Merge branch 'refs/heads/v17/dev' into v17/feature/blocks-segment-variation

# Conflicts:
#	tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/PropertyEditors/BlockListElementLevelVariationTests.Publishing.cs

.editorconfig

@@ -102,7 +102,7 @@ dotnet_style_predefined_type_for_locals_parameters_members = true:warning
 dotnet_style_predefined_type_for_member_access = true:warning
 # Modifier preferences
 # https://docs.microsoft.com/visualstudio/ide/editorconfig-language-conventions#normalize-modifiers
-dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
+dotnet_style_require_accessibility_modifiers = always:warning
 csharp_preferred_modifier_order = public,private,protected,internal,static,extern,new,virtual,abstract,sealed,override,readonly,unsafe,volatile,async:warning
 visual_basic_preferred_modifier_order = Partial,Default,Private,Protected,Public,Friend,NotOverridable,Overridable,MustOverride,Overloads,Overrides,MustInherit,NotInheritable,Static,Shared,Shadows,ReadOnly,WriteOnly,Dim,Const,WithEvents,Widening,Narrowing,Custom,Async:warning
 dotnet_style_readonly_field = true:warning

.github/BUILD.md

@@ -9,7 +9,7 @@ In order to use Umbraco as a CMS and build your website with it, you should not
 -   Are you about to [create a pull request for Umbraco][contribution guidelines]?
 -   Are you trying to get to the bottom of a problem in your existing Umbraco installation?
 
-If the answer is yes, please read on. Otherwise, make sure to head on over [to the releases page](https://releases.umbraco.com) and start using Umbraco CMS as intended.
+If the answer is yes, please read on. Otherwise, make sure to head on over [to the download page](https://our.umbraco.com/download) and start using Umbraco CMS as intended.
 
 ## Table of contents
 
@@ -37,7 +37,7 @@ In order to work with the Umbraco source code locally, first make sure you have
 
 ### Familiarizing yourself with the code
 
-Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects.  There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
 
 There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.
 
@@ -73,19 +73,13 @@ Just be careful not to include this change in your PR.
 
 Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:
 
-```json
+```
 "BackOfficeHost": "http://localhost:5173",
 "AuthorizeCallbackPathName": "/oauth_complete",
 "AuthorizeCallbackLogoutPathName": "/logout",
-"AuthorizeCallbackErrorPathName": "/error",
-"BackOfficeTokenCookie": {
-  "SameSite": "None"
-}
+"AuthorizeCallbackErrorPathName": "/error"
 ```
 
-> [!NOTE]
-> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `Umbraco:Cms:Security:BackOfficeTokenCookie:SameSite` setting is set to `None`.
-
 Then run Umbraco from the command line.
 
 ```

.github/CONTRIBUTING.md

@@ -30,7 +30,7 @@ This guide describes each step to make your first contribution:
 
    Create a new branch based on `main` and name it after the issue you're fixing. For example: `v15/bugfix/18132-rte-tinymce-onchange-value-check`.
 
-   Please follow this format for branches: `v{major}/{feature|bugfix|task|qa|improvement}/{issue}-{description}`.
+   Please follow this format for branches: `v{major}/{feature|bugfix|task}/{issue}-{description}`.
 
    This is a development branch for the particular issue you're working on, in this case, a bug-fix for issue number `18132` that affects Umbraco v.15.
 

.github/README.md

@@ -38,14 +38,6 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
 
-## Backoffice Preview
-
-Want to see the latest backoffice UI in action? Check out our live preview:
-
-**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
-
-This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
-
 ## Get help
 
 If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 

.github/contributing-first-issue.md

@@ -24,7 +24,7 @@ Great question! The short version goes like this:
 
 1. **Switch to the correct branch**
 
-    Switch to the `main` branch
+    Switch to the `contrib` branch
 
 1. **Build**
 
@@ -32,7 +32,7 @@ Great question! The short version goes like this:
 
 1. **Branch**
 
-    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `main`, create a new branch first.
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
 
 1. **Change**
 
@@ -42,7 +42,7 @@ Great question! The short version goes like this:
 
     Done? Yay! 🎉
 
-    Remember to commit to your new `temp` branch, and don't commit to `main`. Then you can push the changes up to your fork on GitHub.
+    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
 
 #### Keeping your Umbraco fork in sync with the main repository
 [sync fork]: #keeping-your-umbraco-fork-in-sync-with-the-main-repository
@@ -59,10 +59,10 @@ Then when you want to get the changes from the main repository:
 
 ```
 git fetch upstream
-git rebase upstream/main
+git rebase upstream/contrib
 ```
 
-In this command we're syncing with the `main` branch, but you can of course choose another one if needed.
+In this command we're syncing with the `contrib` branch, but you can of course choose another one if needed.
 
 [More information on how this works can be found on the thoughtbot blog.][sync fork ext]
 
@@ -79,7 +79,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 - If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
 - If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
-- Unsure where to start? Did something not work as expected? Try leaving a note in the [forum][forum]. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
 
 
   <!-- Local -->
@@ -90,7 +90,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 [sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
-[forum]: https://forum.umbraco.com/
+[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
 [up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
 [issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues

.github/contributing-localization.md

@@ -115,7 +115,7 @@ Save the changes and return to the Backoffice to see the update.
 
 
 
-1. Commit your changes to a new temporary branch (avoid committing directly to `main`). 
+1. Commit your changes to a new temporary branch (avoid committing directly to `contrib`). 
 
 2. Push the changes to your fork on GitHub.
 

.github/copilot-instructions.md

@@ -6,177 +6,142 @@ Always reference these instructions first and fallback to search or bash command
 
 Bootstrap, build, and test the repository:
 
--   Install .NET SDK (version specified in global.json):
-    -   `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
-    -   `export PATH="/home/runner/.dotnet:$PATH"`
--   Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
-    -   `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
-    -   `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
-    -   `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
--   Fix shallow clone issue (required for GitVersioning):
-    -   `git fetch --unshallow`
--   Restore packages:
-    -   `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
--   Build the solution:
-    -   `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
--   Install and build frontend:
-    -   `cd src/Umbraco.Web.UI.Client`
-    -   `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
-    -   `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
--   Install and build Login
-    -   `cd src/Umbraco.Web.UI.Login`
-    -   `npm ci --no-fund --no-audit --prefer-offline`
-    -   `npm run build`
--   Run the application:
-    -   `cd src/Umbraco.Web.UI`
-    -   `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
-
-Check out [BUILD.md](./BUILD.md) for more detailed instructions.
+- Install .NET SDK (version specified in global.json):
+  - `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
+  - `export PATH="/home/runner/.dotnet:$PATH"`
+- Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
+  - `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
+  - `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
+  - `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
+- Fix shallow clone issue (required for GitVersioning):
+  - `git fetch --unshallow`
+- Restore packages:
+  - `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
+- Build the solution:
+  - `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
+- Install and build frontend:
+  - `cd src/Umbraco.Web.UI.Client`
+  - `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
+  - `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
+- Install and build Login
+  - `cd src/Umbraco.Web.UI.Login`
+  - `npm ci --no-fund --no-audit --prefer-offline`
+  - `npm run build`
+- Run the application:
+  - `cd src/Umbraco.Web.UI`
+  - `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
 
 ## Validation
 
--   ALWAYS run through at least one complete end-to-end scenario after making changes.
--   Build and unit tests must pass before committing changes.
--   Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
--   Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
--   For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
--   For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
--   Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
+- ALWAYS run through at least one complete end-to-end scenario after making changes.
+- Build and unit tests must pass before committing changes.
+- Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
+- Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
+- For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
+- For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
+- Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
 
 ## Testing
 
 ### Unit Tests (.NET)
-
--   Location: tests/Umbraco.Tests.UnitTests/
--   Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
--   Duration: ~1 minute with 3,343 tests
--   NEVER CANCEL: Set timeout to 5+ minutes
+- Location: tests/Umbraco.Tests.UnitTests/
+- Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
+- Duration: ~1 minute with 3,343 tests
+- NEVER CANCEL: Set timeout to 5+ minutes
 
 ### Integration Tests (.NET)
-
--   Location: tests/Umbraco.Tests.Integration/
--   Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
--   NEVER CANCEL: Set timeout to 10+ minutes
+- Location: tests/Umbraco.Tests.Integration/
+- Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
+- NEVER CANCEL: Set timeout to 10+ minutes
 
 ### Frontend Tests
-
--   Location: src/Umbraco.Web.UI.Client/
--   Run: `npm test` (requires `npx playwright install` first)
--   Frontend tests use Web Test Runner with Playwright
+- Location: src/Umbraco.Web.UI.Client/
+- Run: `npm test` (requires `npx playwright install` first)
+- Frontend tests use Web Test Runner with Playwright
 
 ### Acceptance Tests (E2E)
-
--   Location: tests/Umbraco.Tests.AcceptanceTest/
--   Requires running Umbraco application and configuration
--   See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
+- Location: tests/Umbraco.Tests.AcceptanceTest/
+- Requires running Umbraco application and configuration
+- See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
 
 ## Project Structure
 
 The solution contains 30 C# projects organized as follows:
 
 ### Main Application Projects
-
--   **Umbraco.Web.UI**: Main web application project (startup project)
--   **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
--   **Umbraco.Web.UI.Login**: Separate login screen frontend
--   **Umbraco.Core**: Core domain models and interfaces
--   **Umbraco.Infrastructure**: Data access and infrastructure
--   **Umbraco.Cms**: Main CMS package
+- **Umbraco.Web.UI**: Main web application project (startup project)
+- **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
+- **Umbraco.Web.UI.Login**: Separate login screen frontend
+- **Umbraco.Core**: Core domain models and interfaces
+- **Umbraco.Infrastructure**: Data access and infrastructure
+- **Umbraco.Cms**: Main CMS package
 
 ### API Projects
-
--   **Umbraco.Cms.Api.Management**: Management API
--   **Umbraco.Cms.Api.Delivery**: Content Delivery API
--   **Umbraco.Cms.Api.Common**: Shared API components
+- **Umbraco.Cms.Api.Management**: Management API
+- **Umbraco.Cms.Api.Delivery**: Content Delivery API
+- **Umbraco.Cms.Api.Common**: Shared API components
 
 ### Persistence Projects
-
--   **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
--   **Umbraco.Cms.Persistence.Sqlite**: SQLite support
--   **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
+- **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
+- **Umbraco.Cms.Persistence.Sqlite**: SQLite support
+- **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
 
 ### Test Projects
-
--   **Umbraco.Tests.UnitTests**: Unit tests
--   **Umbraco.Tests.Integration**: Integration tests
--   **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
--   **Umbraco.Tests.Common**: Shared test utilities
+- **Umbraco.Tests.UnitTests**: Unit tests
+- **Umbraco.Tests.Integration**: Integration tests
+- **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
+- **Umbraco.Tests.Common**: Shared test utilities
 
 ## Common Tasks
 
-### Running Umbraco in Different Modes
-
-**Production Mode (Standard Development)**
-Use this for backend development, testing full builds, or when you don't need hot reloading:
-
-1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
-2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
-3. Access backoffice: `https://localhost:44339/umbraco`
-4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
-
-**Vite Dev Server Mode (Frontend Development with Hot Reload)**
-Use this for frontend-only development with hot module reloading:
-
-1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
-    ```json
-    "BackOfficeHost": "http://localhost:5173",
-    "AuthorizeCallbackPathName": "/oauth_complete",
-    "AuthorizeCallbackLogoutPathName": "/logout",
-    "AuthorizeCallbackErrorPathName": "/error",
-    "BackOfficeTokenCookie": {
-      "SameSite": "None"
-    }
-    ```
+### Frontend Development
+For frontend-only changes:
+1. Configure backend for frontend development:
+   ```json
+   <!-- Add to src/Umbraco.Web.UI/appsettings.json under Umbraco:Cms:Security: -->
+   ```json
+   "BackOfficeHost": "http://localhost:5173",
+   "AuthorizeCallbackPathName": "/oauth_complete",
+   "AuthorizeCallbackLogoutPathName": "/logout",
+   "AuthorizeCallbackErrorPathName": "/error"
+   ```
 2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
 3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
-4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
-5. Changes to TypeScript/Lit files hot reload automatically
-
-**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
 
 ### Backend-Only Development
-
 For backend-only changes, disable frontend builds:
-
--   Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
-    ```
-    <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
-      [...]
-    </Target>-->
-    ```
--   Remember to uncomment before committing
+- Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
+  ```
+  <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
+    [...]
+  </Target>-->
+  ```
+- Remember to uncomment before committing
 
 ### Building NuGet Packages
-
 To build custom NuGet packages for testing:
-
 ```bash
 dotnet pack -c Release -o Build.Out
 dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
 ```
 
 ### Regenerating Frontend API Types
-
 When changing Management API:
-
 ```bash
 cd src/Umbraco.Web.UI.Client
 npm run generate:server-api-dev
 ```
-
 Also update OpenApi.json from /umbraco/swagger/management/swagger.json
 
 ## Database Setup
 
 Default configuration supports SQLite for development. For production-like testing:
-
--   Use SQL Server/LocalDb for better performance
--   Configure connection string in src/Umbraco.Web.UI/appsettings.json
+- Use SQL Server/LocalDb for better performance
+- Configure connection string in src/Umbraco.Web.UI/appsettings.json
 
 ## Clean Up / Reset
 
 To reset development environment:
-
 ```bash
 # Remove configuration and database
 rm src/Umbraco.Web.UI/appsettings.json
@@ -188,31 +153,31 @@ git clean -xdf .
 
 ## Version Information
 
--   Target Framework: .NET (version specified in global.json)
--   Current Version: (specified in version.json)
--   Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
--   npm Requirement: Latest compatible version
+- Target Framework: .NET (version specified in global.json)
+- Current Version: (specified in version.json)
+- Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
+- npm Requirement: Latest compatible version
 
 ## Known Issues
 
--   Build requires full git history (not shallow clone) due to GitVersioning
--   Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
--   Frontend tests require Playwright browser installation: `npx playwright install`
--   Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
+- Build requires full git history (not shallow clone) due to GitVersioning
+- Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
+- Frontend tests require Playwright browser installation: `npx playwright install`
+- Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
 
 ## Timing Expectations
 
 **NEVER CANCEL** these operations - they are expected to take time:
 
-| Operation               | Expected Time | Timeout Setting |
-| ----------------------- | ------------- | --------------- |
-| `dotnet restore`        | 50 seconds    | 90+ seconds     |
-| `dotnet build`          | 4.5 minutes   | 10+ minutes     |
-| `npm ci`                | 11 seconds    | 30+ seconds     |
-| `npm run build:for:cms` | 1.25 minutes  | 5+ minutes      |
-| `npm test`              | 2 minutes     | 5+ minutes      |
-| `npm run lint`          | 1 minute      | 5+ minutes      |
-| Unit tests              | 1 minute      | 5+ minutes      |
-| Integration tests       | Variable      | 10+ minutes     |
+| Operation | Expected Time | Timeout Setting |
+|-----------|--------------|-----------------|
+| `dotnet restore` | 50 seconds | 90+ seconds |
+| `dotnet build` | 4.5 minutes | 10+ minutes |
+| `npm ci` | 11 seconds | 30+ seconds |
+| `npm run build:for:cms` | 1.25 minutes | 5+ minutes |
+| `npm test` | 2 minutes | 5+ minutes |
+| `npm run lint` | 1 minute | 5+ minutes |
+| Unit tests | 1 minute | 5+ minutes |
+| Integration tests | Variable | 10+ minutes |
 
-Always wait for commands to complete rather than canceling and retrying.
+Always wait for commands to complete rather than canceling and retrying.

.github/workflows/azure-backoffice.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - release/*
       - v*/dev
       - v*/main
     paths:
@@ -16,7 +15,6 @@ on:
     types: [opened, synchronize, reopened, closed]
     branches:
       - main
-      - release/*
       - v*/dev
       - v*/main
   workflow_dispatch:

.github/workflows/label-to-release-announcement.yml

@@ -52,7 +52,7 @@ jobs:
               for (const item of items) {
                 const releaseLabels = (item.labels || [])
                   .map(l => (typeof l === "string" ? l : l.name)) // always get the name
-                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
+                  .filter(n => typeof n === "string" && n.startsWith("release/"));
                 if (releaseLabels.length === 0) continue;
 
                 core.info(`#${item.number}: ${releaseLabels.join(", ")}`);

.gitignore

@@ -95,10 +95,6 @@ tools/docfx/
 /tests/Umbraco.Tests.Integration/[Uu]mbraco/[Ll]ogs/
 /tests/Umbraco.Tests.Integration/Views/
 /tests/Umbraco.Tests.UnitTests/[Uu]mbraco/[Dd]ata/TEMP/
-/BenchmarkDotNet.Artifacts/
-playwright-report
-trace.zip
-/tests/Umbraco.Tests.AcceptanceTest/results
 
 # Ignore auto-generated schema
 /src/Umbraco.Cms.Targets/tasks/
@@ -111,3 +107,5 @@ trace.zip
 /tests/Umbraco.Tests.Integration/appsettings-schema.*.json
 /tests/Umbraco.Tests.Integration/umbraco-package-schema.json
 /src/Umbraco.Cms/appsettings-schema.json
+playwright-report
+trace.zip

.vscode/launch.json

@@ -101,13 +101,10 @@
       "env": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "ASPNETCORE_URLS": "https://localhost:44339",
-        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
         "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
-        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
-        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
-        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error"
       },
       "sourceFileMap": {
         "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"

.vscode/settings.json

@@ -3,7 +3,6 @@
     "backoffice",
     "pickable",
     "Pickable",
-    "Umbraco",
     "unprovide",
     "Unproviding"
   ],

