Set version to 13.13.1.

Fix media picker folder navigation with "ignore user start nodes" enabled.

Directory.Packages.props

@@ -12,23 +12,24 @@
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.22" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.10.0" />
     <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.22" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.22" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.22" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
@@ -47,7 +48,7 @@
     <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
     <PackageVersion Include="Examine" Version="3.7.1" />
     <PackageVersion Include="Examine.Core" Version="3.7.1" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.11.71" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
     <PackageVersion Include="MailKit" Version="4.8.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
@@ -55,7 +56,7 @@
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
     <PackageVersion Include="ncrontab" Version="3.3.3" />
-    <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="NPoco" Version="5.7.1" />
     <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
     <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
@@ -73,16 +74,16 @@
     <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" />
-    <PackageVersion Include="Smidge.InMemory" Version="4.4.0" />
-    <PackageVersion Include="Smidge.Nuglify" Version="4.5.1" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Smidge.InMemory" Version="4.6.0" />
+    <PackageVersion Include="Smidge.Nuglify" Version="4.6.0" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.9.0" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
     <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Azure.Identity" Version="1.13.1" />
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
     <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
@@ -96,8 +97,8 @@
     <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
     <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
-    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <PackageVersion Include="System.Text.Json" Version="8.0.6" />
     <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.3" />
   </ItemGroup>
 </Project>

build/azure-pipelines.yml

@@ -25,6 +25,10 @@ parameters:
     displayName: Upload API docs
     type: boolean
     default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
   - name: forceReleaseTestFilter
     displayName: Force to use the release test filters
     type: boolean
@@ -93,6 +97,11 @@ stages:
           - script: npm ci --no-fund --no-audit --prefer-offline
             workingDirectory:  src/Umbraco.Web.UI.Client
             displayName: Run npm ci (Backoffice)
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
           - task: gulp@0
             displayName: Run gulp build (Backoffice)
             inputs:
@@ -106,6 +115,10 @@ stages:
               workingDir: src/Umbraco.Web.UI.Login
               verbose: false
               customCommand: ci
+          - powershell: |
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
           - task: npm@1
             displayName: Run npm build (Login)
             inputs:
@@ -129,6 +142,10 @@ stages:
               command: build
               projects: $(solution)
               arguments: '--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg'
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
           - task: PublishPipelineArtifact@1
             displayName: Publish nupkg
             inputs:
@@ -139,6 +156,35 @@ stages:
             inputs:
               targetPath: $(Build.SourcesDirectory)
               artifactName: build_output
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Backend BOM
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-build
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'
 
   - stage: Build_Docs
     condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -464,37 +510,18 @@ stages:
               artifact: nupkg
               path: $(Agent.BuildDirectory)/app/nupkg
 
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
           - task: UseDotNet@2
             displayName: Use .NET SDK from global.json
             inputs:
               useGlobalJson: true
 
-          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
+          - template: templates/e2e-install.yml
+            parameters:
+              nodeVersion: $(nodeVersion)
+              npm_config_cache: $(npm_config_cache)
+              PlaywrightUserEmail: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
+              PlaywrightPassword: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              ASPNETCORE_URLS: $(ASPNETCORE_URLS)
 
           # Build application
           - pwsh: |
@@ -755,6 +782,34 @@ stages:
               searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
               testRunTitle: "$(Agent.JobName)"
 
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-build"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-build"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-build"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"
+
   ###############################################
   ## Release
   ###############################################

build/templates/dependency-track.yml

@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -0,0 +1,47 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.100",
+    "version": "8.0.415",
     "rollForward": "latestFeature"
   }
 }

src/Umbraco.Cms.Api.Delivery/Caching/DeliveryApiOutputCachePolicy.cs

@@ -1,5 +1,6 @@
-using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.AspNetCore.OutputCaching;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Core.DeliveryApi;
 
 namespace Umbraco.Cms.Api.Delivery.Caching;
@@ -7,9 +8,13 @@ namespace Umbraco.Cms.Api.Delivery.Caching;
 internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
 {
     private readonly TimeSpan _duration;
+    private readonly StringValues _varyByHeaderNames;
 
-    public DeliveryApiOutputCachePolicy(TimeSpan duration)
-        => _duration = duration;
+    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
+    {
+        _duration = duration;
+        _varyByHeaderNames = varyByHeaderNames;
+    }
 
     ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
     {
@@ -18,8 +23,14 @@ internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
             .RequestServices
             .GetRequiredService<IRequestPreviewService>();
 
-        context.EnableOutputCaching = requestPreviewService.IsPreview() is false;
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
         context.ResponseExpirationTimeSpan = _duration;
+        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;
 
         return ValueTask.CompletedTask;
     }

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByRouteContentApiController.cs

@@ -19,7 +19,7 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
     private readonly IRequestRedirectService _requestRedirectService;
     private readonly IRequestPreviewService _requestPreviewService;
     private readonly IRequestMemberAccessService _requestMemberAccessService;
-    private const string PreviewContentRequestPathPrefix = $"/{Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
+    private const string PreviewContentRequestPathPrefix = $"/{Umbraco.Cms.Core.Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
 
     [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
     public ByRouteContentApiController(

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Accessors;
 using Umbraco.Cms.Api.Delivery.Caching;
@@ -33,26 +34,33 @@ public static class UmbracoBuilderExtensions
         builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
-        {
-            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-            if (apiVersion is null)
-            {
-                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            }
 
-            // V1 of the Delivery API uses a different expansion strategy than V2+
-            return apiVersion.MajorVersion == 1
-                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-        });
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
         builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
         builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
         builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
         builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
         builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
         builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
         builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
         builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();
@@ -108,12 +116,20 @@ public static class UmbracoBuilderExtensions
 
             if (outputCacheSettings.ContentDuration.TotalSeconds > 0)
             {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.ContentCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.ContentDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.ContentDuration,
+                        new StringValues([Constants.DeliveryApi.HeaderNames.AcceptLanguage, Constants.DeliveryApi.HeaderNames.StartItem])));
             }
 
             if (outputCacheSettings.MediaDuration.TotalSeconds > 0)
             {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.MediaCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.MediaDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.MediaCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.MediaDuration,
+                        Constants.DeliveryApi.HeaderNames.StartItem));
             }
         });
 

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerContentDocumentationFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
@@ -21,7 +21,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = "Accept-Language",
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Defines the language to return. Use this when querying language variant content items.",
@@ -37,7 +37,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = "Preview",
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Whether to request draft content.",
@@ -46,7 +46,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = "Start-Item",
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
             In = ParameterLocation.Header,
             Required = false,
             Description = "URL segment or GUID of a root content item.",

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerDocumentationFilterBase.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
@@ -63,7 +63,7 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
     protected void AddApiKey(OpenApiOperation operation) =>
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = "Api-Key",
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
             In = ParameterLocation.Header,
             Required = false,
             Description = "API key specified through configuration to authorize access to the API.",

src/Umbraco.Cms.Api.Delivery/Handlers/InitializeMemberApplicationNotificationHandler.cs

@@ -6,6 +6,7 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
 using Umbraco.Cms.Infrastructure.Security;
 
 namespace Umbraco.Cms.Api.Delivery.Handlers;
@@ -16,16 +17,21 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
     private readonly ILogger<InitializeMemberApplicationNotificationHandler> _logger;
     private readonly DeliveryApiSettings _deliveryApiSettings;
     private readonly IServiceScopeFactory _serviceScopeFactory;
+    private readonly IServerRoleAccessor _serverRoleAccessor;
+    private static readonly SemaphoreSlim _locker = new(1);
+    private static bool _isInitialized = false;
 
     public InitializeMemberApplicationNotificationHandler(
         IRuntimeState runtimeState,
         IOptions<DeliveryApiSettings> deliveryApiSettings,
         ILogger<InitializeMemberApplicationNotificationHandler> logger,
-        IServiceScopeFactory serviceScopeFactory)
+        IServiceScopeFactory serviceScopeFactory,
+        IServerRoleAccessor serverRoleAccessor)
     {
         _runtimeState = runtimeState;
         _logger = logger;
         _serviceScopeFactory = serviceScopeFactory;
+        _serverRoleAccessor = serverRoleAccessor;
         _deliveryApiSettings = deliveryApiSettings.Value;
     }
 
@@ -36,34 +42,55 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
             return;
         }
 
-        // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
-        // install that is not allowed (no connection string means no DbContext)
-        using IServiceScope scope = _serviceScopeFactory.CreateScope();
-        IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
-
-        if (_deliveryApiSettings.MemberAuthorization?.AuthorizationCodeFlow?.Enabled is not true)
+        if (_serverRoleAccessor.CurrentServerRole is ServerRole.Subscriber)
         {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+            // subscriber instances should not alter the member application
             return;
         }
 
-        if (ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls) is false)
+        try
         {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
-            return;
-        }
+            await _locker.WaitAsync(cancellationToken);
+            if (_isInitialized)
+            {
+                return;
+            }
 
-        if (_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls.Any()
-            && ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls) is false)
+            _isInitialized = true;
+
+            // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
+            // install that is not allowed (no connection string means no DbContext)
+            using IServiceScope scope = _serviceScopeFactory.CreateScope();
+            IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+
+            if (_deliveryApiSettings.MemberAuthorization?.AuthorizationCodeFlow?.Enabled is not true)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls.Any()
+                && ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            await memberApplicationManager.EnsureMemberApplicationAsync(
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls,
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls,
+                cancellationToken);
+        }
+        finally
         {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
-            return;
+            _locker.Release();
         }
-
-        await memberApplicationManager.EnsureMemberApplicationAsync(
-            _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls,
-            _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls,
-            cancellationToken);
     }
 
     private bool ValidateRedirectUrls(Uri[] redirectUrls)

src/Umbraco.Cms.Api.Delivery/Rendering/RequestContextOutputExpansionStrategyV2.cs

@@ -1,62 +1,24 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;
+using Umbraco.Cms.Web.Common.Rendering;
 
 namespace Umbraco.Cms.Api.Delivery.Rendering;
 
-internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
 {
-    private const string All = "$all";
-    private const string None = "";
-    private const string ExpandParameterName = "expand";
-    private const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
     private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;
 
-    private readonly Stack<Node?> _expandProperties;
-    private readonly Stack<Node?> _includeProperties;
-
     public RequestContextOutputExpansionStrategyV2(
         IHttpContextAccessor httpContextAccessor,
         IApiPropertyRenderer propertyRenderer,
         ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
     {
-        _propertyRenderer = propertyRenderer;
         _logger = logger;
-        _expandProperties = new Stack<Node?>();
-        _includeProperties = new Stack<Node?>();
-
         InitializeExpandAndInclude(httpContextAccessor);
     }
 
-    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
     private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
     {
         string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -66,7 +28,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
 
         try
         {
-            _expandProperties.Push(Node.Parse(toExpand));
+            ExpandProperties.Push(Node.Parse(toExpand));
         }
         catch (ArgumentException ex)
         {
@@ -76,7 +38,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
 
         try
         {
-            _includeProperties.Push(Node.Parse(toInclude));
+            IncludeProperties.Push(Node.Parse(toInclude));
         }
         catch (ArgumentException ex)
         {
@@ -84,102 +46,4 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
             throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
         }
     }
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = _expandProperties.Peek();
-        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = _includeProperties.Peek();
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            _includeProperties.Push(nextIncludeProperties);
-            _expandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            _expandProperties.Pop();
-            _includeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
-
-    private class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
 }

src/Umbraco.Cms.Api.Delivery/Services/ApiAccessService.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
@@ -29,7 +29,7 @@ internal sealed class ApiAccessService : RequestHeaderHandler, IApiAccessService
     private bool IfEnabled(Func<bool> condition) => _deliveryApiSettings.Enabled && condition();
 
     private bool HasValidApiKey() => _deliveryApiSettings.ApiKey.IsNullOrWhiteSpace() == false
-                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue("Api-Key"));
+                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.ApiKey));
 
     private bool IfMediaEnabled(Func<bool> condition) => _deliveryApiSettings is { Enabled: true, Media.Enabled: true } && condition();
 }

src/Umbraco.Cms.Api.Delivery/Services/RequestPreviewService.cs

@@ -11,5 +11,5 @@ internal sealed class RequestPreviewService : RequestHeaderHandler, IRequestPrev
     }
 
     /// <inheritdoc />
-    public bool IsPreview() => string.Equals(GetHeaderValue("Preview"), "true", StringComparison.OrdinalIgnoreCase);
+    public bool IsPreview() => string.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.Preview), "true", StringComparison.OrdinalIgnoreCase);
 }

src/Umbraco.Cms.Api.Delivery/Services/RequestStartItemProvider.cs

@@ -58,5 +58,5 @@ internal sealed class RequestStartItemProvider : RequestHeaderHandler, IRequestS
     }
 
     /// <inheritdoc/>
-    public string? RequestedStartItem() => GetHeaderValue("Start-Item");
+    public string? RequestedStartItem() => GetHeaderValue(Constants.DeliveryApi.HeaderNames.StartItem);
 }

src/Umbraco.Cms.Imaging.ImageSharp2/Umbraco.Cms.Imaging.ImageSharp2.csproj

@@ -5,7 +5,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="SixLabors.ImageSharp" VersionOverride="[2.1.10, 3)" />
+    <PackageReference Include="SixLabors.ImageSharp" VersionOverride="[2.1.11, 3)" />
     <PackageReference Include="SixLabors.ImageSharp.Web" VersionOverride="[2.0.2, 3)" />
   </ItemGroup>
 

src/Umbraco.Cms.Persistence.EFCore/Scoping/EFCoreScope.cs

@@ -127,10 +127,16 @@ internal class EFCoreScope<TDbContext> : CoreScope, IEfCoreScope<TDbContext>
 
         Locks.ClearLocks(InstanceId);
 
-        if (ParentScope is null)
+        // Since we can nest EFCoreScopes in other scopes derived from CoreScope, we should check whether our ParentScope OR the base ParentScope exists.
+        // Only if neither do do we take responsibility for ensuring the locks are cleared.
+        // Eventually the highest parent will clear the locks.
+        // Further, these locks are a reference to the locks of the highest parent anyway (see the constructor of CoreScope).
+#pragma warning disable SA1100 // Do not prefix calls with base unless local implementation exists (justification: provides additional clarify here that this is defined on the base class).
+        if (ParentScope is null && base.HasParentScope is false)
         {
             Locks.EnsureLocksCleared(InstanceId);
         }
+#pragma warning restore SA1100 // Do not prefix calls with base unless local implementation exists
 
         _efCoreScopeProvider.PopAmbientScope();
 

src/Umbraco.Core/Cache/AppCacheExtensions.cs

@@ -43,24 +43,41 @@ public static class AppCacheExtensions
     public static T? GetCacheItem<T>(this IAppCache provider, string cacheKey)
     {
         var result = provider.Get(cacheKey);
-        if (IsRetrievedItemNull(result))
+        if (result == null)
         {
             return default;
         }
 
+        // If we've retrieved the specific string that represents null in the cache, return it only if we are requesting it (via a typed request for a string).
+        // Otherwise consider it a null value.
+        if (RetrievedNullRepresentationInCache(result))
+        {
+            return RequestedNullRepresentationInCache<T>() ? (T)result : default;
+        }
+
         return result.TryConvertTo<T>().Result;
     }
 
     public static T? GetCacheItem<T>(this IAppCache provider, string cacheKey, Func<T> getCacheItem)
     {
         var result = provider.Get(cacheKey, () => getCacheItem());
-        if (IsRetrievedItemNull(result))
+        if (result == null)
         {
             return default;
         }
 
+        // If we've retrieved the specific string that represents null in the cache, return it only if we are requesting it (via a typed request for a string).
+        // Otherwise consider it a null value.
+        if (RetrievedNullRepresentationInCache(result))
+        {
+            return RequestedNullRepresentationInCache<T>() ? (T)result : default;
+        }
+
         return result.TryConvertTo<T>().Result;
     }
 
-    private static bool IsRetrievedItemNull(object? result) => result is null or (object)Cms.Core.Constants.Cache.NullRepresentationInCache;
+    private static bool RetrievedNullRepresentationInCache(object result) => result == (object)Cms.Core.Constants.Cache.NullRepresentationInCache;
+
+    private static bool RequestedNullRepresentationInCache<T>() => typeof(T) == typeof(string);
+
 }

src/Umbraco.Core/Cache/DistributedCacheExtensions.cs

@@ -159,15 +159,30 @@ public static class DistributedCacheExtensions
         => dc.RefreshMemberCache(members.AsEnumerable());
 
     public static void RefreshMemberCache(this DistributedCache dc, IEnumerable<IMember> members)
-        => dc.RefreshByPayload(MemberCacheRefresher.UniqueId, members.DistinctBy(x => (x.Id, x.Username)).Select(x => new MemberCacheRefresher.JsonPayload(x.Id, x.Username, false)));
-
+        => dc.RefreshByPayload(
+            MemberCacheRefresher.UniqueId,
+            GetPayloads(members, false));
 
     [Obsolete("Use the overload accepting IEnumerable instead to avoid allocating arrays. This overload will be removed in Umbraco 13.")]
     public static void RemoveMemberCache(this DistributedCache dc, params IMember[] members)
         => dc.RemoveMemberCache(members.AsEnumerable());
 
     public static void RemoveMemberCache(this DistributedCache dc, IEnumerable<IMember> members)
-        => dc.RefreshByPayload(MemberCacheRefresher.UniqueId, members.DistinctBy(x => (x.Id, x.Username)).Select(x => new MemberCacheRefresher.JsonPayload(x.Id, x.Username, true)));
+        => dc.RefreshByPayload(
+            MemberCacheRefresher.UniqueId,
+            GetPayloads(members, true));
+
+    // Internal for unit test.
+    internal static IEnumerable<MemberCacheRefresher.JsonPayload> GetPayloads(IEnumerable<IMember> members, bool removed)
+        => members
+            .DistinctBy(x => (x.Id, x.Username))
+            .Select(x => new MemberCacheRefresher.JsonPayload(x.Id, x.Username, removed)
+            {
+                PreviousUsername = x.HasAdditionalData &&
+                    x.AdditionalData!.TryGetValue(Cms.Core.Constants.Entities.AdditionalDataKeys.MemberPreviousUserName, out var previousUsername)
+                    ? previousUsername?.ToString()
+                    : null,
+            });
 
     #endregion
 

src/Umbraco.Core/Cache/PartialViewCacheInvalidators/NoopMemberPartialViewCacheInvalidator.cs

