name.
+    /// The check is made in runtime to support attributes added in runtime.
+    /// </summary>
+    /// <param name="actionDescriptor">The action descriptor to inspect.</param>
+    /// <param name="apiName">The API name to check for.</param>
+    /// <returns>
+    /// <c>true</c> if the <see cref="MapToApiAttribute"/> is present and matches the specified API name,
+    /// or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
+    /// </returns>
+    public static bool HasMapToApiAttribute(this ActionDescriptor actionDescriptor, string apiName)
+    {
+        var value = actionDescriptor.GetMapToApiAttributeValue();
+
+        return value == apiName
+               || (value is null && apiName == DefaultApiConfiguration.ApiName);
+    }
+
+    private static string? GetMapToApiAttributeValue(this ActionDescriptor actionDescriptor)
+    {
+        IEnumerable<MapToApiAttribute> mapToApiAttributes = actionDescriptor?.EndpointMetadata?.OfType<MapToApiAttribute>() ?? [];
+
+        return mapToApiAttributes.SingleOrDefault()?.ApiName;
+    }
+}
@@ -4,7 +4,7 @@ using Microsoft.Extensions.Logging;

 namespace Umbraco.Cms.Api.Common.Json;

-internal class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
+internal sealed class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
 {
    private readonly string _jsonOptionsName;

@@ -3,8 +3,7 @@ using Microsoft.AspNetCore.Mvc.Formatters;

 namespace Umbraco.Cms.Api.Common.Json;

-
-internal class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
+internal sealed class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
 {
    private readonly string _jsonOptionsName;

@@ -5,8 +5,5 @@ namespace Umbraco.Cms.Api.Common.OpenApi;

 public interface IOperationIdSelector
 {
-    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
-    string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions);
-
    string? OperationId(ApiDescription apiDescription);
 }
@@ -16,9 +16,6 @@ public class OperationIdSelector : IOperationIdSelector
    public OperationIdSelector(IEnumerable<IOperationIdHandler> operationIdHandlers)
        => _operationIdHandlers = operationIdHandlers;

-    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
-    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions) => OperationId(apiDescription);
-
    public virtual string? OperationId(ApiDescription apiDescription)
    {
        IOperationIdHandler? handler = _operationIdHandlers.FirstOrDefault(h => h.CanHandle(apiDescription));
@@ -10,12 +10,12 @@ namespace Umbraco.Cms.Api.Common.OpenApi;

 public class SubTypesSelector : ISubTypesSelector
 {
-    private readonly IOptions<GlobalSettings> _settings;
    private readonly IHostingEnvironment _hostingEnvironment;
    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly IEnumerable<ISubTypesHandler> _subTypeHandlers;
    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;

+    [Obsolete("The settings parameter is not required anymore, use the other constructor instead. Scheduled for removal in Umbraco 17.")]
    public SubTypesSelector(
        IOptions<GlobalSettings> settings,
        IHostingEnvironment hostingEnvironment,
@@ -23,7 +23,18 @@ public class SubTypesSelector : ISubTypesSelector
        IEnumerable<ISubTypesHandler> subTypeHandlers,
        IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
    {
-        _settings = settings;
+        _hostingEnvironment = hostingEnvironment;
+        _httpContextAccessor = httpContextAccessor;
+        _subTypeHandlers = subTypeHandlers;
+        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
+    }
+
+    public SubTypesSelector(
+        IHostingEnvironment hostingEnvironment,
+        IHttpContextAccessor httpContextAccessor,
+        IEnumerable<ISubTypesHandler> subTypeHandlers,
+        IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
+    {
        _hostingEnvironment = hostingEnvironment;
        _httpContextAccessor = httpContextAccessor;
        _subTypeHandlers = subTypeHandlers;
@@ -32,7 +43,7 @@ public class SubTypesSelector : ISubTypesSelector

    public IEnumerable<Type> SubTypes(Type type)
    {
-        var backOfficePath =  _settings.Value.GetBackOfficePath(_hostingEnvironment);
+        var backOfficePath = _hostingEnvironment.GetBackOfficePath();
        var swaggerPath = $"{backOfficePath}/swagger";

        if (_httpContextAccessor.HttpContext?.Request.Path.StartsWithSegments(swaggerPath) ?? false)
@@ -7,7 +7,7 @@ using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Swashbuckle.AspNetCore.SwaggerUI;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
 using Umbraco.Extensions;
 using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
@@ -30,24 +30,21 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
        IOptions<SwaggerGenOptions> swaggerGenOptions = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<SwaggerGenOptions>>();

        applicationBuilder.UseSwagger(swaggerOptions =>
-            {
-                swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
-            });
+        {
+            swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
+        });

        applicationBuilder.UseSwaggerUI(swaggerUiOptions => SwaggerUiConfiguration(swaggerUiOptions, swaggerGenOptions.Value, applicationBuilder));
    }

    protected virtual bool SwaggerIsEnabled(IApplicationBuilder applicationBuilder)
-    {
-        IWebHostEnvironment webHostEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>();
-        return webHostEnvironment.IsProduction() is false;
-    }
+        => applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>().IsProduction() is false;

    protected virtual string SwaggerRouteTemplate(IApplicationBuilder applicationBuilder)
-        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
+        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";

    protected virtual string SwaggerUiRoutePrefix(IApplicationBuilder applicationBuilder)
-        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
+        => $"{GetBackOfficePath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";

    protected virtual void SwaggerUiConfiguration(
        SwaggerUIOptions swaggerUiOptions,
@@ -56,8 +53,7 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
    {
        swaggerUiOptions.RoutePrefix = SwaggerUiRoutePrefix(applicationBuilder);

-        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs
-                     .OrderBy(x => x.Value.Title))
+        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs.OrderBy(x => x.Value.Title))
        {
            swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
        }
@@ -70,11 +66,6 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
        swaggerUiOptions.OAuthUsePkce();
    }