CLAUDE.md

@@ -1,381 +0,0 @@
-# Umbraco CMS - Multi-Project Repository
-
-Enterprise-grade CMS built on .NET 10.0. This repository contains 21 production projects organized in a layered architecture with clear separation of concerns.
-
-**Repository**: https://github.com/umbraco/Umbraco-CMS
-**License**: MIT
-**Main Branch**: `main`
-
----
-
-## 1. Overview
-
-### What This Repository Contains
-
-**21 Production Projects** organized in 3 main categories:
-
-1. **Core Architecture** (Domain & Infrastructure)
-   - `Umbraco.Core` - Interface contracts, domain models, notifications
-   - `Umbraco.Infrastructure` - Service implementations, data access, caching
-
-2. **Web & APIs** (Presentation Layer)
-   - `Umbraco.Web.UI` - Main ASP.NET Core web application
-   - `Umbraco.Web.Common` - Shared web functionality, controllers, middleware
-   - `Umbraco.Cms.Api.Management` - Backoffice Management API (REST)
-   - `Umbraco.Cms.Api.Delivery` - Content Delivery API (headless)
-   - `Umbraco.Cms.Api.Common` - Shared API infrastructure
-
-3. **Specialized Features** (Pluggable Modules)
-   - Persistence: EF Core (modern), NPoco (legacy) for SQL Server & SQLite
-   - Caching: `PublishedCache.HybridCache` (in-memory + distributed)
-   - Search: `Examine.Lucene` (full-text search)
-   - Imaging: `Imaging.ImageSharp` v1 & v2 (image processing)
-   - Other: Static assets, targets, development tools
-
-**6 Test Projects**:
-- `Umbraco.Tests.Common` - Shared test utilities
-- `Umbraco.Tests.UnitTests` - Unit tests
-- `Umbraco.Tests.Integration` - Integration tests
-- `Umbraco.Tests.Benchmarks` - Performance benchmarks
-- `Umbraco.Tests.AcceptanceTest` - E2E tests
-- `Umbraco.Tests.AcceptanceTest.UmbracoProject` - Test instance
-
-### Key Technologies
-
-- **.NET 10.0** - Target framework for all projects
-- **ASP.NET Core** - Web framework
-- **Entity Framework Core** - Modern ORM
-- **OpenIddict** - OAuth 2.0/OpenID Connect authentication
-- **Swashbuckle** - OpenAPI/Swagger documentation
-- **Lucene.NET** - Full-text search via Examine
-- **ImageSharp** - Image processing
-
----
-
-## 2. Repository Structure
-
-```
-Umbraco-CMS/
-├── src/                                    # 21 production projects
-│   ├── Umbraco.Core/                      # Domain contracts (interfaces only)
-│   │   └── CLAUDE.md                      # ⭐ Core architecture guide
-│   ├── Umbraco.Infrastructure/            # Service implementations
-│   ├── Umbraco.Web.Common/                # Web utilities
-│   ├── Umbraco.Web.UI/                    # Main web application
-│   ├── Umbraco.Cms.Api.Management/        # Management API
-│   ├── Umbraco.Cms.Api.Delivery/          # Delivery API (headless)
-│   ├── Umbraco.Cms.Api.Common/            # Shared API infrastructure
-│   │   └── CLAUDE.md                      # ⭐ API patterns guide
-│   ├── Umbraco.PublishedCache.HybridCache/ # Content caching
-│   ├── Umbraco.Examine.Lucene/            # Search indexing
-│   ├── Umbraco.Cms.Persistence.EFCore/    # EF Core data access
-│   ├── Umbraco.Cms.Persistence.EFCore.Sqlite/
-│   ├── Umbraco.Cms.Persistence.EFCore.SqlServer/
-│   ├── Umbraco.Cms.Persistence.Sqlite/    # Legacy SQLite
-│   ├── Umbraco.Cms.Persistence.SqlServer/ # Legacy SQL Server
-│   ├── Umbraco.Cms.Imaging.ImageSharp/    # Image processing v1
-│   ├── Umbraco.Cms.Imaging.ImageSharp2/   # Image processing v2
-│   ├── Umbraco.Cms.StaticAssets/          # Embedded assets
-│   ├── Umbraco.Cms.DevelopmentMode.Backoffice/
-│   ├── Umbraco.Cms.Targets/               # NuGet targets
-│   └── Umbraco.Cms/                       # Meta-package
-│
-├── tests/                                  # 6 test projects
-│   ├── Umbraco.Tests.Common/
-│   ├── Umbraco.Tests.UnitTests/
-│   ├── Umbraco.Tests.Integration/
-│   ├── Umbraco.Tests.Benchmarks/
-│   ├── Umbraco.Tests.AcceptanceTest/
-│   └── Umbraco.Tests.AcceptanceTest.UmbracoProject/
-│
-├── templates/                              # Project templates
-│   └── Umbraco.Templates/
-│
-├── tools/                                  # Build tools
-│   └── Umbraco.JsonSchema/
-│
-├── umbraco.sln                            # Main solution file
-├── Directory.Build.props                  # Shared build configuration
-├── Directory.Packages.props               # Centralized package versions
-├── .editorconfig                          # Code style
-└── .globalconfig                          # Roslyn analyzers
-```
-
-### Architecture Layers
-
-**Dependency Flow** (unidirectional, always flows inward):
-
-```
-Web.UI → Web.Common → Infrastructure → Core
-                ↓
-          Api.Management → Api.Common → Infrastructure → Core
-                ↓
-          Api.Delivery → Api.Common → Infrastructure → Core
-```
-
-**Key Principle**: Core has NO dependencies (pure contracts). Infrastructure implements Core. Web/APIs depend on Infrastructure.
-
-### Project Dependencies
-
-**Core Layer**:
-- `Umbraco.Core` → No dependencies (only Microsoft.Extensions.*)
-
-**Infrastructure Layer**:
-- `Umbraco.Infrastructure` → `Umbraco.Core`
-- `Umbraco.PublishedCache.*` → `Umbraco.Infrastructure`
-- `Umbraco.Examine.Lucene` → `Umbraco.Infrastructure`
-- `Umbraco.Cms.Persistence.*` → `Umbraco.Infrastructure`
-
-**Web Layer**:
-- `Umbraco.Web.Common` → `Umbraco.Infrastructure` + caching + search
-- `Umbraco.Web.UI` → `Umbraco.Web.Common` + all features
-
-**API Layer**:
-- `Umbraco.Cms.Api.Common` → `Umbraco.Web.Common`
-- `Umbraco.Cms.Api.Management` → `Umbraco.Cms.Api.Common`
-- `Umbraco.Cms.Api.Delivery` → `Umbraco.Cms.Api.Common`
-
----
-
-## 3. Teamwork & Collaboration
-
-### Branching Strategy
-
-- **Main branch**: `main` (protected)
-- **Branch naming convention**: `v<version>/<type>/<description>`
-
-**Format**: `v{major-version}/{type}/{kebab-case-description}`
-
-**Version**: Read from `version.json` in the repository root. Use the major version number (e.g., `v17` for version 17.x.x).
-
-**Types**:
-| Type | Use Case |
-|------|----------|
-| `feature` | New feature being introduced to the product |
-| `bugfix` | Fix to an existing issue with the product |
-| `qa` | Adding or updating unit, integration, or end-to-end tests |
-| `improvement` | Update to something that already exists but isn't broken (UI finessing, refactoring) |
-| `task` | Update that doesn't directly impact product behavior (dependency updates, build pipeline) |
-
-**Description**: A short, kebab-case description (a few words). This should be prefixed with the GitHub issue number if the update is related to resolving a tracked issue.
-
-**Examples**:
-```
-v17/bugfix/12345-correct-display-of-pending-migrations
-v17/feature/add-webhook-support
-v17/improvement/optimize-content-cache
-v17/qa/add-media-service-tests
-v17/task/update-ef-core-dependency
-```
-
-See `.github/CONTRIBUTING.md` for full guidelines.
-
-### Pull Request Process
-
-- **PR Template**: `.github/pull_request_template.md`
-- **Required CI Checks**:
-  - All tests pass
-  - Code formatting (dotnet format)
-  - No build warnings
-- **Merge Strategy**: Squash and merge (via GitHub UI)
-- **Reviews**: Required from code owners
-
-#### PR Naming Convention
-
-Use the format: `Area: Description (closes #IssueID)`
-
-**Examples**:
-| Area | Description | Issue |
-|------|-------------|-------|
-| Relations: | Move persistence of relations from repository into notification handlers | (closes #00000) |
-| Management API: | Correct the population of the parent for sibling items when retrieved under a folder | |
-| Docs: | Updated contributing guidelines to welcome contributions on bugfixes | |
-
-**Area**: The feature or aspect affected (e.g., UFM, TipTap, Docs, Segmentation, Migrations). Helps readers quickly understand what is being changed.
-
-**Description Best Practices**:
-- Include the area of change (Relations, Management API, etc.)
-- Describe the change and its impact
-- Be specific, not vague (describe "a golden retriever" not just "a dog")
-
-**Issue Linking**: Add `(closes #IssueID)` to auto-close linked issues on merge.
-
-### Commit Messages
-
-Follow Conventional Commits format:
-```
-<type>(<scope>): <description>
-
-Types: feat, fix, docs, style, refactor, test, chore
-Scope: project name (core, web, api, etc.)
-
-Examples:
-feat(core): add IContentService.GetByIds method
-fix(api): resolve null reference in schema handler
-docs(web): update routing documentation
-```
-
-### Code Owners
-
-Project ownership is distributed across teams. Check individual project directories for ownership.
-
----
-
-## 4. Architecture Patterns
-
-### Core Architectural Decisions
-
-1. **Layered Architecture with Dependency Inversion**
-   - Core defines contracts (interfaces)
-   - Infrastructure implements contracts
-   - Web/APIs consume implementations via DI
-
-2. **Interface-First Design**
-   - All services defined as interfaces in Core
-   - Enables testing, polymorphism, extensibility
-
-3. **Notification Pattern** (not C# events)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "2. Notification System (Event Handling)"
-
-4. **Composer Pattern** (DI registration)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "3. Composer Pattern (DI Registration)"
-
-5. **Scoping Pattern** (Unit of Work)
-   - See `/src/Umbraco.Core/CLAUDE.md` → "5. Scoping Pattern (Unit of Work)"
-
-6. **Attempt Pattern** (operation results)
-   - `Attempt<TResult, TStatus>` instead of exceptions
-   - Strongly-typed operation status enums
-
-### Key Design Patterns Used
-
-- **Repository Pattern** - Data access abstraction
-- **Unit of Work** - Scoping for transactions
-- **Builder Pattern** - `ProblemDetailsBuilder` for API errors
-- **Strategy Pattern** - OpenAPI handlers (schema ID, operation ID)
-- **Options Pattern** - All configuration via `IOptions<T>`
-- **Factory Pattern** - Content type factories
-- **Mediator Pattern** - Notification aggregator
-
----
-
-## 5. Project-Specific Notes
-
-### Centralized Package Management
-
-**All NuGet package versions** are centralized in `Directory.Packages.props`. Individual projects do NOT specify versions.
-
-```xml
-<!-- Individual projects reference WITHOUT version -->
-<PackageReference Include="Swashbuckle.AspNetCore" />
-
-<!-- Versions defined in Directory.Packages.props -->
-<PackageVersion Include="Swashbuckle.AspNetCore" Version="6.5.0" />
-```
-
-### Build Configuration
-
-- `Directory.Build.props` - Shared properties (target framework, company, copyright)
-- `.editorconfig` - Code style rules
-- `.globalconfig` - Roslyn analyzer rules
-
-### Persistence Layer - NPoco and EF Core
-
-The repository contains BOTH (actively supported):
-- **Current**: NPoco-based persistence (`Umbraco.Cms.Persistence.Sqlite`, `Umbraco.Cms.Persistence.SqlServer`) - widely used and fully supported
-- **Future**: EF Core-based persistence (`Umbraco.Cms.Persistence.EFCore.*`) - migration in progress
-
-**Note**: The codebase is actively migrating to EF Core, but NPoco remains the primary persistence layer and is not deprecated. Both are fully supported.
-
-### Authentication: OpenIddict
-
-All APIs use **OpenIddict** (OAuth 2.0/OpenID Connect):
-- Reference tokens (not JWT) for better security
-- **Secure cookie-based token storage** (v17+) - tokens stored in HTTP-only cookies with `__Host-` prefix
-- Tokens are redacted from client-side responses and passed via secure cookies only
-- ASP.NET Core Data Protection for token encryption
-- Configured in `Umbraco.Cms.Api.Common`
-- API requests must include credentials (`credentials: include` for fetch)
-
-**Load Balancing Requirement**: All servers must share the same Data Protection key ring.
-
-### Content Caching Strategy
-
-**HybridCache** (`Umbraco.PublishedCache.HybridCache`):
-- In-memory cache + distributed cache support
-- Published content only (not draft)
-- Invalidated via notifications and cache refreshers
-
-### API Versioning
-
-APIs use `Asp.Versioning.Mvc`:
-- Management API: `/umbraco/management/api/v{version}/*`
-- Delivery API: `/umbraco/delivery/api/v{version}/*`
-- OpenAPI/Swagger docs per version
-
-### Known Limitations
-
-1. **Circular Dependencies**: Avoided via `Lazy<T>` or event notifications
-2. **Multi-Server**: Requires shared Data Protection key ring and synchronized clocks (NTP)
-3. **Database Support**: SQL Server, SQLite
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build solution
-dotnet build
-
-# Run all tests
-dotnet test
-
-# Run specific test category
-dotnet test --filter "Category=Integration"
-
-# Format code
-dotnet format
-
-# Pack all projects
-dotnet pack -c Release
-```
-
-### Key Projects
-
-| Project | Type | Description |
-|---------|------|-------------|
-| **Umbraco.Core** | Library | Interface contracts and domain models |
-| **Umbraco.Infrastructure** | Library | Service implementations and data access |
-| **Umbraco.Web.UI** | Application | Main web application (Razor/MVC) |
-| **Umbraco.Cms.Api.Management** | Library | Management API (backoffice) |
-| **Umbraco.Cms.Api.Delivery** | Library | Delivery API (headless CMS) |
-| **Umbraco.Cms.Api.Common** | Library | Shared API infrastructure |
-| **Umbraco.PublishedCache.HybridCache** | Library | Published content caching |
-| **Umbraco.Examine.Lucene** | Library | Full-text search indexing |
-
-### Important Files
-
-- **Solution**: `umbraco.sln`
-- **Build Config**: `Directory.Build.props`, `Directory.Packages.props`
-- **Code Style**: `.editorconfig`, `.globalconfig`
-- **Documentation**: `/CLAUDE.md`, `/src/Umbraco.Core/CLAUDE.md`, `/src/Umbraco.Cms.Api.Common/CLAUDE.md`
-
-### Project-Specific Documentation
-
-For detailed information about individual projects, see their CLAUDE.md files:
-- **Core Architecture**: `/src/Umbraco.Core/CLAUDE.md` - Service contracts, notification patterns
-- **API Infrastructure**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md` - OpenAPI, authentication, serialization
-
-### Getting Help
-
-- **Official Docs**: https://docs.umbraco.com/
-- **Contributing Guide**: `.github/CONTRIBUTING.md`
-- **Issues**: https://github.com/umbraco/Umbraco-CMS/issues
-- **Community**: https://forum.umbraco.com/
-- **Releases**: https://releases.umbraco.com/
-
----
-
-**This repository follows a layered architecture with strict dependency rules. The Core defines contracts, Infrastructure implements them, and Web/APIs consume them. Each layer can be understood independently, but dependencies always flow inward toward Core.**

Directory.Build.props

@@ -40,8 +40,8 @@
   <!-- Package Validation -->
   <PropertyGroup>
     <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
-    <EnablePackageValidation>true</EnablePackageValidation>
-    <PackageValidationBaselineVersion>17.0.0</PackageValidationBaselineVersion>
+    <EnablePackageValidation>false</EnablePackageValidation> <!-- TODO (V17): Set to true with version 17.0.0 once this version is released. -->
+    <PackageValidationBaselineVersion>16.0.0</PackageValidationBaselineVersion>
     <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
     <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
   </PropertyGroup>

Directory.Packages.props

@@ -2,39 +2,38 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <!-- Global packages (private, build-time packages for all projects) -->
   <ItemGroup>
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.9.50" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.8.118" />
     <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
     <GlobalPackageReference Include="Umbraco.Code" Version="2.4.0" />
     <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.0-rc.2.25502.107" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.1.0" />
-    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.0-rc.2.25502.107" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.9.0" />
+    <PackageVersion Include="System.Linq.Async" Version="6.0.3" />
   </ItemGroup>
   <!-- Umbraco packages -->
   <ItemGroup>
@@ -50,8 +49,7 @@
     <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.14.1" />
-    <PackageVersion Include="Markdig" Version="0.44.0" />
+    <PackageVersion Include="MailKit" Version="4.14.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
     <PackageVersion Include="MessagePack" Version="3.1.4" />
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
@@ -59,9 +57,9 @@
     <PackageVersion Include="ncrontab" Version="3.4.0" />
     <PackageVersion Include="NPoco" Version="6.1.0" />
     <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.2.0" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.2.0" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="7.1.0" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.1.0" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.1.0" />
     <PackageVersion Include="Serilog" Version="4.3.0" />
     <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
@@ -74,18 +72,11 @@
     <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.11" />
     <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.0.1" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="9.0.6" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
-    <!-- Dazinator.Extensions.FileProviders references vulnerable versions of the following: -->
-    <!-- TODO (V18): Remove these pinned dependencies when the Dazinator.Extensions.FileProviders dependency is removed. -->
-    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
-    <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <!-- Markdown references vulnerable version of the following: -->
-    <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
-    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
   </ItemGroup>
 </Project>

NOTICES.txt

@@ -196,14 +196,6 @@ Copyright: 2013-2024 .NET Foundation and Contributors
 
 ---
 
-Markdig: A fast, powerful, CommonMark compliant, extensible Markdown processor for .NET
-
-URL: https://github.com/xoofx/markdig
-License: BSD-2-Clause license
-Copyright: 2018+, Alexandre Mutel. All rights reserved.
-
----
-
 Markdown: A library for parsing and compiling Markdown
 
 URL: https://github.com/hey-red/Markdown

build/azure-pipelines.yml

@@ -34,10 +34,6 @@ parameters:
     displayName: Upload API docs
     type: boolean
     default: false
-  - name: uploadDependencyTrack
-    displayName: Upload BOMs to Dependency Track
-    type: boolean
-    default: false
   - name: forceReleaseTestFilter
     displayName: Force to use the release test filters
     type: boolean
@@ -107,15 +103,6 @@ stages:
               command: build
               projects: $(solution)
               arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
-          - powershell: |
-              dotnet tool install --global CycloneDX
-              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
-            displayName: 'Generate Backend BOM'
-          - powershell: |
-              npm install --global @cyclonedx/cyclonedx-npm
-              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
-            displayName: Generate Login UI BOM
-            workingDirectory: src/Umbraco.Web.UI.Login
           - task: PublishPipelineArtifact@1
             displayName: Publish nupkg
             inputs:
@@ -126,11 +113,6 @@ stages:
             inputs:
               targetPath: $(Build.SourcesDirectory)
               artifactName: build_output
-          - task: PublishPipelineArtifact@1
-            displayName: Publish Backend BOM
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)/bom
-              artifactName: bom-backend
 
       - job: B
         displayName: Build Bellissima Package
@@ -142,11 +124,6 @@ stages:
             lfs: false,
             fetchDepth: 500
           - template: templates/backoffice-install.yml
-          - powershell: |
-              npm install --global @cyclonedx/cyclonedx-npm
-              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-backoffice.xml --ignore-npm-errors --verbose
-            displayName: Generate Backoffice UI BOM
-            workingDirectory: src/Umbraco.Web.UI.Client
           - script: npm run build:for:npm
             displayName: Run build:for:npm
             workingDirectory: src/Umbraco.Web.UI.Client
@@ -163,35 +140,6 @@ stages:
             inputs:
               targetPath: $(Build.ArtifactStagingDirectory)/npm
               artifactName: npm
-          - publish: $(Build.ArtifactStagingDirectory)/bom
-            artifact: bom-frontend
-            displayName: 'Publish Frontend BOM'
-
-  - stage: E2E_BOM
-    displayName: E2E Tests BOM Generation
-    dependsOn: []
-    jobs:
-    - job:
-      displayName: E2E Generate BOM
-      pool:
-        vmImage: "ubuntu-latest"
-      steps:
-        - checkout: self
-          submodules: false
-          lfs: false,
-          fetchDepth: 500
-        - template: templates/e2e-install.yml
-          parameters:
-            nodeVersion: ${{ variables.nodeVersion }}
-            npm_config_cache: ${{ variables.npm_config_cache }}
-        - powershell: |
-            npm install --global @cyclonedx/cyclonedx-npm
-            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
-          displayName: Generate E2E Tests BOM
-          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-        - publish: $(Build.ArtifactStagingDirectory)/bom
-          artifact: bom-e2e
-          displayName: 'Publish E2E BOM'
 
   - stage: Build_Docs
     condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -215,7 +163,7 @@ stages:
             inputs:
               targetType: inline
               script: |
-                dotnet tool install -g docfx
+                choco install docfx --version=2.59.4 -y
                 if ($lastexitcode -ne 0){
                     throw ("Error installing DocFX")
                 }
@@ -720,34 +668,6 @@ stages:
               ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
               DatabaseType: ${{ variables.DatabaseType }}
 
-  - stage: Dependency_Track
-    displayName: Dependency Track
-    dependsOn:
-      - Build
-      - E2E_BOM
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
-    variables:
-      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
-      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
-    jobs:
-      - template: templates/dependency-track.yml
-        parameters:
-          projectName: "Umbraco-CMS"
-          umbracoVersion: $(umbracoVersion)
-          projects:
-            - name: "Backend"
-              artifact: "bom-backend"
-              bomFilePath: "bom-dotnet.xml"
-            - name: "Login"
-              artifact: "bom-backend"
-              bomFilePath: "bom-login.xml"
-            - name: "Backoffice"
-              artifact: "bom-frontend"
-              bomFilePath: "bom-backoffice.xml"
-            - name: "E2E"
-              artifact: "bom-e2e"
-              bomFilePath: "bom-e2e.xml"
-
   ###############################################
   ## Release
   ###############################################
@@ -954,4 +874,3 @@ stages:
               ContainerName: "$web"
               BlobPrefix: v$(umbracoMajorVersion)/ui-api
               CleanTargetBeforeCopy: true
-

build/nightly-E2E-setup-template.yml

@@ -26,18 +26,38 @@ steps:
       artifact: nupkg
       path: $(Agent.BuildDirectory)/app/nupkg
 