@@ -0,0 +1,9 @@
+namespace Umbraco.Cms.Core.Cache.PartialViewCacheInvalidators;
+
+internal class NoopMemberPartialViewCacheInvalidator : IMemberPartialViewCacheInvalidator
+{
+    public void ClearPartialViewCacheItems(IEnumerable<int> memberIds)
+    {
+        // No operation performed, this is a no-op implementation.
+    }
+}

src/Umbraco.Core/Cache/Refreshers/Implement/MemberCacheRefresher.cs

@@ -70,6 +70,8 @@ public sealed class MemberCacheRefresher : PayloadCacheRefresherBase<MemberCache
 
         public string? Username { get; }
 
+        public string? PreviousUsername { get; set; }
+
         public bool Removed { get; }
     }
 
@@ -121,6 +123,13 @@ public sealed class MemberCacheRefresher : PayloadCacheRefresherBase<MemberCache
             // https://github.com/umbraco/Umbraco-CMS/pull/17350
             // https://github.com/umbraco/Umbraco-CMS/pull/17815
             memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(CacheKeys.MemberUserNameCachePrefix + p.Username));
+
+            // If provided, clear the cache by the previous user name too.
+            if (string.IsNullOrEmpty(p.PreviousUsername) is false)
+            {
+                memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(p.PreviousUsername));
+                memberCache.Result?.Clear(RepositoryCacheKeys.GetKey<IMember, string>(CacheKeys.MemberUserNameCachePrefix + p.PreviousUsername));
+            }
         }
     }
 }

src/Umbraco.Core/Cache/ValueEditorCache.cs

@@ -51,7 +51,15 @@ public class ValueEditorCache : IValueEditorCache
             {
                 foreach (Dictionary<int, IDataValueEditor> editors in _valueEditorCache.Values)
                 {
-                    editors.Remove(id);
+                    if (editors.TryGetValue(id, out IDataValueEditor? editor))
+                    {
+                        if (editor is IDisposable disposable)
+                        {
+                            disposable.Dispose();
+                        }
+
+                        editors.Remove(id);
+                    }
                 }
             }
         }

src/Umbraco.Core/Constants-DeliveryApi.cs

@@ -1,4 +1,4 @@
-namespace Umbraco.Cms.Core;
+namespace Umbraco.Cms.Core;
 
 public static partial class Constants
 {
@@ -24,14 +24,42 @@ public static partial class Constants
         public static class OutputCache
         {
             /// <summary>
-            ///     Output cache policy name for content
+            ///     Output cache policy name for content.
             /// </summary>
             public const string ContentCachePolicy = "DeliveryApiContent";
 
             /// <summary>
-            ///     Output cache policy name for media
+            ///     Output cache policy name for media.
             /// </summary>
             public const string MediaCachePolicy = "DeliveryApiMedia";
         }
+
+        /// <summary>
+        ///     Constants for Delivery API header names.
+        /// </summary>
+        public static class HeaderNames
+        {
+            /// <summary>
+            /// Header name for accept language.
+            /// </summary>
+            public const string AcceptLanguage = "Accept-Language";
+
+            /// <summary>
+            /// Header name for API key.
+            /// </summary>
+            public const string ApiKey = "Api-Key";
+
+            /// <summary>
+            /// Header name for preview.
+            /// </summary>
+            public const string Preview = "Preview";
+
+            /// <summary>
+            /// Header name for start item.
+            /// </summary>
+            public const string StartItem = "Start-Item";
+
+
+        }
     }
 }

src/Umbraco.Core/Constants-Entities.cs

@@ -0,0 +1,14 @@
+namespace Umbraco.Cms.Core;
+
+public static partial class Constants
+{
+    public static class Entities
+    {
+        public static class AdditionalDataKeys
+        {
+            public const string MemberPreviousUserName = "previousUsername";
+
+            public const string MemberGroupPreviousName = "previousName";
+        }
+    }
+}

src/Umbraco.Core/DependencyInjection/UmbracoBuilder.cs

@@ -8,12 +8,14 @@ using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.Cache.PartialViewCacheInvalidators;
 using Umbraco.Cms.Core.Composing;
 using Umbraco.Cms.Core.Configuration;
 using Umbraco.Cms.Core.Configuration.Grid;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Diagnostics;
 using Umbraco.Cms.Core.Dictionary;
+using Umbraco.Cms.Core.DynamicRoot;
 using Umbraco.Cms.Core.Editors;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Features;
@@ -35,7 +37,6 @@ using Umbraco.Cms.Core.Runtime;
 using Umbraco.Cms.Core.Scoping;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.DynamicRoot;
 using Umbraco.Cms.Core.Sync;
 using Umbraco.Cms.Core.Telemetry;
 using Umbraco.Cms.Core.Templates;
@@ -341,6 +342,11 @@ namespace Umbraco.Cms.Core.DependencyInjection
             // Data type configuration cache
             Services.AddUnique<IDataTypeConfigurationCache, DataTypeConfigurationCache>();
             Services.AddNotificationHandler<DataTypeCacheRefresherNotification, DataTypeConfigurationCacheRefresher>();
+
+            // Partial view cache invalidators (no-op, shipped implementation is added in Umbraco.Web.Website, but we
+            // need this to ensure we have a service registered for this interface even in headless setups).
+            // See: https://github.com/umbraco/Umbraco-CMS/issues/19661
+            Services.AddUnique<IMemberPartialViewCacheInvalidator, NoopMemberPartialViewCacheInvalidator>();
         }
     }
 }

src/Umbraco.Core/Extensions/PublishedContentExtensions.cs

@@ -826,7 +826,7 @@ public static class PublishedContentExtensions
     /// </param>
     /// <returns></returns>
     /// <remarks>
-    ///     This can be useful in order to return all nodes in an entire site by a type when combined with TypedContentAtRoot
+    ///     This can be useful in order to return all nodes in an entire site by a type when combined with ContentAtRoot
     /// </remarks>
     public static IEnumerable<IPublishedContent> DescendantsOrSelfOfType(
         this IEnumerable<IPublishedContent> parentNodes, IVariationContextAccessor variationContextAccessor, string docTypeAlias, string? culture = null) => parentNodes.SelectMany(x =>
@@ -843,7 +843,7 @@ public static class PublishedContentExtensions
     /// </param>
     /// <returns></returns>
     /// <remarks>
-    ///     This can be useful in order to return all nodes in an entire site by a type when combined with TypedContentAtRoot
+    ///     This can be useful in order to return all nodes in an entire site by a type when combined with ContentAtRoot
     /// </remarks>
     public static IEnumerable<T> DescendantsOrSelf<T>(this IEnumerable<IPublishedContent> parentNodes, IVariationContextAccessor variationContextAccessor, string? culture = null)
         where T : class, IPublishedContent =>

src/Umbraco.Core/Handlers/PublicAccessHandler.cs

@@ -21,16 +21,17 @@ public sealed class PublicAccessHandler :
 
     private void Handle(IEnumerable<IMemberGroup> affectedEntities)
     {
+        var keyName = Constants.Entities.AdditionalDataKeys.MemberGroupPreviousName;
         foreach (IMemberGroup grp in affectedEntities)
         {
             // check if the name has changed
-            if ((grp.AdditionalData?.ContainsKey("previousName") ?? false)
-                && grp.AdditionalData["previousName"] != null
-                && grp.AdditionalData["previousName"]?.ToString().IsNullOrWhiteSpace() == false
-                && grp.AdditionalData["previousName"]?.ToString() != grp.Name)
+            if ((grp.AdditionalData?.ContainsKey(keyName) ?? false)
+                && grp.AdditionalData[keyName] != null
+                && grp.AdditionalData[keyName]?.ToString().IsNullOrWhiteSpace() == false
+                && grp.AdditionalData[keyName]?.ToString() != grp.Name)
             {
                 _publicAccessService.RenameMemberGroupRoleRules(
-                    grp.AdditionalData["previousName"]?.ToString(),
+                    grp.AdditionalData[keyName]?.ToString(),
                     grp.Name);
             }
         }

src/Umbraco.Core/IO/PhysicalFileSystem.cs

@@ -346,13 +346,6 @@ namespace Umbraco.Cms.Core.IO
             // our root path, due to relative segments, so better check
             if (_ioHelper.PathStartsWith(path, _rootPath, Path.DirectorySeparatorChar))
             {
-                // this says that 4.7.2 supports long paths - but Windows does not
-                // https://docs.microsoft.com/en-us/dotnet/api/system.io.pathtoolongexception?view=netframework-4.7.2
-                if (path.Length > 260)
-                {
-                    throw new PathTooLongException($"Path {path} is too long.");
-                }
-
                 return path;
             }
 

src/Umbraco.Core/Models/DeliveryApi/ApiContentRoute.cs

@@ -10,5 +10,7 @@ public sealed class ApiContentRoute : IApiContentRoute
 
     public string Path { get; }
 
+    public string? QueryString { get; set; }
+
     public IApiContentStartItem StartItem { get; }
 }

src/Umbraco.Core/Models/DeliveryApi/IApiContentRoute.cs

@@ -4,5 +4,10 @@ public interface IApiContentRoute
 {
     string Path { get; }
 
+    public string? QueryString
+    {
+        get => null; set { }
+    }
+
     IApiContentStartItem StartItem { get; }
 }

src/Umbraco.Core/Models/MemberGroup.cs

@@ -35,7 +35,7 @@ _additionalData ??= new Dictionary<string, object?>();
                 // if the name has changed, add the value to the additional data,
                 // this is required purely for event handlers to know the previous name of the group
                 // so we can keep the public access up to date.
-                AdditionalData["previousName"] = _name;
+                AdditionalData[Constants.Entities.AdditionalDataKeys.MemberGroupPreviousName] = _name;
             }
 
             SetPropertyValueAndDetectChanges(value, ref _name, nameof(Name));

src/Umbraco.Core/Models/PublishedContent/PublishedValueFallback.cs

@@ -30,7 +30,7 @@ public class PublishedValueFallback : IPublishedValueFallback
     /// <inheritdoc />
     public bool TryGetValue<T>(IPublishedProperty property, string? culture, string? segment, Fallback fallback, T? defaultValue, out T? value)
     {
-        _variationContextAccessor.ContextualizeVariation(property.PropertyType.Variations, ref culture, ref segment);
+        _variationContextAccessor.ContextualizeVariation(property.PropertyType.Variations, property.Alias, ref culture, ref segment);
 
         foreach (var f in fallback)
         {
@@ -78,7 +78,7 @@ public class PublishedValueFallback : IPublishedValueFallback
             return false;
         }
 
-        _variationContextAccessor.ContextualizeVariation(propertyType.Variations, ref culture, ref segment);
+        _variationContextAccessor.ContextualizeVariation(propertyType.Variations, alias, ref culture, ref segment);
 
         foreach (var f in fallback)
         {
@@ -124,7 +124,7 @@ public class PublishedValueFallback : IPublishedValueFallback
         IPublishedPropertyType? propertyType = content.ContentType.GetPropertyType(alias);
         if (propertyType != null)
         {
-            _variationContextAccessor.ContextualizeVariation(propertyType.Variations, content.Id, ref culture, ref segment);
+            _variationContextAccessor.ContextualizeVariation(propertyType.Variations, content.Id, alias, ref culture, ref segment);
             noValueProperty = content.GetProperty(alias);
         }
 
@@ -195,7 +195,7 @@ public class PublishedValueFallback : IPublishedValueFallback
             {
                 culture = null;
                 segment = null;
-                _variationContextAccessor.ContextualizeVariation(propertyType.Variations, content.Id, ref culture, ref segment);
+                _variationContextAccessor.ContextualizeVariation(propertyType.Variations, content.Id, alias, ref culture, ref segment);
             }
 
             property = content?.GetProperty(alias);

src/Umbraco.Core/Models/PublishedContent/VariationContext.cs

@@ -25,9 +25,15 @@ public class VariationContext
     public string Segment { get; }
 
     /// <summary>
-    ///     Gets the segment for the content item
+    ///     Gets the segment for the content item.
     /// </summary>
-    /// <param name="contentId"></param>
-    /// <returns></returns>
+    /// <param name="contentId">The content Id.</param>
     public virtual string GetSegment(int contentId) => Segment;
+
+    /// <summary>
+    ///     Gets the segment for the content item and property alias.
+    /// </summary>
+    /// <param name="contentId">The content Id.</param>
+    /// <param name="propertyAlias">The property alias.</param>
+    public virtual string GetSegment(int contentId, string propertyAlias) => Segment;
 }

src/Umbraco.Core/Models/PublishedContent/VariationContextAccessorExtensions.cs

@@ -8,25 +8,45 @@ namespace Umbraco.Extensions;
 
 public static class VariationContextAccessorExtensions
 {
+    [Obsolete("Please use the method overload that accepts all parameters. Scheduled for removal in Umbraco 18.")]
     public static void ContextualizeVariation(
         this IVariationContextAccessor variationContextAccessor,
         ContentVariation variations,
         ref string? culture,
         ref string? segment)
-        => variationContextAccessor.ContextualizeVariation(variations, null, ref culture, ref segment);
+        => variationContextAccessor.ContextualizeVariation(variations, null, null, ref culture, ref segment);
 
+    public static void ContextualizeVariation(
+        this IVariationContextAccessor variationContextAccessor,
+        ContentVariation variations,
+        string? propertyAlias,
+        ref string? culture,
+        ref string? segment)
+        => variationContextAccessor.ContextualizeVariation(variations, null, propertyAlias, ref culture, ref segment);
+
+    [Obsolete("Please use the method overload that accepts all parameters. Scheduled for removal in Umbraco 18.")]
     public static void ContextualizeVariation(
         this IVariationContextAccessor variationContextAccessor,
         ContentVariation variations,
         int contentId,
         ref string? culture,
         ref string? segment)
-        => variationContextAccessor.ContextualizeVariation(variations, (int?)contentId, ref culture, ref segment);
+        => variationContextAccessor.ContextualizeVariation(variations, (int?)contentId, null, ref culture, ref segment);
+
+    public static void ContextualizeVariation(
+        this IVariationContextAccessor variationContextAccessor,
+        ContentVariation variations,
+        int contentId,
+        string? propertyAlias,
+        ref string? culture,
+        ref string? segment)
+        => variationContextAccessor.ContextualizeVariation(variations, (int?)contentId, propertyAlias, ref culture, ref segment);
 
     private static void ContextualizeVariation(
         this IVariationContextAccessor variationContextAccessor,
         ContentVariation variations,
         int? contentId,
+        string? propertyAlias,
         ref string? culture,
         ref string? segment)
     {
@@ -37,18 +57,22 @@ public static class VariationContextAccessorExtensions
 
         // use context values
         VariationContext? publishedVariationContext = variationContextAccessor?.VariationContext;
-        if (culture == null)
-        {
-            culture = variations.VariesByCulture() ? publishedVariationContext?.Culture : string.Empty;
-        }
+        culture ??= variations.VariesByCulture() ? publishedVariationContext?.Culture : string.Empty;
 
         if (segment == null)
         {
             if (variations.VariesBySegment())
             {
-                segment = contentId == null
-                    ? publishedVariationContext?.Segment
-                    : publishedVariationContext?.GetSegment(contentId.Value);
+                if (contentId == null)
+                {
+                    segment = publishedVariationContext?.Segment;
+                }
+                else
+                {
+                    segment = propertyAlias == null ?
+                        publishedVariationContext?.GetSegment(contentId.Value) :
+                        publishedVariationContext?.GetSegment(contentId.Value, propertyAlias);
+                }
             }
             else
             {

src/Umbraco.Core/Scoping/CoreScope.cs

@@ -250,6 +250,8 @@ public class CoreScope : ICoreScope
         _parentScope = coreScope;
     }
 
+    protected bool HasParentScope => _parentScope is not null;
+
     protected void HandleScopedNotifications() => _notificationPublisher?.ScopeExit(Completed.HasValue && Completed.Value);
 
     private void EnsureNotDisposed()

src/Umbraco.Core/Services/ContentService.cs

@@ -2199,7 +2199,7 @@ public class ContentService : RepositoryService, IContentService
                     variesByCulture ? culturesPublished.IsCollectionEmpty() ? null : culturesPublished : ["*"],
                     null,
                     eventMessages));
-            scope.Notifications.Publish(new ContentPublishedNotification(publishedDocuments, eventMessages).WithState(notificationState));
+            scope.Notifications.Publish(new ContentPublishedNotification(publishedDocuments, eventMessages, true).WithState(notificationState));
 
             scope.Complete();
         }

src/Umbraco.Core/Services/MemberService.cs

@@ -770,16 +770,27 @@ namespace Umbraco.Cms.Core.Services
                 throw new ArgumentException("Cannot save member with empty name.");
             }
 
+            var previousUsername = _memberRepository.Get(member.Id)?.Username;
+
             scope.WriteLock(Constants.Locks.MemberTree);
 
             _memberRepository.Save(member);
 
             if (publishNotificationSaveOptions.HasFlag(PublishNotificationSaveOptions.Saved))
             {
-                scope.Notifications.Publish(
-                    savingNotification is null
+                // If the user name has changed, populate the previous user name in the additional data, so the cache refreshers
+                // have it available to clear the cache by the old name as well as the new.
+                if (string.IsNullOrWhiteSpace(previousUsername) is false &&
+                    string.Equals(previousUsername, member.Username, StringComparison.OrdinalIgnoreCase) is false)
+                {
+                    member.AdditionalData![Constants.Entities.AdditionalDataKeys.MemberPreviousUserName] = previousUsername;
+                }
+
+                MemberSavedNotification memberSavedNotification = savingNotification is null
                     ? new MemberSavedNotification(member, evtMsgs)
-                    : new MemberSavedNotification(member, evtMsgs).WithStateFrom(savingNotification));
+                    : new MemberSavedNotification(member, evtMsgs).WithStateFrom(savingNotification);
+
+                scope.Notifications.Publish(memberSavedNotification);
             }
 
             Audit(AuditType.Save, 0, member.Id);

src/Umbraco.Core/Services/NotificationService.cs

@@ -385,48 +385,7 @@ public class NotificationService : INotificationService
         // build summary
         var summary = new StringBuilder();
 