-    private string GetUmbracoPath(IApplicationBuilder applicationBuilder)
-    {
-        GlobalSettings settings = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<GlobalSettings>>().Value;
-        IHostingEnvironment hostingEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>();
-
-        return settings.GetBackOfficePath(hostingEnvironment);
-    }
+    private string GetBackOfficePath(IApplicationBuilder applicationBuilder)
+        => applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>().GetBackOfficePath();
 }
@@ -0,0 +1,148 @@
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.Rendering;
+
+public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
+{
+    protected const string All = "$all";
+    protected const string None = "";
+    protected const string ExpandParameterName = "expand";
+    protected const string FieldsParameterName = "fields";
+
+    private readonly IApiPropertyRenderer _propertyRenderer;
+
+    protected Stack<Node?> ExpandProperties { get; } = new();
+
+    protected Stack<Node?> IncludeProperties { get; } = new();
+
+    public ElementOnlyOutputExpansionStrategy(
+        IApiPropertyRenderer propertyRenderer)
+    {
+        _propertyRenderer = propertyRenderer;
+    }
+
+    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
+        => content.ItemType == PublishedItemType.Content
+            ? MapProperties(content.Properties)
+            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
+
+    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
+    {
+        if (media.ItemType != PublishedItemType.Media)
+        {
+            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
+        }
+
+        IPublishedProperty[] properties = media
+            .Properties
+            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
+            .ToArray();
+
+        return properties.Any()
+            ? MapProperties(properties)
+            : new Dictionary<string, object?>();
+    }
+
+    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
+        => MapProperties(element.Properties, true);
+
+    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
+    {
+        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
+        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
+        var result = new Dictionary<string, object?>();
+        foreach (IPublishedProperty property in properties)
+        {
+            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
+            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
+            {
+                continue;
+            }
+
+            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
+
+            IncludeProperties.Push(nextIncludeProperties);
+            ExpandProperties.Push(nextExpandProperties);
+
+            result[property.Alias] = GetPropertyValue(property);
+
+            ExpandProperties.Pop();
+            IncludeProperties.Pop();
+        }
+
+        return result;
+    }
+
+    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
+        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
+           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
+
+    private object? GetPropertyValue(IPublishedProperty property)
+        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
+
+    protected sealed class Node
+    {
+        public string Key { get; private set; } = string.Empty;
+
+        public List<Node> Items { get; } = new();
+
+        public static Node Parse(string value)
+        {
+            // verify that there are as many start brackets as there are end brackets
+            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
+            {
+                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
+            }
+
+            // verify that the value does not start with a start bracket
+            if (value.StartsWith("["))
+            {
+                throw new ArgumentException("Value cannot start with a bracket");
+            }
+
+            // verify that there are no empty brackets
+            if (value.Contains("[]"))
+            {
+                throw new ArgumentException("Value cannot contain empty brackets");
+            }
+
+            var stack = new Stack<Node>();
+            var root = new Node { Key = "root" };
+            stack.Push(root);
+
+            var currentNode = new Node();
+            root.Items.Add(currentNode);
+
+            foreach (char c in value)
+            {
+                switch (c)
+                {
+                    case '[': // Start a new node, child of the current node
+                        stack.Push(currentNode);
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ',': // Start a new node, but at the same level of the current node
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ']': // Back to parent of the current node
+                        currentNode = stack.Pop();
+                        break;
+                    default: // Add char to current node key
+                        currentNode.Key += c;
+                        break;
+                }
+            }
+
+            return root;
+        }
+    }
+}
@@ -31,6 +31,8 @@ public static class Paths

        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");

+        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
+
        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
        private static string EndpointPath(string relativePath) => $"/umbraco/delivery/api/v1/{relativePath}";
    }
@@ -17,8 +17,8 @@
  </ItemGroup>

  <ItemGroup>
-    <!-- Take top-level depedendency on Microsoft.IdentityModel.JsonWebTokens, because OpenIddict.AspNetCore depends on a vulnerable version -->
-    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
  </ItemGroup>

  <ItemGroup>
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;
+
+public class SubsetViewModel<T>
+{
+    [Required]
+    public long TotalBefore { get; set; }
+
+    [Required]
+    public long TotalAfter { get; set; }
+
+    [Required]
+    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
+
+    public static SubsetViewModel<T> Empty() => new();
+}
@@ -1,5 +1,6 @@
-using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.AspNetCore.OutputCaching;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Caching;
@@ -7,9 +8,13 @@ namespace Umbraco.Cms.Api.Delivery.Caching;
 internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
 {
    private readonly TimeSpan _duration;
+    private readonly StringValues _varyByHeaderNames;

-    public DeliveryApiOutputCachePolicy(TimeSpan duration)
-        => _duration = duration;
+    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
+    {
+        _duration = duration;
+        _varyByHeaderNames = varyByHeaderNames;
+    }

    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
    {
@@ -18,8 +23,14 @@ internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
            .RequestServices
            .GetRequiredService<IRequestPreviewService>();

-        context.EnableOutputCaching = requestPreviewService.IsPreview() is false;
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
        context.ResponseExpirationTimeSpan = _duration;
+        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;

        return ValueTask.CompletedTask;
    }
@@ -26,7 +26,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
        options.OperationFilter<DeliveryApiSecurityFilter>();
    }

-    private class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
+    private sealed class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter, IDocumentFilter
    {
        public void Apply(OpenApiOperation operation, OperationFilterContext context)
        {
@@ -48,7 +48,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                                Id = AuthSchemeName,
                            }
                        },
-                        new string[] { }
+                        []
                    }
                }
            };
@@ -1,4 +1,3 @@
-using System.Diagnostics;
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -8,7 +7,6 @@ using Umbraco.Cms.Core.Models.PublishedContent;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdContentApiController : ContentApiItemControllerBase
 {
@@ -21,16 +19,6 @@ public class ByIdContentApiController : ContentApiItemControllerBase
        : base(apiPublishedContentCache, apiContentResponseBuilder)
        => _requestMemberAccessService = requestMemberAccessService;

-    [HttpGet("item/{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-    [ProducesResponseType(StatusCodes.Status403Forbidden)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> ById(Guid id)
-        => await HandleRequest(id);
-
    /// <summary>
    ///     Gets a content item by id.
    /// </summary>
@@ -8,7 +8,6 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdsContentApiController : ContentApiItemControllerBase
 {
@@ -21,15 +20,6 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
        : base(apiPublishedContentCache, apiContentResponseBuilder)
        => _requestMemberAccessService = requestMemberAccessService;

-    [HttpGet("item")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-    [ProducesResponseType(StatusCodes.Status403Forbidden)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
-        => await HandleRequest(ids);
-
    /// <summary>
    ///     Gets content items by ids.
    /// </summary>
@@ -58,6 +48,6 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
            .WhereNotNull()
            .ToArray();

-        return await Task.FromResult(Ok(apiContentItems));
+        return Ok(apiContentItems);
    }
 }
@@ -1,17 +1,13 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByRouteContentApiController : ContentApiItemControllerBase
 {
@@ -21,45 +17,6 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
    private readonly IRequestMemberAccessService _requestMemberAccessService;
    private const string PreviewContentRequestPathPrefix = $"/{Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";