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
   - task: UseDotNet@2
     displayName: Use .NET SDK from global.json
     inputs:
       useGlobalJson: true
 
-  - template: templates/e2e-install.yml
-    parameters:
-      nodeVersion: ${{ parameters.nodeVersion }}
-      npm_config_cache: ${{ parameters.npm_config_cache }}
-      PlaywrightUserEmail: ${{ parameters.PlaywrightUserEmail }}
-      PlaywrightPassword: ${{ parameters.PlaywrightPassword }}
-      ASPNETCORE_URLS: ${{ parameters.ASPNETCORE_URLS }}
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}
+      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages
 
   # Install Template
   - pwsh: |

build/nightly-E2E-test-pipelines.yml

@@ -9,8 +9,8 @@ schedules:
     branches:
       include:
         - v15/dev
-        - v16/dev
         - main
+        - v17/dev
 
 parameters:
   - name: skipIntegrationTests
@@ -18,22 +18,16 @@ parameters:
     type: boolean
     default: false
 
-  - name: skipDifferentAppSettingsAcceptanceTests
-    displayName: Skip acceptance tests with different app settings
+  - name: differentAppSettingsAcceptanceTests
+    displayName: Run acceptance tests with different app settings
     type: boolean
-    default: false
+    default: true
 
   - name: skipDefaultConfigAcceptanceTests
     displayName: Skip tests with DefaultConfig
     type: boolean
     default: false
 
-  # Can we slow our tests down when running on SQLite? That way we might be able to avoid DB locks
-  - name: skipSqliteAcceptanceTests
-    displayName: Skip SQLite acceptance tests
-    type: boolean
-    default: true
-
 variables:
   nodeVersion: 20
   solution: umbraco.sln
@@ -348,7 +342,7 @@ stages:
       - job:
         displayName: E2E Tests (SQLite)
         timeoutInMinutes: 180
-        condition: ${{ and(eq(parameters.skipDefaultConfigAcceptanceTests, false), eq(parameters.skipSqliteAcceptanceTests, false)) }}
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
         variables:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
@@ -449,15 +443,15 @@ stages:
               vmImage: "ubuntu-latest"
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             WindowsPart1Of3:
-              testCommand: "npm run testWindows -- --shard=1/3"
+              testCommand: "npm run test -- --shard=1/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart2Of3:
-              testCommand: "npm run testWindows -- --shard=2/3"
+              testCommand: "npm run test -- --shard=2/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart3Of3:
-              testCommand: "npm run testWindows -- --shard=3/3"
+              testCommand: "npm run test -- --shard=3/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
         pool:
@@ -511,7 +505,7 @@ stages:
     jobs:
       - job:
         displayName: E2E Tests with Different App settings (SQL Server)
-        condition: ${{ eq(parameters.skipDifferentAppSettingsAcceptanceTests, false) }}
+        condition: ${{ eq(parameters.differentAppSettingsAcceptanceTests, true) }}
         timeoutInMinutes: 180
         variables:
           SA_PASSWORD: UmbracoAcceptance123!
@@ -570,49 +564,6 @@ stages:
               CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
               CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
               additionalEnvironmentVariables: false
-            # EntityDataPicker
-            WindowsEntityDataPicker:
-              vmImage: "windows-latest"
-              testFolder: "EntityDataPicker"
-              port: ''
-              testCommand: "npx playwright test --project=entityDataPicker"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            LinuxEntityDataPicker:
-              vmImage: "ubuntu-latest"
-              testFolder: "EntityDataPicker"
-              port: ''
-              testCommand: "npx playwright test --project=entityDataPicker"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            # ContentSettingConfig
-            WindowsContentSettingsConfig:
-              vmImage: "windows-latest"
-              testFolder: "ContentSettingConfig"
-              port: ''
-              testCommand: "npx playwright test --project=contentSettingConfig"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            LinuxContentSettingsConfig:
-              vmImage: "ubuntu-latest"
-              testFolder: "ContentSettingConfig"
-              port: ''
-              testCommand: "npx playwright test --project=contentSettingConfig"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
-            # SMTP
-            LinuxSMTP:
-              vmImage: "ubuntu-latest"
-              testFolder: "SMTP"
-              port: ''
-              testCommand: "npx playwright test --project=smtp"
-              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
-              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-              additionalEnvironmentVariables: false
         pool:
           vmImage: $(vmImage)
         steps:
@@ -690,23 +641,6 @@ stages:
               AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
               AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
 
-          # Start SMTP4dev via Docker for SMTP tests
-          - bash: |
-              echo "Starting SMTP4dev container..."
-              docker run -d --name smtp4dev -p 5000:80 -p 25:25 rnwood/smtp4dev
-
-              echo "Waiting for SMTP4dev to be ready..."
-              for i in {1..30}; do
-                if curl -s http://localhost:5000/api/messages > /dev/null; then
-                  echo "SMTP4dev is ready"
-                  break
-                fi
-                echo "Attempt $i: Waiting for SMTP4dev..."
-                sleep 2
-              done
-            displayName: Start SMTP4dev Docker container (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), contains(variables['testFolder'], 'SMTP'))
-
           # Run tests Template
           - template: nightly-E2E-run-tests-template.yml
             parameters:
@@ -717,14 +651,6 @@ stages:
               AZUREB2CTESTUSERPASSWORD: $(AZUREB2CTESTUSERPASSWORD)
               DatabaseType: ${{ variables.DatabaseType }}
 
-          # Stop SMTP4dev container
-          - bash: |
-              echo "Stopping SMTP4dev container..."
-              docker stop smtp4dev
-              docker rm smtp4dev
-            displayName: Stop SMTP4dev Docker container
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), contains(variables['testFolder'], 'SMTP'))
-
   - stage: NotifySlackBot
     displayName: Notify Slack on Failure
     dependsOn: DefaultConfigE2E
@@ -769,4 +695,4 @@ stages:
                 --data "$PAYLOAD" \
                 "$SLACK_WEBHOOK_URL"
             env:
-              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)
+              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)

build/nightly-build-trigger.yml

@@ -9,7 +9,7 @@ schedules:
   branches:
     include:
     - v13/dev
-    - v16/dev
+    - v17/dev
     - main
 
 steps:

build/templates/dependency-track.yml

@@ -1,55 +0,0 @@
-parameters:
-  - name: projectName
-    type: string
-  - name: umbracoVersion
-    type: string
-  - name: projects
-    type: object
-
-jobs:
-- job: Create_DT_Project
-  displayName: Create Dependency Track Project
-  steps:
-    - checkout: none
-
-    - bash: |
-        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URI)/api/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
-        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
-          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
-        else
-          project_id=$(curl --no-progress-meter \
-            -X PUT "$(DT_API_URI)/api/v1/project" \
-            -H "X-Api-Key: $(DT_API_KEY)" \
-            -H "Content-Type: application/json" \
-            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
-            | jq -r '.uuid')
-          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
-            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
-            exit 1
-          fi
-          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
-        fi
-      displayName: Ensure main project exists in Dependency Track
-
-- ${{ each project in parameters.projects }}:
-  - job:
-    displayName: Upload ${{ project.name }} BOM
-    dependsOn: Create_DT_Project
-    steps:
-      - checkout: none
-
-      - download: current
-        artifact: ${{ project.artifact }}
-        displayName: Download ${{ project.artifact }} artifact
-
-      - task: upload-bom-dtrack@1
-        inputs:
-          dtrackURI: $(DT_API_URI)
-          dtrackAPIKey: $(DT_API_KEY)
-          dtrackProjAutoCreate: true
-          dtrackProjName: '${{ parameters.projectName }}-${{ project.name }}'
-          dtrackProjVersion: ${{ parameters.umbracoVersion }}
-          dtrackParentProjName: ${{ parameters.projectName }}
-          dtrackParentProjVersion: ${{ parameters.umbracoVersion }}
-          bomFilePath: '$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}'
-        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -1,49 +0,0 @@
-parameters:
-  - name: nodeVersion
-    type: string
-    default: ''
-
-  - name: npm_config_cache
-    type: string
-    default: ''
-
-  - name: PlaywrightUserEmail
-    type: string
-    default: ''
-
-  - name: PlaywrightPassword
-    type: string
-    default: ''
-
-  - name: ASPNETCORE_URLS
-    type: string
-    default: ''
-
-steps:
-  - task: NodeTool@0
-    displayName: Use Node.js $(nodeVersion)
-    inputs:
-      versionSpec: $(nodeVersion)
-
-  - pwsh: |
-      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
-      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
-      URL=${{ parameters.ASPNETCORE_URLS }}
-      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-    displayName: Generate .env
-    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-  # Cache and restore NPM packages
-  - task: Cache@2
-    displayName: Cache NPM packages
-    inputs:
-      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-      restoreKeys: |
-        npm_e2e | "$(Agent.OS)"
-        npm_e2e
-      path: ${{ parameters.npm_config_cache }}
-
-  - script: npm ci --no-fund --no-audit --prefer-offline
-    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-    displayName: Restore NPM packages

context7.json

@@ -1,4 +0,0 @@
-{
-  "url": "https://context7.com/umbraco/umbraco-cms",
-  "public_key": "pk_GTIgsrGAQiHNxCirZBDIM"
-}

global.json

@@ -1,7 +1,7 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "10.0.100-rc.2.25502.107",
     "rollForward": "latestFeature",
-    "allowPrerelease": false
+    "allowPrerelease": true
   }
 }

src/Umbraco.Cms.Api.Common/Accessors/RequestContextOutputExpansionStrategyAccessor.cs

@@ -1,12 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Umbraco.Cms.Core.DeliveryApi;
-
-namespace Umbraco.Cms.Api.Common.Accessors;
-
-public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
-{
-    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
-        : base(httpContextAccessor)
-    {
-    }
-}

src/Umbraco.Cms.Api.Common/Accessors/RequestContextServiceAccessorBase.cs

@@ -1,20 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
-
-namespace Umbraco.Cms.Api.Common.Accessors;
-
-public abstract class RequestContextServiceAccessorBase<T>
-    where T : class
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-
-    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
-        => _httpContextAccessor = httpContextAccessor;
-
-    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
-    {
-        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
-        return requestStartNodeService is not null;
-    }
-}

src/Umbraco.Cms.Api.Common/CLAUDE.md

@@ -1,371 +0,0 @@
-# Umbraco.Cms.Api.Common
-
-Shared infrastructure for Umbraco CMS REST APIs (Management and Delivery).
-
----
-
-## 1. Architecture
-
-**Type**: Class Library (NuGet Package)
-**Target Framework**: .NET 10.0
-**Purpose**: Common API infrastructure - OpenAPI/Swagger, JSON serialization, OpenIddict authentication, problem details
-
-### Key Technologies
-
-- **ASP.NET Core** - Web framework
-- **Swashbuckle** - OpenAPI/Swagger documentation generation
-- **OpenIddict** - OAuth 2.0/OpenID Connect authentication
-- **Asp.Versioning** - API versioning
-- **System.Text.Json** - Polymorphic JSON serialization
-
-### Dependencies
-
-- `Umbraco.Core` - Domain models and service contracts
-- `Umbraco.Web.Common` - Web functionality
-
-### Project Structure (46 files)
-
-```
-Umbraco.Cms.Api.Common/
-├── OpenApi/                    # Schema/Operation ID handlers for Swagger
-│   ├── SchemaIdHandler.cs     # Generates schema IDs (e.g., "PagedUserModel")
-│   ├── OperationIdHandler.cs  # Generates operation IDs
-│   └── SubTypesHandler.cs     # Polymorphism support
-├── Serialization/              # JSON type resolution
-│   └── UmbracoJsonTypeInfoResolver.cs
-├── Configuration/              # Options configuration
-│   ├── ConfigureUmbracoSwaggerGenOptions.cs
-│   └── ConfigureOpenIddict.cs
-├── DependencyInjection/        # Service registration
-│   ├── UmbracoBuilderApiExtensions.cs
-│   └── UmbracoBuilderAuthExtensions.cs
-├── Builders/                   # RFC 7807 problem details
-│   └── ProblemDetailsBuilder.cs
-├── ViewModels/Pagination/      # Common DTOs
-└── Security/                   # Auth paths and handlers
-```
-
-### Design Patterns
-
-1. **Strategy Pattern** - `ISchemaIdHandler`, `IOperationIdHandler` (extensible via inheritance)
-2. **Builder Pattern** - `ProblemDetailsBuilder` for fluent error responses
-3. **Options Pattern** - All configuration via `IConfigureOptions<T>`
-
----
-
-## 2. Commands
-
-See "Quick Reference" section at bottom for common commands.
-
----
-
-## 3. Key Patterns
-
-### Virtual Handlers for Extensibility
-
-Handlers are intentionally virtual to allow consuming APIs to override:
-
-```csharp
-// NOTE: Left unsealed on purpose, so it is extendable.
-public class SchemaIdHandler : ISchemaIdHandler
-{
-    public virtual bool CanHandle(Type type) { }
-    public virtual string Handle(Type type) { }
-}
-```
-
-**Why**: Management and Delivery APIs can customize schema/operation ID generation.
-
-### Schema ID Sanitization (OpenApi/SchemaIdHandler.cs:24-29, 32)
-
-```csharp
-// Add "Model" suffix to avoid TypeScript name clashes (lines 24-29)
-if (name.EndsWith("Model") == false)
-{
-    // because some models names clash with common classes in TypeScript (i.e. Document),
-    // we need to add a "Model" postfix to all models
-    name = $"{name}Model";
-}
-
-// Remove invalid characters to prevent OpenAPI generation errors (line 32)
-return Regex.Replace(name, @"[^\w]", string.Empty);
-```
-
-### Polymorphic Deserialization (Serialization/UmbracoJsonTypeInfoResolver.cs:29-35)
-
-```csharp
-// IMPORTANT: do NOT return an empty enumerable here. it will cause nullability to fail on reference
-// properties, because "$ref" does not mix and match well with "nullable" in OpenAPI.
-if (type.IsInterface is false)
-{
-    return new[] { type };
-}
-```
-
-**Why**: Interfaces must return concrete types to avoid OpenAPI schema conflicts.
-
----
-
-## 4. Testing
-
-**Location**: No direct tests - tested via integration tests in consuming APIs
-
-**How to test changes**:
-```bash
-# Run integration tests that exercise this library
-dotnet test tests/Umbraco.Tests.Integration/
-
-# Verify OpenAPI generation
-# 1. Run Management API
-# 2. Navigate to /umbraco/swagger/
-# 3. Check schema IDs and operation IDs
-```
-
-**Focus areas when testing**:
-- OpenAPI document generation (schema IDs, operation IDs)
-- Polymorphic JSON serialization/deserialization
-- OpenIddict authentication flow
-- Problem details formatting
-
----
-
-## 5. OpenIddict Authentication
-
-### Key Configuration (DependencyInjection/UmbracoBuilderAuthExtensions.cs)
-
-**Reference Tokens over JWT** (line 76-80):
-```csharp
-// Enable reference tokens
-// - see https://documentation.openiddict.com/configuration/token-storage.html
-options
-    .UseReferenceAccessTokens()
-    .UseReferenceRefreshTokens();
-```
-
-**Why**: More secure (revocable), better for load balancing, uses ASP.NET Core Data Protection.
-
-**Token Lifetime** (line 88-91):
-```csharp
-// Make the access token lifetime 25% of the refresh token lifetime
-options.SetAccessTokenLifetime(new TimeSpan(timeOut.Ticks / 4));
-options.SetRefreshTokenLifetime(timeOut);
-```
-
-**PKCE Required** (line 59-63):
-```csharp
-// Enable authorization code flow with PKCE
-options
-    .AllowAuthorizationCodeFlow()
-    .RequireProofKeyForCodeExchange()
-    .AllowRefreshTokenFlow();
-```
-
-**Endpoints**: Backoffice `/umbraco/management/api/v1/security/*`, Member `/umbraco/member/api/v1/security/*`
-
-### Secure Cookie-Based Token Storage (v17+)
-
-**Implementation** (DependencyInjection/HideBackOfficeTokensHandler.cs):
-
-Back-office tokens are hidden from client-side JavaScript via HTTP-only cookies:
-
-```csharp
-private const string AccessTokenCookieKey = "__Host-umbAccessToken";
-private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
-
-// Tokens are encrypted via Data Protection and stored in cookies
-SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
-context.Response.AccessToken = "[redacted]";  // Client sees redacted value
-```
-
-**Key Security Features** (lines 143-165): `HttpOnly`, `IsEssential`, `Path="/"`, `Secure` (HTTPS), `__Host-` prefix
-
-**Configuration**: `BackOfficeTokenCookieSettings.Enabled` (default: true in v17+)
-
-**Implications**: Client-side cannot access tokens; encrypted with Data Protection; load balancing needs shared key ring; API requests need `credentials: include`
-
----
-
-## 6. Common Issues & Edge Cases
-
-### Polymorphic Deserialization Requires `$type`
-
-**Issue**: Deserializing to an interface without `$type` discriminator fails.
-
-**Handled in** (Json/NamedSystemTextJsonInputFormatter.cs:24-29):
-```csharp
-catch (NotSupportedException exception)
-{
-    // This happens when trying to deserialize to an interface, without sending the $type as part of the request
-    context.ModelState.TryAddModelException(string.Empty, new InputFormatterException(exception.Message, exception));
-    return await InputFormatterResult.FailureAsync();
-}
-```
-
-**Solution**: Clients must include `$type` property for interface types, or use concrete types.
-
-### Schema ID Collisions with TypeScript
-
-**Issue**: Type names like `Document` clash with TypeScript built-ins.
-
-**Solution**: Add "Model" suffix (OpenApi/SchemaIdHandler.cs:24-29)
-
-### Generic Type Handling
-
-**Issue**: `PagedViewModel<T>` needs flattened schema name.
-
-**Solution** (OpenApi/SchemaIdHandler.cs:41-50):
-```csharp
-private string HandleGenerics(string name, Type type)
-{
-    if (!type.IsGenericType)
-        return name;
-
-    // use attribute custom name or append the generic type names
-    // turns "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
-    return $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
-}
-```
-
----
-
-## 7. Extending This Library
-
-### Adding a Custom OpenAPI Handler
-
-1. **Implement interface**:
-   ```csharp
-   public class MySchemaIdHandler : SchemaIdHandler
-   {
-       public override bool CanHandle(Type type)
-           => type.Namespace?.StartsWith("MyProject") is true;
-
-       public override string Handle(Type type)
-           => $"My{base.Handle(type)}";
-   }
-   ```
-
-2. **Register in consuming API**:
-   ```csharp
-   builder.Services.AddSingleton<ISchemaIdHandler, MySchemaIdHandler>();
-   ```
-
-**Note**: Handlers registered later take precedence in the selector.
-
-### Customizing Problem Details
-
-```csharp
-var problemDetails = new ProblemDetailsBuilder()
-    .WithTitle("Validation Failed")
-    .WithDetail("The request contains errors")
-    .WithType("ValidationError")
-    .WithOperationStatus(MyOperationStatus.ValidationFailed)
-    .WithRequestModelErrors(errors)
-    .Build();
-
-return BadRequest(problemDetails);
-```
-
----
-
-## 8. Project-Specific Notes
-
-### Why Virtual Handlers?
-
-**Decision**: Make `SchemaIdHandler`, `OperationIdHandler`, etc. virtual.
-
-**Why**: Management API and Delivery API have different schema ID requirements. Virtual methods allow override without rewriting the entire handler.
-
-**Example**: Management API might prefix all schemas with "Management", Delivery API with "Delivery".
-
-### Performance: Subtype Caching
-
-**Why**: Cache discovered subtypes (UmbracoJsonTypeInfoResolver.cs:14) to avoid expensive reflection calls
-
-### Known Limitations
-
-1. **Polymorphic Deserialization**:
-   - Requires `$type` discriminator in JSON for interfaces
-   - Only discovers types in Umbraco namespaces
-   - Not all .NET types are discoverable
-
-2. **OpenAPI Schema Generation**:
-   - Generic types are flattened (e.g., `PagedViewModel<T>` → `PagedTModel`)
-   - Type names may need "Model" suffix to avoid clashes
-
-3. **OpenIddict Multi-Server**:
-   - Requires shared Data Protection key ring
-   - All servers must have synchronized clocks (NTP)
-   - Reference tokens require database storage
-
-### External Dependencies
-
-**OpenIddict**:
-- OAuth 2.0 / OpenID Connect provider
-- Version: See `Directory.Packages.props`
-- Uses ASP.NET Core Data Protection for token encryption
-
-**Swashbuckle**:
-- OpenAPI 3.0 document generation
-- Custom filters: `EnumSchemaFilter`, `MimeTypeDocumentFilter`, `RemoveSecuritySchemesDocumentFilter`
-
-**Asp.Versioning**:
-- API versioning via `ApiVersion` attribute
-- API explorer integration for multi-version Swagger docs
-
-### Configuration
-
-**HTTPS**: `DisableTransportSecurityRequirement` for local dev only (ConfigureOpenIddict.cs:14). **Warning**: Never disable in production.
-
-### Usage Pattern
-
-Consuming APIs call `builder.AddUmbracoApiOpenApiUI().AddUmbracoOpenIddict()`
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build project
-dotnet build src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj
-
-# Pack for NuGet
-dotnet pack src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj -c Release
-
-# Test via integration tests
-dotnet test tests/Umbraco.Tests.Integration/
-
-# Check packages
-dotnet list src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj package --outdated
-dotnet list src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj package --vulnerable
-```
-
-### Key Classes
-
-| Class | Purpose | File |
-|-------|---------|------|
-| `ProblemDetailsBuilder` | Build RFC 7807 error responses | Builders/ProblemDetailsBuilder.cs |
-| `SchemaIdHandler` | Generate OpenAPI schema IDs | OpenApi/SchemaIdHandler.cs |
-| `UmbracoJsonTypeInfoResolver` | Polymorphic JSON serialization | Serialization/UmbracoJsonTypeInfoResolver.cs |
-| `UmbracoBuilderAuthExtensions` | Configure OpenIddict | DependencyInjection/UmbracoBuilderAuthExtensions.cs |
-| `HideBackOfficeTokensHandler` | Secure cookie-based token storage | DependencyInjection/HideBackOfficeTokensHandler.cs |
-| `PagedViewModel<T>` | Generic pagination model | ViewModels/Pagination/PagedViewModel.cs |
-
-### Important Files
-
-- `Umbraco.Cms.Api.Common.csproj` - Project dependencies
-- `DependencyInjection/UmbracoBuilderApiExtensions.cs` - OpenAPI registration (line 12-31)
-- `DependencyInjection/UmbracoBuilderAuthExtensions.cs` - OpenIddict setup (line 20-183)
-- `Security/Paths.cs` - API endpoint path constants
-
-### Getting Help
-
-- **Root documentation**: `/CLAUDE.md` - Repository overview
-- **Core patterns**: `/src/Umbraco.Core/CLAUDE.md` - Core contracts and patterns
-- **Official docs**: https://docs.umbraco.com/
-- **OpenIddict docs**: https://documentation.openiddict.com/
-
----
-
-**This library is the foundation for all Umbraco CMS REST APIs. Focus on OpenAPI customization, authentication configuration, and polymorphic serialization when working here.**