-        if (content.ContentType.VariesByNothing())
-        {
-            if (!_contentSettings.Notifications.DisableHtmlEmail)
-            {
-                // create the HTML summary for invariant content
-
-                // list all of the property values like we used to
-                summary.Append("<table style=\"width: 100 %; \">");
-                foreach (IProperty p in content.Properties)
-                {
-                    // TODO: doesn't take into account variants
-                    var newText = p.GetValue() != null ? p.GetValue()?.ToString() : string.Empty;
-                    var oldText = newText;
-
-                    // check if something was changed and display the changes otherwise display the fields
-                    if (oldDoc?.Properties.Contains(p.PropertyType.Alias) ?? false)
-                    {
-                        IProperty? oldProperty = oldDoc.Properties[p.PropertyType.Alias];
-                        oldText = oldProperty?.GetValue() != null ? oldProperty.GetValue()?.ToString() : string.Empty;
-
-                        // replace HTML with char equivalent
-                        ReplaceHtmlSymbols(ref oldText);
-                        ReplaceHtmlSymbols(ref newText);
-                    }
-
-                    // show the values
-                    summary.Append("<tr>");
-                    summary.Append(
-                        "<th style='text-align: left; vertical-align: top; width: 25%;border-bottom: 1px solid #CCC'>");
-                    summary.Append(p.PropertyType.Name);
-                    summary.Append("</th>");
-                    summary.Append("<td style='text-align: left; vertical-align: top;border-bottom: 1px solid #CCC'>");
-                    summary.Append(newText);
-                    summary.Append("</td>");
-                    summary.Append("</tr>");
-                }
-
-                summary.Append("</table>");
-            }
-        }
-        else if (content.ContentType.VariesByCulture())
-        {
+        if (content.ContentType.VariesByCulture()) {
             // it's variant, so detect what cultures have changed
             if (!_contentSettings.Notifications.DisableHtmlEmail)
             {
@@ -465,8 +424,43 @@ public class NotificationService : INotificationService
         }
         else
         {
-            // not supported yet...
-            throw new NotSupportedException();
+            if (!_contentSettings.Notifications.DisableHtmlEmail)
+            {
+                // create the HTML summary for invariant content
+
+                // list all of the property values like we used to
+                summary.Append("<table style=\"width: 100 %; \">");
+                foreach (IProperty p in content.Properties)
+                {
+                    // TODO: doesn't take into account variants
+                    var newText = p.GetValue() != null ? p.GetValue()?.ToString() : string.Empty;
+                    var oldText = newText;
+
+                    // check if something was changed and display the changes otherwise display the fields
+                    if (oldDoc?.Properties.Contains(p.PropertyType.Alias) ?? false)
+                    {
+                        IProperty? oldProperty = oldDoc.Properties[p.PropertyType.Alias];
+                        oldText = oldProperty?.GetValue() != null ? oldProperty.GetValue()?.ToString() : string.Empty;
+
+                        // replace HTML with char equivalent
+                        ReplaceHtmlSymbols(ref oldText);
+                        ReplaceHtmlSymbols(ref newText);
+                    }
+
+                    // show the values
+                    summary.Append("<tr>");
+                    summary.Append(
+                        "<th style='text-align: left; vertical-align: top; width: 25%;border-bottom: 1px solid #CCC'>");
+                    summary.Append(p.PropertyType.Name);
+                    summary.Append("</th>");
+                    summary.Append("<td style='text-align: left; vertical-align: top;border-bottom: 1px solid #CCC'>");
+                    summary.Append(newText);
+                    summary.Append("</td>");
+                    summary.Append("</tr>");
+                }
+
+                summary.Append("</table>");
+            }
         }
 
         var protocol = _globalSettings.UseHttps ? "https" : "http";

src/Umbraco.Core/Services/RedirectUrlService.cs

@@ -1,5 +1,4 @@
-using System.Threading.Tasks;
-using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Persistence.Repositories;
@@ -146,5 +145,5 @@ internal class RedirectUrlService : RepositoryService, IRedirectUrlService
         {
             return await _redirectUrlRepository.GetMostRecentUrlAsync(url, culture);
         }
-    }	
+    }
 }

src/Umbraco.Core/Templates/HtmlLocalLinkParser.cs

@@ -1,5 +1,6 @@
 using System.Globalization;
 using System.Text.RegularExpressions;
+using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.Routing;
 using Umbraco.Cms.Core.Web;
 
@@ -43,7 +44,17 @@ public sealed class HtmlLocalLinkParser
     /// <param name="text"></param>
     /// <param name="preview"></param>
     /// <returns></returns>
-    public string EnsureInternalLinks(string text, bool preview)
+    public string EnsureInternalLinks(string text, bool preview) =>
+        EnsureInternalLinks(text, preview, UrlMode.Default);
+
+    /// <summary>
+    ///     Parses the string looking for the {localLink} syntax and updates them to their correct links.
+    /// </summary>
+    /// <param name="text"></param>
+    /// <param name="preview"></param>
+    /// <param name="urlMode"></param>
+    /// <returns></returns>
+    public string EnsureInternalLinks(string text, bool preview, UrlMode urlMode)
     {
         if (!_umbracoContextAccessor.TryGetUmbracoContext(out IUmbracoContext? umbracoContext))
         {
@@ -52,12 +63,12 @@ public sealed class HtmlLocalLinkParser
 
         if (!preview)
         {
-            return EnsureInternalLinks(text);
+            return EnsureInternalLinks(text, urlMode);
         }
 
         using (umbracoContext.ForcedPreview(preview)) // force for URL provider
         {
-            return EnsureInternalLinks(text);
+            return EnsureInternalLinks(text, urlMode);
         }
     }
 
@@ -66,7 +77,16 @@ public sealed class HtmlLocalLinkParser
     /// </summary>
     /// <param name="text"></param>
     /// <returns></returns>
-    public string EnsureInternalLinks(string text)
+    public string EnsureInternalLinks(string text) =>
+        EnsureInternalLinks(text, UrlMode.Default);
+
+    /// <summary>
+    ///     Parses the string looking for the {localLink} syntax and updates them to their correct links.
+    /// </summary>
+    /// <param name="text"></param>
+    /// <param name="urlMode"></param>
+    /// <returns></returns>
+    public string EnsureInternalLinks(string text, UrlMode urlMode)
     {
         if (!_umbracoContextAccessor.TryGetUmbracoContext(out _))
         {
@@ -80,11 +100,11 @@ public sealed class HtmlLocalLinkParser
                 var newLink = "#";
                 if (udi?.EntityType == Constants.UdiEntityType.Document)
                 {
-                    newLink = _publishedUrlProvider.GetUrl(udi.Guid);
+                    newLink = _publishedUrlProvider.GetUrl(udi.Guid, urlMode);
                 }
                 else if (udi?.EntityType == Constants.UdiEntityType.Media)
                 {
-                    newLink = _publishedUrlProvider.GetMediaUrl(udi.Guid);
+                    newLink = _publishedUrlProvider.GetMediaUrl(udi.Guid, urlMode);
                 }
 
                 if (newLink == null)
@@ -96,7 +116,7 @@ public sealed class HtmlLocalLinkParser
             }
             else if (intId.HasValue)
             {
-                var newLink = _publishedUrlProvider.GetUrl(intId.Value);
+                var newLink = _publishedUrlProvider.GetUrl(intId.Value, urlMode);
                 text = text.Replace(tagValue, "href=\"" + newLink);
             }
         }

src/Umbraco.Examine.Lucene/BackOfficeExamineSearcher.cs

@@ -28,9 +28,7 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
     private readonly IEntityService _entityService;
     private readonly IExamineManager _examineManager;
     private readonly ILocalizationService _languageService;
-    private readonly IPublishedUrlProvider _publishedUrlProvider;
     private readonly IUmbracoTreeSearcherFields _treeSearcherFields;
-    private readonly IUmbracoMapper _umbracoMapper;
 
     public BackOfficeExamineSearcher(
         IExamineManager examineManager,
@@ -48,8 +46,6 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
         _entityService = entityService;
         _treeSearcherFields = treeSearcherFields;
         _appCaches = appCaches;
-        _umbracoMapper = umbracoMapper;
-        _publishedUrlProvider = publishedUrlProvider;
     }
 
     public IEnumerable<ISearchResult> Search(
@@ -82,8 +78,6 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
             query = "\"" + g + "\"";
         }
 
-        IUser? currentUser = _backOfficeSecurityAccessor?.BackOfficeSecurity?.CurrentUser;
-
         switch (entityType)
         {
             case UmbracoEntityTypes.Member:
@@ -96,7 +90,7 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
                 }
 
                 if (searchFrom != null && searchFrom != Constants.Conventions.MemberTypes.AllMembersListId &&
-                    searchFrom.Trim() != "-1")
+                    searchFrom.Trim() != Constants.System.RootString)
                 {
                     sb.Append("+__NodeTypeAlias:");
                     sb.Append(searchFrom);
@@ -112,10 +106,13 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
                     fieldsToLoad.Add(field);
                 }
 
-                var allMediaStartNodes = currentUser != null
-                    ? currentUser.CalculateMediaStartNodeIds(_entityService, _appCaches)
-                    : Array.Empty<int>();
-                AppendPath(sb, UmbracoObjectTypes.Media, allMediaStartNodes, searchFrom, ignoreUserStartNodes, _entityService);
+                AppendPath(sb, UmbracoObjectTypes.Media, searchFrom, ignoreUserStartNodes, out var abortMediaQuery);
+                if (abortMediaQuery)
+                {
+                    totalFound = 0;
+                    return [];
+                }
+
                 break;
             case UmbracoEntityTypes.Document:
                 type = "content";
@@ -125,10 +122,13 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
                     fieldsToLoad.Add(field);
                 }
 
-                var allContentStartNodes = currentUser != null
-                    ? currentUser.CalculateContentStartNodeIds(_entityService, _appCaches)
-                    : Array.Empty<int>();
-                AppendPath(sb, UmbracoObjectTypes.Document, allContentStartNodes, searchFrom, ignoreUserStartNodes, _entityService);
+                AppendPath(sb, UmbracoObjectTypes.Document, searchFrom, ignoreUserStartNodes, out var abortContentQuery);
+                if (abortContentQuery)
+                {
+                    totalFound = 0;
+                    return [];
+                }
+
                 break;
             default:
                 throw new NotSupportedException("The " + typeof(BackOfficeExamineSearcher) +
@@ -344,67 +344,89 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
         }
     }
 
-    private void AppendPath(StringBuilder sb, UmbracoObjectTypes objectType, int[]? startNodeIds, string? searchFrom, bool ignoreUserStartNodes, IEntityService entityService)
+    private void AppendPath(StringBuilder sb, UmbracoObjectTypes objectType, string? searchFrom, bool ignoreUserStartNodes, out bool abortQuery)
     {
-        if (sb == null)
+        ArgumentNullException.ThrowIfNull(sb);
+
+        abortQuery = false;
+
+        if (searchFrom is Constants.System.RootString)
         {
-            throw new ArgumentNullException(nameof(sb));
+            searchFrom = null;
         }
 
-        if (entityService == null)
+        var userStartNodes = ignoreUserStartNodes ? [Constants.System.Root] : GetUserStartNodes(objectType);
+        if (searchFrom is null && userStartNodes.Contains(Constants.System.Root))
         {
-            throw new ArgumentNullException(nameof(entityService));
+            // If we have no searchFrom and the user either has access to the root node or we are ignoring user
+            // start nodes, we don't need to filter by path.
+            return;
         }
 
-        UdiParser.TryParse(searchFrom, true, out Udi? udi);
-        searchFrom = udi == null ? searchFrom : entityService.GetId(udi).Result.ToString();
-
-        TreeEntityPath? entityPath =
-            int.TryParse(searchFrom, NumberStyles.Integer, CultureInfo.InvariantCulture, out var searchFromId) &&
-            searchFromId > 0
-                ? entityService.GetAllPaths(objectType, searchFromId).FirstOrDefault()
-                : null;
-        if (entityPath != null)
+        string[] pathsToFilter;
+        if (searchFrom is null)
         {
-            // find... only what's underneath
-            sb.Append("+__Path:");
-            AppendPath(sb, entityPath.Path, false);
-            sb.Append(" ");
+            // If we don't want to filter by a specific entity, we can simply use the user start nodes.
+            pathsToFilter = GetEntityPaths(objectType, userStartNodes);
         }
-        else if (startNodeIds?.Length == 0)
+        else
         {
-            // make sure we don't find anything
-            sb.Append("+__Path:none ");
-        }
-        else if (startNodeIds?.Contains(-1) == false && ignoreUserStartNodes == false) // -1 = no restriction
-        {
-            IEnumerable<TreeEntityPath> entityPaths = entityService.GetAllPaths(objectType, startNodeIds);
-
-            // for each start node, find the start node, and what's underneath
-            // +__Path:(-1*,1234 -1*,1234,* -1*,5678 -1*,5678,* ...)
-            sb.Append("+__Path:(");
-            var first = true;
-            foreach (TreeEntityPath ep in entityPaths)
+            TreeEntityPath? searchFromPath = GetEntityPath(searchFrom, objectType);
+            if (searchFromPath is null)
             {
-                if (first)
-                {
-                    first = false;
-                }
-                else
-                {
-                    sb.Append(" ");
-                }
-
-                AppendPath(sb, ep.Path, true);
+                // If the searchFrom cannot be found, return no results.
+                // This is to prevent showing entities outside the intended filter.
+                abortQuery = true;
+                return;
             }
 
-            sb.Append(") ");
+            var userStartNodePaths = GetEntityPaths(objectType, userStartNodes);
+
+            // If the user has access to the entity, we can simply filter by the entity path.
+            if (userStartNodePaths.Any(userStartNodePath => StartsWithPath(searchFromPath.Path, userStartNodePath)))
+            {
+                sb.Append("+__Path:");
+                AppendPath(sb, searchFromPath.Path, false);
+                sb.Append(' ');
+                return;
+            }
+
+            // If the user does not have access to the entity, let's filter the paths by the ones that start with the
+            // entity path (are descendants of the entity).
+            pathsToFilter = userStartNodePaths.Where(ep => StartsWithPath(ep, searchFromPath.Path)).ToArray();
         }
+
+        // If we have no paths left, no need to perform the query at all, just return no results.
+        if (pathsToFilter.Length == 0)
+        {
+            abortQuery = true;
+            return;
+        }
+
+        // For each start node, find the start node, and what's underneath
+        // +__Path:(-1*,1234 -1*,1234,* -1*,5678 -1*,5678,* ...)
+        sb.Append("+__Path:(");
+        var first = true;
+        foreach (string pathToFilter in pathsToFilter)
+        {
+            if (first)
+            {
+                first = false;
+            }
+            else
+            {
+                sb.Append(' ');
+            }
+
+            AppendPath(sb, pathToFilter, true);
+        }
+
+        sb.Append(") ");
     }
 
-    private void AppendPath(StringBuilder sb, string path, bool includeThisNode)
+    private static void AppendPath(StringBuilder sb, string path, bool includeThisNode)
     {
-        path = path.Replace("-", "\\-").Replace(",", "\\,");
+        path = path.Replace("-", "\\-");
         if (includeThisNode)
         {
             sb.Append(path);
@@ -412,6 +434,68 @@ public class BackOfficeExamineSearcher : IBackOfficeExamineSearcher
         }
 
         sb.Append(path);
-        sb.Append("\\,*");
+        sb.Append(",*");
+    }
+
+    private static bool StartsWithPath(string path1, string path2)
+    {
+        if (path1.StartsWith(path2) == false)
+        {
+            return false;
+        }
+
+        return path1.Length == path2.Length || path1[path2.Length] == ',';
+    }
+
+    private int[] GetUserStartNodes(UmbracoObjectTypes objectType)
+    {
+        IUser? currentUser = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser;
+        if (currentUser is null)
+        {
+            return [];
+        }
+
+        var startNodes = objectType switch
+        {
+            UmbracoObjectTypes.Document => currentUser.CalculateContentStartNodeIds(_entityService, _appCaches),
+            UmbracoObjectTypes.Media => currentUser.CalculateMediaStartNodeIds(_entityService, _appCaches),
+            _ => throw new NotSupportedException($"The object type {objectType} is not supported for start nodes."),
+        };
+
+        return startNodes ?? [Constants.System.Root]; // If no start nodes are defined, we assume the user has access to the root node (-1).
+    }
+
+    private string[] GetEntityPaths(UmbracoObjectTypes objectType, int[] entityIds) =>
+        entityIds switch
+        {
+            [] => [],
+            _ when entityIds.Contains(Constants.System.Root) => [Constants.System.RootString],
+            _ => _entityService.GetAllPaths(objectType, entityIds).Select(x => x.Path).ToArray(),
+        };
+
+    private TreeEntityPath? GetEntityPath(string? searchFrom, UmbracoObjectTypes objectType)
+    {
+        if (searchFrom is null)
+        {
+            return null;
+        }
+
+        Guid? entityKey = null;
+        if (Guid.TryParse(searchFrom, out Guid entityGuid))
+        {
+            entityKey = entityGuid;
+        } // fallback to Udi for legacy reasons as the calling methods take string?
+        else if (UdiParser.TryParse(searchFrom, true, out Udi? udi) && udi is GuidUdi guidUdi)
+        {
+            entityKey = guidUdi.Guid;
+        }
+        else if (int.TryParse(searchFrom, NumberStyles.Integer, CultureInfo.InvariantCulture, out var entityId)
+                 && entityId > 0
+                 && _entityService.GetKey(entityId, objectType) is { Success: true } attempt)
+        {
+            entityKey = attempt.Result;
+        }
+
+        return entityKey is null ? null : _entityService.GetAllPaths(objectType, entityKey.Value).FirstOrDefault();
     }
 }

src/Umbraco.Infrastructure/DeliveryApi/ApiRichTextMarkupParser.cs

@@ -56,7 +56,7 @@ internal sealed class ApiRichTextMarkupParser : ApiRichTextParserBase, IApiRichT
                 link.GetAttributeValue("href", string.Empty),
                 route =>
                 {
-                    link.SetAttributeValue("href", route.Path);
+                    link.SetAttributeValue("href", $"{route.Path}{route.QueryString}");
                     link.SetAttributeValue("data-start-item-path", route.StartItem.Path);
                     link.SetAttributeValue("data-start-item-id", route.StartItem.Id.ToString("D"));
                 },

src/Umbraco.Infrastructure/DeliveryApi/ApiRichTextParserBase.cs

@@ -4,6 +4,7 @@ using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Infrastructure.DeliveryApi;
 