-    [Obsolete($"Please use the constructor that accepts {nameof(IApiContentPathResolver)}. Will be removed in V15.")]
-    public ByRouteContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IRequestRoutingService requestRoutingService,
-        IRequestRedirectService requestRedirectService,
-        IRequestPreviewService requestPreviewService,
-        IRequestMemberAccessService requestMemberAccessService)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            requestRedirectService,
-            requestPreviewService,
-            requestMemberAccessService,
-            StaticServiceProvider.Instance.GetRequiredService<IApiContentPathResolver>())
-    {
-    }
-
-    [Obsolete($"Please use the non-obsolete constructor. Will be removed in V15.")]
-    public ByRouteContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService,
-        IRequestRoutingService requestRoutingService,
-        IRequestRedirectService requestRedirectService,
-        IRequestPreviewService requestPreviewService,
-        IRequestMemberAccessService requestMemberAccessService,
-        IApiContentPathResolver apiContentPathResolver)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            requestRedirectService,
-            requestPreviewService,
-            requestMemberAccessService,
-            apiContentPathResolver)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
    public ByRouteContentApiController(
        IApiPublishedContentCache apiPublishedContentCache,
        IApiContentResponseBuilder apiContentResponseBuilder,
@@ -75,16 +32,6 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
        _apiContentPathResolver = apiContentPathResolver;
    }

-    [HttpGet("item/{*path}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-    [ProducesResponseType(StatusCodes.Status403Forbidden)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> ByRoute(string path = "")
-        => await HandleRequest(path);
-
    /// <summary>
    ///     Gets a content item by route.
    /// </summary>
@@ -117,7 +64,7 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
                return deniedAccessResult;
            }

-            return await Task.FromResult(Ok(ApiContentResponseBuilder.Build(contentItem)));
+            return Ok(ApiContentResponseBuilder.Build(contentItem));
        }

        IApiContentRoute? redirectRoute = _requestRedirectService.GetRedirectRoute(path);
@@ -13,8 +13,9 @@ namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 [DeliveryApiAccess]
 [VersionedDeliveryApiRoute("content")]
 [ApiExplorerSettings(GroupName = "Content")]
-[LocalizeFromAcceptLanguageHeader]
+[ContextualizeFromAcceptHeaders]
 [ValidateStartItem]
+[AddVaryHeader]
 [OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.ContentCachePolicy)]
 public abstract class ContentApiControllerBase : DeliveryApiControllerBase
 {
@@ -12,7 +12,6 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class QueryContentApiController : ContentApiControllerBase
 {
@@ -30,20 +29,6 @@ public class QueryContentApiController : ContentApiControllerBase
        _requestMemberAccessService = requestMemberAccessService;
    }

-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IApiContentResponse>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> Query(
-        string? fetch,
-        [FromQuery] string[] filter,
-        [FromQuery] string[] sort,
-        int skip = 0,
-        int take = 10)
-        => await HandleRequest(fetch, filter, sort, skip, take);
-
    /// <summary>
    ///     Gets a paginated list of content item(s) from query.
    /// </summary>
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Models.DeliveryApi;
@@ -8,7 +8,6 @@ using Umbraco.Cms.Infrastructure.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Media;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdMediaApiController : MediaApiControllerBase
 {
@@ -19,14 +18,6 @@ public class ByIdMediaApiController : MediaApiControllerBase
    {
    }

-    [HttpGet("item/{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> ById(Guid id)
-        => await HandleRequest(id);
-
    /// <summary>
    ///     Gets a media item by id.
    /// </summary>
@@ -36,16 +27,16 @@ public class ByIdMediaApiController : MediaApiControllerBase
    [MapToApiVersion("2.0")]
    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByIdV20(Guid id)
-        => await HandleRequest(id);
+    public Task<IActionResult> ByIdV20(Guid id)
+        => Task.FromResult(HandleRequest(id));

-    private async Task<IActionResult> HandleRequest(Guid id)
+    private IActionResult HandleRequest(Guid id)
    {
        IPublishedContent? media = PublishedMediaCache.GetById(id);

        if (media is null)
        {
-            return await Task.FromResult(NotFound());
+            return NotFound();
        }

        return Ok(BuildApiMediaWithCrops(media));
@@ -9,7 +9,6 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Media;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByIdsMediaApiController : MediaApiControllerBase
 {
@@ -18,13 +17,6 @@ public class ByIdsMediaApiController : MediaApiControllerBase
    {
    }

-    [HttpGet("item")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
-        => await HandleRequest(ids);
-
    /// <summary>
    ///     Gets media items by ids.
    /// </summary>
@@ -33,10 +25,10 @@ public class ByIdsMediaApiController : MediaApiControllerBase
    [HttpGet("items")]
    [MapToApiVersion("2.0")]
    [ProducesResponseType(typeof(IEnumerable<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> ItemsV20([FromQuery(Name = "id")] HashSet<Guid> ids)
-        => await HandleRequest(ids);
+    public Task<IActionResult> ItemsV20([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => Task.FromResult(HandleRequest(ids));

-    private async Task<IActionResult> HandleRequest(HashSet<Guid> ids)
+    private IActionResult HandleRequest(HashSet<Guid> ids)
    {
        IPublishedContent[] mediaItems = ids
            .Select(PublishedMediaCache.GetById)
@@ -47,6 +39,6 @@ public class ByIdsMediaApiController : MediaApiControllerBase
            .Select(BuildApiMediaWithCrops)
            .ToArray();

-        return await Task.FromResult(Ok(apiMediaItems));
+        return Ok(apiMediaItems);
    }
 }
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.DeliveryApi;
@@ -9,7 +9,6 @@ using Umbraco.Cms.Infrastructure.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Media;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class ByPathMediaApiController : MediaApiControllerBase
 {
@@ -22,14 +21,6 @@ public class ByPathMediaApiController : MediaApiControllerBase
        : base(publishedMediaCache, apiMediaWithCropsResponseBuilder)
        => _apiMediaQueryService = apiMediaQueryService;

-    [HttpGet("item/{*path}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> ByPath(string path)
-        => await HandleRequest(path);
-
    /// <summary>
    ///     Gets a media item by its path.
    /// </summary>
@@ -39,17 +30,17 @@ public class ByPathMediaApiController : MediaApiControllerBase
    [MapToApiVersion("2.0")]
    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByPathV20(string path)
-        => await HandleRequest(path);
+    public Task<IActionResult> ByPathV20(string path)
+        => Task.FromResult(HandleRequest(path));

-    private async Task<IActionResult> HandleRequest(string path)
+    private IActionResult HandleRequest(string path)
    {
        path = DecodePath(path);

        IPublishedContent? media = _apiMediaQueryService.GetByPath(path);
        if (media is null)
        {
-            return await Task.FromResult(NotFound());
+            return NotFound();
        }

        return Ok(BuildApiMediaWithCrops(media));
@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
@@ -14,7 +14,6 @@ using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Media;