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -1,10 +1,13 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
-using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
@@ -13,31 +16,15 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
     private readonly IOperationIdSelector _operationIdSelector;
     private readonly ISchemaIdSelector _schemaIdSelector;
     private readonly ISubTypesSelector _subTypesSelector;
-    private readonly IDocumentInclusionSelector _documentInclusionSelector;
 
-    public ConfigureUmbracoSwaggerGenOptions(
-        IOperationIdSelector operationIdSelector,
-        ISchemaIdSelector schemaIdSelector,
-        ISubTypesSelector subTypesSelector,
-        IDocumentInclusionSelector documentInclusionSelector)
-    {
-        _operationIdSelector = operationIdSelector;
-        _schemaIdSelector = schemaIdSelector;
-        _subTypesSelector = subTypesSelector;
-        _documentInclusionSelector = documentInclusionSelector;
-    }
-
-    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
     public ConfigureUmbracoSwaggerGenOptions(
         IOperationIdSelector operationIdSelector,
         ISchemaIdSelector schemaIdSelector,
         ISubTypesSelector subTypesSelector)
-        : this(
-              operationIdSelector,
-              schemaIdSelector,
-              subTypesSelector,
-              StaticServiceProvider.Instance.GetRequiredService<IDocumentInclusionSelector>())
     {
+        _operationIdSelector = operationIdSelector;
+        _schemaIdSelector = schemaIdSelector;
+        _subTypesSelector = subTypesSelector;
     }
 
     public void Configure(SwaggerGenOptions swaggerGenOptions)
@@ -52,11 +39,19 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
             });
 
         swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description));
-        swaggerGenOptions.DocInclusionPredicate(_documentInclusionSelector.Include);
-        swaggerGenOptions.TagActionsBy(api =>
-            api.GroupName is null
-                ? []
-                : new[] { api.GroupName });
+        swaggerGenOptions.DocInclusionPredicate((name, api) =>
+        {
+            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
+                && controllerActionDescriptor.HasMapToApiAttribute(name))
+            {
+                return true;
+            }
+
+            ApiVersionMetadata apiVersionMetadata = api.ActionDescriptor.GetApiVersionMetadata();
+            return apiVersionMetadata.Name == name
+                   || (string.IsNullOrEmpty(apiVersionMetadata.Name) && name == DefaultApiConfiguration.ApiName);
+        });
+        swaggerGenOptions.TagActionsBy(api => new[] { api.GroupName });
         swaggerGenOptions.OrderActionsBy(ActionOrderBy);
         swaggerGenOptions.SchemaFilter<EnumSchemaFilter>();
         swaggerGenOptions.CustomSchemaIds(_schemaIdSelector.SchemaId);

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -1,246 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-using Microsoft.AspNetCore.DataProtection;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Options;
-using OpenIddict.Server;
-using OpenIddict.Validation;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Events;
-using Umbraco.Cms.Core.Notifications;
-using Umbraco.Cms.Web.Common.Security;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.DependencyInjection;
-
-internal sealed class HideBackOfficeTokensHandler
-    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
-        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
-        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
-        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
-        INotificationHandler<UserLogoutSuccessNotification>
-{
-    private const string RedactedTokenValue = "[redacted]";
-
-    // The __Host- prefix enforces secure cookies at browser level (requires Secure, Path=/, no Domain).
-    // For local development over HTTP, we use a simpler prefix to avoid browser rejection.
-    private const string SecureCookiePrefix = "__Host-";
-    private const string AccessTokenCookieName = "umbAccessToken";
-    private const string RefreshTokenCookieName = "umbRefreshToken";
-    private const string PkceCodeCookieName = "umbPkceCode";
-
-    private readonly IHttpContextAccessor _httpContextAccessor;
-    private readonly IDataProtectionProvider _dataProtectionProvider;
-    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
-    private readonly GlobalSettings _globalSettings;
-
-    public HideBackOfficeTokensHandler(
-        IHttpContextAccessor httpContextAccessor,
-        IDataProtectionProvider dataProtectionProvider,
-        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
-        IOptions<GlobalSettings> globalSettings)
-    {
-        _httpContextAccessor = httpContextAccessor;
-        _dataProtectionProvider = dataProtectionProvider;
-        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
-        _globalSettings = globalSettings.Value;
-    }
-
-    /// <summary>
-    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
-    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
-    /// tokens from the response, so they are not exposed to the client.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
-    {
-        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        HttpContext httpContext = GetHttpContext();
-
-        if (context.Response.AccessToken is not null)
-        {
-            SetCookie(httpContext, AccessTokenCookieName, context.Response.AccessToken);
-            context.Response.AccessToken = RedactedTokenValue;
-        }
-
-        if (context.Response.RefreshToken is not null)
-        {
-            SetCookie(httpContext, RefreshTokenCookieName, context.Response.RefreshToken);
-            context.Response.RefreshToken = RedactedTokenValue;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when a PKCE code is issued to the client. For the back-office client, we will intercept the
-    /// response, write the PKCE code from the response into a HTTP-only cookie, and redact the code from the response,
-    /// so it's not exposed to the client.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyAuthorizationResponseContext context)
-    {
-        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        if (context.Response.Code is not null)
-        {
-            SetCookie(GetHttpContext(), PkceCodeCookieName, context.Response.Code);
-            context.Response.Code = RedactedTokenValue;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when requesting new tokens.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
-    {
-        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
-        {
-            // Only ever handle the back-office client.
-            return ValueTask.CompletedTask;
-        }
-
-        HttpContext httpContext = GetHttpContext();
-
-        // Handle when the PKCE code is being exchanged for an access token.
-        if (context.Request.Code == RedactedTokenValue
-            && TryGetCookie(httpContext, PkceCodeCookieName, out var code))
-        {
-            context.Request.Code = code;
-
-            // We won't need the PKCE cookie after this, let's remove it.
-            RemoveCookie(httpContext, PkceCodeCookieName);
-        }
-        else
-        {
-            // PCKE codes should always be redacted. If we got here, someone might be trying to pass another PKCE
-            // code. For security reasons, explicitly discard the code (if any) to be on the safe side.
-            context.Request.Code = null;
-        }
-
-        // Handle when a refresh token is being exchanged for a new access token.
-        if (context.Request.RefreshToken == RedactedTokenValue
-            && TryGetCookie(httpContext, RefreshTokenCookieName, out var refreshToken))
-        {
-            context.Request.RefreshToken = refreshToken;
-        }
-        else
-        {
-            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
-            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
-            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
-            context.Request.RefreshToken = null;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    /// This is invoked when extracting the auth context for a client request.
-    /// </summary>
-    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
-    {
-        // For the back-office client, this only happens when an access token is sent to the API.
-        if (context.AccessToken != RedactedTokenValue)
-        {
-            return ValueTask.CompletedTask;
-        }
-
-        if (TryGetCookie(GetHttpContext(), AccessTokenCookieName, out var accessToken))
-        {
-            context.AccessToken = accessToken;
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    public void Handle(UserLogoutSuccessNotification notification)
-    {
-        HttpContext? httpContext = _httpContextAccessor.HttpContext;
-        if (httpContext is null)
-        {
-            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
-            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
-            // so the cookie clean-up is mostly cosmetic.
-            return;
-        }
-
-        RemoveCookie(httpContext, AccessTokenCookieName);
-        RemoveCookie(httpContext, RefreshTokenCookieName);
-    }
-
-    private HttpContext GetHttpContext()
-        => _httpContextAccessor.GetRequiredHttpContext();
-
-    private string GetCookieKey(HttpContext httpContext, string cookieName)
-        => _globalSettings.UseHttps || httpContext.Request.IsHttps
-            ? $"{SecureCookiePrefix}{cookieName}"
-            : cookieName;
-
-    private void SetCookie(HttpContext httpContext, string cookieName, string value)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
-
-        RemoveCookie(httpContext, cookieName);
-        httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
-    }
-
-    private void RemoveCookie(HttpContext httpContext, string cookieName)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
-    }
-
-    private CookieOptions GetCookieOptions(HttpContext httpContext) =>
-        new()
-        {
-            // Prevent the client-side scripts from accessing the cookie.
-            HttpOnly = true,
-
-            // Mark the cookie as essential to the application, to enforce it despite any
-            // data collection consent options. This aligns with how ASP.NET Core Identity
-            // does when writing cookies for cookie authentication.
-            IsEssential = true,
-
-            // Cookie path must be root for optimal security.
-            Path = "/",
-
-            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
-            // environments over HTTP, so we need to take that into account here.
-            // Thus, we will make the cookie secure if:
-            // - HTTPS is explicitly enabled by config (default for production environments), or
-            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
-            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
-
-            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
-            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
-        };
-
-    private bool TryGetCookie(HttpContext httpContext, string cookieName, [NotNullWhen(true)] out string? value)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
-        {
-            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
-            return true;
-        }
-
-        value = null;
-        return false;
-    }
-
-    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
-        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
-            ? result
-            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
-}

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderApiExtensions.cs

@@ -25,7 +25,6 @@ public static class UmbracoBuilderApiExtensions
         builder.Services.AddSingleton<ISchemaIdHandler, SchemaIdHandler>();
         builder.Services.AddSingleton<ISubTypesSelector, SubTypesSelector>();
         builder.Services.AddSingleton<ISubTypesHandler, SubTypesHandler>();
-        builder.Services.AddSingleton<IDocumentInclusionSelector, DocumentInclusionSelector>();
         builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new SwaggerRouteTemplatePipelineFilter("UmbracoApiCommon")));
 
         return builder;

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -11,7 +11,6 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Infrastructure.BackgroundJobs;
 using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs.DistributedJobs;
-using Umbraco.Cms.Core.Notifications;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
@@ -114,25 +113,6 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
-
-                options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
-                });
             })
 
             // Register the OpenIddict validation components.
@@ -157,19 +137,9 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
-
-                options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
-                        .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
-                });
             });
 
         builder.Services.AddSingleton<IDistributedBackgroundJob, OpenIddictCleanupJob>();
         builder.Services.ConfigureOptions<ConfigureOpenIddict>();
-
-        builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/DocumentInclusionSelector.cs

@@ -1,30 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Mvc.Abstractions;
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-using Microsoft.AspNetCore.Mvc.Controllers;
-using Umbraco.Cms.Api.Common.Configuration;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-/// <summary>
-/// Determines whether an API description should be included in a specific documentation set based on the document name
-/// and API metadata.
-/// </summary>
-public class DocumentInclusionSelector : IDocumentInclusionSelector
-{
-    /// <inheritdoc/>
-    public bool Include(string documentName, ApiDescription apiDescription)
-    {
-        if (apiDescription.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
-            && controllerActionDescriptor.HasMapToApiAttribute(documentName))
-        {
-            return true;
-        }
-
-        ApiVersionMetadata apiVersionMetadata = apiDescription.ActionDescriptor.GetApiVersionMetadata();
-        return apiVersionMetadata.Name == documentName
-               || (string.IsNullOrEmpty(apiVersionMetadata.Name) && documentName == DefaultApiConfiguration.ApiName);
-    }
-}
-

src/Umbraco.Cms.Api.Common/OpenApi/EnumSchemaFilter.cs

@@ -1,27 +1,25 @@
 using System.Reflection;
 using System.Runtime.Serialization;
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
 public class EnumSchemaFilter : ISchemaFilter
 {
-    public void Apply(IOpenApiSchema model, SchemaFilterContext context)
+    public void Apply(OpenApiSchema model, SchemaFilterContext context)
     {
-        if (model is not OpenApiSchema schema || context.Type.IsEnum is false)
+        if (context.Type.IsEnum)
         {
-            return;
-        }
-
-        schema.Type = JsonSchemaType.String;
-        schema.Format = null;
-        schema.Enum = new List<JsonNode>();
-        foreach (var name in Enum.GetNames(context.Type))
-        {
-            var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
-            schema.Enum.Add(actualName);
+            model.Type = "string";
+            model.Format = null;
+            model.Enum.Clear();
+            foreach (var name in Enum.GetNames(context.Type))
+            {
+                var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
+                model.Enum.Add(new OpenApiString(actualName));
+            }
         }
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/IDocumentInclusionSelector.cs

@@ -1,19 +0,0 @@
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-/// <summary>
-/// Defines a method that determines whether a given API description should be included in a specific documentation
-/// document.
-/// </summary>
-public interface IDocumentInclusionSelector
-{
-    /// <summary>
-    /// Determines whether the specified API description should be included in the generated documentation for the given
-    /// document name.
-    /// </summary>
-    /// <param name="documentName">The name of the documentation document being generated.</param>
-    /// <param name="apiDescription">The API description to evaluate for inclusion.</param>
-    /// <returns>true if the API description should be included in the documentation; otherwise, false.</returns>
-    bool Include(string documentName, ApiDescription apiDescription);
-}

src/Umbraco.Cms.Api.Common/OpenApi/MimeTypeDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Extensions;
 
@@ -21,32 +21,25 @@ public class MimeTypeDocumentFilter : IDocumentFilter
         }
 
         OpenApiOperation[] operations = swaggerDoc.Paths
-            .SelectMany(path => path.Value.Operations?.Values ?? Enumerable.Empty<OpenApiOperation>())
+            .SelectMany(path => path.Value.Operations.Values)
             .ToArray();
 
-        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
+        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType> content)
         {
-            if (content is null || content.ContainsKey("application/json") is false)
+            if (content.ContainsKey("application/json"))
             {
-                return;
+                content.RemoveAll(r => r.Key != "application/json");
             }
 
-            content.RemoveAll(r => r.Key != "application/json");
         }
 
-        OpenApiRequestBody[] requestBodies = operations
-            .Select(operation => operation.RequestBody)
-            .OfType<OpenApiRequestBody>()
-            .ToArray();
+        OpenApiRequestBody[] requestBodies = operations.Select(operation => operation.RequestBody).WhereNotNull().ToArray();
         foreach (OpenApiRequestBody requestBody in requestBodies)
         {
             RemoveUnwantedMimeTypes(requestBody.Content);
         }
 
-        OpenApiResponse[] responses = operations
-            .SelectMany(operation => operation.Responses?.Values ?? Enumerable.Empty<IOpenApiResponse>())
-            .OfType<OpenApiResponse>()
-            .ToArray();
+        OpenApiResponse[] responses = operations.SelectMany(operation => operation.Responses.Values).WhereNotNull().ToArray();
         foreach (OpenApiResponse response in responses)
         {
             RemoveUnwantedMimeTypes(response.Content);

src/Umbraco.Cms.Api.Common/OpenApi/RemoveSecuritySchemesDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -20,6 +20,6 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
             return;
         }
 
-        swaggerDoc.Components?.SecuritySchemes?.Clear();
+        swaggerDoc.Components.SecuritySchemes.Clear();
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/SwaggerRouteTemplatePipelineFilter.cs

@@ -3,12 +3,13 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Swashbuckle.AspNetCore.SwaggerUI;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
+using Umbraco.Extensions;
 using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;

src/Umbraco.Cms.Api.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs

@@ -1,148 +0,0 @@
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.Rendering;
-
-public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
-{
-    protected const string All = "$all";
-    protected const string None = "";
-    protected const string ExpandParameterName = "expand";
-    protected const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
-
-    protected Stack<Node?> ExpandProperties { get; } = new();
-
-    protected Stack<Node?> IncludeProperties { get; } = new();
-
-    public ElementOnlyOutputExpansionStrategy(
-        IApiPropertyRenderer propertyRenderer)
-    {
-        _propertyRenderer = propertyRenderer;
-    }
-
-    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
-        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            IncludeProperties.Push(nextIncludeProperties);
-            ExpandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            ExpandProperties.Pop();
-            IncludeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
-
-    protected sealed class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
-}

src/Umbraco.Cms.Api.Common/Security/ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler.cs