@@ -41,6 +42,7 @@ internal abstract partial class ApiRichTextParserBase
                     : null;
                 if (route != null)
                 {
+                    route.QueryString = match.Groups["query"].Value.NullOrWhiteSpaceAsNull();
                     handled = true;
                     handleContentRoute(route);
                 }
@@ -79,6 +81,6 @@ internal abstract partial class ApiRichTextParserBase
         handleMediaUrl(_apiMediaUrlProvider.GetUrl(media));
     }
 
-    [GeneratedRegex("{localLink:(?<udi>umb:.+)}")]
+    [GeneratedRegex("{localLink:(?<udi>umb:.+)}(?<query>[^\"]*)")]
     private static partial Regex LocalLinkRegex();
 }

src/Umbraco.Infrastructure/IPublishedContentQuery.cs

@@ -35,6 +35,8 @@ public interface IPublishedContentQuery
 
     IEnumerable<IPublishedContent> ContentAtRoot();
 
+    IEnumerable<IPublishedContent> ContentAtRoot(string? culture) => culture is null ? ContentAtRoot() : throw new NotSupportedException();
+
     IPublishedContent? Media(int id);
 
     IPublishedContent? Media(Guid id);

src/Umbraco.Infrastructure/Persistence/Repositories/Implement/ContentTypeRepository.cs

@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Persistence.Querying;
 using Umbraco.Cms.Core.Persistence.Repositories;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Strings;
 using Umbraco.Cms.Infrastructure.Persistence.Dtos;
 using Umbraco.Cms.Infrastructure.Persistence.Querying;
@@ -25,8 +26,9 @@ internal class ContentTypeRepository : ContentTypeRepositoryBase<IContentType>,
         ILogger<ContentTypeRepository> logger,
         IContentTypeCommonRepository commonRepository,
         ILanguageRepository languageRepository,
-        IShortStringHelper shortStringHelper)
-        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper)
+        IShortStringHelper shortStringHelper,
+        Lazy<IIdKeyMap> idKeyMap)
+        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper, idKeyMap)
     {
     }
 

src/Umbraco.Infrastructure/Persistence/Repositories/Implement/ContentTypeRepositoryBase.cs

@@ -29,15 +29,22 @@ internal abstract class ContentTypeRepositoryBase<TEntity> : EntityRepositoryBas
     where TEntity : class, IContentTypeComposition
 {
     private readonly IShortStringHelper _shortStringHelper;
+    private readonly Lazy<IIdKeyMap> _idKeyMap;
 
-    protected ContentTypeRepositoryBase(IScopeAccessor scopeAccessor, AppCaches cache,
-        ILogger<ContentTypeRepositoryBase<TEntity>> logger, IContentTypeCommonRepository commonRepository,
-        ILanguageRepository languageRepository, IShortStringHelper shortStringHelper)
+    protected ContentTypeRepositoryBase(
+        IScopeAccessor scopeAccessor,
+        AppCaches cache,
+        ILogger<ContentTypeRepositoryBase<TEntity>> logger,
+        IContentTypeCommonRepository commonRepository,
+        ILanguageRepository languageRepository,
+        IShortStringHelper shortStringHelper,
+        Lazy<IIdKeyMap> idKeyMap)
         : base(scopeAccessor, cache, logger)
     {
         _shortStringHelper = shortStringHelper;
         CommonRepository = commonRepository;
         LanguageRepository = languageRepository;
+        _idKeyMap = idKeyMap;
     }
 
     protected IContentTypeCommonRepository CommonRepository { get; }
@@ -287,7 +294,7 @@ AND umbracoNode.nodeObjectType = @objectType",
             // If the Id of the DataType is not set, we resolve it from the db by its PropertyEditorAlias
             if (propertyType.DataTypeId == 0 || propertyType.DataTypeId == default)
             {
-                AssignDataTypeFromPropertyEditor(propertyType);
+                AssignDataTypeIdFromProvidedKeyOrPropertyEditor(propertyType);
             }
 
             PropertyTypeDto propertyTypeDto =
@@ -590,7 +597,7 @@ AND umbracoNode.id <> @id",
             // if the Id of the DataType is not set, we resolve it from the db by its PropertyEditorAlias
             if (propertyType.DataTypeId == 0 || propertyType.DataTypeId == default)
             {
-                AssignDataTypeFromPropertyEditor(propertyType);
+                AssignDataTypeIdFromProvidedKeyOrPropertyEditor(propertyType);
             }
 
             // validate the alias
@@ -1434,37 +1441,59 @@ AND umbracoNode.id <> @id",
     protected abstract TEntity? PerformGet(Guid id);
 
     /// <summary>
-    ///     Try to set the data type id based on its ControlId
+    ///     Try to set the data type Id based on the provided key or property editor alias.
     /// </summary>
     /// <param name="propertyType"></param>
-    private void AssignDataTypeFromPropertyEditor(IPropertyType propertyType)
+    private void AssignDataTypeIdFromProvidedKeyOrPropertyEditor(IPropertyType propertyType)
     {
-        // we cannot try to assign a data type of it's empty
-        if (propertyType.PropertyEditorAlias.IsNullOrWhiteSpace() == false)
+        // If a key is provided, use that.
+        if (propertyType.DataTypeKey != Guid.Empty)
         {
-            Sql<ISqlContext> sql = Sql()
-                .Select<DataTypeDto>(dt => dt.Select(x => x.NodeDto))
-                .From<DataTypeDto>()
-                .InnerJoin<NodeDto>().On<DataTypeDto, NodeDto>((dt, n) => dt.NodeId == n.NodeId)
-                .Where(
-                    "propertyEditorAlias = @propertyEditorAlias",
-                    new { propertyEditorAlias = propertyType.PropertyEditorAlias })
-                .OrderBy<DataTypeDto>(typeDto => typeDto.NodeId);
-            DataTypeDto? datatype = Database.FirstOrDefault<DataTypeDto>(sql);
-
-            // we cannot assign a data type if one was not found
-            if (datatype != null)
+            Attempt<int> dataTypeIdAttempt = _idKeyMap.Value.GetIdForKey(propertyType.DataTypeKey, UmbracoObjectTypes.DataType);
+            if (dataTypeIdAttempt.Success)
             {
-                propertyType.DataTypeId = datatype.NodeId;
-                propertyType.DataTypeKey = datatype.NodeDto.UniqueId;
+                propertyType.DataTypeId = dataTypeIdAttempt.Result;
+                return;
             }
             else
             {
                 Logger.LogWarning(
-                    "Could not assign a data type for the property type {PropertyTypeAlias} since no data type was found with a property editor {PropertyEditorAlias}",
-                    propertyType.Alias, propertyType.PropertyEditorAlias);
+                    "Could not assign a data type for the property type {PropertyTypeAlias} since no integer Id was found matching the key {DataTypeKey}. Falling back to look up via the property editor alias.",
+                    propertyType.Alias,
+                    propertyType.DataTypeKey);
             }
         }
+
+        // Otherwise if a property editor alias is provided, try to find a data type that uses that alias.
+        if (propertyType.PropertyEditorAlias.IsNullOrWhiteSpace())
+        {
+            // We cannot try to assign a data type if it's empty.
+            return;
+        }
+
+        Sql<ISqlContext> sql = Sql()
+            .Select<DataTypeDto>(dt => dt.Select(x => x.NodeDto))
+            .From<DataTypeDto>()
+            .InnerJoin<NodeDto>().On<DataTypeDto, NodeDto>((dt, n) => dt.NodeId == n.NodeId)
+            .Where(
+                "propertyEditorAlias = @propertyEditorAlias",
+                new { propertyEditorAlias = propertyType.PropertyEditorAlias })
+            .OrderBy<DataTypeDto>(typeDto => typeDto.NodeId);
+        DataTypeDto? datatype = Database.FirstOrDefault<DataTypeDto>(sql);
+
+        // we cannot assign a data type if one was not found
+        if (datatype != null)
+        {
+            propertyType.DataTypeId = datatype.NodeId;
+            propertyType.DataTypeKey = datatype.NodeDto.UniqueId;
+        }
+        else
+        {
+            Logger.LogWarning(
+                "Could not assign a data type for the property type {PropertyTypeAlias} since no data type was found with a property editor {PropertyEditorAlias}",
+                propertyType.Alias,
+                propertyType.PropertyEditorAlias);
+        }
     }
 
     protected abstract TEntity? PerformGet(string alias);

src/Umbraco.Infrastructure/Persistence/Repositories/Implement/MediaTypeRepository.cs

@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Persistence.Querying;
 using Umbraco.Cms.Core.Persistence.Repositories;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Strings;
 using Umbraco.Cms.Infrastructure.Persistence.Dtos;
 using Umbraco.Cms.Infrastructure.Persistence.Querying;
@@ -24,8 +25,9 @@ internal class MediaTypeRepository : ContentTypeRepositoryBase<IMediaType>, IMed
         ILogger<MediaTypeRepository> logger,
         IContentTypeCommonRepository commonRepository,
         ILanguageRepository languageRepository,
-        IShortStringHelper shortStringHelper)
-        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper)
+        IShortStringHelper shortStringHelper,
+        Lazy<IIdKeyMap> idKeyMap)
+        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper, idKeyMap)
     {
     }
 

src/Umbraco.Infrastructure/Persistence/Repositories/Implement/MemberTypeRepository.cs

@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Persistence.Querying;
 using Umbraco.Cms.Core.Persistence.Repositories;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Strings;
 using Umbraco.Cms.Infrastructure.Persistence.Dtos;
 using Umbraco.Cms.Infrastructure.Persistence.Factories;
@@ -27,9 +28,10 @@ internal class MemberTypeRepository : ContentTypeRepositoryBase<IMemberType>, IM
         ILogger<MemberTypeRepository> logger,
         IContentTypeCommonRepository commonRepository,
         ILanguageRepository languageRepository,
-        IShortStringHelper shortStringHelper)
-        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper) =>
-        _shortStringHelper = shortStringHelper;
+        IShortStringHelper shortStringHelper,
+        Lazy<IIdKeyMap> idKeyMap)
+        : base(scopeAccessor, cache, logger, commonRepository, languageRepository, shortStringHelper, idKeyMap)
+         => _shortStringHelper = shortStringHelper;
 
     protected override bool SupportsPublishing => MemberType.SupportsPublishingConst;
 

src/Umbraco.Infrastructure/Persistence/Repositories/Implement/UserRepository.cs

@@ -372,15 +372,17 @@ SELECT 4 AS [Key], COUNT(id) AS [Value] FROM umbracoUser WHERE userDisabled = 0
 
         List<int> userIds = dtos.Count == 1 ? new List<int> {dtos[0].Id} : dtos.Select(x => x.Id).ToList();
         Dictionary<int, UserDto>? xUsers = dtos.Count == 1 ? null : dtos.ToDictionary(x => x.Id, x => x);
+        Sql<ISqlContext> sql;
 
         // get users2groups
 
-        Sql<ISqlContext> sql = SqlContext.Sql()
-            .Select<User2UserGroupDto>()
-            .From<User2UserGroupDto>()
-            .WhereIn<User2UserGroupDto>(x => x.UserId, userIds);
-
-        List<User2UserGroupDto>? user2Groups = Database.Fetch<User2UserGroupDto>(sql);
+        var user2Groups = Database.FetchByGroups<User2UserGroupDto, int>(userIds, Constants.Sql.MaxParameterCount, ints =>
+        {
+            return SqlContext.Sql()
+                .Select<User2UserGroupDto>()
+                .From<User2UserGroupDto>()
+                .WhereIn<User2UserGroupDto>(x => x.UserId, ints);
+        }).ToList();
         var groupIds = user2Groups.Select(x => x.UserGroupId).ToList();
 
         // get groups
@@ -422,12 +424,13 @@ SELECT 4 AS [Key], COUNT(id) AS [Value] FROM umbracoUser WHERE userDisabled = 0
 
         // get start nodes
 
-        sql = SqlContext.Sql()
-            .Select<UserStartNodeDto>()
-            .From<UserStartNodeDto>()
-            .WhereIn<UserStartNodeDto>(x => x.UserId, userIds);
-
-        List<UserStartNodeDto>? startNodes = Database.Fetch<UserStartNodeDto>(sql);
+        var startNodes = Database.FetchByGroups<UserStartNodeDto, int>(userIds, Constants.Sql.MaxParameterCount, ints =>
+        {
+            return SqlContext.Sql()
+                .Select<UserStartNodeDto>()
+                .From<UserStartNodeDto>()
+                .WhereIn<UserStartNodeDto>(x => x.UserId, ints);
+        }).ToList();
 
         // get groups2languages
 
@@ -1085,19 +1088,20 @@ SELECT 4 AS [Key], COUNT(id) AS [Value] FROM umbracoUser WHERE userDisabled = 0
     /// <inheritdoc />
     public void InvalidateSessionsForRemovedProviders(IEnumerable<string> currentLoginProviders)
     {
-        // Get all the user or member keys associated with the removed providers.
+        // Get all the user keys associated with the removed providers.
         Sql<ISqlContext> idsQuery = SqlContext.Sql()
             .Select<ExternalLoginDto>(x => x.UserOrMemberKey)
             .From<ExternalLoginDto>()
+            .Where<ExternalLoginDto>(x => !x.LoginProvider.StartsWith(Constants.Security.MemberExternalAuthenticationTypePrefix)) // Only invalidate sessions relating to backoffice users, not members.
             .WhereNotIn<ExternalLoginDto>(x => x.LoginProvider, currentLoginProviders);
-        List<Guid> userAndMemberKeysAssociatedWithRemovedProviders = Database.Fetch<Guid>(idsQuery);
-        if (userAndMemberKeysAssociatedWithRemovedProviders.Count == 0)
+        List<Guid> userKeysAssociatedWithRemovedProviders = Database.Fetch<Guid>(idsQuery);
+        if (userKeysAssociatedWithRemovedProviders.Count == 0)
         {
             return;
         }
 
-        // Filter for actual users and convert to integer IDs.
-        var userIdsAssociatedWithRemovedProviders = userAndMemberKeysAssociatedWithRemovedProviders
+        // Convert to user integer IDs.
+        var userIdsAssociatedWithRemovedProviders = userKeysAssociatedWithRemovedProviders
             .Select(ConvertUserKeyToUserId)
             .Where(x => x.HasValue)
             .Select(x => x!.Value)
@@ -1119,7 +1123,6 @@ SELECT 4 AS [Key], COUNT(id) AS [Value] FROM umbracoUser WHERE userDisabled = 0
         // User Ids are stored as integers in the umbracoUser table, but as a GUID representation
         // of that integer in umbracoExternalLogin (converted via IntExtensions.ToGuid()).
         // We need to parse that to get the user Ids to invalidate.
-        // Note also that umbracoExternalLogin contains members too, as proper GUIDs, so we need to ignore them.
         IntExtensions.TryParseFromGuid(userOrMemberKey, out int? userId) ? userId : null;
 
     #endregion

src/Umbraco.Infrastructure/PropertyEditors/BlockEditorPropertyValueEditor.cs

@@ -88,7 +88,7 @@ internal abstract class BlockEditorPropertyValueEditor : BlockValuePropertyValue
     {
         var rawJson = value == null ? string.Empty : value is string str ? str : value.ToString();
 
-        BlockEditorData? blockEditorData = BlockEditorValues.DeserializeAndClean(rawJson);
+        BlockEditorData? blockEditorData = SafeParseBlockEditorData(rawJson);
         if (blockEditorData is null)
         {
             yield break;
@@ -115,17 +115,7 @@ internal abstract class BlockEditorPropertyValueEditor : BlockValuePropertyValue
     {
         var val = property.GetValue(culture, segment);
 
-        BlockEditorData? blockEditorData;
-        try
-        {
-            blockEditorData = BlockEditorValues.DeserializeAndClean(val);
-        }
-        catch (JsonSerializationException)
-        {
-            // if this occurs it means the data is invalid, shouldn't happen but has happened if we change the data format.
-            return string.Empty;
-        }
-
+        BlockEditorData? blockEditorData = SafeParseBlockEditorData(val);
         if (blockEditorData == null)
         {
             return string.Empty;
@@ -150,17 +140,7 @@ internal abstract class BlockEditorPropertyValueEditor : BlockValuePropertyValue
             return null;
         }
 
-        BlockEditorData? blockEditorData;
-        try
-        {
-            blockEditorData = BlockEditorValues.DeserializeAndClean(editorValue.Value);
-        }
-        catch (JsonSerializationException)
-        {
-            // if this occurs it means the data is invalid, shouldn't happen but has happened if we change the data format.
-            return string.Empty;
-        }
-
+        BlockEditorData? blockEditorData = SafeParseBlockEditorData(editorValue.Value);
         if (blockEditorData == null || blockEditorData.BlockValue.ContentData.Count == 0)
         {
             return string.Empty;
@@ -171,4 +151,23 @@ internal abstract class BlockEditorPropertyValueEditor : BlockValuePropertyValue
         // return json
         return JsonConvert.SerializeObject(blockEditorData.BlockValue, Formatting.None);
     }
+
+    // We don't throw on error here because we want to be able to parse what we can, even if some of the data is invalid. In cases where migrating
+    // from nested content to blocks, we don't want to trigger a fatal error for retrieving references, as this isn't vital to the operation.
+    // See: https://github.com/umbraco/Umbraco-CMS/issues/19784 and Umbraco support cases.
+    private BlockEditorData? SafeParseBlockEditorData(object? value)
+    {
+        try
+        {
+            return BlockEditorValues.DeserializeAndClean(value);
+        }
+        catch (JsonSerializationException ex)
+        {
+            _logger.LogWarning(
+                "Could not deserialize the provided property value into a block editor value: {PropertyValue}. Error: {ErrorMessage}.",
+                value,
+                ex.Message);
+            return null;
+        }
+    }
 }

src/Umbraco.Infrastructure/PropertyEditors/FileUploadPropertyValueEditor.cs

@@ -2,6 +2,7 @@
 // See LICENSE for more details.
 