-[ApiVersion("1.0")]
 [ApiVersion("2.0")]
 public class QueryMediaApiController : MediaApiControllerBase
 {
@@ -27,19 +26,6 @@ public class QueryMediaApiController : MediaApiControllerBase
        : base(publishedMediaCache, apiMediaWithCropsResponseBuilder)
        => _apiMediaQueryService = apiMediaQueryService;

-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
-    public async Task<IActionResult> Query(
-        string? fetch,
-        [FromQuery] string[] filter,
-        [FromQuery] string[] sort,
-        int skip = 0,
-        int take = 10)
-        => await HandleRequest(fetch, filter, sort, skip, take);
-
    /// <summary>
    ///     Gets a paginated list of media item(s) from query.
    /// </summary>
@@ -53,15 +39,15 @@ public class QueryMediaApiController : MediaApiControllerBase
    [MapToApiVersion("2.0")]
    [ProducesResponseType(typeof(PagedViewModel<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    public async Task<IActionResult> QueryV20(
+    public Task<IActionResult> QueryV20(
        string? fetch,
        [FromQuery] string[] filter,
        [FromQuery] string[] sort,
        int skip = 0,
        int take = 10)
-        => await HandleRequest(fetch, filter, sort, skip, take);
+        => Task.FromResult(HandleRequest(fetch, filter, sort, skip, take));

-    private async Task<IActionResult> HandleRequest(string? fetch, string[] filter, string[] sort, int skip, int take)
+    private IActionResult HandleRequest(string? fetch, string[] filter, string[] sort, int skip, int take)
    {
        Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> queryAttempt = _apiMediaQueryService.ExecuteQuery(fetch, filter, sort, skip, take);

@@ -79,6 +65,6 @@ public class QueryMediaApiController : MediaApiControllerBase
            Items = mediaItems.Select(BuildApiMediaWithCrops)
        };

-        return await Task.FromResult(Ok(model));
+        return Ok(model);
    }
 }
@@ -0,0 +1,28 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OpenIddict.Server.AspNetCore;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Security;
+
+[ApiVersion("1.0")]
+[ApiController]
+[VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
+[ApiExplorerSettings(IgnoreApi = true)]
+[Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
+public class CurrentMemberController : DeliveryApiControllerBase
+{
+    private readonly ICurrentMemberClaimsProvider _currentMemberClaimsProvider;
+
+    public CurrentMemberController(ICurrentMemberClaimsProvider currentMemberClaimsProvider)
+        => _currentMemberClaimsProvider = currentMemberClaimsProvider;
+
+    [HttpGet("userinfo")]
+    public async Task<IActionResult> Userinfo()
+    {
+        Dictionary<string, object> claims = await _currentMemberClaimsProvider.GetClaimsAsync();
+        return Ok(claims);
+    }
+}
@@ -5,7 +5,6 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using OpenIddict.Abstractions;
@@ -13,7 +12,6 @@ using OpenIddict.Server.AspNetCore;
 using Umbraco.Cms.Api.Delivery.Routing;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Web.Common.Security;
 using Umbraco.Extensions;
@@ -33,31 +31,6 @@ public class MemberController : DeliveryApiControllerBase
    private readonly DeliveryApiSettings _deliveryApiSettings;
    private readonly ILogger<MemberController> _logger;

-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V16.")]
-    public MemberController(
-        IHttpContextAccessor httpContextAccessor,
-        IMemberSignInManager memberSignInManager,
-        IMemberManager memberManager,
-        IOptions<DeliveryApiSettings> deliveryApiSettings,
-        ILogger<MemberController> logger)
-        : this(memberSignInManager, memberManager, StaticServiceProvider.Instance.GetRequiredService<IMemberClientCredentialsManager>(), deliveryApiSettings, logger)
-    {
-    }
-
-    [Obsolete("Please use the non-obsolete constructor. Will be removed in V16.")]
-    public MemberController(
-        IHttpContextAccessor httpContextAccessor,
-        IMemberSignInManager memberSignInManager,
-        IMemberManager memberManager,
-        IMemberClientCredentialsManager memberClientCredentialsManager,
-        IOptions<DeliveryApiSettings> deliveryApiSettings,
-        ILogger<MemberController> logger)
-        : this(memberSignInManager, memberManager, memberClientCredentialsManager, deliveryApiSettings, logger)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
    public MemberController(
        IMemberSignInManager memberSignInManager,
        IMemberManager memberManager,
@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Accessors;
 using Umbraco.Cms.Api.Delivery.Caching;
@@ -34,26 +35,35 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
-        {
-            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-            if (apiVersion is null)
-            {
-                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            }

-            // V1 of the Delivery API uses a different expansion strategy than V2+
-            return apiVersion.MajorVersion == 1
-                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-        });
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
        builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
+        builder.Services.AddSingleton<IRequestSegmmentService, RequestSegmentService>();
+        builder.Services.AddSingleton<IRequestSegmentService, RequestSegmentService>();
        builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
        builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
        builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
        builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
        builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
        builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
        builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();
@@ -61,7 +71,7 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IApiMediaQueryService, ApiMediaQueryService>();
        builder.Services.AddTransient<IMemberApplicationManager, MemberApplicationManager>();
        builder.Services.AddTransient<IRequestMemberAccessService, RequestMemberAccessService>();
-        builder.Services.AddScoped<IMemberClientCredentialsManager, MemberClientCredentialsManager>();
+        builder.Services.AddTransient<ICurrentMemberClaimsProvider, CurrentMemberClaimsProvider>();

        builder.Services.ConfigureOptions<ConfigureUmbracoDeliveryApiSwaggerGenOptions>();
        builder.AddUmbracoApiOpenApiUI();
@@ -109,12 +119,20 @@ public static class UmbracoBuilderExtensions

            if (outputCacheSettings.ContentDuration.TotalSeconds > 0)
            {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.ContentCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.ContentDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.ContentDuration,
+                        new StringValues([Constants.DeliveryApi.HeaderNames.AcceptLanguage, Constants.DeliveryApi.HeaderNames.AcceptSegment, Constants.DeliveryApi.HeaderNames.StartItem])));
            }

            if (outputCacheSettings.MediaDuration.TotalSeconds > 0)
            {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.MediaCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.MediaDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.MediaCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.MediaDuration,
+                        Constants.DeliveryApi.HeaderNames.StartItem));
            }
        });