@@ -1,84 +0,0 @@
-using System.Security.Claims;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Options;
-using OpenIddict.Server;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Infrastructure.Security;
-
-/// <summary>
-/// Provides OpenIddict server event handlers to expose the backoffice authentication token via a custom authentication scheme.
-/// </summary>
-public class ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler : IOpenIddictServerHandler<OpenIddictServerEvents.GenerateTokenContext>,
-    IOpenIddictServerHandler<OpenIddictServerEvents.ApplyRevocationResponseContext>
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-    private readonly string[] _claimTypes;
-    private readonly TimeSpan _timeOut;
-
-    /// <summary>
-    /// Initializes a new instance of the <see cref="ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler"/> class.
-    /// </summary>
-    public ExposeBackOfficeAuthenticationOpenIddictServerEventsHandler(
-        IHttpContextAccessor httpContextAccessor,
-        IOptions<GlobalSettings> globalSettings,
-        IOptions<BackOfficeIdentityOptions> backOfficeIdentityOptions)
-    {
-        _httpContextAccessor = httpContextAccessor;
-        _timeOut = globalSettings.Value.TimeOut;
-
-        // These are the type identifiers for the claims required by the principal
-        // for the custom authentication scheme.
-        // We make available the ID, user name and allowed applications (sections) claims.
-        _claimTypes =
-        [
-            backOfficeIdentityOptions.Value.ClaimsIdentity.UserIdClaimType,
-            backOfficeIdentityOptions.Value.ClaimsIdentity.UserNameClaimType,
-            Core.Constants.Security.AllowedApplicationsClaimType,
-        ];
-    }
-
-    /// <inheritdoc/>
-    /// <remarks>
-    /// Event handler for when access tokens are generated (created or refreshed).
-    /// </remarks>
-    public async ValueTask HandleAsync(OpenIddictServerEvents.GenerateTokenContext context)
-    {
-        // Only proceed if this is a back-office sign-in.
-        if (context.Principal.Identity?.AuthenticationType != Core.Constants.Security.BackOfficeAuthenticationType)
-        {
-            return;
-        }
-
-        // Create a new principal with the claims from the authenticated principal.
-        var principal = new ClaimsPrincipal(
-            new ClaimsIdentity(
-                context.Principal.Claims.Where(claim => _claimTypes.Contains(claim.Type)),
-                Core.Constants.Security.BackOfficeExposedAuthenticationType));
-
-        // Sign-in the new principal for the custom authentication scheme.
-        await _httpContextAccessor
-            .GetRequiredHttpContext()
-            .SignInAsync(Core.Constants.Security.BackOfficeExposedAuthenticationType, principal, GetAuthenticationProperties());
-    }
-
-    /// <inheritdoc/>
-    /// <remarks>
-    /// Event handler for when access tokens are revoked.
-    /// </remarks>
-    public async ValueTask HandleAsync(OpenIddictServerEvents.ApplyRevocationResponseContext context)
-        => await _httpContextAccessor
-            .GetRequiredHttpContext()
-            .SignOutAsync(Core.Constants.Security.BackOfficeExposedAuthenticationType, GetAuthenticationProperties());
-
-    private AuthenticationProperties GetAuthenticationProperties()
-        => new()
-        {
-            IsPersistent = true,
-            IssuedUtc = DateTimeOffset.UtcNow,
-            ExpiresUtc = DateTimeOffset.UtcNow.Add(_timeOut)
-        };
-}

src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj

@@ -4,12 +4,6 @@
     <Description>Contains the bits and pieces that are shared between the Umbraco CMS APIs.</Description>
   </PropertyGroup>
 
-  <ItemGroup>
-    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
-      <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>
-    </AssemblyAttribute>
-  </ItemGroup>
-
   <ItemGroup>
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>

src/Umbraco.Cms.Api.Delivery/CLAUDE.md

@@ -1,382 +0,0 @@
-# Umbraco.Cms.Api.Delivery
-
-Headless content delivery REST API for Umbraco CMS. Enables frontend applications to fetch published content, media, and member-protected resources.
-
----
-
-## 1. Architecture
-
-**Type**: Class Library (NuGet Package)
-**Target Framework**: .NET 10.0
-**Purpose**: Content Delivery API for headless CMS scenarios
-
-### Key Technologies
-
-- **ASP.NET Core** - Web framework
-- **OpenIddict** - Member authentication (OAuth 2.0)
-- **Asp.Versioning** - API versioning (V1, V2)
-- **Output Caching** - Configurable response caching
-- **Examine/Lucene** - Content querying
-
-### Dependencies
-
-- `Umbraco.Cms.Api.Common` - Shared API infrastructure (OpenAPI, auth)
-- `Umbraco.Web.Common` - Web functionality
-
-### Project Structure (86 files)
-
-```
-Umbraco.Cms.Api.Delivery/
-├── Controllers/
-│   ├── Content/               # Content endpoints (by ID, route, query)
-│   ├── Media/                 # Media endpoints (by ID, path, query)
-│   └── Security/              # Member auth (authorize, token, signout)
-├── Querying/
-│   ├── Filters/               # ContentType, Name, CreateDate, UpdateDate
-│   ├── Selectors/             # Ancestors, Children, Descendants
-│   └── Sorts/                 # Name, CreateDate, UpdateDate, Level, SortOrder
-├── Indexing/                  # Lucene index field handlers
-├── Services/                  # Business logic and query building
-├── Caching/                   # Output cache policies
-├── Rendering/                 # Output expansion strategies
-├── Configuration/             # Swagger configuration
-└── Filters/                   # Action filters (access, validation)
-```
-
-### Design Patterns
-
-1. **Strategy Pattern** - Query handlers (`ISelectorHandler`, `IFilterHandler`, `ISortHandler`)
-2. **Factory Pattern** - `ApiContentQueryFactory` builds Examine queries
-3. **Template Method** - `ContentApiControllerBase` for shared controller logic
-4. **Options Pattern** - `DeliveryApiSettings` for all configuration
-
----
-
-## 2. Commands
-
-See "Quick Reference" section at bottom for common commands.
-
----
-
-## 3. Key Patterns
-
-### API Versioning (V1 vs V2)
-
-**V1** (legacy) and **V2** (current) coexist. Key difference is output expansion:
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:49-52
-// V1 uses RequestContextOutputExpansionStrategy
-// V2+ uses RequestContextOutputExpansionStrategyV2
-return apiVersion.MajorVersion == 1
-    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-```
-
-**Why V2**: Improved `expand` and `fields` query parameter parsing (tree-based).
-
-### Query System Architecture
-
-Content querying flows through handlers registered in DI:
-
-1. **Selectors** (`fetch` parameter): `ancestors:id`, `children:id`, `descendants:id`
-2. **Filters** (`filter[]` parameter): `contentType:alias`, `name:value`, `createDate>2024-01-01`
-3. **Sorts** (`sort[]` parameter): `name:asc`, `createDate:desc`, `level:asc`
-
-```csharp
-// Services/ApiContentQueryService.cs:91-96
-ISelectorHandler? selectorHandler = _selectorHandlers.FirstOrDefault(h => h.CanHandle(fetch));
-return selectorHandler?.BuildSelectorOption(fetch);
-```
-
-### Path Decoding Workaround
-
-ASP.NET Core doesn't decode forward slashes in route parameters:
-
-```csharp
-// Controllers/DeliveryApiControllerBase.cs:21-31
-// OpenAPI clients URL-encode paths, but ASP.NET Core doesn't decode "/"
-// See https://github.com/dotnet/aspnetcore/issues/11544
-if (path.Contains("%2F", StringComparison.OrdinalIgnoreCase))
-{
-    path = WebUtility.UrlDecode(path);
-}
-```
-
----
-
-## 4. Testing
-
-**Location**: No direct tests - tested via integration tests in test projects
-
-```bash
-dotnet test tests/Umbraco.Tests.Integration/ --filter "FullyQualifiedName~Delivery"
-```
-
-**Internals exposed to** (csproj lines 28-36):
-- `Umbraco.Tests.UnitTests`
-- `Umbraco.Tests.Integration`
-- `DynamicProxyGenAssembly2` (for mocking)
-
-**Focus areas**:
-- Query parsing (selectors, filters, sorts)
-- Member authentication flows
-- Output caching behavior
-- Protected content access
-
----
-
-## 5. Security & Access Control
-
-### Three Access Modes
-
-```csharp
-// Services/ApiAccessService.cs:21-27
-public bool HasPublicAccess() => _deliveryApiSettings.PublicAccess || HasValidApiKey();
-public bool HasPreviewAccess() => HasValidApiKey();
-public bool HasMediaAccess() => _deliveryApiSettings is { PublicAccess: true, Media.PublicAccess: true } || HasValidApiKey();
-```
-
-**Access levels**:
-1. **Public** - No authentication required (if enabled)
-2. **API Key** - Via `Api-Key` header
-3. **Preview** - Always requires API key
-
-### Member Authentication
-
-OpenIddict-based OAuth 2.0 for member-protected content:
-
-**Flows supported** (Controllers/Security/MemberController.cs):
-- Authorization Code + PKCE (line 53)
-- Client Credentials (line 112)
-- Refresh Token (line 98)
-
-**Endpoints**:
-- `GET /umbraco/delivery/api/v1/security/member/authorize`
-- `POST /umbraco/delivery/api/v1/security/member/token`
-- `GET /umbraco/delivery/api/v1/security/member/signout`
-
-**Scopes**: Only `openid` and `offline_access` allowed for members (line 220-222)
-
-### Protected Content
-
-Member access checked via `ProtectedAccess` model:
-
-```csharp
-// Controllers/Content/QueryContentApiController.cs:56-57
-ProtectedAccess protectedAccess = await _requestMemberAccessService.MemberAccessAsync();
-Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> queryAttempt =
-    _apiContentQueryService.ExecuteQuery(fetch, filter, sort, protectedAccess, skip, take);
-```
-
----
-
-## 6. Output Caching
-
-### Cache Policy Configuration
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:120-136
-// Content and Media have separate cache durations
-options.AddPolicy(
-    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
-    new DeliveryApiOutputCachePolicy(
-        outputCacheSettings.ContentDuration,
-        new StringValues([AcceptLanguage, AcceptSegment, StartItem])));
-```
-
-**Cache invalidation conditions** (Caching/DeliveryApiOutputCachePolicy.cs:31):
-```csharp
-// Never cache preview or non-public access
-context.EnableOutputCaching = requestPreviewService.IsPreview() is false
-    && apiAccessService.HasPublicAccess();
-```
-
-**Vary by headers**: `Accept-Language`, `Accept-Segment`, `Start-Item`
-
----
-
-## 7. Edge Cases & Known Issues
-
-### Technical Debt (TODOs in codebase)
-
-1. **V1 Removal Pending** (4 locations):
-   - `DependencyInjection/UmbracoBuilderExtensions.cs:98` - FIXME: remove matcher policy
-   - `Routing/DeliveryApiItemsEndpointsMatcherPolicy.cs:11` - FIXME: remove class
-   - `Filters/SwaggerDocumentationFilterBase.cs:79,83` - FIXME: remove V1 swagger docs
-
-2. **Obsolete Reference Warnings** (csproj:9-13):
-   - `ASP0019` - IHeaderDictionary.Append usage
-   - `CS0618/CS0612` - Obsolete member references
-
-### Empty Query Results
-
-Query service returns empty results (not errors) for invalid options:
-
-```csharp
-// Services/ApiContentQueryService.cs:54-78
-// Invalid selector/filter/sort returns fail status with empty result
-return Attempt.FailWithStatus(ApiContentQueryOperationStatus.SelectorOptionNotFound, emptyResult);
-```
-
-### Start Item Fallback
-
-When no `fetch` parameter provided, uses start item or all content:
-
-```csharp
-// Services/ApiContentQueryService.cs:99-112
-if (_requestStartItemProviderAccessor.TryGetValue(out IRequestStartItemProvider? requestStartItemProvider))
-{
-    IPublishedContent? startItem = requestStartItemProvider.GetStartItem();
-    // Use descendants of start item
-}
-return _apiContentQueryProvider.AllContentSelectorOption(); // Fallback to all
-```
-
----
-
-## 8. Project-Specific Notes
-
-### V1 vs V2 Differences
-
-| Feature | V1 | V2 |
-|---------|----|----|
-| Output expansion | Basic | Tree-based parsing |
-| `expand` parameter | Flat list | Nested syntax |
-| `fields` parameter | Limited | Full property selection |
-| Default expansion strategy | `RequestContextOutputExpansionStrategy` | `RequestContextOutputExpansionStrategyV2` |
-
-**Migration note**: V1 is deprecated; plan removal when V17+ drops V1 support.
-
-### JSON Configuration
-
-Delivery API has its own JSON options (distinct from Management API):
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:82-88
-.AddJsonOptions(Constants.JsonOptionsNames.DeliveryApi, options =>
-{
-    options.JsonSerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.CamelCase;
-    options.JsonSerializerOptions.TypeInfoResolver = new DeliveryApiJsonTypeResolver();
-    options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
-});
-```
-
-### Member Token Revocation
-
-Tokens automatically revoked on member changes:
-
-```csharp
-// DependencyInjection/UmbracoBuilderExtensions.cs:93-96
-builder.AddNotificationAsyncHandler<MemberSavedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<MemberDeletedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<AssignedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-builder.AddNotificationAsyncHandler<RemovedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
-```
-
-### External Dependencies
-
-**Examine/Lucene** (via Core):
-- Powers content querying
-- Selector/Filter/Sort handlers build Lucene queries
-
-**OpenIddict** (via Api.Common):
-- Member OAuth 2.0 authentication
-- Reference tokens (not JWT)
-
-### Configuration (appsettings.json)
-
-```json
-{
-  "Umbraco": {
-    "CMS": {
-      "DeliveryApi": {
-        "Enabled": true,
-        "PublicAccess": true,
-        "ApiKey": "your-api-key",
-        "Media": {
-          "Enabled": true,
-          "PublicAccess": true
-        },
-        "MemberAuthorization": {
-          "AuthorizationCodeFlow": { "Enabled": true },
-          "ClientCredentialsFlow": { "Enabled": false }
-        },
-        "OutputCache": {
-          "Enabled": true,
-          "ContentDuration": "00:01:00",
-          "MediaDuration": "00:01:00"
-        }
-      }
-    }
-  }
-}
-```
-
-### API Endpoints Summary
-
-**Content** (`/umbraco/delivery/api/v2/content`):
-- `GET /item/{id}` - Single content by GUID
-- `GET /item/{path}` - Single content by route
-- `GET /items` - Multiple by IDs
-- `GET /` - Query with fetch/filter/sort
-
-**Media** (`/umbraco/delivery/api/v2/media`):
-- `GET /item/{id}` - Single media by GUID
-- `GET /item/{path}` - Single media by path
-- `GET /items` - Multiple by IDs
-- `GET /` - Query media
-
-**Security** (`/umbraco/delivery/api/v1/security/member`):
-- `GET /authorize` - Start OAuth flow
-- `POST /token` - Exchange code for token
-- `GET /signout` - Revoke session
-
----
-
-## Quick Reference
-
-### Essential Commands
-
-```bash
-# Build project
-dotnet build src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj
-
-# Pack for NuGet
-dotnet pack src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj -c Release
-
-# Run integration tests
-dotnet test tests/Umbraco.Tests.Integration/ --filter "FullyQualifiedName~Delivery"
-
-# Check packages
-dotnet list src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj package --outdated
-```
-
-### Key Classes
-
-| Class | Purpose | File |
-|-------|---------|------|
-| `DeliveryApiControllerBase` | Base controller with path decoding | Controllers/DeliveryApiControllerBase.cs |
-| `ApiContentQueryService` | Query orchestration | Services/ApiContentQueryService.cs |
-| `ApiAccessService` | Access control logic | Services/ApiAccessService.cs |
-| `DeliveryApiOutputCachePolicy` | Cache policy implementation | Caching/DeliveryApiOutputCachePolicy.cs |
-| `MemberController` | OAuth endpoints | Controllers/Security/MemberController.cs |
-| `RequestContextOutputExpansionStrategyV2` | V2 output expansion | Rendering/RequestContextOutputExpansionStrategyV2.cs |
-
-### Important Files
-
-- `Umbraco.Cms.Api.Delivery.csproj` - Project dependencies
-- `DependencyInjection/UmbracoBuilderExtensions.cs` - DI registration (lines 33-141)
-- `Configuration/DeliveryApiConfiguration.cs` - API constants
-- `Services/ApiContentQueryService.cs` - Query execution
-
-### Getting Help
-
-- **Root documentation**: `/CLAUDE.md` - Repository overview
-- **API Common patterns**: `/src/Umbraco.Cms.Api.Common/CLAUDE.md`
-- **Official docs**: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api
-- **Media docs**: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/media-delivery-api
-
----
-
-**This library exposes Umbraco content and media via REST for headless scenarios. Focus on query handlers, access control, and member authentication when working here.**

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Delivery.Filters;

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -35,9 +35,23 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            var schemaRef = new OpenApiSecuritySchemeReference(AuthSchemeName, context.Document);
-            operation.Security ??= new List<OpenApiSecurityRequirement>();
-            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = AuthSchemeName,
+                            }
+                        },
+                        []
+                    }
+                }
+            };
         }
 
         public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
@@ -47,7 +61,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            swaggerDoc.AddComponent(
+            swaggerDoc.Components.SecuritySchemes.Add(
                 AuthSchemeName,
                 new OpenApiSecurityScheme
                 {
@@ -60,9 +74,9 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                         AuthorizationCode = new OpenApiOAuthFlow
                         {
                             AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
-                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative),
-                        },
-                    },
+                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
+                        }
+                    }
                 });
         }
     }

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByRouteContentApiController.cs

@@ -99,8 +99,8 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
 
     private IActionResult RedirectTo(IApiContentRoute redirectRoute)
     {
-        Response.Headers.Append("Location-Start-Item-Path", redirectRoute.StartItem.Path);
-        Response.Headers.Append("Location-Start-Item-Id", redirectRoute.StartItem.Id.ToString("D"));
+        Response.Headers.Add("Location-Start-Item-Path", redirectRoute.StartItem.Path);
+        Response.Headers.Add("Location-Start-Item-Id", redirectRoute.StartItem.Id.ToString("D"));
         return RedirectPermanent(redirectRoute.Path);
     }
 }

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -35,35 +35,28 @@ public static class UmbracoBuilderExtensions
         builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-
-        builder.Services.AddUnique<IOutputExpansionStrategy>(
-            provider =>
+        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
+        {
+            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+            if (apiVersion is null)
             {
-                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-                if (apiVersion is null)
-                {
-                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-                }
-
-                // V1 of the Delivery API uses a different expansion strategy than V2+
-                return apiVersion.MajorVersion == 1
-                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            },
-            ServiceLifetime.Scoped);
+                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            }
 
+            // V1 of the Delivery API uses a different expansion strategy than V2+
+            return apiVersion.MajorVersion == 1
+                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+        });
         builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
         builder.Services.AddSingleton<IRequestSegmmentService, RequestSegmentService>();
         builder.Services.AddSingleton<IRequestSegmentService, RequestSegmentService>();
         builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
         builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
         builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-
-        // Webooks register a more basic implementation, remove it.
-        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
+        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
         builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
-
         builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
         builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
         builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerContentDocumentationFilter.cs

@@ -1,9 +1,9 @@
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
-using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
@@ -13,7 +13,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
     protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
     {
-        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters ??= new List<OpenApiParameter>();
 
         AddExpand(operation, context);
 
@@ -21,50 +21,50 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.AcceptLanguage,
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Defines the language to return. Use this when querying language variant content items.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            Examples = new Dictionary<string, IOpenApiExample>
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                { "Default", new OpenApiExample { Value = string.Empty } },
-                { "English culture", new OpenApiExample { Value = "en-us" } },
-            },
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "English culture", new OpenApiExample { Value = new OpenApiString("en-us") } }
+            }
         });
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.AcceptSegment,
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptSegment,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Defines the segment to return. Use this when querying segment variant content items.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            Examples = new Dictionary<string, IOpenApiExample>
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                { "Default", new OpenApiExample { Value = string.Empty } },
-                { "Segment One", new OpenApiExample { Value = "segment-one" } },
-            },
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Segment One", new OpenApiExample { Value = new OpenApiString("segment-one") } }
+            }
         });
 
         AddApiKey(operation);
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.Preview,
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Whether to request draft content.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.Boolean },
+            Schema = new OpenApiSchema { Type = "boolean" }
         });
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.StartItem,
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
             In = ParameterLocation.Header,
             Required = false,
             Description = "URL segment or GUID of a root content item.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+            Schema = new OpenApiSchema { Type = "string" }
         });
     }
 
@@ -92,36 +92,105 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
         }
     }
 