 using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.IO;
 using Umbraco.Cms.Core.Models.Editors;
@@ -16,11 +17,18 @@ namespace Umbraco.Cms.Core.PropertyEditors;
 /// <summary>
 ///     The value editor for the file upload property editor.
 /// </summary>
-internal class FileUploadPropertyValueEditor : DataValueEditor
+/// <remarks>
+///     As this class is loaded into <see cref="ValueEditorCache"/> which can be cleared, it needs
+///     to be disposable in order to properly clean up resources such as
+///     the settings change subscription and avoid a memory leak.
+/// </remarks>
+internal class FileUploadPropertyValueEditor : DataValueEditor, IDisposable
 {
     private readonly MediaFileManager _mediaFileManager;
     private readonly IFileStreamSecurityValidator _fileStreamSecurityValidator;
+
     private ContentSettings _contentSettings;
+    private readonly IDisposable? _contentSettingsChangeSubscription;
 
     public FileUploadPropertyValueEditor(
         DataEditorAttribute attribute,
@@ -36,7 +44,7 @@ internal class FileUploadPropertyValueEditor : DataValueEditor
         _mediaFileManager = mediaFileManager ?? throw new ArgumentNullException(nameof(mediaFileManager));
         _fileStreamSecurityValidator = fileStreamSecurityValidator;
         _contentSettings = contentSettings.CurrentValue ?? throw new ArgumentNullException(nameof(contentSettings));
-        contentSettings.OnChange(x => _contentSettings = x);
+        _contentSettingsChangeSubscription = contentSettings.OnChange(x => _contentSettings = x);
     }
 
     /// <summary>
@@ -163,4 +171,6 @@ internal class FileUploadPropertyValueEditor : DataValueEditor
 
         return filepath;
     }
+
+    public void Dispose() => _contentSettingsChangeSubscription?.Dispose();
 }

src/Umbraco.Infrastructure/PropertyEditors/ImageCropperPropertyEditor.cs

@@ -21,6 +21,10 @@ namespace Umbraco.Cms.Core.PropertyEditors;
 /// <summary>
 ///     Represents an image cropper property editor.
 /// </summary>
+/// <remarks>
+///     As this class is not registered with DI as a singleton, it must be disposed to release
+///     the settings change subscription and avoid a memory leak.
+/// </remarks>
 [DataEditor(
     Constants.PropertyEditors.Aliases.ImageCropper,
     "Image Cropper",
@@ -42,6 +46,7 @@ public class ImageCropperPropertyEditor : DataEditor, IMediaUrlGenerator,
     private readonly IIOHelper _ioHelper;
     private readonly ILogger<ImageCropperPropertyEditor> _logger;
     private readonly MediaFileManager _mediaFileManager;
+
     private ContentSettings _contentSettings;
 
     // Scheduled for removal in v12

src/Umbraco.Infrastructure/PropertyEditors/ImageCropperPropertyValueEditor.cs

@@ -23,13 +23,20 @@ namespace Umbraco.Cms.Core.PropertyEditors;
 /// <summary>
 ///     The value editor for the image cropper property editor.
 /// </summary>
-internal class ImageCropperPropertyValueEditor : DataValueEditor // TODO: core vs web?
+/// <remarks>
+///     As this class is loaded into <see cref="ValueEditorCache"/> which can be cleared, it needs
+///     to be disposable in order to properly clean up resources such as
+///     the settings change subscription and avoid a memory leak.
+/// </remarks>
+internal class ImageCropperPropertyValueEditor : DataValueEditor, IDisposable
 {
     private readonly IDataTypeConfigurationCache _dataTypeConfigurationCache;
     private readonly IFileStreamSecurityValidator _fileStreamSecurityValidator;
     private readonly ILogger<ImageCropperPropertyValueEditor> _logger;
     private readonly MediaFileManager _mediaFileManager;
+
     private ContentSettings _contentSettings;
+    private readonly IDisposable? _contentSettingsChangeSubscription;
 
     public ImageCropperPropertyValueEditor(
         DataEditorAttribute attribute,
@@ -49,7 +56,7 @@ internal class ImageCropperPropertyValueEditor : DataValueEditor // TODO: core v
         _contentSettings = contentSettings.CurrentValue;
         _dataTypeConfigurationCache = dataTypeConfigurationCache;
         _fileStreamSecurityValidator = fileStreamSecurityValidator;
-        contentSettings.OnChange(x => _contentSettings = x);
+        _contentSettingsChangeSubscription = contentSettings.OnChange(x => _contentSettings = x);
     }
 
     /// <summary>
@@ -252,4 +259,6 @@ internal class ImageCropperPropertyValueEditor : DataValueEditor // TODO: core v
 
         return filepath;
     }
+
+    public void Dispose() => _contentSettingsChangeSubscription?.Dispose();
 }

src/Umbraco.Infrastructure/PropertyEditors/UploadFileTypeValidator.cs

@@ -11,10 +11,19 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Core.PropertyEditors;
 
-internal class UploadFileTypeValidator : IValueValidator
+/// <summary>
+///     The value editor for file upload property editors.
+/// </summary>
+/// <remarks>
+///     As this class is not registered with DI as a singleton, it must be disposed to release
+///     the settings change subscription and avoid a memory leak.
+/// </remarks>
+internal class UploadFileTypeValidator : IValueValidator, IDisposable
 {
     private readonly ILocalizedTextService _localizedTextService;
+
     private ContentSettings _contentSettings;
+    private readonly IDisposable? _contentSettingsChangeSubscription;
 
     public UploadFileTypeValidator(
         ILocalizedTextService localizedTextService,
@@ -23,7 +32,7 @@ internal class UploadFileTypeValidator : IValueValidator
         _localizedTextService = localizedTextService;
         _contentSettings = contentSettings.CurrentValue;
 
-        contentSettings.OnChange(x => _contentSettings = x);
+        _contentSettingsChangeSubscription = contentSettings.OnChange(x => _contentSettings = x);
     }
 
     public IEnumerable<ValidationResult> Validate(object? value, string? valueType, object? dataTypeConfiguration)
@@ -103,4 +112,6 @@ internal class UploadFileTypeValidator : IValueValidator
         extension = fileName.GetFileExtension().TrimStart(".");
         return true;
     }
+
+    public void Dispose() => _contentSettingsChangeSubscription?.Dispose();
 }

src/Umbraco.Infrastructure/PropertyEditors/ValueConverters/RteMacroRenderingValueConverter.cs

@@ -31,8 +31,12 @@ namespace Umbraco.Cms.Core.PropertyEditors.ValueConverters;
 ///     A value converter for TinyMCE that will ensure any macro content is rendered properly even when
 ///     used dynamically.
 /// </summary>
+/// <remarks>
+///     As this class is not registered with DI as a singleton, it must be disposed to release
+///     the settings change subscription and avoid a memory leak.
+/// </remarks>
 [DefaultPropertyValueConverter]
-public class RteMacroRenderingValueConverter : SimpleTinyMceValueConverter, IDeliveryApiPropertyValueConverter
+public class RteMacroRenderingValueConverter : SimpleTinyMceValueConverter, IDeliveryApiPropertyValueConverter, IDisposable
 {
     private readonly HtmlImageSourceParser _imageSourceParser;
     private readonly HtmlLocalLinkParser _linkParser;
@@ -47,7 +51,9 @@ public class RteMacroRenderingValueConverter : SimpleTinyMceValueConverter, IDel
     private readonly ILogger<RteMacroRenderingValueConverter> _logger;
     private readonly IApiElementBuilder _apiElementBuilder;
     private readonly RichTextBlockPropertyValueConstructorCache _constructorCache;
+
     private DeliveryApiSettings _deliveryApiSettings;
+    private readonly IDisposable? _deliveryApiSettingsChangeSubscription;
 
     [Obsolete("Please use the constructor that takes all arguments. Will be removed in V14.")]
     public RteMacroRenderingValueConverter(IUmbracoContextAccessor umbracoContextAccessor, IMacroRenderer macroRenderer,
@@ -107,8 +113,9 @@ public class RteMacroRenderingValueConverter : SimpleTinyMceValueConverter, IDel
         _apiElementBuilder = apiElementBuilder;
         _constructorCache = constructorCache;
         _logger = logger;
+
         _deliveryApiSettings = deliveryApiSettingsMonitor.CurrentValue;
-        deliveryApiSettingsMonitor.OnChange(settings => _deliveryApiSettings = settings);
+        _deliveryApiSettingsChangeSubscription = deliveryApiSettingsMonitor.OnChange(settings => _deliveryApiSettings = settings);
     }
 
     public override PropertyCacheLevel GetPropertyCacheLevel(IPublishedPropertyType propertyType) =>
@@ -314,4 +321,6 @@ public class RteMacroRenderingValueConverter : SimpleTinyMceValueConverter, IDel
 
         public required RichTextBlockModel? RichTextBlockModel { get; set; }
     }
+
+    public void Dispose() => _deliveryApiSettingsChangeSubscription?.Dispose();
 }

src/Umbraco.Infrastructure/PublishedContentQuery.cs

@@ -153,6 +153,9 @@ public class PublishedContentQuery : IPublishedContentQuery
     public IEnumerable<IPublishedContent> ContentAtRoot()
         => ItemsAtRoot(_publishedSnapshot.Content);
 
+    public IEnumerable<IPublishedContent> ContentAtRoot(string? culture)
+        => ItemsAtRoot(_publishedSnapshot.Content, culture);
+
     #endregion
 
     #region Media
@@ -232,8 +235,8 @@ public class PublishedContentQuery : IPublishedContentQuery
         IPublishedCache? cache)
         => cache?.GetByXPath(xpath, vars) ?? Array.Empty<IPublishedContent>();
 
-    private static IEnumerable<IPublishedContent> ItemsAtRoot(IPublishedCache? cache)
-        => cache?.GetAtRoot() ?? Array.Empty<IPublishedContent>();
+    private static IEnumerable<IPublishedContent> ItemsAtRoot(IPublishedCache? cache, string? culture = null)
+        => cache?.GetAtRoot(culture) ?? Array.Empty<IPublishedContent>();
 
     #endregion
 

src/Umbraco.Infrastructure/Routing/RedirectTracker.cs

@@ -95,6 +95,7 @@ namespace Umbraco.Cms.Infrastructure.Routing
 
             using UmbracoContextReference reference = _umbracoContextFactory.EnsureUmbracoContext();
             IPublishedContentCache? contentCache = reference.UmbracoContext.Content;
+
             if (contentCache == null)
             {
                 _logger.LogWarning("Could not track redirects because there is no published content cache available on the current published snapshot.");
@@ -106,11 +107,16 @@ namespace Umbraco.Cms.Infrastructure.Routing
                 try
                 {
                     var newRoute = contentCache.GetRouteById(contentId, culture);
+
                     if (!IsValidRoute(newRoute) || oldRoute == newRoute)
                     {
                         continue;
                     }
 
+                    // Ensure we don't create a self-referencing redirect. This can occur if a document is renamed and then the name is reverted back
+                    // to the original. We resolve this by removing any existing redirect that points to the new route.
+                    RemoveSelfReferencingRedirect(contentKey, newRoute);
+
                     _redirectUrlService.Register(oldRoute, contentKey, culture);
                 }
                 catch (Exception ex)
@@ -121,5 +127,17 @@ namespace Umbraco.Cms.Infrastructure.Routing
         }
 
         private static bool IsValidRoute([NotNullWhen(true)] string? route) => route is not null && !route.StartsWith("err/");
+
+        private void RemoveSelfReferencingRedirect(Guid contentKey, string route)
+        {
+            IEnumerable<IRedirectUrl> allRedirectUrls = _redirectUrlService.GetContentRedirectUrls(contentKey);
+            foreach (IRedirectUrl redirectUrl in allRedirectUrls)
+            {
+                if (redirectUrl.Url == route)
+                {
+                    _redirectUrlService.Delete(redirectUrl.Key);
+                }
+            }
+        }
     }
 }

src/Umbraco.Infrastructure/Search/IndexingNotificationHandler.DeliveryApi.cs

@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Configuration.Models;
@@ -17,7 +17,7 @@ internal sealed class DeliveryApiContentIndexingNotificationHandler :
 {
     private readonly IDeliveryApiIndexingHandler _deliveryApiIndexingHandler;
     private readonly ILogger<DeliveryApiContentIndexingNotificationHandler> _logger;
-    private DeliveryApiSettings _deliveryApiSettings;
+    private readonly DeliveryApiSettings _deliveryApiSettings;
 
     public DeliveryApiContentIndexingNotificationHandler(
         IDeliveryApiIndexingHandler deliveryApiIndexingHandler,
@@ -27,7 +27,6 @@ internal sealed class DeliveryApiContentIndexingNotificationHandler :
         _deliveryApiIndexingHandler = deliveryApiIndexingHandler;
         _logger = logger;
         _deliveryApiSettings = deliveryApiSettings.CurrentValue;
-        deliveryApiSettings.OnChange(settings => _deliveryApiSettings = settings);
     }
 
     public void Handle(ContentCacheRefresherNotification notification)

src/Umbraco.Infrastructure/Security/IdentityMapDefinition.cs

@@ -129,7 +129,7 @@ public class IdentityMapDefinition : IMapDefinition
         target.IsApproved = source.IsApproved;
         target.SecurityStamp = source.SecurityStamp;
         DateTime? lockedOutUntil = source.LastLockoutDate?.AddMinutes(_securitySettings.UserDefaultLockoutTimeInMinutes);
-        target.LockoutEnd = source.IsLockedOut ? (lockedOutUntil ?? DateTime.MaxValue).ToUniversalTime() : null;
+        target.LockoutEnd = source.IsLockedOut ? lockedOutUntil ?? DateTime.MaxValue : null;
     }
 
     // Umbraco.Code.MapAll -Id -LockoutEnabled -PhoneNumber -PhoneNumberConfirmed -ConcurrencyStamp -NormalizedEmail -NormalizedUserName -Roles
@@ -146,17 +146,46 @@ public class IdentityMapDefinition : IMapDefinition
         target.PasswordConfig = source.PasswordConfiguration;
         target.IsApproved = source.IsApproved;
         target.SecurityStamp = source.SecurityStamp;
-        DateTime? lockedOutUntil = source.LastLockoutDate?.AddMinutes(_securitySettings.MemberDefaultLockoutTimeInMinutes);
-        target.LockoutEnd = source.IsLockedOut ? (lockedOutUntil ?? DateTime.MaxValue).ToUniversalTime() : null;
+        target.LockoutEnd = GetLockoutEnd(source);
+        target.LastLockoutDateUtc = GetLastLockoutDateUtc(source);
         target.Comments = source.Comments;
-        target.LastLockoutDateUtc = source.LastLockoutDate == DateTime.MinValue
-            ? null
-            : source.LastLockoutDate?.ToUniversalTime();
-        target.CreatedDateUtc = source.CreateDate.ToUniversalTime();
+        target.CreatedDateUtc = EnsureUtcWithServerTime(source.CreateDate);
         target.Key = source.Key;
         target.MemberTypeAlias = source.ContentTypeAlias;
         target.TwoFactorEnabled = _twoFactorLoginService.IsTwoFactorEnabledAsync(source.Key).GetAwaiter().GetResult();
 
         // NB: same comments re AutoMapper as per BackOfficeUser
     }
+
+    private DateTimeOffset? GetLockoutEnd(IMember source)
+    {
+        if (source.IsLockedOut is false)
+        {
+            return null;
+        }
+
+        DateTime? lockedOutUntil = source.LastLockoutDate?.AddMinutes(_securitySettings.MemberDefaultLockoutTimeInMinutes);
+        if (lockedOutUntil.HasValue is false)
+        {
+            return DateTimeOffset.MaxValue;
+        }
+
+        return EnsureUtcWithServerTime(lockedOutUntil.Value);
+    }
+
+    private static DateTime? GetLastLockoutDateUtc(IMember source)
+    {
+        if (source.LastLockoutDate is null || source.LastLockoutDate == DateTime.MinValue)
+        {
+            return null;
+        }
+
+        return EnsureUtcWithServerTime(source.LastLockoutDate.Value);
+    }
+
+    private static DateTime EnsureUtcWithServerTime(DateTime date) =>
+
+        // We have a server time value here, but the the Kind is UTC, so we can't use .ToUniversalTime() to convert to the UTC
+        // value that the LockoutEnd property expects. We need to create a DateTimeOffset with the correct offset.
+        DateTime.SpecifyKind(date, DateTimeKind.Local).ToUniversalTime();
 }

src/Umbraco.Infrastructure/Umbraco.Infrastructure.csproj

@@ -43,6 +43,10 @@
 
     <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
     <PackageReference Include="System.Text.RegularExpressions" />
+
+    <!-- Take top-level dependency on these Microsoft.CodeAnalysis.* packages due to conflicts when installing Microsoft.EntityFrameworkCore.Design -->
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" />
   </ItemGroup>
 
   <ItemGroup>

src/Umbraco.PublishedCache.NuCache/Property.cs

@@ -114,7 +114,7 @@ internal class Property : PublishedPropertyBase
     // determines whether a property has value
     public override bool HasValue(string? culture = null, string? segment = null)
     {
-        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, ref culture, ref segment);
+        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, PropertyType.Alias, ref culture, ref segment);
 
         var value = GetSourceValue(culture, segment);
         var hasValue = PropertyType.IsValue(value, PropertyValueLevel.Source);
@@ -148,7 +148,7 @@ internal class Property : PublishedPropertyBase
 
     public override object? GetSourceValue(string? culture = null, string? segment = null)
     {
-        _content.VariationContextAccessor.ContextualizeVariation(_sourceVariations, _content.Id, ref culture, ref segment);
+        _content.VariationContextAccessor.ContextualizeVariation(_sourceVariations, _content.Id, PropertyType.Alias, ref culture, ref segment);
 
         // source values are tightly bound to the property/schema culture and segment configurations, so we need to
         // sanitize the contextualized culture/segment states before using them to access the source values.
@@ -240,7 +240,7 @@ internal class Property : PublishedPropertyBase
 
         EnsureSourceValuesInitialized();
 
-        var k = new CompositeStringStringKey(culture, segment);
+        var k = new CompositeStringStringKey(culture ?? string.Empty, segment ?? string.Empty); // Null values are not valid when creating a CompositeStringStringKey.
 