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+public sealed class AddVaryHeaderAttribute : ActionFilterAttribute
+{
+    private const string Vary = "Accept-Language, Accept-Segment, Preview, Start-Item";
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+        => context.HttpContext.Response.Headers.Vary = context.HttpContext.Response.Headers.Vary.Count > 0
+            ? $"{context.HttpContext.Response.Headers.Vary}, {Vary}"
+            : Vary;
+}
@@ -0,0 +1,53 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal sealed class ContextualizeFromAcceptHeadersAttribute : TypeFilterAttribute
+{
+    public ContextualizeFromAcceptHeadersAttribute()
+        : base(typeof(LocalizeFromAcceptLanguageHeaderAttributeFilter))
+    {
+    }
+
+    private sealed class LocalizeFromAcceptLanguageHeaderAttributeFilter : IActionFilter
+    {
+        private readonly IRequestCultureService _requestCultureService;
+        private readonly IRequestSegmentService _requestSegmentService;
+        private readonly IVariationContextAccessor _variationContextAccessor;
+
+        public LocalizeFromAcceptLanguageHeaderAttributeFilter(
+            IRequestCultureService requestCultureService,
+            IRequestSegmentService requestSegmentService,
+            IVariationContextAccessor variationContextAccessor)
+        {
+            _requestCultureService = requestCultureService;
+            _requestSegmentService = requestSegmentService;
+            _variationContextAccessor = variationContextAccessor;
+        }
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            var requestedCulture = _requestCultureService.GetRequestedCulture().NullOrWhiteSpaceAsNull();
+            var requestedSegment = _requestSegmentService.GetRequestedSegment().NullOrWhiteSpaceAsNull();
+            if (requestedCulture.IsNullOrWhiteSpace() && requestedSegment.IsNullOrWhiteSpace())
+            {
+                return;
+            }
+
+            // contextualize the request
+            // NOTE: request culture or segment can be null here (but not both), so make sure to retain any existing
+            //       context by means of fallback to current variation context (if available)
+            _variationContextAccessor.VariationContext = new VariationContext(
+                requestedCulture ?? _variationContextAccessor.VariationContext?.Culture,
+                requestedSegment ?? _variationContextAccessor.VariationContext?.Segment);
+        }
+
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+        }
+    }
+}
@@ -11,7 +11,7 @@ internal sealed class DeliveryApiAccessAttribute : TypeFilterAttribute
    {
    }

-    private class DeliveryApiAccessFilter : IActionFilter
+    private sealed class DeliveryApiAccessFilter : IActionFilter
    {
        private readonly IApiAccessService _apiAccessService;
        private readonly IRequestPreviewService _requestPreviewService;
@@ -11,7 +11,7 @@ internal sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
    {
    }

-    private class DeliveryApiMediaAccessFilter : IActionFilter
+    private sealed class DeliveryApiMediaAccessFilter : IActionFilter
    {
        private readonly IApiAccessService _apiAccessService;

@@ -1,37 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.Filters;
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Delivery.Filters;
-
-internal sealed class LocalizeFromAcceptLanguageHeaderAttribute : TypeFilterAttribute
-{
-    public LocalizeFromAcceptLanguageHeaderAttribute()
-        : base(typeof(LocalizeFromAcceptLanguageHeaderAttributeFilter))
-    {
-    }
-
-    private class LocalizeFromAcceptLanguageHeaderAttributeFilter : IActionFilter
-    {
-        private readonly IRequestCultureService _requestCultureService;
-
-        public LocalizeFromAcceptLanguageHeaderAttributeFilter(IRequestCultureService requestCultureService)
-            => _requestCultureService = requestCultureService;
-
-        public void OnActionExecuting(ActionExecutingContext context)
-        {
-            var requestedCulture = _requestCultureService.GetRequestedCulture();
-            if (requestedCulture.IsNullOrWhiteSpace())
-            {
-                return;
-            }
-
-            _requestCultureService.SetRequestCulture(requestedCulture);
-        }
-
-        public void OnActionExecuted(ActionExecutedContext context)
-        {
-        }
-    }
-}
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
@@ -21,7 +21,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Accept-Language",
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Defines the language to return. Use this when querying language variant content items.",
@@ -33,11 +33,25 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
            }
        });

+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptSegment,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "Defines the segment to return. Use this when querying segment variant content items.",
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
+            {
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Segment One", new OpenApiExample { Value = new OpenApiString("segment-one") } }
+            }
+        });
+
        AddApiKey(operation);

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Preview",
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Whether to request draft content.",
@@ -46,7 +60,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Start-Item",
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
            In = ParameterLocation.Header,
            Required = false,
            Description = "URL segment or GUID of a root content item.",
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
@@ -63,7 +63,7 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
    protected void AddApiKey(OpenApiOperation operation) =>
        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Api-Key",
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
            In = ParameterLocation.Header,
            Required = false,
            Description = "API key specified through configuration to authorize access to the API.",
@@ -12,7 +12,7 @@ internal sealed class ValidateStartItemAttribute : TypeFilterAttribute
    {
    }

-    private class ValidateStartItemFilter : IActionFilter
+    private sealed class ValidateStartItemFilter : IActionFilter
    {
        private readonly IRequestStartItemProviderAccessor _requestStartItemProviderAccessor;

@@ -7,6 +7,7 @@ using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
 using Umbraco.Cms.Infrastructure.Security;

 namespace Umbraco.Cms.Api.Delivery.Handlers;
@@ -18,18 +19,24 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
    private readonly DeliveryApiSettings _deliveryApiSettings;
    private readonly IServiceScopeFactory _serviceScopeFactory;
    private readonly IMemberClientCredentialsManager _memberClientCredentialsManager;
+    private readonly IServerRoleAccessor _serverRoleAccessor;
+
+    private static readonly SemaphoreSlim _locker = new(1);
+    private static bool _isInitialized = false;

    public InitializeMemberApplicationNotificationHandler(
        IRuntimeState runtimeState,
        IOptions<DeliveryApiSettings> deliveryApiSettings,
        ILogger<InitializeMemberApplicationNotificationHandler> logger,
        IServiceScopeFactory serviceScopeFactory,
-        IMemberClientCredentialsManager memberClientCredentialsManager)
+        IMemberClientCredentialsManager memberClientCredentialsManager,
+        IServerRoleAccessor serverRoleAccessor)
    {
        _runtimeState = runtimeState;
        _logger = logger;
        _serviceScopeFactory = serviceScopeFactory;
        _memberClientCredentialsManager = memberClientCredentialsManager;
+        _serverRoleAccessor = serverRoleAccessor;
        _deliveryApiSettings = deliveryApiSettings.Value;
    }

@@ -40,13 +47,34 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
            return;
        }

-        // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
-        // install that is not allowed (no connection string means no DbContext)
-        using IServiceScope scope = _serviceScopeFactory.CreateScope();
-        IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+        if (_serverRoleAccessor.CurrentServerRole is ServerRole.Subscriber)
+        {
+            // subscriber instances should not alter the member application
+            return;
+        }