-    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
         new()
         {
-            { "Select all", new OpenApiExample { Value = string.Empty } },
-            { "Select all ancestors of a node by id", new OpenApiExample { Value = "ancestors:id" } },
-            { "Select all ancestors of a node by path", new OpenApiExample { Value = "ancestors:path" } },
-            { "Select all children of a node by id", new OpenApiExample { Value = "children:id" } },
-            { "Select all children of a node by path", new OpenApiExample { Value = "children:path" } },
-            { "Select all descendants of a node by id", new OpenApiExample { Value = "descendants:id" } },
-            { "Select all descendants of a node by path", new OpenApiExample { Value = "descendants:path" } },
+            { "Select all", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Select all ancestors of a node by id",
+                new OpenApiExample { Value = new OpenApiString("ancestors:id") }
+            },
+            {
+                "Select all ancestors of a node by path",
+                new OpenApiExample { Value = new OpenApiString("ancestors:path") }
+            },
+            {
+                "Select all children of a node by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a node by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            },
+            {
+                "Select all descendants of a node by id",
+                new OpenApiExample { Value = new OpenApiString("descendants:id") }
+            },
+            {
+                "Select all descendants of a node by path",
+                new OpenApiExample { Value = new OpenApiString("descendants:path") }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
         new()
         {
-            { "Default filter", new OpenApiExample { Value = string.Empty } },
-            { "Filter by content type (equals)", new OpenApiExample { Value = new JsonArray { "contentType:alias1" } } },
-            { "Filter by name (contains)", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
-            { "Filter by creation date (less than)", new OpenApiExample { Value = new JsonArray { "createDate<2024-01-01" } } },
-            { "Filter by update date (greater than or equal)", new OpenApiExample { Value = new JsonArray { "updateDate>:2023-01-01" } } },
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by content type (equals)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("contentType:alias1") } }
+            },
+            {
+                "Filter by name (contains)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            },
+            {
+                "Filter by creation date (less than)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("createDate<2024-01-01") } }
+            },
+            {
+                "Filter by update date (greater than or equal)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("updateDate>:2023-01-01") } }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
         new()
         {
-            { "Default sort", new OpenApiExample { Value = string.Empty } },
-            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
-            { "Sort by level", new OpenApiExample { Value = new JsonArray { "level:asc", "level:desc" } } },
-            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
-            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
-            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by level",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("level:asc"), new OpenApiString("level:desc") }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
         };
 }

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerDocumentationFilterBase.cs

@@ -1,7 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
@@ -9,8 +9,6 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
     : SwaggerFilterBase<TBaseController>, IOperationFilter, IParameterFilter
     where TBaseController : Controller
 {
-    protected abstract string DocumentationLink { get; }
-
     public void Apply(OpenApiOperation operation, OperationFilterContext context)
     {
         if (CanApply(context))
@@ -19,19 +17,21 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
         }
     }
 
-    public void Apply(IOpenApiParameter parameter, ParameterFilterContext context)
+    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
     {
-        if (CanApply(context) && parameter is OpenApiParameter openApiParameter)
+        if (CanApply(context))
         {
-            ApplyParameter(openApiParameter, context);
+            ApplyParameter(parameter, context);
         }
     }
 
+    protected abstract string DocumentationLink { get; }
+
     protected abstract void ApplyOperation(OpenApiOperation operation, OperationFilterContext context);
 
     protected abstract void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context);
 
-    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, IOpenApiExample> examples, string description)
+    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, OpenApiExample> examples, string description)
     {
         parameter.Description = QueryParameterDescription(description);
         parameter.Examples = examples;
@@ -60,19 +60,15 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
         AddFields(operation);
     }
 
-    protected void AddApiKey(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
-            {
-                Name = Constants.DeliveryApi.HeaderNames.ApiKey,
-                In = ParameterLocation.Header,
-                Required = false,
-                Description = "API key specified through configuration to authorize access to the API.",
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            });
-    }
+    protected void AddApiKey(OpenApiOperation operation) =>
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "API key specified through configuration to authorize access to the API.",
+            Schema = new OpenApiSchema { Type = "string" }
+        });
 
     protected string PaginationDescription(bool skip, string itemType)
         => $"Specifies the number of found {itemType} items to {(skip ? "skip" : "take")}. Use this to control pagination of the response.";
@@ -86,70 +82,78 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
 
     // FIXME: remove this when Delivery API V1 has been removed (expectedly in V15)
     private void AddExpandV1(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "expand",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all", new OpenApiExample { Value = new OpenApiString("all") } },
                 {
-                    { "Expand none", new OpenApiExample { Value = string.Empty } },
-                    { "Expand all", new OpenApiExample { Value = "all" } },
-                    { "Expand specific property", new OpenApiExample { Value = "property:alias1" } },
-                    { "Expand specific properties", new OpenApiExample { Value = "property:alias1,alias2" } },
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1") }
                 },
-            });
-    }
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1,alias2") }
+                }
+            }
+        });
 
     private void AddExpand(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "expand",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
                 {
-                    { "Expand none", new OpenApiExample { Value = string.Empty } },
-                    { "Expand all properties", new OpenApiExample { Value = "properties[$all]" } },
-                    { "Expand specific property", new OpenApiExample { Value = "properties[alias1]" } },
-                    { "Expand specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
-                    { "Expand nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
                 },
-            });
-    }
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Expand nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
 
     private void AddFields(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "fields",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Explicitly defines which properties should be included in the response (by default all properties are included)"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "fields",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription(
-                        "Explicitly defines which properties should be included in the response (by default all properties are included)"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Include all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
                 {
-                    { "Include all properties", new OpenApiExample { Value = "properties[$all]" } },
-                    { "Include only specific property", new OpenApiExample { Value = "properties[alias1]" } },
-                    { "Include only specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
-                    { "Include only specific nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
+                    "Include only specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
                 },
-            });
-    }
+                {
+                    "Include only specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Include only specific nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
 }

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerMediaDocumentationFilter.cs

@@ -1,7 +1,8 @@
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Media;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
@@ -12,7 +13,7 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt
 
     protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
     {
-        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters ??= new List<OpenApiParameter>();
 
         AddExpand(operation, context);
 
@@ -45,29 +46,77 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt
         }
     }
 
-    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
         new()
         {
-            { "Select all children at root level", new OpenApiExample { Value = "children:/" } },
-            { "Select all children of a media item by id", new OpenApiExample { Value = "children:id" } },
-            { "Select all children of a media item by path", new OpenApiExample { Value = "children:path" } },
+            {
+                "Select all children at root level",
+                new OpenApiExample { Value = new OpenApiString("children:/") }
+            },
+            {
+                "Select all children of a media item by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a media item by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
         new()
         {
-            { "Default filter", new OpenApiExample { Value = string.Empty } },
-            { "Filter by media type", new OpenApiExample { Value = new JsonArray { "mediaType:alias1" } } },
-            { "Filter by name", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by media type",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("mediaType:alias1") } }
+            },
+            {
+                "Filter by name",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
         new()
         {
-            { "Default sort", new OpenApiExample { Value = string.Empty } },
-            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
-            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
-            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
-            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
         };
 }

src/Umbraco.Cms.Api.Delivery/Rendering/RequestContextOutputExpansionStrategyV2.cs

@@ -1,25 +1,62 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
-using Umbraco.Cms.Api.Common.Rendering;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Rendering;
 
-internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
 {
+    private const string All = "$all";
+    private const string None = "";
+    private const string ExpandParameterName = "expand";
+    private const string FieldsParameterName = "fields";
+
+    private readonly IApiPropertyRenderer _propertyRenderer;
     private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;
 
+    private readonly Stack<Node?> _expandProperties;
+    private readonly Stack<Node?> _includeProperties;
+
     public RequestContextOutputExpansionStrategyV2(
         IHttpContextAccessor httpContextAccessor,
         IApiPropertyRenderer propertyRenderer,
         ILogger<RequestContextOutputExpansionStrategyV2> logger)
-        : base(propertyRenderer)
     {
+        _propertyRenderer = propertyRenderer;
         _logger = logger;
+        _expandProperties = new Stack<Node?>();
+        _includeProperties = new Stack<Node?>();
 
         InitializeExpandAndInclude(httpContextAccessor);
     }
 
+    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
+        => content.ItemType == PublishedItemType.Content
+            ? MapProperties(content.Properties)
+            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
+
+    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
+    {
+        if (media.ItemType != PublishedItemType.Media)
+        {
+            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
+        }
+
+        IPublishedProperty[] properties = media
+            .Properties
+            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
+            .ToArray();
+
+        return properties.Any()
+            ? MapProperties(properties)
+            : new Dictionary<string, object?>();
+    }
+
+    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
+        => MapProperties(element.Properties, true);
+
     private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
     {
         string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -29,7 +66,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutpu
 
         try
         {
-            ExpandProperties.Push(Node.Parse(toExpand));
+            _expandProperties.Push(Node.Parse(toExpand));
         }
         catch (ArgumentException ex)
         {
@@ -39,7 +76,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutpu
 
         try
         {
-            IncludeProperties.Push(Node.Parse(toInclude));
+            _includeProperties.Push(Node.Parse(toInclude));
         }
         catch (ArgumentException ex)
         {
@@ -47,4 +84,102 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutpu
             throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
         }
     }
+
+    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
+    {
+        Node? currentExpandProperties = _expandProperties.Peek();
+        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        Node? currentIncludeProperties = _includeProperties.Peek();
+        var result = new Dictionary<string, object?>();
+        foreach (IPublishedProperty property in properties)
+        {
+            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
+            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
+            {
+                continue;
+            }
+
+            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
+
+            _includeProperties.Push(nextIncludeProperties);
+            _expandProperties.Push(nextExpandProperties);
+
+            result[property.Alias] = GetPropertyValue(property);
+
+            _expandProperties.Pop();
+            _includeProperties.Pop();
+        }
+
+        return result;
+    }
+
+    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
+        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
+           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
+
+    private object? GetPropertyValue(IPublishedProperty property)
+        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
+
+    private sealed class Node
+    {
+        public string Key { get; private set; } = string.Empty;
+
+        public List<Node> Items { get; } = new();
+
+        public static Node Parse(string value)
+        {
+            // verify that there are as many start brackets as there are end brackets
+            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
+            {
+                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
+            }
+
+            // verify that the value does not start with a start bracket
+            if (value.StartsWith("["))
+            {
+                throw new ArgumentException("Value cannot start with a bracket");
+            }
+
+            // verify that there are no empty brackets
+            if (value.Contains("[]"))
+            {
+                throw new ArgumentException("Value cannot contain empty brackets");
+            }
+
+            var stack = new Stack<Node>();
+            var root = new Node { Key = "root" };
+            stack.Push(root);
+
+            var currentNode = new Node();
+            root.Items.Add(currentNode);
+
+            foreach (char c in value)
+            {
+                switch (c)
+                {
+                    case '[': // Start a new node, child of the current node
+                        stack.Push(currentNode);
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ',': // Start a new node, but at the same level of the current node
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ']': // Back to parent of the current node
+                        currentNode = stack.Pop();
+                        break;
+                    default: // Add char to current node key
+                        currentNode.Key += c;
+                        break;
+                }
+            }
+
+            return root;
+        }
+    }
 }

src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj

@@ -7,9 +7,10 @@
   <PropertyGroup>
     <!--
       TODO: Fix and remove overrides:
+      [ASP0019] use IHeaderDictionary.Append or the indexer to append or set headers
       [CS0618/CS0612] update obsolete references
     -->
-    <WarningsNotAsErrors>$(WarningsNotAsErrors),CS0618,CS0612</WarningsNotAsErrors>
+    <WarningsNotAsErrors>$(WarningsNotAsErrors),ASP0019,CS0618,CS0612</WarningsNotAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/Umbraco.Cms.Api.Management/CLAUDE.md