         SourceInterValue vvalue = _sourceValues!.GetOrAdd(k, _ =>
             new SourceInterValue
@@ -262,7 +262,7 @@ internal class Property : PublishedPropertyBase
 
     public override object? GetValue(string? culture = null, string? segment = null)
     {
-        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, ref culture, ref segment);
+        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, PropertyType.Alias, ref culture, ref segment);
 
         object? value;
         CacheValue cacheValues = GetCacheValues(PropertyType.CacheLevel).For(culture, segment);
@@ -285,7 +285,7 @@ internal class Property : PublishedPropertyBase
     [Obsolete("The current implementation of XPath is suboptimal and will be removed entirely in a future version. Scheduled for removal in v14")]
     public override object? GetXPathValue(string? culture = null, string? segment = null)
     {
-        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, ref culture, ref segment);
+        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, PropertyType.Alias, ref culture, ref segment);
 
         CacheValue cacheValues = GetCacheValues(PropertyType.CacheLevel).For(culture, segment);
 
@@ -304,7 +304,7 @@ internal class Property : PublishedPropertyBase
 
     public override object? GetDeliveryApiValue(bool expanding, string? culture = null, string? segment = null)
     {
-        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, ref culture, ref segment);
+        _content.VariationContextAccessor.ContextualizeVariation(_variations, _content.Id, PropertyType.Alias, ref culture, ref segment);
 
         object? value;
         CacheValue cacheValues = GetCacheValues(expanding ? PropertyType.DeliveryApiCacheLevelForExpansion : PropertyType.DeliveryApiCacheLevel).For(culture, segment);

src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs

@@ -131,12 +131,17 @@ public class AuthenticationController : UmbracoApiControllerBase
         AuthorizationPolicies.BackOfficeAccess)] // Needed to enforce the principle set on the request, if one exists.
     public IDictionary<string, object> GetPasswordConfig(int userId)
     {
+        if (HttpContext.HasActivePasswordResetFlowSession(userId))
+        {
+            return _passwordConfiguration.GetConfiguration();
+        }
+
         Attempt<int> currentUserId =
             _backofficeSecurityAccessor.BackOfficeSecurity?.GetUserId() ?? Attempt<int>.Fail();
-        return _passwordConfiguration.GetConfiguration(
-            currentUserId.Success
-                ? currentUserId.Result != userId
-                : true);
+
+        return currentUserId.Success
+            ? _passwordConfiguration.GetConfiguration(currentUserId.Result != userId)
+            : new Dictionary<string, object>();
     }
 
     /// <summary>
@@ -417,6 +422,8 @@ public class AuthenticationController : UmbracoApiControllerBase
     [Authorize(Policy = AuthorizationPolicies.DenyLocalLoginIfConfigured)]
     public async Task<ActionResult<UserDetail?>> PostLogin(LoginModel loginModel)
     {
+        HttpContext.EndPasswordResetFlowSession();
+
         // Start a timed scope to ensure failed responses return is a consistent time
         var loginDuration = Math.Max(_loginDurationAverage ?? _securitySettings.UserDefaultFailedLoginDurationInMilliseconds, _securitySettings.UserMinimumFailedLoginDurationInMilliseconds);
         await using var timedScope = new TimedScope(loginDuration, HttpContext.RequestAborted);
@@ -490,6 +497,8 @@ public class AuthenticationController : UmbracoApiControllerBase
             return BadRequest();
         }
 
+        HttpContext.EndPasswordResetFlowSession();
+
         BackOfficeIdentityUser? identityUser = await _userManager.FindByEmailAsync(model.Email);
 
         await Task.Delay(RandomNumberGenerator.GetInt32(400, 2500)); // To randomize response time preventing user enumeration
@@ -646,6 +655,8 @@ public class AuthenticationController : UmbracoApiControllerBase
     [AllowAnonymous]
     public async Task<IActionResult> PostSetPassword(SetPasswordModel model)
     {
+        HttpContext.EndPasswordResetFlowSession();
+
         BackOfficeIdentityUser? identityUser =
             await _userManager.FindByIdAsync(model.UserId.ToString(CultureInfo.InvariantCulture));
             if (identityUser is null)

src/Umbraco.Web.BackOffice/Controllers/BackOfficeController.cs

@@ -402,6 +402,11 @@ public class BackOfficeController : UmbracoController
 
         var result = await _userManager.VerifyUserTokenAsync(user, "Default", "ResetPassword", resetCode);
 
+        if (result)
+        {
+            HttpContext.StartPasswordResetFlowSession(userId);
+        }
+
         return result ?
 
             // Redirect to login with userId and resetCode

src/Umbraco.Web.BackOffice/Controllers/ContentController.cs

@@ -44,6 +44,7 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers;
 [PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]
 [ParameterSwapControllerActionSelector(nameof(GetById), "id", typeof(int), typeof(Guid), typeof(Udi))]
+[ParameterSwapControllerActionSelector(nameof(GetByIds), "ids", typeof(int[]), typeof(Guid[]), typeof(Udi[]))]
 [ParameterSwapControllerActionSelector(nameof(GetNiceUrl), "id", typeof(int), typeof(Guid), typeof(Udi))]
 public class ContentController : ContentControllerBase
 {
@@ -247,6 +248,30 @@ public class ContentController : ContentControllerBase
         return foundContent.Select(MapToDisplay).WhereNotNull();
     }
 
+    /// <summary>
+    ///     Return content for the specified ids
+    /// </summary>
+    /// <param name="ids"></param>
+    /// <returns></returns>
+    [FilterAllowedOutgoingContent(typeof(IEnumerable<ContentItemDisplay>))]
+    public IEnumerable<ContentItemDisplay> GetByIds([FromQuery] Guid[] ids)
+    {
+        IEnumerable<IContent> foundContent = _contentService.GetByIds(ids);
+        return foundContent.Select(MapToDisplay).WhereNotNull();
+    }
+
+    /// <summary>
+    ///     Return content for the specified ids
+    /// </summary>
+    /// <param name="ids"></param>
+    /// <returns></returns>
+    [FilterAllowedOutgoingContent(typeof(IEnumerable<ContentItemDisplay>))]
+    public IEnumerable<ContentItemDisplay> GetByIds([FromQuery] Udi[] ids)
+    {
+        IEnumerable<IContent> foundContent = _contentService.GetByIds(ids)!;
+        return foundContent.Select(MapToDisplay).WhereNotNull();
+    }
+
     /// <summary>
     ///     Updates the permissions for a content item for a particular user group
     /// </summary>

src/Umbraco.Web.BackOffice/Controllers/ContentTypeController.cs

@@ -674,8 +674,21 @@ public class ContentTypeController : ContentTypeControllerBase<IContentType>
     [Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentTypes)]
     public IActionResult Import(string file)
     {
+        if (string.IsNullOrWhiteSpace(file))
+        {
+            return NotFound();
+        }
+
+        // The incoming 'file' parameter we expect to contain the just a file name and extension.
+        // We accept only this and no input parameters containing paths, to prevent any path based security exploits.
+        var invalidFileNameChars = Path.GetInvalidFileNameChars();
+        if (file.IndexOfAny(invalidFileNameChars) >= 0 || file.Contains(Path.DirectorySeparatorChar) || file.Contains(Path.AltDirectorySeparatorChar))
+        {
+            return NotFound();
+        }
+
         var filePath = Path.Combine(_hostingEnvironment.MapPathContentRoot(Constants.SystemDirectories.TempFileUploads), file);
-        if (string.IsNullOrEmpty(file) || !System.IO.File.Exists(filePath))
+        if (System.IO.File.Exists(filePath) is false)
         {
             return NotFound();
         }

src/Umbraco.Web.BackOffice/Controllers/DictionaryController.cs

@@ -1,27 +1,27 @@
-using System.Xml;
 using System.Globalization;
 using System.Net.Mime;
 using System.Text;
+using System.Xml;
+using System.Xml.Linq;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.ContentEditing;
-using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Infrastructure.Packaging;
 using Umbraco.Cms.Web.Common.Attributes;
 using Umbraco.Cms.Web.Common.Authorization;
 using Umbraco.Extensions;
-using Umbraco.Cms.Infrastructure.Packaging;
-using System.Xml.Linq;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
 
 namespace Umbraco.Cms.Web.BackOffice.Controllers;
 
@@ -460,7 +460,17 @@ public class DictionaryController : BackOfficeNotificationsController
             return NotFound();
         }
 
-        var filePath = Path.Combine(_hostingEnvironment.MapPathContentRoot(Constants.SystemDirectories.Data), file);
+        // The incoming 'file' parameter we expect to contain the full path to the uploaded file.
+        // We accept only files coming from the uploads folder to prevent any path based security exploits.
+        var fileName = Path.GetFileName(file);
+        var invalidFileNameChars = Path.GetInvalidFileNameChars();
+        if (fileName.IndexOfAny(invalidFileNameChars) >= 0 || fileName.Contains(Path.DirectorySeparatorChar) || fileName.Contains(Path.AltDirectorySeparatorChar))
+        {
+            return NotFound();
+        }
+
+        var root = _hostingEnvironment.MapPathContentRoot(Constants.SystemDirectories.TempFileUploads);
+        var filePath = Path.Combine(root, fileName);
         if (!System.IO.File.Exists(filePath))
         {
             return NotFound();

src/Umbraco.Web.BackOffice/Controllers/EntityController.cs

@@ -847,6 +847,21 @@ public class EntityController : UmbracoAuthorizedJsonController
             return NotFound();
         }
 
+        EntityBasic? MapEntityBasic(IEntitySlim source, string? culture)
+        {
+            EntityBasic? target = _umbracoMapper.Map<IEntitySlim, EntityBasic>(source, context =>
+            {
+                context.SetCulture(culture);
+            });
+
+            if (target is not null)
+            {
+                target.AdditionalData["hasChildren"] = source.HasChildren;
+            }
+
+            return target;
+        }
+
         UmbracoObjectTypes? objectType = ConvertToObjectType(type);
         if (objectType.HasValue)
         {
@@ -857,12 +872,25 @@ public class EntityController : UmbracoAuthorizedJsonController
 
             var ignoreUserStartNodes = IsDataTypeIgnoringUserStartNodes(dataTypeKey);
 
+            var culture = ClientCulture();
+
             // root is special: we reduce it to start nodes if the user's start node is not the default, then we need to return their start nodes
             if (id == Constants.System.Root && startNodeIds.Length > 0 &&
-                startNodeIds.Contains(Constants.System.Root) == false && !ignoreUserStartNodes)
+                startNodeIds.Contains(Constants.System.Root) == false &&
+                ignoreUserStartNodes == false)
             {
-                return new PagedResult<EntityBasic>(0, 0, 0);
+                var startNodeEntities = _entityService.GetAll(objectType.Value, startNodeIds).ToList();
+                IEnumerable<IEntitySlim> pagedStartNodeEntities = startNodeEntities
+                    .Skip((pageNumber - 1) * pageSize)
+                    .Take(pageSize);
+                return new PagedResult<EntityBasic>(startNodeEntities.Count, pageNumber, pageSize)
+                {
+                    Items = pagedStartNodeEntities
+                        .Select(source => MapEntityBasic(source, culture))
+                        .WhereNotNull(),
+                };
             }
+
             //adding multiple conditions ,considering id,key & name as filter param
             //for id as int
             int.TryParse(filter, out int filterAsIntId);
@@ -882,13 +910,11 @@ public class EntityController : UmbracoAuthorizedJsonController
                       || x.Key == filterAsGuid),
                 Ordering.By(orderBy, orderDirection));
 
-
             if (totalRecords == 0)
             {
                 return new PagedResult<EntityBasic>(0, 0, 0);
             }
 
-            var culture = ClientCulture();
             var pagedResult = new PagedResult<EntityBasic>(totalRecords, pageNumber, pageSize)
             {
                 Items = entities
@@ -898,22 +924,8 @@ public class EntityController : UmbracoAuthorizedJsonController
                                      (objectType == UmbracoObjectTypes.Document || objectType == UmbracoObjectTypes.Media) is false ||
                                      (ContentPermissions.IsInBranchOfStartNode(entity.Path, startNodeIds, startNodePaths, out var hasPathAccess) &&
                                      hasPathAccess))
-                    .Select(source =>
-                    {
-                        EntityBasic? target = _umbracoMapper.Map<IEntitySlim, EntityBasic>(source, context =>
-                        {
-                            context.SetCulture(culture);
-                            context.SetCulture(culture);
-                        });
-
-                        if (target is not null)
-                        {
-                            //TODO: Why is this here and not in the mapping?
-                            target.AdditionalData["hasChildren"] = source.HasChildren;
-                        }
-
-                        return target;
-                    }).WhereNotNull()
+                    .Select(source => MapEntityBasic(source, culture))
+                    .WhereNotNull(),
             };
 
             return pagedResult;
@@ -1126,7 +1138,7 @@ public class EntityController : UmbracoAuthorizedJsonController
                 .Select(s => int.Parse(s, CultureInfo.InvariantCulture)).Distinct().ToArray();
 
             var ignoreUserStartNodes =
-                IsDataTypeIgnoringUserStartNodes(queryStrings?.GetValue<Guid?>("dataTypeId"));
+                IsDataTypeIgnoringUserStartNodes(queryStrings?.GetValue<Guid?>("dataTypeKey"));
             if (ignoreUserStartNodes == false)
             {
                 int[]? aids = null;

src/Umbraco.Web.BackOffice/Controllers/HelpController.cs

@@ -6,7 +6,6 @@ using Microsoft.Extensions.Options;
 using Newtonsoft.Json;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Web.Common.Attributes;
 
 namespace Umbraco.Cms.Web.BackOffice.Controllers;
@@ -16,7 +15,8 @@ public class HelpController : UmbracoAuthorizedJsonController
 {
     private static HttpClient? _httpClient;
     private readonly ILogger<HelpController> _logger;
-    private HelpPageSettings? _helpPageSettings;
+
+    private readonly HelpPageSettings? _helpPageSettings;
 
     [ActivatorUtilitiesConstructor]
     public HelpController(
@@ -25,12 +25,9 @@ public class HelpController : UmbracoAuthorizedJsonController
     {
         _logger = logger;
 
-        ResetHelpPageSettings(helpPageSettings.CurrentValue);
-        helpPageSettings.OnChange(ResetHelpPageSettings);
+        _helpPageSettings = helpPageSettings.CurrentValue;
     }
 
-    private void ResetHelpPageSettings(HelpPageSettings settings) => _helpPageSettings = settings;
-
     public async Task<List<HelpPage>> GetContextHelpForPage(string section, string tree,
         string baseUrl = "https://our.umbraco.com")
     {

src/Umbraco.Web.BackOffice/Controllers/ImagesController.cs

@@ -23,7 +23,7 @@ public class ImagesController : UmbracoAuthorizedApiController
 {
     private readonly MediaFileManager _mediaFileManager;
     private readonly IImageUrlGenerator _imageUrlGenerator;
-    private ContentSettings _contentSettings;
+    private readonly ContentSettings _contentSettings;
 
     [Obsolete("Use non obsolete-constructor. Scheduled for removal in Umbraco 13.")]
     public ImagesController(
@@ -45,8 +45,6 @@ public class ImagesController : UmbracoAuthorizedApiController
         _mediaFileManager = mediaFileManager;
         _imageUrlGenerator = imageUrlGenerator;
         _contentSettings = contentSettingsMonitor.CurrentValue;
-
-        contentSettingsMonitor.OnChange(x => _contentSettings = x);
     }
 
     /// <summary>

src/Umbraco.Web.BackOffice/Controllers/MediaController.cs

@@ -47,6 +47,7 @@ namespace Umbraco.Cms.Web.BackOffice.Controllers;
 [PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
 [Authorize(Policy = AuthorizationPolicies.SectionAccessMedia)]
 [ParameterSwapControllerActionSelector(nameof(GetById), "id", typeof(int), typeof(Guid), typeof(Udi))]
+[ParameterSwapControllerActionSelector(nameof(GetByIds), "ids", typeof(int[]), typeof(Guid[]), typeof(Udi[]))]
 [ParameterSwapControllerActionSelector(nameof(GetChildren), "id", typeof(int), typeof(Guid), typeof(Udi))]
 public class MediaController : ContentControllerBase
 {
@@ -296,6 +297,30 @@ public class MediaController : ContentControllerBase
         return foundMedia.Select(media => _umbracoMapper.Map<MediaItemDisplay>(media));
     }
 
+    /// <summary>
+    ///     Return media for the specified ids
+    /// </summary>
+    /// <param name="ids"></param>
+    /// <returns></returns>
+    [FilterAllowedOutgoingMedia(typeof(IEnumerable<MediaItemDisplay>))]
+    public IEnumerable<MediaItemDisplay?> GetByIds([FromQuery] Guid[] ids)
+    {
+        IEnumerable<IMedia> foundMedia = _mediaService.GetByIds(ids);
+        return foundMedia.Select(media => _umbracoMapper.Map<MediaItemDisplay>(media));
+    }
+
+    /// <summary>
+    ///     Return media for the specified ids
+    /// </summary>
+    /// <param name="ids"></param>
+    /// <returns></returns>
+    [FilterAllowedOutgoingMedia(typeof(IEnumerable<MediaItemDisplay>))]
+    public IEnumerable<MediaItemDisplay?> GetByIds([FromQuery] Udi[] ids)
+    {
+        IEnumerable<IMedia> foundMedia = _mediaService.GetByIds(ids);
+        return foundMedia.Select(media => _umbracoMapper.Map<MediaItemDisplay>(media));
+    }
+
     /// <summary>
     ///     Returns a paged result of media items known to be of a "Folder" type
     /// </summary>

src/Umbraco.Web.BackOffice/Controllers/PreviewController.cs

@@ -178,26 +178,31 @@ public partial class PreviewController : Controller
         return RedirectPermanent($"../../{id}{query}");
     }
 
-    private static bool ValidateProvidedCulture(string culture)
+    /// <summary>
+    /// Validates the provided culture code.
+    /// </summary>
+    /// <remarks>
+    /// Marked as internal to expose for unit tests.
+    /// </remarks>
+    internal static bool ValidateProvidedCulture(string culture)
     {
         if (string.IsNullOrEmpty(culture))
         {
             return true;
         }
 
-        // We can be confident the backoffice will have provided a valid culture in linking to the
-        // preview, so we don't need to check that the culture matches an Umbraco language.
-        // We are only concerned here with protecting against XSS attacks from a fiddled preview
-        // URL, so we can just confirm we have a valid culture.
-        try
-        {
-            CultureInfo.GetCultureInfo(culture, true);
-            return true;
-        }
-        catch (CultureNotFoundException)
+        // Culture codes are expected to match this pattern.
+        if (CultureCodeRegex().IsMatch(culture) is false)
         {
             return false;
         }
+
+        // We can be confident the backoffice will have provided a valid culture in linking to the
+        // preview, so we don't need to check that the culture matches an Umbraco language (or is even a
+        // valid culture code).
+        // We are only concerned here with protecting against XSS attacks from a fiddled preview
+        // URL, so we can proceed if the the regex is matched.
+        return true;
     }
 
     public ActionResult? EnterPreview(int id)
@@ -261,4 +266,7 @@ public partial class PreviewController : Controller
 