-        await HandleMemberApplication(memberApplicationManager, cancellationToken);
-        await HandleMemberClientCredentialsApplication(memberApplicationManager, cancellationToken);
+        try
+        {
+            await _locker.WaitAsync(cancellationToken);
+            if (_isInitialized)
+            {
+                return;
+            }
+
+            // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
+            // install that is not allowed (no connection string means no DbContext)
+            using IServiceScope scope = _serviceScopeFactory.CreateScope();
+            IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+
+            await HandleMemberApplication(memberApplicationManager, cancellationToken);
+            await HandleMemberClientCredentialsApplication(memberApplicationManager, cancellationToken);
+
+            _isInitialized = true;
+        }
+        finally
+        {
+            _locker.Release();
+        }
    }

    private async Task HandleMemberApplication(IMemberApplicationManager memberApplicationManager, CancellationToken cancellationToken)
@@ -91,7 +119,7 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
        }
    }

-    private bool ValidateRedirectUrls(Uri[] redirectUrls)
+    private bool ValidateRedirectUrls(IEnumerable<Uri> redirectUrls)
    {
        if (redirectUrls.Any() is false)
        {
@@ -1,56 +1,7 @@
-using System.Text.Json;
-using System.Text.Json.Serialization;
-using System.Text.Json.Serialization.Metadata;
-using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Infrastructure.Serialization;

 namespace Umbraco.Cms.Api.Delivery.Json;

 // see https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/polymorphism?pivots=dotnet-7-0
-public class DeliveryApiJsonTypeResolver : DefaultJsonTypeInfoResolver
-{
-    public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
-    {
-        JsonTypeInfo jsonTypeInfo = base.GetTypeInfo(type, options);
-
-        Type[] derivedTypes = GetDerivedTypes(jsonTypeInfo);
-        if (derivedTypes.Length > 0)
-        {
-            ConfigureJsonPolymorphismOptions(jsonTypeInfo, derivedTypes);
-        }
-
-        return jsonTypeInfo;
-    }
-
-    protected virtual Type[] GetDerivedTypes(JsonTypeInfo jsonTypeInfo)
-    {
-        if (jsonTypeInfo.Type == typeof(IApiContent))
-        {
-            return new[] { typeof(ApiContent) };
-        }
-
-        if (jsonTypeInfo.Type == typeof(IApiContentResponse))
-        {
-            return new[] { typeof(ApiContentResponse) };
-        }
-
-        if (jsonTypeInfo.Type == typeof(IRichTextElement))
-        {
-            return new[] { typeof(RichTextRootElement), typeof(RichTextGenericElement), typeof(RichTextTextElement) };
-        }
-
-        return Array.Empty<Type>();
-    }
-
-    protected void ConfigureJsonPolymorphismOptions(JsonTypeInfo jsonTypeInfo, params Type[] derivedTypes)
-    {
-        jsonTypeInfo.PolymorphismOptions = new JsonPolymorphismOptions
-        {
-            UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FailSerialization,
-        };
-
-        foreach (Type derivedType in derivedTypes)
-        {
-            jsonTypeInfo.PolymorphismOptions.DerivedTypes.Add(new JsonDerivedType(derivedType));
-        }
-    }
-}
+public class DeliveryApiJsonTypeResolver : ContentJsonTypeResolverBase
+{ }
@@ -0,0 +1,88 @@
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Json;
+
+public abstract class DeliveryApiVersionAwareJsonConverterBase<T> : JsonConverter<T>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly JsonConverter<T> _defaultConverter = (JsonConverter<T>)JsonSerializerOptions.Default.GetConverter(typeof(T));
+
+    public DeliveryApiVersionAwareJsonConverterBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    /// <inheritdoc />
+    public override T? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        => _defaultConverter.Read(ref reader, typeToConvert, options);
+
+    /// <inheritdoc />
+    public override void Write(Utf8JsonWriter writer, T value, JsonSerializerOptions options)
+    {
+        Type type = typeof(T);
+        var apiVersion = GetApiVersion();
+
+        // Get the properties in the specified order
+        PropertyInfo[] properties = type.GetProperties().OrderBy(GetPropertyOrder).ToArray();
+
+        writer.WriteStartObject();
+
+        foreach (PropertyInfo property in properties)
+        {
+            // Filter out properties based on the API version
+            var include = apiVersion is null || ShouldIncludeProperty(property, apiVersion.Value);
+
+            if (include is false)
+            {
+                continue;
+            }
+
+            var propertyName = property.Name;
+            writer.WritePropertyName(options.PropertyNamingPolicy?.ConvertName(propertyName) ?? propertyName);
+            JsonSerializer.Serialize(writer, property.GetValue(value), options);
+        }
+
+        writer.WriteEndObject();
+    }
+
+    private int? GetApiVersion()
+    {
+        HttpContext? httpContext = _httpContextAccessor.HttpContext;
+        ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+
+        return apiVersion?.MajorVersion;
+    }
+
+    private int GetPropertyOrder(PropertyInfo prop)
+    {
+        var attribute = prop.GetCustomAttribute<JsonPropertyOrderAttribute>();
+        return attribute?.Order ?? 0;
+    }
+
+    /// <summary>
+    ///     Determines whether a property should be included based on version bounds.
+    /// </summary>
+    /// <param name="propertyInfo">The property info.</param>
+    /// <param name="version">An integer representing an API version.</param>
+    /// <returns><c>true</c> if the property should be included; otherwise, <c>false</c>.</returns>
+    private bool ShouldIncludeProperty(PropertyInfo propertyInfo, int version)
+    {
+        var attribute = propertyInfo
+            .GetCustomAttributes(typeof(IncludeInApiVersionAttribute), false)
+            .FirstOrDefault();
+
+        if (attribute is not IncludeInApiVersionAttribute apiVersionAttribute)
+        {
+            return true; // No attribute means include the property
+        }
+
+        // Check if the version is within the specified bounds
+        var isWithinMinVersion = apiVersionAttribute.MinVersion.HasValue is false || version >= apiVersionAttribute.MinVersion.Value;
+        var isWithinMaxVersion = apiVersionAttribute.MaxVersion.HasValue is false || version <= apiVersionAttribute.MaxVersion.Value;
+
+        return isWithinMinVersion && isWithinMaxVersion;
+    }
+}
@@ -37,12 +37,12 @@ public abstract class ContainsFilterBase : IFilterHandler
    {
        GroupCollection groups = QueryParserRegex.Match(filter).Groups;

-        if (groups.Count != 3 || groups.ContainsKey("operator") is false || groups.ContainsKey("value") is false)
+        if (groups.Count != 3 || groups.TryGetValue("operator", out Group? operatorGroup) is false || groups.TryGetValue("value", out Group? valueGroup) is false)
        {
            return DefaultFilterOption();
        }