@@ -1,621 +0,0 @@
-# Umbraco CMS - Management API
-
-RESTful API for Umbraco backoffice operations. Manages content, media, users, and system configuration through OpenAPI-documented endpoints.
-
-**Project**: `Umbraco.Cms.Api.Management`
-**Type**: ASP.NET Core Web API Library
-**Files**: 1,317 C# files across 54+ controller domains
-
----
-
-## 1. Architecture
-
-### Target Framework
-- **.NET 10.0** (`net10.0`)
-- **C# 12** with nullable reference types enabled
-- **ASP.NET Core** Web API
-
-### Application Type
-**REST API Library** - Plugged into Umbraco.Web.UI, provides the Management API surface for backoffice operations.
-
-### Key Technologies
-- **Web Framework**: ASP.NET Core MVC with `Asp.Versioning.Mvc` (v1.0 currently)
-- **OpenAPI**: Swashbuckle.AspNetCore with custom schema/operation filters
-- **Authentication**: OpenIddict via `Umbraco.Cms.Api.Common` (reference tokens, not JWT)
-- **Authorization**: Policy-based with `IAuthorizationService`
-- **Validation**: FluentValidation via base controllers
-- **Serialization**: System.Text.Json with custom converters
-- **Mapping**: Manual presentation factories (no AutoMapper)
-- **Patching**: JsonPatch.Net for PATCH operations
-- **Real-time**: SignalR hubs (`BackofficeHub`, `ServerEventHub`)
-- **DI**: Microsoft.Extensions.DependencyInjection via `ManagementApiComposer`
-
-### Project Structure
-```
-src/Umbraco.Cms.Api.Management/
-├── Controllers/                   # 54+ domain-specific controller folders
-│   ├── Document/                  # Document (content) CRUD + publish/unpublish
-│   ├── Media/                     # Media CRUD + upload
-│   ├── Member/                    # Member management
-│   ├── User/                      # User management
-│   ├── DataType/                  # Data type configuration
-│   ├── DocumentType/              # Content type schemas
-│   ├── Template/                  # Razor template management
-│   ├── Dictionary/                # Localization dictionary
-│   ├── Language/                  # Language/culture config
-│   ├── Security/                  # Auth, login, external logins
-│   ├── Install/                   # Installation wizard
-│   ├── Upgrade/                   # Upgrade operations
-│   ├── LogViewer/                 # Log browsing
-│   ├── HealthCheck/               # Health check dashboard
-│   ├── Webhook/                   # Webhook management
-│   └── [48 more domains...]
-│
-├── ViewModels/                    # Request/response DTOs (one folder per domain)
-├── Factories/                     # Domain model → ViewModel converters
-├── Services/                      # Business logic (thin layer over Core.Services)
-├── Mapping/                       # ViewModel → domain model mappers
-├── Security/                      # Auth providers, sign-in manager, external logins
-├── OpenApi/                       # Swashbuckle filters (schema, operation, security)
-├── Routing/                       # Route configuration, SignalR hubs
-├── DependencyInjection/           # Service registration (55+ files)
-├── Middleware/                    # Preview, server events
-├── Configuration/                 # IOptions configurators
-├── Filters/                       # Action filters
-├── Serialization/                 # JSON converters
-└── OpenApi.json                   # Embedded OpenAPI spec (1.3MB)
-```
-
-### Dependencies
-- **Umbraco.Cms.Api.Common** - Shared API infrastructure (base controllers, OpenAPI config)
-- **Umbraco.Infrastructure** - Service implementations, data access
-- **Umbraco.PublishedCache.HybridCache** - Published content queries
-- **JsonPatch.Net** - JSON Patch (RFC 6902) support
-- **Swashbuckle.AspNetCore** - OpenAPI generation
-
-### Design Patterns
-1. **Controller-per-Operation** - Each endpoint is a separate controller class
-   - Example: `CreateDocumentController`, `UpdateDocumentController`, `DeleteDocumentController`
-   - Enables fine-grained authorization and operation-specific logic
-   - **Responsibilities**: entrypoint/routing, authorization and mapping
-   - **avoid**: business logic directly in controllers (there are a few known violations)
-
-2. **Presentation Factory Pattern** - Factories convert domain models to ViewModels
-   - Example: `IDocumentEditingPresentationFactory` (src/Umbraco.Cms.Api.Management/Factories/)
-   - Separation: Controllers → Factories → ViewModels
-
-3. **Attempt Pattern** - Operations return `Attempt<TResult, TStatus>` for status-based error handling
-   - Controllers map status enums to HTTP status codes via helper methods
-
-4. **Authorization Service Pattern** - All authorization via `IAuthorizationService`, not attributes
-   - Checked in base controller methods (see `ManagementApiControllerBase`)
-
-5. **Options Pattern** - All configuration via `IOptions<T>` (security, routing, OpenAPI)
-
-6. **SignalR Event Broadcasting** - Real-time notifications via `BackofficeHub` and `ServerEventHub`
-
----
-
-## 2. Commands
-
-### Build & Run
-```bash
-# Build
-dotnet build src/Umbraco.Cms.Api.Management
-
-# Test (tests in ../../tests/Umbraco.Tests.Integration and Umbraco.Tests.UnitTests)
-dotnet test --filter "FullyQualifiedName~Management"
-
-# Pack (for NuGet distribution)
-dotnet pack src/Umbraco.Cms.Api.Management -c Release
-```
-
-### Code Quality
-```bash
-# Format code
-dotnet format src/Umbraco.Cms.Api.Management
-
-# Build with warnings (note: some warnings suppressed, see .csproj line 23)
-dotnet build src/Umbraco.Cms.Api.Management /p:TreatWarningsAsErrors=true
-```
-
-### OpenAPI Documentation
-The project embeds a pre-generated `OpenApi.json` (1.3MB). To regenerate:
-```bash
-# Run Umbraco.Web.UI, access /umbraco/swagger
-# Export JSON from Swagger UI
-```
-
-### Package Management
-```bash
-# Add package (versions centralized in Directory.Packages.props)
-dotnet add src/Umbraco.Cms.Api.Management package [PackageName]
-
-# Check for vulnerable packages
-dotnet list src/Umbraco.Cms.Api.Management package --vulnerable
-```
-
-### Environment Setup
-1. **Prerequisites**: .NET 10 SDK
-2. **IDE**: Visual Studio 2022 or Rider (with .editorconfig support)
-3. **Configuration**: Inherits from `Umbraco.Web.UI` appsettings (no app settings in this library)
-
----
-
-## 3. Style Guide
-
-### Project-Specific Patterns
-
-**Controller Naming** (line examples from CreateDocumentController.cs:16):
-```csharp
-[ApiVersion("1.0")]
-public class CreateDocumentController : CreateDocumentControllerBase
-```
-- Pattern: `{Verb}{Entity}Controller` (e.g., `CreateDocumentController`, `UpdateMediaController`)
-- Base class: `{Verb}{Entity}ControllerBase` for shared logic
-- **Critical**: One operation per controller (not one controller per resource)
-
-**Async Naming** - All async methods use `Async` suffix consistently:
-```csharp
-await _contentEditingService.CreateAsync(model, CurrentUserKey(_backOfficeSecurityAccessor));
-```
-
-**Factory Pattern Usage** (line 44):
-```csharp
-ContentCreateModel model = _documentEditingPresentationFactory.MapCreateModel(requestModel);
-```
-- ViewModels → Domain: `Map{Operation}Model(requestModel)`
-- Domain → ViewModels: Factory classes in `Factories/` folder
-
-### Key Patterns from Codebase
-
-**ControllerBase Helper Methods** (inherited from `ManagementApiControllerBase` in Api.Common):
-- `CreatedAtId<TController>(expression, id)` - Returns 201 with Location header
-- `ContentEditingOperationStatusResult(status)` - Maps status enum to ProblemDetails
-- `CurrentUserKey(accessor)` - Gets current user from security context
-
-**Authorization Pattern** (all controllers):
-```csharp
-private readonly IAuthorizationService _authorizationService;
-// Check permissions in action, not via [Authorize] attribute
-```
-
----
-
-## 4. Test Bench
-
-### Test Location
-- **Unit Tests**: `tests/Umbraco.Tests.UnitTests/Umbraco.Cms.Api.Management/`
-- **Integration Tests**: `tests/Umbraco.Tests.Integration/Umbraco.Cms.Api.Management/`
-
-### Running Tests
-```bash
-# All Management API tests
-dotnet test --filter "FullyQualifiedName~Management"
-
-# Specific domain (e.g., Document controllers)
-dotnet test --filter "FullyQualifiedName~Management.Controllers.Document"
-```
-
-### Testing Focus
-1. **Controller logic** - Request validation, authorization checks, status code mapping
-2. **Factories** - ViewModel ↔ Domain model conversion accuracy
-3. **Authorization** - Policy enforcement for each operation
-4. **OpenAPI schema** - Ensure Swagger generation doesn't break
-
-### InternalsVisibleTo
-Tests have access to internal types (see .csproj:44-52):
-- `Umbraco.Tests.UnitTests`
-- `Umbraco.Tests.Integration`
-- `DynamicProxyGenAssembly2` (for Moq)
-
----
-
-## 5. Error Handling
-
-### Operation Status Pattern
-Controllers use `Attempt<TResult, TStatus>` with strongly-typed status enums:
-```csharp
-Attempt<ContentCreateResult, ContentEditingOperationStatus> result =
-    await _contentEditingService.CreateAsync(model, userKey);
-
-return result.Success
-    ? CreatedAtId<ByKeyDocumentController>(controller => nameof(controller.ByKey), result.Result.Content!.Key)
-    : ContentEditingOperationStatusResult(result.Status); // Maps to ProblemDetails
-```
-
-**Status Enums** (from Core):
-- `ContentEditingOperationStatus` - InvalidParent, NotFound, NotAllowed, etc.
-- `UserOperationStatus` - UserNameIsNotEmail, DuplicateUserName, etc.
-- Each enum value maps to specific HTTP status + ProblemDetails type
-
-### ProblemDetails
-All errors return RFC 7807 ProblemDetails via helper methods in base controllers:
-- 400 Bad Request: Validation failures, invalid operations
-- 403 Forbidden: Authorization failures
-- 404 Not Found: Resource not found
-- 409 Conflict: Duplicate operations
-
-### Critical Logging Points
-1. **Authorization failures** - Logged by AuthorizationService
-2. **Service operation failures** - Logged in Infrastructure layer services
-3. **External login errors** - BackOfficeSignInManager (Security/)
-
----
-
-## 6. Clean Code
-
-### Key Design Decisions
-
-**Why Controller-per-Operation?** (not RESTful resource-based controllers)
-- Fine-grained authorization per operation
-- Operation-specific request/response models
-- Clearer OpenAPI documentation
-- Example: 20+ controllers in `Controllers/Document/` for different operations
-
-**Why Manual Factories instead of AutoMapper?**
-- Explicit control over mapping logic
-- Easier debugging (no magic)
-- Better performance (no reflection overhead)
-- See `Factories/` directory (92 factory classes)
-
-### Project-Specific Architectural Decisions
-
-**Embedded OpenAPI Spec** (OpenApi.json - 1.3MB):
-- Pre-generated, embedded as resource
-- Served for client SDK generation
-- **Why?** Deterministic output, faster startup (no runtime generation)
-
-**SignalR for Real-time** (Routing/BackofficeHub.cs:33):
-- `BackofficeHub` - User notifications, cache refreshes
-- `ServerEventHub` - Background job updates, health checks
-- Routes: `/umbraco/backoffice-signalr`, `/umbraco/serverevent-signalr`
-
-### Code Smells to Watch For
-
-1. **Large factory classes** - Some factories have 1000+ lines (e.g., `UserGroupPresentationFactory.cs`)
-   - Consider splitting by operation
-
-2. **Repeated authorization checks** - Each controller duplicates auth logic
-   - Already abstracted to base classes, but still verbose
-
-3. **ViewModel explosion** - 1000+ ViewModel classes across ViewModels/ folders
-   - Consider shared base models or composition
-
----
-
-## 7. Security
-
-### Authentication & Authorization
-**Method**: OpenIddict (OAuth 2.0) via Umbraco.Cms.Api.Common
-- Reference tokens (not JWT) stored in database
-- Token validation via OpenIddict middleware
-- ASP.NET Core Data Protection for token encryption
-
-**Authorization**:
-- Basic authorization is done trough policies and the `AuthorizeAttribute`
-```csharp
-// Example from DocumentTreeControllerBase.cs, the user needs at least access to a section that uses trees
-[Authorize(Policy = AuthorizationPolicies.SectionAccessForContentTree)]
-```
-- Authorization that needs (parts of) the payload are done manually trough the IAuthorizationService
-```csharp
-// Example from CreateDocumentController.cs:22
-private readonly IAuthorizationService _authorizationService;
-
-// Authorization checked in base controller methods, not attributes
-protected async Task<IActionResult> HandleRequest(request, Func<Task<IActionResult>> handler)
-{
-    var authResult = await _authorizationService.AuthorizeAsync(User, request, policy);
-    // ...
-}
-```
-
-**Policies** (defined in Security/Authorization/):
-- `ContentPermissionHandler` - Document/Media CRUD permissions
-- `SectionAccessHandler` - Backoffice section access
-- `UserGroupPermissionHandler` - Admin operations
-
-**Password Requirements** (Security/ConfigureBackOfficeIdentityOptions.cs:18):
-- See Identity options configuration
-
-### External Login Providers
-**Location**: `Security/BackOfficeExternalLoginProviders.cs`
-- Google, Microsoft, OpenID Connect providers
-- Auto-linking with `ExternalSignInAutoLinkOptions`
-- **Critical**: Validate external claims before auto-linking users
-
-### Input Validation
-**FluentValidation** used throughout:
-- Request models validated automatically via MVC integration
-- Custom validators in each domain folder (e.g., `ViewModels/Document/Validators/`)
-
-**Parameter Validation**:
-```csharp
-// Controllers validate IDs, keys before service calls
-if (requestModel.Parent == null)
-    return BadRequest(new ProblemDetailsBuilder()...);
-```
-
-### API Security
-**CORS** - Configured in Umbraco.Web.UI (not this project)
-
-**HTTPS Enforcement** - Configured in Umbraco.Web.UI
-
-**Request Size Limits** - Configured for file uploads in Umbraco.Web.UI
-
-**Security Headers** - Handled by Umbraco.Web.UI middleware
-
-### Secrets Management
-**No secrets in this project** - Configuration injected from parent application (Umbraco.Web.UI)
-
-### Dependency Security
-```bash
-# Check vulnerable packages
-dotnet list src/Umbraco.Cms.Api.Management package --vulnerable
-```
-
-### Security Anti-Patterns to Avoid
-1. **Never bypass authorization checks** - All operations must authorize
-2. **Never trust client validation** - Always validate on server
-3. **Never expose stack traces** - ProblemDetails abstracts errors
-4. **Never log sensitive data** - User passwords, tokens, API keys
-
----
-
-## 8. Teamwork and Workflow
-
-**⚠️ SKIPPED** - This is a sub-project. See root `/CLAUDE.md` for repository-wide teamwork protocols.
-
----
-
-## 9. Edge Cases
-
-### Domain-Specific Edge Cases
-
-**Document Operations**:
-1. **Publishing with descendants** - Can timeout on large trees
-   - Use `PublishDocumentWithDescendantsController` with result polling
-   - See `Controllers/Document/PublishDocumentWithDescendantsResultController.cs`
-
-2. **Recycle bin operations** - Items in recycle bin can't be published
-   - Check `IsTrashed` before publish operations
-
-3. **Public access rules** - Affects authorization and routing
-   - See `Controllers/Document/CreatePublicAccessDocumentController.cs`
-
-**Media Upload**:
-1. **Large file uploads** - Request size limits in parent app
-   - Controllers accept multipart/form-data
-   - Temporary files cleaned by background job
-
-2. **Media picker** - Can reference deleted media
-   - Validation in `Factories/` checks for orphaned references
-
-**User Management**:
-1. **External logins** - Auto-linking can create duplicate users if email mismatches
-   - See `Security/ExternalSignInAutoLinkOptions.cs`
-
-2. **User groups** - Deleting user group doesn't delete users
-   - Users reassigned to default group
-
-**Webhooks**:
-1. **Webhook failures** - Failed webhooks retry with exponential backoff
-   - See `Controllers/Webhook/` for configuration
-
-### Known Gotchas (from TODO comments)
-
-**StyleSheet/Script/PartialView Tree Controllers** - All have identical TODO comment:
-```
-TODO: [NL] This must return path segments for a query to work
-// src/Umbraco.Cms.Api.Management/Controllers/Stylesheet/Tree/StylesheetTreeControllerBase.cs
-// src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/ScriptTreeControllerBase.cs
-// src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/PartialViewTreeControllerBase.cs
-```
-
-**BackOfficeController** - External login TODO:
-```
-// src/Umbraco.Cms.Api.Management/Controllers/Security/BackOfficeController.cs
-// TODO: Handle external logins properly
-```
-
----
-
-## 10. Agentic Workflow
-
-### When to Add a New Endpoint
-
-**Decision Points**:
-1. Does the operation fit an existing controller domain? (Document, Media, User, etc.)
-2. Is this a new CRUD operation or a custom action?
-3. Does this require new authorization policies?
-
-**Workflow**:
-1. **Create Controller** in appropriate `Controllers/{Domain}/` folder
-   - Follow naming: `{Verb}{Entity}Controller`
-   - Inherit from domain-specific base controller or `ManagementApiControllerBase`
-
-2. **Define ViewModels** in `ViewModels/{Domain}/`
-   - Request model (e.g., `CreateDocumentRequestModel`)
-   - Response model (if not reusing existing)
-
-3. **Create or Update Factory** in `Factories/`
-   - Map request ViewModel → domain model
-   - Map domain result → response ViewModel
-
-4. **Authorization** - Check required permissions in controller action
-   - Use `IAuthorizationService.AuthorizeAsync()`
-
-5. **Service Layer** - Call Core services (from `Umbraco.Core.Services`)
-   - Handle `Attempt<>` results
-   - Map status to HTTP status codes
-
-6. **OpenAPI Annotations**:
-   - `[ApiVersion("1.0")]`
-   - `[MapToApiVersion("1.0")]`
-   - `[ProducesResponseType(...)]` for all status codes
-
-7. **Testing**:
-   - Unit test controller logic
-   - Integration test end-to-end flow
-
-8. **Update OpenApi.json** (if needed for client generation)
-
-### Quality Gates Before PR
-1. All tests pass
-2. Code formatted (`dotnet format`)
-3. No new warnings (check suppressed warnings list in .csproj:23)
-4. OpenAPI schema valid (run Swagger UI)
-5. Authorization tested (unit + integration tests)
-
-### Common Pitfalls
-1. **Forgetting authorization checks** - Every operation must authorize
-2. **Inconsistent status code mapping** - Use base controller helpers
-3. **Large factory classes** - Split by operation if >500 lines
-4. **Missing ProducesResponseType** - Breaks OpenAPI client generation
-5. **Not handling Attempt failures** - Always check `result.Success`
-
----
-
-## 11. Project-Specific Notes
-
-### Key Design Decisions
-
-**Why 1,317 files for one API?**
-- Controller-per-operation pattern = many controllers
-- 54 domains × average 10-20 operations per domain
-- Tradeoff: Verbose but explicit, easier to navigate than megacontrollers
-
-**Why manual factories instead of AutoMapper?**
-- Performance: No reflection overhead
-- Debuggability: Step through mapping logic
-- Control: Complex mappings (e.g., security trimming) require custom logic
-
-**Why embedded OpenApi.json?**
-- Deterministic OpenAPI spec for client generation
-- Faster startup (no runtime generation)
-- Easier versioning (commit changes to spec)
-- Added `OpenAPIContractTest` to test that all operations are exported
-
-### External Integrations
-None directly in this project. All integrations handled by:
-- **Umbraco.Infrastructure** - External search, media, email providers
-- **Umbraco.Core** - External data sources, webhooks
-
-### Known Limitations
-
-1. **API Versioning**: Currently v1.0 and v1.1
-   - Future versions will require new controller classes or action methods
-
-2. **Batch Operations**: Limited batch endpoint support
-   - Most operations are single-entity (create one document at a time)
-
-3. **Real-time Limits**: SignalR hubs don't scale beyond single-server without Redis backplane
-   - Configure Redis for multi-server setups
-
-4. **File Upload Size**: Controlled by parent app (Umbraco.Web.UI)
-   - This project doesn't set limits
-
-### Performance Considerations
-
-**Caching**:
-- Published content cached via `Umbraco.PublishedCache.HybridCache`
-- Controllers query cache, not database (for published content)
-
-**Background Jobs**:
-- Long-running operations (publish with descendants, export) return job ID
-- Poll result endpoint for completion
-- See `Controllers/Document/PublishDocumentWithDescendantsResultController.cs`
-
-**OpenAPI Generation**:
-- Pre-generated (OpenApi.json embedded)
-- Runtime generation disabled for performance
-
-### Technical Debt (Top Issues from TODO comments)
-
-1. **Warnings Suppressed** (Umbraco.Cms.Api.Management.csproj:9-22):
-   ```
-   TODO: Fix and remove overrides:
-   - SA1117: params all on same line
-   - SA1401: make fields private
-   - SA1134: own line attributes
-   - CS0108: hidden inherited member
-   - CS0618/CS9042: update obsolete references
-   - CS1998: remove async or make method synchronous
-   - CS8524: switch statement exhaustiveness
-   - IDE0060: removed unused parameter
-   - SA1649: file name match type
-   - CS0419: ambiguous reference
-   - CS1573: param tag for all parameters
-   - CS1574: unresolveable cref
-   ```
-
-2. **Tree Controller Path Segments** (multiple files):
-   - Stylesheet/Script/PartialView tree controllers need path segment support for queries
-   - Files: `Controllers/Stylesheet/Tree/StylesheetTreeControllerBase.cs`
-   - Files: `Controllers/Script/Tree/ScriptTreeControllerBase.cs`
-   - Files: `Controllers/PartialView/Tree/PartialViewTreeControllerBase.cs`
-
-3. **External Login Handling** (Controllers/Security/BackOfficeController.cs):
-   - TODO: Handle external logins properly
-
-4. **Large Factory Classes** (Factories/UserGroupPresentationFactory.cs):
-   - Some factories exceed 1000 lines - consider splitting
-
-5. **ViewModel Explosion** - 1000+ ViewModel classes
-   - Consider shared base models or composition to reduce duplication
-
----
-
-## Quick Reference
-
-### Essential Commands
-```bash
-# Build
-dotnet build src/Umbraco.Cms.Api.Management
-
-# Test Management API
-dotnet test --filter "FullyQualifiedName~Management"
-
-# Format code
-dotnet format src/Umbraco.Cms.Api.Management
-
-# Pack for NuGet
-dotnet pack src/Umbraco.Cms.Api.Management -c Release
-```
-
-### Key Projects
-- **Umbraco.Cms.Api.Management** (this) - Management API controllers and models
-- **Umbraco.Cms.Api.Common** - Shared API infrastructure, base controllers
-- **Umbraco.Infrastructure** - Service implementations, data access
-- **Umbraco.Core** - Domain models, service interfaces
-
-### Important Files
-- **Project file**: `src/Umbraco.Cms.Api.Management/Umbraco.Cms.Api.Management.csproj`
-- **Composer**: `src/Umbraco.Cms.Api.Management/ManagementApiComposer.cs` (DI entry point)
-- **Routing**: `src/Umbraco.Cms.Api.Management/Routing/BackOfficeAreaRoutes.cs`
-- **OpenAPI Spec**: `src/Umbraco.Cms.Api.Management/OpenApi.json` (embedded, 1.3MB)
-- **Base Controllers**: See `Umbraco.Cms.Api.Common` project
-
-### Configuration
-No appsettings in this library - all configuration from parent app (Umbraco.Web.UI):
-- OpenIddict settings
-- CORS settings
-- File upload limits
-
-### API Endpoints
-Base path: `/umbraco/management/api/v1/`
-
-Examples:
-- `POST /umbraco/management/api/v1/document` - Create document
-- `GET /umbraco/management/api/v1/document/{id}` - Get document by key
-- `PUT /umbraco/management/api/v1/document/{id}` - Update document
-- `DELETE /umbraco/management/api/v1/document/{id}` - Delete document
-
-Full spec: See OpenApi.json or Swagger UI at `/umbraco/swagger`
-
-### Getting Help
-- **Root Documentation**: `/CLAUDE.md` (repository overview)
-- **API Common Docs**: `../Umbraco.Cms.Api.Common/CLAUDE.md` (shared API patterns)
-- **Core Docs**: `../Umbraco.Core/CLAUDE.md` (domain architecture)
-- **Official Docs**: https://docs.umbraco.com/umbraco-cms/reference/management-api

src/Umbraco.Cms.Api.Management/Configuration/ConfigureUmbracoManagementApiSwaggerGenOptions.cs

@@ -1,8 +1,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Common.Serialization;
 using Umbraco.Cms.Api.Management.DependencyInjection;
 using Umbraco.Cms.Api.Management.OpenApi;
@@ -11,7 +11,7 @@ namespace Umbraco.Cms.Api.Management.Configuration;
 
 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
-    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
+    private IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
     public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
     {
@@ -20,6 +20,7 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<
 
     public void Configure(SwaggerGenOptions swaggerGenOptions)
     {
+
         swaggerGenOptions.SwaggerDoc(
             ManagementApiConfiguration.ApiName,
             new OpenApiInfo
@@ -50,10 +51,10 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<
                      AuthorizationCode = new OpenApiOAuthFlow
                      {
                          AuthorizationUrl =
-                             new Uri(Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
-                         TokenUrl = new Uri(Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative),
-                     },
-                 },
+                             new Uri(Common.Security.Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
+                         TokenUrl = new Uri(Common.Security.Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative)
+                     }
+                 }
              });
 
         // Sets Security requirement on backoffice apis

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentControllerBase.cs

@@ -1,5 +1,7 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels.Content;
+using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models.ContentEditing;
 using Umbraco.Cms.Core.Models.ContentEditing.Validation;
 using Umbraco.Cms.Core.PropertyEditors.Validation;
@@ -10,6 +12,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Content;
 
 public abstract class ContentControllerBase : ManagementApiControllerBase
 {
+
     protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
         => OperationStatusResult(status, problemDetailsBuilder => status switch
         {
@@ -95,17 +98,6 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
                 .Build()),
         });
 
-    protected IActionResult GetReferencesOperationStatusResult(GetReferencesOperationStatus status)
-        => OperationStatusResult(status, problemDetailsBuilder => status switch
-        {
-            GetReferencesOperationStatus.ContentNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The requested content could not be found")
-                .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
-                .WithTitle("Unknown get references operation status.")
-                .Build()),
-        });
-
     protected IActionResult ContentEditingOperationStatusResult<TContentModelBase, TValueModel, TVariantModel>(
         ContentEditingOperationStatus status,
         TContentModelBase requestModel,

src/Umbraco.Cms.Api.Management/Controllers/Document/References/ReferencedByDocumentController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByDocumentController : DocumentControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByDocumentController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByDocumentController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a paged list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByDocumentController : DocumentControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a paged list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Document, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Document/References/ReferencedDescendantsDocumentController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.References;
 
@@ -17,32 +15,12 @@ public class ReferencedDescendantsDocumentController : DocumentControllerBase
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public ReferencedDescendantsDocumentController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+    public ReferencedDescendantsDocumentController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
-    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
-    CancellationToken cancellationToken,
-    Guid id,
-    int skip = 0,
-    int take = 20)
-    {
-        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItems.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
-        };
-
-        return pagedViewModel;
-    }
-
     /// <summary>
     ///     Gets a paged list of the descendant nodes of the current item used in any kind of relation.
     /// </summary>
@@ -54,26 +32,19 @@ public class ReferencedDescendantsDocumentController : DocumentControllerBase
     [HttpGet("{id:guid}/referenced-descendants")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
+    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
         int skip = 0,
         int take = 20)
     {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Document, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
+        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
         var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
         {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
+            Total = relationItems.Total,
+            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
         };
 
-        return Ok(pagedViewModel);
+        return pagedViewModel;
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/CreateDocumentTypeTemplateController.cs

@@ -1,47 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Controllers.Template;
-using Umbraco.Cms.Api.Management.ViewModels.DocumentType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DocumentType;
-
-[ApiVersion("1.0")]
-public class CreateDocumentTypeTemplateController : DocumentTypeControllerBase
-{
-    private readonly IContentTypeService _contentTypeService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-
-    public CreateDocumentTypeTemplateController(
-        IContentTypeService contentTypeService,
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
-    {
-        _contentTypeService = contentTypeService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-    }
-
-    [HttpPost("{id:guid}/template")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    public async Task<IActionResult> CreateTemplate(
-        CancellationToken cancellationToken,
-        Guid id,
-        CreateDocumentTypeTemplateRequestModel requestModel)
-    {
-        Attempt<Guid?, ContentTypeOperationStatus> result = await _contentTypeService.CreateTemplateAsync(
-            id,
-            requestModel.Name,
-            requestModel.Alias,
-            requestModel.IsDefault,
-            CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return result.Success
-            ? CreatedAtId<ByKeyTemplateController>(controller => nameof(controller.ByKey), result.Result!.Value)
-            : OperationStatusResult(result.Status);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/DocumentTypeControllerBase.cs