     [GeneratedRegex("^\\/(?<id>\\d*)(\\?culture=(?<culture>[\\w-]*))?$")]
     private static partial Regex DefaultPreviewRedirectRegex();
+
+    [GeneratedRegex(@"^[a-z]{2,3}[-0-9a-z]*$", RegexOptions.IgnoreCase)]
+    private static partial Regex CultureCodeRegex();
 }

src/Umbraco.Web.BackOffice/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -1,6 +1,7 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Core.IO;
@@ -21,6 +22,8 @@ using Umbraco.Cms.Web.BackOffice.Security;
 using Umbraco.Cms.Web.BackOffice.Services;
 using Umbraco.Cms.Web.BackOffice.SignalR;
 using Umbraco.Cms.Web.BackOffice.Trees;
+using Umbraco.Cms.Web.Common.Accessors;
+using Umbraco.Cms.Web.Common.Rendering;
 
 namespace Umbraco.Extensions;
 
@@ -121,6 +124,9 @@ public static partial class UmbracoBuilderExtensions
         builder.Services.AddSingleton<UnhandledExceptionLoggerMiddleware>();
         builder.Services.AddTransient<BlockGridSampleHelper>();
         builder.Services.AddUnique<IWebhookPresentationFactory, WebhookPresentationFactory>();
+        // deliveryApi will overwrite these more basic ones.
+        builder.Services.AddScoped<IOutputExpansionStrategy, ElementOnlyOutputExpansionStrategy>();
+        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
 
         return builder;
     }

src/Umbraco.Web.BackOffice/Extensions/HttpContextExtensions.cs

@@ -5,9 +5,20 @@ namespace Umbraco.Extensions;
 
 public static class HttpContextExtensions
 {
+    private const string PasswordResetFlowSessionKey = nameof(PasswordResetFlowSessionKey);
+
     public static void SetExternalLoginProviderErrors(this HttpContext httpContext, BackOfficeExternalLoginProviderErrors errors)
         => httpContext.Items[nameof(BackOfficeExternalLoginProviderErrors)] = errors;
 
     public static BackOfficeExternalLoginProviderErrors? GetExternalLoginProviderErrors(this HttpContext httpContext)
         => httpContext.Items[nameof(BackOfficeExternalLoginProviderErrors)] as BackOfficeExternalLoginProviderErrors;
+
+    internal static void StartPasswordResetFlowSession(this HttpContext httpContext, int userId)
+        => httpContext.Session.SetInt32(PasswordResetFlowSessionKey, userId);
+
+    internal static void EndPasswordResetFlowSession(this HttpContext httpContext)
+        => httpContext.Session.Remove(PasswordResetFlowSessionKey);
+
+    internal static bool HasActivePasswordResetFlowSession(this HttpContext httpContext, int userId)
+        => httpContext.Session.GetInt32(PasswordResetFlowSessionKey) == userId;
 }

src/Umbraco.Web.BackOffice/Trees/ContentTreeController.cs

@@ -100,7 +100,13 @@ public class ContentTreeController : ContentTreeControllerBase, ISearchableTreeW
 
     public async Task<EntitySearchResults> SearchAsync(string query, int pageSize, long pageIndex, string? searchFrom = null)
     {
-        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(query, UmbracoEntityTypes.Document, pageSize, pageIndex, out var totalFound, searchFrom);
+        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(
+            query,
+            UmbracoEntityTypes.Document,
+            pageSize,
+            pageIndex,
+            out var totalFound,
+            searchFrom: searchFrom);
         return new EntitySearchResults(results, totalFound);
     }
 
@@ -399,7 +405,14 @@ public class ContentTreeController : ContentTreeControllerBase, ISearchableTreeW
 
     public async Task<EntitySearchResults> SearchAsync(string query, int pageSize, long pageIndex, string? searchFrom = null, string? culture = null)
     {
-        var results = _treeSearcher.ExamineSearch(query, UmbracoEntityTypes.Document, pageSize, pageIndex, out long totalFound, culture: culture, searchFrom: searchFrom);
+        var results = _treeSearcher.ExamineSearch(
+            query,
+            UmbracoEntityTypes.Document,
+            pageSize,
+            pageIndex,
+            out long totalFound,
+            culture: culture,
+            searchFrom: searchFrom);
         return new EntitySearchResults(results, totalFound);
     }
 }

src/Umbraco.Web.BackOffice/Trees/MediaTreeController.cs

@@ -76,8 +76,13 @@ public class MediaTreeController : ContentTreeControllerBase, ISearchableTree, I
     public async Task<EntitySearchResults> SearchAsync(string query, int pageSize, long pageIndex,
         string? searchFrom = null)
     {
-        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(query, UmbracoEntityTypes.Media, pageSize,
-            pageIndex, out var totalFound, searchFrom);
+        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(
+            query,
+            UmbracoEntityTypes.Media,
+            pageSize,
+            pageIndex,
+            out var totalFound,
+            searchFrom: searchFrom);
         return new EntitySearchResults(results, totalFound);
     }
 

src/Umbraco.Web.BackOffice/Trees/MemberTreeController.cs

@@ -51,7 +51,13 @@ public class MemberTreeController : TreeController, ISearchableTree, ITreeNodeCo
 
     public async Task<EntitySearchResults> SearchAsync(string query, int pageSize, long pageIndex, string? searchFrom = null)
     {
-        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(query, UmbracoEntityTypes.Member, pageSize, pageIndex, out var totalFound, searchFrom);
+        IEnumerable<SearchResultEntity> results = _treeSearcher.ExamineSearch(
+            query,
+            UmbracoEntityTypes.Member,
+            pageSize,
+            pageIndex,
+            out var totalFound,
+            searchFrom: searchFrom);
         return new EntitySearchResults(results, totalFound);
     }
 

src/Umbraco.Web.Common/Accessors/RequestContextOutputExpansionStrategyAccessor.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Web.Common.Accessors;
+
+public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
+{
+    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}

src/Umbraco.Web.Common/Accessors/RequestContextServiceAccessorBase.cs

@@ -0,0 +1,20 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Umbraco.Cms.Web.Common.Accessors;
+
+public abstract class RequestContextServiceAccessorBase<T>
+    where T : class
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
+    {
+        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
+        return requestStartNodeService is not null;
+    }
+}

src/Umbraco.Web.Common/Extensions/FriendlyPublishedContentExtensions.cs

@@ -211,7 +211,7 @@ public static class FriendlyPublishedContentExtensions
     /// </param>
     /// <returns></returns>
     /// <remarks>
-    ///     This can be useful in order to return all nodes in an entire site by a type when combined with TypedContentAtRoot
+    ///     This can be useful in order to return all nodes in an entire site by a type when combined with ContentAtRoot
     /// </remarks>
     public static IEnumerable<IPublishedContent> DescendantsOrSelfOfType(
         this IEnumerable<IPublishedContent> parentNodes, string docTypeAlias, string? culture = null)
@@ -227,7 +227,7 @@ public static class FriendlyPublishedContentExtensions
     /// </param>
     /// <returns></returns>
     /// <remarks>
-    ///     This can be useful in order to return all nodes in an entire site by a type when combined with TypedContentAtRoot
+    ///     This can be useful in order to return all nodes in an entire site by a type when combined with ContentAtRoot
     /// </remarks>
     public static IEnumerable<T> DescendantsOrSelf<T>(
         this IEnumerable<IPublishedContent> parentNodes,

src/Umbraco.Web.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs

@@ -0,0 +1,148 @@
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Web.Common.Rendering;
+
+public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
+{
+    protected const string All = "$all";
+    protected const string None = "";
+    protected const string ExpandParameterName = "expand";
+    protected const string FieldsParameterName = "fields";
+
+    private readonly IApiPropertyRenderer _propertyRenderer;
+
+    protected Stack<Node?> ExpandProperties { get; } = new();
+
+    protected Stack<Node?> IncludeProperties { get; } = new();
+
+    public ElementOnlyOutputExpansionStrategy(
+        IApiPropertyRenderer propertyRenderer)
+    {
+        _propertyRenderer = propertyRenderer;
+    }
+
+    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
+        => content.ItemType == PublishedItemType.Content
+            ? MapProperties(content.Properties)
+            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
+
+    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
+    {
+        if (media.ItemType != PublishedItemType.Media)
+        {
+            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
+        }
+
+        IPublishedProperty[] properties = media
+            .Properties
+            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
+            .ToArray();
+
+        return properties.Any()
+            ? MapProperties(properties)
+            : new Dictionary<string, object?>();
+    }
+
+    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
+        => MapProperties(element.Properties, true);
+
+    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
+    {
+        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
+        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
+        var result = new Dictionary<string, object?>();
+        foreach (IPublishedProperty property in properties)
+        {
+            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
+            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
+            {
+                continue;
+            }
+
+            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
+
+            IncludeProperties.Push(nextIncludeProperties);
+            ExpandProperties.Push(nextExpandProperties);
+
+            result[property.Alias] = GetPropertyValue(property);
+
+            ExpandProperties.Pop();
+            IncludeProperties.Pop();
+        }
+
+        return result;
+    }
+
+    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
+        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
+           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
+
+    private object? GetPropertyValue(IPublishedProperty property)
+        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
+
+    protected sealed class Node
+    {
+        public string Key { get; private set; } = string.Empty;
+
+        public List<Node> Items { get; } = new();
+
+        public static Node Parse(string value)
+        {
+            // verify that there are as many start brackets as there are end brackets
+            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
+            {
+                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
+            }
+
+            // verify that the value does not start with a start bracket
+            if (value.StartsWith("["))
+            {
+                throw new ArgumentException("Value cannot start with a bracket");
+            }
+
+            // verify that there are no empty brackets
+            if (value.Contains("[]"))
+            {
+                throw new ArgumentException("Value cannot contain empty brackets");
+            }
+
+            var stack = new Stack<Node>();
+            var root = new Node { Key = "root" };
+            stack.Push(root);
+
+            var currentNode = new Node();
+            root.Items.Add(currentNode);
+
+            foreach (char c in value)
+            {
+                switch (c)
+                {
+                    case '[': // Start a new node, child of the current node
+                        stack.Push(currentNode);
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ',': // Start a new node, but at the same level of the current node
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ']': // Back to parent of the current node
+                        currentNode = stack.Pop();
+                        break;
+                    default: // Add char to current node key
+                        currentNode.Key += c;
+                        break;
+                }
+            }
+
+            return root;
+        }
+    }
+}

src/Umbraco.Web.Common/Security/ConfigureFormOptions.cs

@@ -14,6 +14,6 @@ public class ConfigureFormOptions : IConfigureOptions<FormOptions>
 
         // convert from KB to bytes
         options.MultipartBodyLengthLimit = _runtimeSettings.Value.MaxRequestLength.HasValue
-            ? _runtimeSettings.Value.MaxRequestLength.Value * 1024
+            ? (long)_runtimeSettings.Value.MaxRequestLength.Value * 1024
             : long.MaxValue;
 }

src/Umbraco.Web.Common/Security/ConfigureKestrelServerOptions.cs

@@ -15,6 +15,6 @@ public class ConfigureKestrelServerOptions : IConfigureOptions<KestrelServerOpti
 
         // convert from KB to bytes, 52428800 bytes (50 MB) is the same as in the IIS settings
         options.Limits.MaxRequestBodySize = _runtimeSettings.Value.MaxRequestLength.HasValue
-            ? _runtimeSettings.Value.MaxRequestLength.Value * 1024
+            ? (long)_runtimeSettings.Value.MaxRequestLength.Value * 1024
             : 52428800;
 }

src/Umbraco.Web.Common/UmbracoHelper.cs

@@ -349,6 +349,8 @@ public class UmbracoHelper
 
     public IEnumerable<IPublishedContent> ContentAtRoot() => _publishedContentQuery.ContentAtRoot();
 
+    public IEnumerable<IPublishedContent> ContentAtRoot(string? culture) => _publishedContentQuery.ContentAtRoot(culture);
+
     #endregion
 
     #region Media

src/Umbraco.Web.UI.Client/package-lock.json

@@ -24,9 +24,9 @@
         "angular-sanitize": "1.8.3",
         "angular-touch": "1.8.3",
         "angular-ui-sortable": "0.19.0",
-        "animejs": "3.2.1",
+        "animejs": "3.2.2",
         "bootstrap-social": "5.1.1",
-        "chart.js": "^2.9.3",
+        "chart.js": "^2.9.4",
         "clipboard": "2.0.11",
         "diff": "5.1.0",
         "flatpickr": "4.6.13",
@@ -37,12 +37,12 @@
         "lazyload-js": "1.0.0",
         "moment": "2.29.4",
         "ng-file-upload": "12.2.13",
-        "nouislider": "15.7.1",
+        "nouislider": "15.7.2",
         "spectrum-colorpicker2": "2.0.10",
-        "tinymce": "6.8.2",
+        "tinymce": "6.8.6",
         "typeahead.js": "0.11.1",
-        "underscore": "1.13.6",
-        "wicg-inert": "3.1.2"
+        "underscore": "1.13.7",
+        "wicg-inert": "3.1.3"
       },
       "devDependencies": {
         "@babel/core": "7.21.8",
@@ -3360,9 +3360,10 @@
       }
     },
     "node_modules/animejs": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/animejs/-/animejs-3.2.1.tgz",
-      "integrity": "sha512-sWno3ugFryK5nhiDm/2BKeFCpZv7vzerWUcUPyAZLDhMek3+S/p418ldZJbJXo5ZUOpfm2kP2XRO4NJcULMy9A=="
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/animejs/-/animejs-3.2.2.tgz",
+      "integrity": "sha512-Ao95qWLpDPXXM+WrmwcKbl6uNlC5tjnowlaRYtuVDHHoygjtIPfDUoK9NthrlZsQSKjZXlmji2TrBUAVbiH0LQ==",
+      "license": "MIT"
     },
     "node_modules/ansi-colors": {
       "version": "1.1.0",
@@ -12971,9 +12972,10 @@
       }
     },
     "node_modules/nouislider": {
-      "version": "15.7.1",
-      "resolved": "https://registry.npmjs.org/nouislider/-/nouislider-15.7.1.tgz",
-      "integrity": "sha512-5N7C1ru/i8y3dg9+Z6ilj6+m1EfabvOoaRa7ztpxBSKKRZso4vA52DGSbBJjw5XLtFr/LZ9SgGAXqyVtlVHO5w=="
+      "version": "15.7.2",
+      "resolved": "https://registry.npmjs.org/nouislider/-/nouislider-15.7.2.tgz",
+      "integrity": "sha512-Jn1xuJZk0cs7XdzFD2tKucedlvi5/eEAsyewPS70Qqba3a1vcyEey2VZFmp7JiS06QfgkD0kEFk8oMnJrLDWXQ==",
+      "license": "MIT"
     },
     "node_modules/now-and-later": {
       "version": "2.0.1",
@@ -16694,9 +16696,10 @@
       "integrity": "sha512-NB6Dk1A9xgQPMoGqC5CVXn123gWyte215ONT5Pp5a0yt4nlEoO1ZWeCwpncaekPHXO60i47ihFnZPiRPjRMq4Q=="
     },
     "node_modules/tinymce": {
-      "version": "6.8.2",
-      "resolved": "https://registry.npmjs.org/tinymce/-/tinymce-6.8.2.tgz",
-      "integrity": "sha512-Lho79o2Y1Yn+XdlTEkHTEkEmzwYWTXz7IUsvPwxJF3VTtgHUIAAuBab29kik+f2KED3rZvQavr9D7sHVMJ9x4A=="
+      "version": "6.8.6",
+      "resolved": "https://registry.npmjs.org/tinymce/-/tinymce-6.8.6.tgz",
+      "integrity": "sha512-++XYEs8lKWvZxDCjrr8Baiw7KiikraZ5JkLMg6EdnUVNKJui0IsrAADj5MsyUeFkcEryfn2jd3p09H7REvewyg==",
+      "license": "MIT"
     },
     "node_modules/to-absolute-glob": {
       "version": "2.0.2",
@@ -17026,9 +17029,10 @@
       }
     },
     "node_modules/underscore": {
-      "version": "1.13.6",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.6.tgz",
-      "integrity": "sha512-+A5Sja4HP1M08MaXya7p5LvjuM7K6q/2EaC0+iovj/wOcMsTzMvDFbasi/oSapiwOlt252IqsKqPjCl7huKS0A=="
+      "version": "1.13.7",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
+      "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==",
+      "license": "MIT"
     },
     "node_modules/undertaker": {
       "version": "1.3.0",
@@ -17738,9 +17742,10 @@
       "dev": true
     },
     "node_modules/wicg-inert": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/wicg-inert/-/wicg-inert-3.1.2.tgz",
-      "integrity": "sha512-Ba9tGNYxXwaqKEi9sJJvPMKuo063umUPsHN0JJsjrs2j8KDSzkWLMZGZ+MH1Jf1Fq4OWZ5HsESJID6nRza2ang=="
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/wicg-inert/-/wicg-inert-3.1.3.tgz",
+      "integrity": "sha512-5L0PKK7iP+0Q/jv2ccgmkz/pfXbumZtlEyWS/xnX+L+Og3f7WjL4+iEs18k4IuldOX3PgGpza3qGndL9xUBjCQ==",
+      "license": "W3C-20150513"
     },
     "node_modules/word-wrap": {
       "version": "1.2.4",

src/Umbraco.Web.UI.Client/package.json

@@ -14,7 +14,7 @@
     "lint": "eslint src"
   },
   "engines": {
-    "node": ">=20.9",
+    "node": ">=20.19.4",
     "npm": ">=10.1"
   },
   "dependencies": {
@@ -36,9 +36,9 @@
     "angular-sanitize": "1.8.3",
     "angular-touch": "1.8.3",
     "angular-ui-sortable": "0.19.0",
-    "animejs": "3.2.1",
+    "animejs": "3.2.2",
     "bootstrap-social": "5.1.1",
-    "chart.js": "^2.9.3",
+    "chart.js": "^2.9.4",
     "clipboard": "2.0.11",
     "diff": "5.1.0",
     "flatpickr": "4.6.13",
@@ -49,12 +49,12 @@
     "lazyload-js": "1.0.0",
     "moment": "2.29.4",
     "ng-file-upload": "12.2.13",
-    "nouislider": "15.7.1",
+    "nouislider": "15.7.2",
     "spectrum-colorpicker2": "2.0.10",
-    "tinymce": "6.8.2",
+    "tinymce": "6.8.6",
     "typeahead.js": "0.11.1",
-    "underscore": "1.13.6",
-    "wicg-inert": "3.1.2"
+    "underscore": "1.13.7",
+    "wicg-inert": "3.1.3"
   },
   "devDependencies": {
     "@babel/core": "7.21.8",

src/Umbraco.Web.UI.Client/src/common/directives/components/content/umbvariantcontent.directive.js