-        FilterOperation? filterOperation = ParseFilterOperation(groups["operator"].Value);
+        FilterOperation? filterOperation = ParseFilterOperation(operatorGroup.Value);
        if (filterOperation.HasValue is false)
        {
            return DefaultFilterOption();
@@ -51,7 +51,7 @@ public abstract class ContainsFilterBase : IFilterHandler
        return new FilterOption
        {
            FieldName = FieldName,
-            Values = new[] { groups["value"].Value },
+            Values = [valueGroup.Value],
            Operator = filterOperation.Value
        };

@@ -1,6 +1,5 @@
 using Umbraco.Cms.Api.Delivery.Indexing.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Querying.Filters;

@@ -15,15 +14,15 @@ public sealed class ContentTypeFilter : IFilterHandler
    /// <inheritdoc/>
    public FilterOption BuildFilterOption(string filter)
    {
-        var alias = filter.Substring(ContentTypeSpecifier.Length);
+        var filterValue = filter.Substring(ContentTypeSpecifier.Length);
+        var negate = filterValue.StartsWith('!');
+        var aliases = filterValue.TrimStart('!').Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);

        return new FilterOption
        {
            FieldName = ContentTypeFilterIndexer.FieldName,
-            Values = alias.IsNullOrWhiteSpace() == false
-                ? new[] { alias.TrimStart('!') }
-                : Array.Empty<string>(),
-            Operator = alias.StartsWith('!')
+            Values = aliases,
+            Operator = negate
                ? FilterOperation.IsNot
                : FilterOperation.Is
        };
@@ -1,4 +1,6 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;
@@ -7,16 +9,45 @@ namespace Umbraco.Cms.Api.Delivery.Querying;

 public abstract class QueryOptionBase
 {
-    private readonly IPublishedContentCache _publishedContentCache;
    private readonly IRequestRoutingService _requestRoutingService;
+    private readonly IRequestPreviewService _requestPreviewService;
+    private readonly IApiDocumentUrlService _apiDocumentUrlService;
+    private readonly IVariationContextAccessor _variationContextAccessor;

-
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
    public QueryOptionBase(
        IPublishedContentCache publishedContentCache,
        IRequestRoutingService requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public QueryOptionBase(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IRequestCultureService requestCultureService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
+    public QueryOptionBase(
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
    {
-        _publishedContentCache = publishedContentCache;
        _requestRoutingService = requestRoutingService;
+        _requestPreviewService = requestPreviewService;
+        _apiDocumentUrlService = apiDocumentUrlService;
+        _variationContextAccessor = variationContextAccessor;
    }

    protected Guid? GetGuidFromQuery(string queryStringValue)
@@ -33,8 +64,9 @@ public abstract class QueryOptionBase

        // Check if the passed value is a path of a content item
        var contentRoute = _requestRoutingService.GetContentRoute(queryStringValue);
-        IPublishedContent? contentItem = _publishedContentCache.GetByRoute(contentRoute);
-
-        return contentItem?.Key;
+        return _apiDocumentUrlService.GetDocumentKeyByRoute(
+            contentRoute,
+            _variationContextAccessor.VariationContext?.Culture,
+            _requestPreviewService.IsPreview());
    }
 }
@@ -5,29 +5,72 @@ using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Cms.Core.Services.Navigation;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Querying.Selectors;

 public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
 {
-    private readonly IPublishedContentCache _publishedContentCache;
    private readonly IDocumentNavigationQueryService _navigationQueryService;
    private const string AncestorsSpecifier = "ancestors:";

+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IDocumentNavigationQueryService navigationQueryService,
+        IRequestPreviewService requestPreviewService)
+        : this(
+            requestRoutingService,
+            requestPreviewService,
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            navigationQueryService)
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
    public AncestorsSelector(
        IPublishedContentCache publishedContentCache,
        IRequestRoutingService requestRoutingService,
        IDocumentNavigationQueryService navigationQueryService)
-        : base(publishedContentCache, requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            navigationQueryService)
    {
-        _publishedContentCache = publishedContentCache;
-        _navigationQueryService = navigationQueryService;
    }

    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
    public AncestorsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : this(publishedContentCache, requestRoutingService, StaticServiceProvider.Instance.GetRequiredService<IDocumentNavigationQueryService>())
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            StaticServiceProvider.Instance.GetRequiredService<IDocumentNavigationQueryService>())
+    {
+    }
+
+    public AncestorsSelector(
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor,
+        IDocumentNavigationQueryService navigationQueryService)
+        : base(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+        => _navigationQueryService = navigationQueryService;
+
+    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
+    public AncestorsSelector(
+        IRequestRoutingService requestRoutingService,
+        IPublishedContentCache publishedContentCache,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor,
+        IDocumentNavigationQueryService navigationQueryService)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor, navigationQueryService)
    {
    }

@@ -41,7 +84,7 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
        var fieldValue = selector[AncestorsSpecifier.Length..];
        Guid? id = GetGuidFromQuery(fieldValue);

-        if (id is null)
+        if (id is null || _navigationQueryService.TryGetAncestorsKeys(id.Value, out IEnumerable<Guid> ancestorKeys) is false)
        {
            // Setting the Value to "" since that would yield no results.
            // It won't be appropriate to return null here since if we reached this,
@@ -53,15 +96,10 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
            };
        }

-        IPublishedContent contentItem = _publishedContentCache.GetById((Guid)id)
-                                        ?? throw new InvalidOperationException("Could not obtain the content cache");
-
-        var ancestorKeys = contentItem.Ancestors(_publishedContentCache, _navigationQueryService).Select(a => a.Key.ToString("D")).ToArray();
-
        return new SelectorOption
        {
            FieldName = AncestorsSelectorIndexer.FieldName,
-            Values = ancestorKeys
+            Values = ancestorKeys.Select(key => key.ToString("D")).ToArray()
        };
    }
 }
@@ -1,5 +1,8 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;

@@ -9,8 +12,33 @@ public sealed class ChildrenSelector : QueryOptionBase, ISelectorHandler
 {
    private const string ChildrenSpecifier = "children:";

+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
    public ChildrenSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : base(publishedContentCache, requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public ChildrenSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
+    public ChildrenSelector(
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : base(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
    {
    }

@@ -1,5 +1,8 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;

@@ -9,8 +12,33 @@ public sealed class DescendantsSelector : QueryOptionBase, ISelectorHandler
 {
    private const string DescendantsSpecifier = "descendants:";

+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
    public DescendantsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
-        : base(publishedContentCache, requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public DescendantsSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
+    public DescendantsSelector(
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : base(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
    {
    }

@@ -1,62 +1,25 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Api.Common.Rendering;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Rendering;

-internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
 {
-    private const string All = "$all";
-    private const string None = "";
-    private const string ExpandParameterName = "expand";
-    private const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
    private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;

-    private readonly Stack<Node?> _expandProperties;
-    private readonly Stack<Node?> _includeProperties;
-
    public RequestContextOutputExpansionStrategyV2(
        IHttpContextAccessor httpContextAccessor,
        IApiPropertyRenderer propertyRenderer,
        ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
    {
-        _propertyRenderer = propertyRenderer;
        _logger = logger;
-        _expandProperties = new Stack<Node?>();
-        _includeProperties = new Stack<Node?>();

        InitializeExpandAndInclude(httpContextAccessor);
    }

-    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
    private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
    {
        string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -66,7 +29,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _expandProperties.Push(Node.Parse(toExpand));
+            ExpandProperties.Push(Node.Parse(toExpand));
        }
        catch (ArgumentException ex)
        {
@@ -76,7 +39,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _includeProperties.Push(Node.Parse(toInclude));
+            IncludeProperties.Push(Node.Parse(toInclude));
        }
        catch (ArgumentException ex)
        {
@@ -84,102 +47,4 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
            throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
        }
    }
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = _expandProperties.Peek();
-        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = _includeProperties.Peek();
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            _includeProperties.Push(nextIncludeProperties);
-            _expandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            _expandProperties.Pop();
-            _includeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
-
-    private class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
 }
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
@@ -29,7 +29,7 @@ internal sealed class ApiAccessService : RequestHeaderHandler, IApiAccessService
    private bool IfEnabled(Func<bool> condition) => _deliveryApiSettings.Enabled && condition();

    private bool HasValidApiKey() => _deliveryApiSettings.ApiKey.IsNullOrWhiteSpace() == false
-                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue("Api-Key"));
+                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.ApiKey));

    private bool IfMediaEnabled(Func<bool> condition) => _deliveryApiSettings is { Enabled: true, Media.Enabled: true } && condition();
 }
@@ -79,10 +79,14 @@ internal sealed class ApiContentQueryProvider : IApiContentQueryProvider
            return new PagedModel<Guid>();
        }

-        Guid[] items = results
-            .Where(r => r.Values.ContainsKey(ItemIdFieldName))
-            .Select(r => Guid.Parse(r.Values[ItemIdFieldName]))
-            .ToArray();
+        List<Guid> items = [];
+        foreach (ISearchResult result in results)
+        {
+            if (result.Values.TryGetValue(ItemIdFieldName, out string? value))
+            {
+                items.Add(Guid.Parse(value));
+            }
+        }

        return new PagedModel<Guid>(results.TotalItemCount, items);
    }
@@ -16,12 +16,18 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
    private readonly IPublishedMediaCache _publishedMediaCache;
    private readonly ILogger<ApiMediaQueryService> _logger;
    private readonly IMediaNavigationQueryService _mediaNavigationQueryService;
+    private readonly IPublishedMediaStatusFilteringService _publishedMediaStatusFilteringService;

-    public ApiMediaQueryService(IPublishedMediaCache publishedMediaCache, ILogger<ApiMediaQueryService> logger, IMediaNavigationQueryService mediaNavigationQueryService)
+    public ApiMediaQueryService(
+        IPublishedMediaCache publishedMediaCache,
+        ILogger<ApiMediaQueryService> logger,
+        IMediaNavigationQueryService mediaNavigationQueryService,
+        IPublishedMediaStatusFilteringService publishedMediaStatusFilteringService)
    {
        _publishedMediaCache = publishedMediaCache;
        _logger = logger;
        _mediaNavigationQueryService = mediaNavigationQueryService;
+        _publishedMediaStatusFilteringService = publishedMediaStatusFilteringService;
    }

    /// <inheritdoc/>
@@ -71,7 +77,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
                break;
            }

-            currentChildren = resolvedMedia.Children(null, _publishedMediaCache, _mediaNavigationQueryService);
+            currentChildren = resolvedMedia.Children(_mediaNavigationQueryService, _publishedMediaStatusFilteringService);
        }

        return resolvedMedia;
@@ -104,7 +110,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
            ? mediaCache.GetById(parentKey)
            : TryGetByPath(childrenOf, mediaCache);

-        return parent?.Children(null, _publishedMediaCache, _mediaNavigationQueryService) ?? Array.Empty<IPublishedContent>();
+        return parent?.Children(_mediaNavigationQueryService, _publishedMediaStatusFilteringService) ?? Array.Empty<IPublishedContent>();
    }

    private IEnumerable<IPublishedContent>? ApplyFilters(IEnumerable<IPublishedContent> source, IEnumerable<string> filters)
@@ -179,7 +185,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
    }


-    private Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> PagedResult(IEnumerable<IPublishedContent> children, int skip, int take)
+    private static Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> PagedResult(IEnumerable<IPublishedContent> children, int skip, int take)
    {
        IPublishedContent[] childrenAsArray = children as IPublishedContent[] ?? children.ToArray();
        var result = new PagedModel<Guid>
@@ -0,0 +1,44 @@
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+// NOTE: this is public and unsealed to allow overriding the default claims with minimal effort.
+public class CurrentMemberClaimsProvider : ICurrentMemberClaimsProvider
+{
+    private readonly IMemberManager _memberManager;
+
+    public CurrentMemberClaimsProvider(IMemberManager memberManager)
+        => _memberManager = memberManager;
+
+    public virtual async Task<Dictionary<string, object>> GetClaimsAsync()
+    {
+        MemberIdentityUser? memberIdentityUser = await _memberManager.GetCurrentMemberAsync();
+        return memberIdentityUser is not null
+            ? await GetClaimsForMemberIdentityAsync(memberIdentityUser)
+            : throw new InvalidOperationException("Could not retrieve the current member. This method should only ever be invoked when a member has been authorized.");
+    }
+
+    protected virtual async Task<Dictionary<string, object>> GetClaimsForMemberIdentityAsync(MemberIdentityUser memberIdentityUser)
+    {
+        var claims = new Dictionary<string, object>
+        {
+            [OpenIddictConstants.Claims.Subject] = memberIdentityUser.Key
+        };
+
+        if (memberIdentityUser.Name is not null)
+        {
+            claims[OpenIddictConstants.Claims.Name] = memberIdentityUser.Name;
+        }
+
+        if (memberIdentityUser.Email is not null)
+        {
+            claims[OpenIddictConstants.Claims.Email] = memberIdentityUser.Email;
+        }
+
+        claims[OpenIddictConstants.Claims.Role] = await _memberManager.GetRolesAsync(memberIdentityUser);
+
+        return claims;
+    }
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`../src/Umbraco.Web.UI.Client/.vscode/lit.code-snippets`