@@ -109,7 +109,7 @@
 
         function onAppChanged(activeApp) {
             // set the name field to readonly if the user don't have update permissions or the active content app is not "Content" or "Info"
-            const allowUpdate = vm.editor.content.allowedActions.includes('A');
+            const allowUpdate = vm.content.allowedActions.includes('A');
             const isContentBasedApp = activeApp && contentAppHelper.isContentBasedApp(activeApp);
             vm.nameReadonly = !allowUpdate || !isContentBasedApp;
         }

src/Umbraco.Web.UI.Client/src/common/directives/components/grid/grid.rte.directive.js

@@ -82,6 +82,9 @@ angular.module("umbraco.directives")
                         //custom initialization for this editor within the grid
                         editor.on('init', function (e) {
 
+                            //register global variable to re-save the dragged RTE settings in the controller
+                            editor.settings = baseLineConfigObj;
+
                             // Used this init event - as opposed to property init_instance_callback
                             // to turn off the loader
                             scope.isLoading = false;

src/Umbraco.Web.UI.Client/src/common/directives/components/umbmediagrid.directive.js

@@ -351,14 +351,17 @@ Use this directive to generate a thumbnail grid of media items.
             // sort function
             scope.sortBy = function (item) {
                 if (scope.sortColumn === "updateDate") {
-                    return [-item['isFolder'],item['updateDate']];
+                    return [-item['isFolder'],parseUpdateDate(item['updateDate'])];
                 }
                 else {
                     return [-item['isFolder'],item['name']];
                 }
             };
 
-
+            function parseUpdateDate(date) {
+                var parsedDate = Date.parse(date);
+                return isNaN(parsedDate) ? date : parsedDate;
+            }
         }
 
         var directive = {

src/Umbraco.Web.UI.Client/src/common/resources/content.resource.js

@@ -852,7 +852,7 @@ function contentResource($q, $http, umbDataFormatter, umbRequestHelper) {
                             orderBy: options.orderBy,
                             orderDirection: options.orderDirection,
                             orderBySystemField: toBool(options.orderBySystemField),
-                            filter: options.filter,
+                            filter: encodeURIComponent(options.filter),
                             cultureName: options.cultureName
                         })),
                 'Failed to retrieve children for content item ' + parentId);

src/Umbraco.Web.UI.Client/src/common/resources/entity.resource.js

@@ -514,10 +514,9 @@ function entityResource($q, $http, umbRequestHelper) {
           *
           */
         getPagedChildren: function (parentId, type, options) {
-
             var defaults = {
-                pageSize: 1,
-                pageNumber: 100,
+                pageSize: 100,
+                pageNumber: 1,
                 filter: '',
                 orderDirection: "Ascending",
                 orderBy: "SortOrder",

src/Umbraco.Web.UI.Client/src/common/services/tinymce.service.js

@@ -1465,7 +1465,8 @@ function tinyMceService($rootScope, $q, imageHelper, $locale, $http, $timeout, s
 
       function syncContent() {
 
-        const content = args.editor.getContent();
+        //get the content from tinyMCE and replace Non-breaking space character to HTML Entity
+        const content = args.editor.getContent().replace('\u00A0', ' ');
 
         if (getPropertyValue() === content) {
           return;

src/Umbraco.Web.UI.Client/src/less/panel.less

@@ -444,4 +444,7 @@ input.umb-panel-header-description {
     margin: 2px 0 0 0;
     height: 22px;
     line-height: 22px;
+    overflow: hidden;
+    white-space: nowrap;
+    text-overflow: ellipsis;
 }

src/Umbraco.Web.UI.Client/src/views/common/infiniteeditors/mediapicker/mediapicker.controller.js

@@ -130,17 +130,13 @@ angular.module("umbraco")
                 }
             }
 
-
             function onInit() {
-
-
                 localizationService.localizeMany(["defaultdialogs_selectMedia", "mediaPicker_tabClipboard"])
                     .then(function (localizationResult) {
                         setTitle(localizationResult);
                         setNavigation(localizationResult);
                     });
 
-
                 userService.getCurrentUser().then(function (userData) {
                     userStartNodes = userData.startMediaIds;
 
@@ -148,10 +144,10 @@ angular.module("umbraco")
                         entityResource.getById($scope.startNodeId, "media")
                             .then(function (ent) {
                                 $scope.startNodeId = ent.id;
-                                run();
+                                return run();
                             });
                     } else {
-                        run();
+                        return run();
                     }
                 });
             }
@@ -160,10 +156,11 @@ angular.module("umbraco")
                 //default root item
                 if (!$scope.target) {
                     if ($scope.lastOpenedNode && $scope.lastOpenedNode !== -1) {
-                        entityResource.getById($scope.lastOpenedNode, "media")
-                            .then(ensureWithinStartNode, gotoStartNode);
+                        return entityResource.getById($scope.lastOpenedNode, "media")
+                          .then(ensureWithinStartNode)
+                          .catch(function () { return gotoStartNode(); });
                     } else {
-                        gotoStartNode();
+                        return gotoStartNode();
                     }
                 } else {
                     // if a target is specified, go look it up - generally this target will just contain ids not the actual full
@@ -176,11 +173,11 @@ angular.module("umbraco")
                     // ID of a UDI or legacy int ID still could be null/undefinied here
                     // As user may dragged in an image that has not been saved to media section yet
                     if (id) {
-                        entityResource.getById(id, "Media")
+                        return entityResource.getById(id, "Media")
                             .then(function (node) {
                                 $scope.target = node;
-                                // Moving directly to existing node's folder
-                                gotoFolder({ id: node.parentId }).then(function () {
+                                // Move directly to existing node's folder, then open details
+                                return gotoFolder({ id: node.parentId }).then(function () {
                                     selectMedia(node);
                                     $scope.target.url = mediaHelper.resolveFileFromEntity(node);
                                     $scope.target.thumbnail = mediaHelper.resolveFileFromEntity(node, true);
@@ -195,6 +192,7 @@ angular.module("umbraco")
                         // No ID set - then this is going to be a tmpimg that has not been uploaded
                         // User editing this will want to be changing the ALT text
                         openDetailsDialog();
+                        return;
                     }
                 }
             }
@@ -257,22 +255,29 @@ angular.module("umbraco")
                     folder = { id: -1, name: "Media", icon: "icon-folder" };
                 }
 
-                if (folder.id > 0) {
-                    entityResource.getAncestors(folder.id, "media", null, { dataTypeKey: dataTypeKey })
-                        .then(function (anc) {
-                            $scope.path = _.filter(anc,
-                                function (f) {
-                                    return f.path.indexOf($scope.startNodeId) !== -1;
-                                });
-                            folder.path = $scope.path[0].path;
-                            performGotoFolder(folder);
-                        });
-                } else {
-                    $scope.path = [];
-                    performGotoFolder(folder);
-                }
+                var setPathPromise = (folder.id > 0)
+                  ? entityResource.getAncestors(folder.id, "media", null, { dataTypeKey: dataTypeKey })
+                      .then(function (anc) {
+                          $scope.path = _.filter(anc, function (f) {
+                              return f.path.indexOf($scope.startNodeId) !== -1;
+                          });
+                          if ($scope.path.length > 0) {
+                              folder.path = $scope.path[0].path;
+                          }
+                      })
+                  : Promise.resolve().then(function () {
+                        $scope.path = [];
+                    });
 
-              return getChildren(folder.id);
+                // Chain: resolve path → set current folder → reset paging → fetch page
+                return setPathPromise.then(function () {
+                    performGotoFolder(folder);
+                    // Reset pagination to the first page on folder change
+                    vm.searchOptions.pageNumber = 1;
+                    vm.searchOptions.totalItems = 0;
+                    vm.searchOptions.totalPages = 0;
+                    return getChildren(folder.id);
+                });
             }
 
             function performGotoFolder(folder) {
@@ -365,7 +370,20 @@ angular.module("umbraco")
             }
 
             function onUploadComplete(files) {
+
+                // Refresh the current folder to get updated pagination info.
                 gotoFolder($scope.currentFolder).then(function () {
+
+                    // If there are multiple pages, navigate to the last page where new uploads appear.
+                    if (vm.searchOptions.totalPages > 1) {
+                        vm.searchOptions.pageNumber = vm.searchOptions.totalPages;
+                        return getChildren($scope.currentFolder.id);
+                    } else {
+                        return Promise.resolve();
+                    }
+                }).then(function () {
+
+                    // Select the newly uploaded items.
                     $timeout(function () {
                         if ($scope.multiPicker) {
                             var images = _.rest(_.sortBy($scope.images, 'id'), $scope.images.length - files.length);
@@ -375,6 +393,7 @@ angular.module("umbraco")
                             clickHandler(image);
                         }
                     });
+
                 });
             }
 
@@ -388,11 +407,9 @@ angular.module("umbraco")
 
                 // also make sure the node is not trashed
                 if (nodePath.indexOf($scope.startNodeId.toString()) !== -1 && node.trashed === false) {
-                    gotoFolder({ id: $scope.lastOpenedNode || $scope.startNodeId, name: "Media", icon: "icon-folder", path: node.path });
-                    return true;
+                    return gotoFolder({ id: $scope.lastOpenedNode || $scope.startNodeId, name: "Media", icon: "icon-folder", path: node.path });
                 } else {
-                    gotoFolder({ id: $scope.startNodeId, name: "Media", icon: "icon-folder" });
-                    return false;
+                    return gotoFolder({ id: $scope.startNodeId, name: "Media", icon: "icon-folder" });
                 }
             }
 
@@ -408,7 +425,7 @@ angular.module("umbraco")
             }
 
             function gotoStartNode() {
-                gotoFolder({ id: $scope.startNodeId, name: "Media", icon: "icon-folder" });
+                return gotoFolder({ id: $scope.startNodeId, name: "Media", icon: "icon-folder" });
             }
 
             function openDetailsDialog() {
@@ -484,8 +501,15 @@ angular.module("umbraco")
             function changePagination(pageNumber) {
                 vm.loading = true;
                 vm.searchOptions.pageNumber = pageNumber;
-                searchMedia();
-            };
+
+                if (vm.searchOptions.filter) {
+                    // search pagination (already present)
+                    searchMedia();
+                } else {
+                    // pagination in folder view
+                    getChildren($scope.currentFolder.id);
+                }
+            }
 
             function searchMedia() {
                 vm.loading = true;
@@ -559,22 +583,43 @@ angular.module("umbraco")
 
             function getChildren(id) {
                 vm.loading = true;
-                return entityResource.getChildren(id, "Media", vm.searchOptions).then(function (data) {
+                return entityResource
+                  .getPagedChildren(id, "Media", vm.searchOptions)
+                    .then(handlePagedChildren)
+                    .finally(function () { vm.loading = false; });
+            }
 
-                    var allowedTypes = dialogOptions.filter ? dialogOptions.filter.split(",") : null;
+            function handlePagedChildren(data) {
+                var items = transformItems(data && data.items ? data.items : [], getAllowedTypes());
+                $scope.images = items;
+                syncPagination(vm.searchOptions, data);
+                vm.searchOptions.filter = ""; // reset filter to ensure folder navigation always starts unfiltered
+                preSelectMedia();
+            }
 
-                    for (var i = 0; i < data.length; i++) {
-                        setDefaultData(data[i]);
-                        data[i].filtered = allowedTypes && allowedTypes.indexOf(data[i].metaData.ContentTypeAlias) < 0;
-                    }
+            function getAllowedTypes() {
+                return dialogOptions.filter ? dialogOptions.filter.split(",") : null;
+            }
 
-                    vm.searchOptions.filter = "";
-                    $scope.images = data ? data : [];
+            function transformItems(items, allowedTypes) {
+                for (var i = 0; i < items.length; i++) {
+                    setDefaultData(items[i]);
+                    items[i].filtered = !!(allowedTypes && allowedTypes.indexOf(items[i].metaData.ContentTypeAlias) < 0);
+                }
+                return items;
+            }
 
-                    // set already selected medias to selected
-                    preSelectMedia();
-                    vm.loading = false;
-                });
+            function syncPagination(opts, data) {
+                var d = data || {};
+                if (d.pageNumber > 0) {
+                    opts.pageNumber = d.pageNumber;
+                }
+                opts.pageNumber = d.pageNumber;
+                if (d.pageSize > 0) {
+                    opts.pageSize = d.pageSize;
+                }
+                opts.totalItems = d.totalItems;
+                opts.totalPages = d.totalPages;
             }
 
             function setDefaultData(item) {

src/Umbraco.Web.UI.Client/src/views/components/editor/umb-editor-header.html

@@ -9,7 +9,7 @@
             </button>
         </div>
 
-        <div class="flex items-center" style="flex: 1;">
+        <div class="flex items-center" style="flex: 1; width: 100%;">
 
             <ng-form data-element="editor-icon" name="iconForm">
                 <button
@@ -25,7 +25,7 @@
                 </button>
             </ng-form>
 
-            <div id="nameField" class="umb-editor-header__name-and-description" style="flex: 1 1 auto;">
+            <div id="nameField" class="umb-editor-header__name-and-description" style="flex: 1; width: calc(100% - 75px);">
                 <div>
                     <p tabindex="0" class="sr-only" ng-show="accessibility.a11yMessageVisible">
                         {{accessibility.a11yMessage}}
@@ -78,7 +78,7 @@
                        ng-if="!hideDescription && !descriptionLocked"
                        ng-model="$parent.description"/>
 
-                <p class="umb-panel-header-locked-description" id="editor-description-{{$id}}" ng-if="descriptionLocked">{{ description }}</p>
+                <p class="umb-panel-header-locked-description" id="editor-description-{{$id}}" ng-if="descriptionLocked" title="{{description}}">{{ description }}</p>
 
             </div>
 

src/Umbraco.Web.UI.Client/src/views/propertyeditors/blockgrid/blockgridui.less

@@ -527,7 +527,7 @@ ng-form.ng-invalid > .umb-block-grid__block:not(.--active) > .umb-block-grid__bl
         &[disabled]:hover {
             color: @gray-7;
             border-color: @gray-7;
-            cursor: default;
+            cursor: not-allowed;
         }
 
         &.umb-block-grid__create-button {

src/Umbraco.Web.UI.Client/src/views/propertyeditors/blockgrid/umb-block-grid-entries.html

@@ -65,12 +65,12 @@
         ng-click="vm.blockEditorApi.requestShowCreate(vm.parentBlock, vm.areaKey, vm.entries.length, $event)">
     </uui-button-inline-create>
 
-    <div class="umb-block-grid__actions" ng-if="!vm.blockEditorApi.readonly && vm.depth === '0'">
+    <div class="umb-block-grid__actions" ng-if="vm.depth === '0'">
         <button
                 id="{{vm.model.alias}}"
                 type="button"
                 class="btn-reset umb-block-grid__create-button umb-outline"
-                ng-disabled="vm.locallyAvailableBlockTypes.length === 0"
+                ng-disabled="vm.locallyAvailableBlockTypes.length === 0 || vm.blockEditorApi.readonly"
                 ng-click="vm.blockEditorApi.requestShowCreate(vm.parentBlock, vm.areaKey, vm.entries.length, $event)">
                 <span ng-if="vm.createLabel">{{vm.createLabel}}</span>
             <localize ng-if="!vm.createLabel && vm.locallyAvailableBlockTypes.length !== 1" key="blockEditor_addBlock">Add content</localize>
@@ -79,7 +79,7 @@
         <button type="button"
                 class="btn-reset umb-block-grid__clipboard-button umb-outline"
                 ng-class="{'--jump': vm.jumpClipboardButton}"
-                ng-disabled="vm.clipboardItems.length === 0"
+                ng-disabled="vm.clipboardItems.length === 0 || vm.blockEditorApi.readonly"
                 ng-click="vm.blockEditorApi.requestShowClipboard(vm.parentBlock, vm.areaKey, vm.entries.length, $event)"
                 localize="title"
                 title="@blockEditor_tabClipboard">

src/Umbraco.Web.UI.Client/src/views/propertyeditors/blockgrid/umbBlockGridPropertyEditor.component.js

@@ -83,7 +83,6 @@
         var shadowRoot;
         var firstLayoutContainer;
 
-
         var vm = this;
 
         vm.readonly = false;
@@ -96,6 +95,10 @@
             if (deleteAllBlocksAction) {
                 deleteAllBlocksAction.isDisabled = vm.readonly;
             }
+
+            if (enterSortModeAction) {
+                enterSortModeAction.isDisabled = vm.readonly;
+            }
         });
 
         vm.loading = true;
@@ -1367,8 +1370,9 @@
             if (copyAllBlocksAction) {
                 copyAllBlocksAction.isDisabled = vm.layout.length === 0;
             }
+
             if (deleteAllBlocksAction) {
-                deleteAllBlocksAction.isDisabled = vm.layout.length === 0;
+                deleteAllBlocksAction.isDisabled = vm.layout.length === 0 || vm.readonly;
             }
 
             // validate limits:

src/Umbraco.Web.UI.Client/src/views/propertyeditors/blocklist/umbblocklistblock.component.js

@@ -57,7 +57,7 @@
         var shadowRoot = $element[0].attachShadow({ mode: 'open' });
         shadowRoot.innerHTML = `
                     <style>
-                    @import "${model.stylesheet}"
+                    @import "${model.stylesheet}?umb__rnd=${Umbraco.Sys.ServerVariables.application.cacheBuster}"
                     </style>
                     <div class="umb-block-list__block--view" ng-include="'${model.view}'"></div>
                 `;

src/Umbraco.Web.UI.Client/src/views/propertyeditors/checkboxlist/checkboxlist.controller.js

@@ -31,6 +31,10 @@ angular.module("umbraco").controller("Umbraco.PropertyEditors.CheckboxListContro
                 if ($scope.model.value === null || $scope.model.value === undefined) {
                     $scope.model.value = [];
                 }
+
+                // ensure any values that are not in the config are removed from the model.value (i.e. if the config has changed since the value was saved).
+                var validValues = vm.configItems.map(item => item.value);
+                $scope.model.value = $scope.model.value.filter(val => validValues.includes(val));
                 
                 // update view model.
                 generateViewModel($scope.model.value);