@@ -41,10 +41,6 @@ public abstract class DocumentTypeControllerBase : ManagementApiControllerBase
                     .WithTitle("Invalid property type alias")
                     .WithDetail("One or more property type aliases are invalid")
                     .Build()),
-                ContentTypeOperationStatus.InvalidTemplateAlias => new BadRequestObjectResult(problemDetailsBuilder
-                    .WithTitle("Invalid template alias")
-                    .WithDetail("The specified template alias is invalid")
-                    .Build()),
                 ContentTypeOperationStatus.PropertyTypeAliasCannotEqualContentTypeAlias => new BadRequestObjectResult(problemDetailsBuilder
                     .WithTitle("Invalid property type alias")
                     .WithDetail("The property type alias cannot be the same as the content type alias")

src/Umbraco.Cms.Api.Management/Controllers/HealthCheck/ExecuteActionHealthCheckController.cs

@@ -32,7 +32,6 @@ public class ExecuteActionHealthCheckController : HealthCheckControllerBase
     /// <summary>
     ///     Executes a given action from a HealthCheck.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="action">The action to be executed.</param>
     /// <returns>The result of a health check after the health check action is performed.</returns>
     [HttpPost("execute-action")]

src/Umbraco.Cms.Api.Management/Controllers/HealthCheck/Group/AllHealthCheckGroupController.cs

@@ -25,7 +25,6 @@ public class AllHealthCheckGroupController : HealthCheckGroupControllerBase
     /// <summary>
     ///     Gets a paginated grouped list of all names the health checks are grouped by.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of health checks group names.</returns>

src/Umbraco.Cms.Api.Management/Controllers/HealthCheck/Group/ByNameHealthCheckGroupController.cs

@@ -25,7 +25,6 @@ public class ByNameHealthCheckGroupController : HealthCheckGroupControllerBase
     /// <summary>
     ///     Gets a health check group with all its health checks by a group name.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="name">The name of the group.</param>
     /// <returns>The health check group or not found result.</returns>
     [HttpGet("{name}")]

src/Umbraco.Cms.Api.Management/Controllers/HealthCheck/Group/CheckHealthCheckGroupController.cs

@@ -18,7 +18,6 @@ public class CheckHealthCheckGroupController : HealthCheckGroupControllerBase
     /// <summary>
     ///     Check all health checks in the group with a given group name.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="name">The name of the group.</param>
     /// <remarks>The health check result(s) will be included as part of the health checks.</remarks>
     /// <returns>The health check group or not found result.</returns>

src/Umbraco.Cms.Api.Management/Controllers/Help/GetHelpController.cs

@@ -11,13 +11,12 @@ using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Help;
 
-[Obsolete("This is no longer used and will be removed in v19")]
 [ApiVersion("1.0")]
 public class GetHelpController : HelpControllerBase
 {
     private readonly ILogger<GetHelpController> _logger;
     private readonly IJsonSerializer _jsonSerializer;
-    private readonly HelpPageSettings _helpPageSettings;
+    private HelpPageSettings _helpPageSettings;
 
     public GetHelpController(
         IOptionsMonitor<HelpPageSettings> helpPageSettings,
@@ -27,8 +26,11 @@ public class GetHelpController : HelpControllerBase
         _logger = logger;
         _jsonSerializer = jsonSerializer;
         _helpPageSettings = helpPageSettings.CurrentValue;
+        helpPageSettings.OnChange(UpdateHelpPageSettings);
     }
 
+    private void UpdateHelpPageSettings(HelpPageSettings settings) => _helpPageSettings = settings;
+
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]

src/Umbraco.Cms.Api.Management/Controllers/Help/HelpControllerBase.cs

@@ -3,7 +3,6 @@ using Umbraco.Cms.Api.Management.Routing;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Help;
 
-[Obsolete("This is no longer used and will be removed in v19")]
 [VersionedApiBackOfficeRoute("help")]
 [ApiExplorerSettings(GroupName = "Help")]
 public abstract class HelpControllerBase : ManagementApiControllerBase

src/Umbraco.Cms.Api.Management/Controllers/Indexer/DetailsIndexerController.cs

@@ -24,9 +24,8 @@ public class DetailsIndexerController : IndexerControllerBase
     /// <summary>
     ///     Check if the index has been rebuilt
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
-    /// <param name="indexName">The name of the index.</param>
-    /// <returns>The index details.</returns>
+    /// <param name="indexName"></param>
+    /// <returns></returns>
     /// <remarks>
     ///     This is kind of rudimentary since there's no way we can know that the index has rebuilt, we
     ///     have a listener for the index op complete so we'll just check if that id is no longer there in the runtime cache

src/Umbraco.Cms.Api.Management/Controllers/Indexer/RebuildIndexerController.cs

@@ -28,9 +28,8 @@ public class RebuildIndexerController : IndexerControllerBase
     /// <summary>
     ///     Rebuilds the index.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="indexName">The name of the index to rebuild.</param>
-    /// <returns>The result of the rebuild operation.</returns>
+    /// <returns></returns>
     [HttpPost("{indexName}/rebuild")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]

src/Umbraco.Cms.Api.Management/Controllers/Install/SettingsInstallController.cs

@@ -1,7 +1,6 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Infrastructure.Install;
 using Umbraco.Cms.Api.Management.ViewModels.Installer;
@@ -13,23 +12,16 @@ namespace Umbraco.Cms.Api.Management.Controllers.Install;
 [ApiVersion("1.0")]
 public class SettingsInstallController : InstallControllerBase
 {
+    private readonly InstallHelper _installHelper;
     private readonly IInstallSettingsFactory _installSettingsFactory;
     private readonly IUmbracoMapper _mapper;
 
-    [Obsolete("Please use the constructor without the InstallHelper parameter. Scheduled for removal in Umbraco 19.")]
     public SettingsInstallController(
         InstallHelper installHelper,
         IInstallSettingsFactory installSettingsFactory,
         IUmbracoMapper mapper)
-        : this(installSettingsFactory, mapper)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
-    public SettingsInstallController(
-        IInstallSettingsFactory installSettingsFactory,
-        IUmbracoMapper mapper)
     {
+        _installHelper = installHelper;
         _installSettingsFactory = installSettingsFactory;
         _mapper = mapper;
     }
@@ -40,6 +32,9 @@ public class SettingsInstallController : InstallControllerBase
     [ProducesResponseType(typeof(InstallSettingsResponseModel), StatusCodes.Status200OK)]
     public async Task<IActionResult> Settings(CancellationToken cancellationToken)
     {
+        // Register that the install has started
+        await _installHelper.SetInstallStatusAsync(false, string.Empty);
+
         InstallSettingsModel installSettings = _installSettingsFactory.GetInstallSettings();
         InstallSettingsResponseModel responseModel = _mapper.Map<InstallSettingsResponseModel>(installSettings)!;
 

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/AllLogViewerController.cs

@@ -28,7 +28,6 @@ public class AllLogViewerController : LogViewerControllerBase
     /// <summary>
     ///     Gets a paginated list of all logs for a specific date range.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <param name="orderDirection">

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/AllMessageTemplateLogViewerController.cs

@@ -27,7 +27,6 @@ public class AllMessageTemplateLogViewerController : LogViewerControllerBase
     /// <summary>
     ///     Gets a paginated list of all log message templates for a specific date range.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <param name="startDate">The start date for the date range (can be null).</param>

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/AllSinkLevelLogViewerController.cs

@@ -24,7 +24,6 @@ public class AllSinkLevelLogViewerController : LogViewerControllerBase
     /// <summary>
     ///     Gets a paginated list of all loggers' levels.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of the configured loggers and their level.</returns>

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/LogLevelCountLogViewerController.cs

@@ -25,7 +25,6 @@ public class LogLevelCountLogViewerController : LogViewerControllerBase
     /// <summary>
     ///     Gets the count for each log level from the logs for a specific date range.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="startDate">The start date for the date range (can be null).</param>
     /// <param name="endDate">The end date for the date range (can be null).</param>
     /// <returns>The log level counts from the (filtered) logs.</returns>

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/SavedSearch/AllSavedSearchLogViewerController.cs

@@ -24,7 +24,6 @@ public class AllSavedSearchLogViewerController : SavedSearchLogViewerControllerB
     /// <summary>
     ///     Gets a paginated list of all saved log searches.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of the saved log searches.</returns>

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/SavedSearch/ByNameSavedSearchLogViewerController.cs

@@ -23,7 +23,6 @@ public class ByNameSavedSearchLogViewerController : SavedSearchLogViewerControll
     /// <summary>
     ///     Gets a saved log search by name.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="name">The name of the saved log search.</param>
     /// <returns>The saved log search or not found result.</returns>
     [HttpGet("{name}")]

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/SavedSearch/CreateSavedSearchLogViewerController.cs

@@ -19,7 +19,6 @@ public class CreateSavedSearchLogViewerController : SavedSearchLogViewerControll
     /// <summary>
     ///     Creates a saved log search.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="savedSearch">The log search to be saved.</param>
     /// <returns>The location of the saved log search after the creation.</returns>
     [HttpPost]

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/SavedSearch/DeleteSavedSearchLogViewerController.cs

@@ -18,7 +18,6 @@ public class DeleteSavedSearchLogViewerController : SavedSearchLogViewerControll
     /// <summary>
     ///     Deletes a saved log search with a given name.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="name">The name of the saved log search.</param>
     /// <returns>The result of the deletion.</returns>
     [HttpDelete("{name}")]

src/Umbraco.Cms.Api.Management/Controllers/LogViewer/ValidateLogFileSizeLogViewerController.cs

@@ -17,7 +17,6 @@ public class ValidateLogFileSizeLogViewerController : LogViewerControllerBase
     /// <summary>
     ///     Gets a value indicating whether or not you are able to view logs for a specified date range.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="startDate">The start date for the date range (can be null).</param>
     /// <param name="endDate">The end date for the date range (can be null).</param>
     /// <returns>The boolean result.</returns>

src/Umbraco.Cms.Api.Management/Controllers/Media/Item/SearchMediaItemController.cs

@@ -4,7 +4,6 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Media.Item;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
@@ -19,32 +18,16 @@ public class SearchMediaItemController : MediaItemControllerBase
     private readonly IIndexedEntitySearchService _indexedEntitySearchService;
     private readonly IMediaPresentationFactory _mediaPresentationFactory;
     private readonly IDataTypeService _dataTypeService;
-    private readonly IMediaTypeService _mediaTypeService;
 
     [ActivatorUtilitiesConstructor]
     public SearchMediaItemController(
         IIndexedEntitySearchService indexedEntitySearchService,
         IMediaPresentationFactory mediaPresentationFactory,
-        IDataTypeService dataTypeService,
-        IMediaTypeService mediaTypeService)
+        IDataTypeService dataTypeService)
     {
         _indexedEntitySearchService = indexedEntitySearchService;
         _mediaPresentationFactory = mediaPresentationFactory;
         _dataTypeService = dataTypeService;
-        _mediaTypeService = mediaTypeService;
-    }
-
-    [Obsolete("Use the non-obsolete constructor instead, will be removed in Umbraco 18.")]
-    public SearchMediaItemController(
-        IIndexedEntitySearchService indexedEntitySearchService,
-        IMediaPresentationFactory mediaPresentationFactory,
-        IDataTypeService dataTypeService)
-        : this(
-            indexedEntitySearchService,
-            mediaPresentationFactory,
-            dataTypeService,
-            StaticServiceProvider.Instance.GetRequiredService<IMediaTypeService>())
-    {
     }
 
     [Obsolete("Use the non-obsolete constructor instead, will be removed in Umbraco 18.")]
@@ -94,17 +77,6 @@ public class SearchMediaItemController : MediaItemControllerBase
         [FromQuery] IEnumerable<Guid>? allowedMediaTypes = null,
         Guid? dataTypeId = null)
     {
-        // We always want to include folders in the search results (aligns with behaviour in Umbraco 13, and allows folders
-        // to be selected to find the selectable items inside).
-        if (allowedMediaTypes is not null)
-        {
-            IMediaType? folderMediaType = _mediaTypeService.Get(Constants.Conventions.MediaTypes.Folder);
-            if (folderMediaType is not null && allowedMediaTypes.Contains(folderMediaType.Key) is false)
-            {
-                allowedMediaTypes = [..allowedMediaTypes, folderMediaType.Key];
-            }
-        }
-
         var ignoreUserStartNodes = await IgnoreUserStartNodes(dataTypeId);
         PagedModel<IEntitySlim> searchResult = await _indexedEntitySearchService.SearchAsync(
             UmbracoObjectTypes.Media,

src/Umbraco.Cms.Api.Management/Controllers/Media/References/ReferencedByMediaController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Media.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByMediaController : MediaControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByMediaController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByMediaController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByMediaController : MediaControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Media, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Media/References/ReferencedDescendantsMediaController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Media.References;
 
@@ -16,32 +14,13 @@ public class ReferencedDescendantsMediaController : MediaControllerBase
 {
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
-    public ReferencedDescendantsMediaController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+
+    public ReferencedDescendantsMediaController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
-    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
-    CancellationToken cancellationToken,
-    Guid id,
-    int skip = 0,
-    int take = 20)
-    {
-        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItems.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
-        };
-
-        return pagedViewModel;
-    }
-
     /// <summary>
     ///     Gets a page list of the child nodes of the current item used in any kind of relation.
     /// </summary>
@@ -53,26 +32,19 @@ public class ReferencedDescendantsMediaController : MediaControllerBase
     [HttpGet("{id:guid}/referenced-descendants")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
+    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
         int skip = 0,
         int take = 20)
     {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Media, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
+        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
         var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
         {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
+            Total = relationItems.Total,
+            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
         };
 
-        return Ok(pagedViewModel);
+        return pagedViewModel;
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/MediaType/MediaTypeControllerBase.cs

@@ -31,7 +31,7 @@ public abstract class MediaTypeControllerBase : ManagementApiControllerBase
                 .WithDetail("The import failed due to not being able to convert the file into proper xml.")
                 .Build()),
             MediaTypeImportOperationStatus.MediaTypeExists => BadRequest(problemDetailsBuilder
-                .WithTitle("Failed to import because media type exists")
+                .WithTitle("Failed to import because media type exits")
                 .WithDetail("The import failed because the media type that was being imported already exits.")
                 .Build()),
             MediaTypeImportOperationStatus.TypeMismatch => BadRequest(problemDetailsBuilder
@@ -42,6 +42,6 @@ public abstract class MediaTypeControllerBase : ManagementApiControllerBase
                 .WithTitle("Invalid Id")
                 .WithDetail("The import failed because the id of the media type you are trying to update did not match the id in the file.")
                 .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, "Unknown media type import operation status."),
+            _ => StatusCode(StatusCodes.Status500InternalServerError, "Unknown media type import operation status.")
         });
 }

src/Umbraco.Cms.Api.Management/Controllers/Member/References/ReferencedByMemberController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Member.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByMemberController : MemberControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByMemberController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByMemberController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByMemberController : MemberControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Member, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Member/References/ReferencedDescendantsMemberController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Member.References;
 
@@ -17,16 +15,23 @@ public class ReferencedDescendantsMemberController : MemberControllerBase
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public ReferencedDescendantsMemberController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+    public ReferencedDescendantsMemberController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of the child nodes of the current item used in any kind of relation.
+    /// </summary>
+    /// <remarks>
+    ///     Used when deleting and unpublishing a single item to check if this item has any descending items that are in any
+    ///     kind of relation.
+    ///     This is basically finding the descending items which are children in relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-descendants")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
@@ -42,38 +47,4 @@ public class ReferencedDescendantsMemberController : MemberControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of the child nodes of the current item used in any kind of relation.
-    /// </summary>
-    /// <remarks>
-    ///     Used when deleting and unpublishing a single item to check if this item has any descending items that are in any
-    ///     kind of relation.
-    ///     This is basically finding the descending items which are children in relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-descendants")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Member, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberType/CopyMemberTypeController.cs

@@ -1,8 +1,7 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.MemberType;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
@@ -20,23 +19,14 @@ public class CopyMemberTypeController : MemberTypeControllerBase
     public CopyMemberTypeController(IMemberTypeService memberTypeService)
         => _memberTypeService = memberTypeService;
 
-    [Obsolete("Please use the overload that includes all parameters. Scheduled for removal in Umbraco 19.")]
-    [NonAction]
-    public async Task<IActionResult> Copy(
-        CancellationToken cancellationToken,
-        Guid id) => await Copy(cancellationToken, id, null);
-
     [HttpPost("{id:guid}/copy")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(StatusCodes.Status201Created)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Copy(
-        CancellationToken cancellationToken,
-        Guid id,
-        CopyMemberTypeRequestModel? copyMemberTypeRequestModel)
+    public async Task<IActionResult> Copy(CancellationToken cancellationToken, Guid id)
     {
-        Attempt<IMemberType?, ContentTypeStructureOperationStatus> result = await _memberTypeService.CopyAsync(id, copyMemberTypeRequestModel?.Target?.Id);
+        Attempt<IMemberType?, ContentTypeStructureOperationStatus> result = await _memberTypeService.CopyAsync(id, containerKey: null);
 
         return result.Success
             ? CreatedAtId<ByKeyMemberTypeController>(controller => nameof(controller.ByKey), result.Result!.Key)

src/Umbraco.Cms.Api.Management/Controllers/MemberType/ExportMemberTypeController.cs

@@ -1,44 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType;
-
-[ApiVersion("1.0")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessMemberTypes)]
-public class ExportMemberTypeController : MemberTypeControllerBase
-{
-    private readonly IMemberTypeService _memberTypeService;
-    private readonly IUdtFileContentFactory _fileContentFactory;
-
-    public ExportMemberTypeController(
-        IMemberTypeService memberTypeService,
-        IUdtFileContentFactory fileContentFactory)
-    {
-        _memberTypeService = memberTypeService;
-        _fileContentFactory = fileContentFactory;
-    }
-
-    [HttpGet("{id:guid}/export")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(FileContentResult), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public IActionResult Export(
-        CancellationToken cancellationToken,
-        Guid id)
-    {
-        IMemberType? memberType = _memberTypeService.Get(id);
-        if (memberType is null)
-        {
-            return OperationStatusResult(ContentTypeOperationStatus.NotFound);
-        }
-
-        return _fileContentFactory.Create(memberType);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/ImportExistingMemberTypeController.cs

@@ -1,46 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.MemberType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services.ImportExport;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType;
-
-[ApiVersion("1.0")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessMemberTypes)]
-public class ImportExistingMemberTypeController : MemberTypeControllerBase
-{
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IMemberTypeImportService _memberTypeImportService;
-
-    public ImportExistingMemberTypeController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeImportService memberTypeImportService)
-    {
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _memberTypeImportService = memberTypeImportService;
-    }
-
-    [HttpPut("{id:guid}/import")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    public async Task<IActionResult> Import(
-        CancellationToken cancellationToken,
-        Guid id,
-        ImportMemberTypeRequestModel model)
-    {
-        Attempt<IMemberType?, MemberTypeImportOperationStatus> importAttempt = await _memberTypeImportService.Import(model.File.Id, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return importAttempt.Success is false
-            ? MemberTypeImportOperationStatusResult(importAttempt.Status)
-            : Ok();
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/ImportNewMemberTypeController.cs

@@ -1,45 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.MemberType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services.ImportExport;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType;
-
-[ApiVersion("1.0")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessMemberTypes)]
-public class ImportNewMemberTypeController : MemberTypeControllerBase
-{
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IMemberTypeImportService _memberTypeImportService;
-
-    public ImportNewMemberTypeController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeImportService memberTypeImportService)
-    {
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _memberTypeImportService = memberTypeImportService;
-    }
-
-    [HttpPost("import")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    public async Task<IActionResult> Import(
-        CancellationToken cancellationToken,
-        ImportMemberTypeRequestModel model)
-    {
-        Attempt<IMemberType?, MemberTypeImportOperationStatus> importAttempt = await _memberTypeImportService.Import(model.File.Id, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return importAttempt.Success is false
-            ? MemberTypeImportOperationStatusResult(importAttempt.Status)
-            : CreatedAtId<ByKeyMemberTypeController>(controller => nameof(controller.ByKey), importAttempt.Result!.Key);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/MemberTypeControllerBase.cs

@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.DocumentType;
 using Umbraco.Cms.Api.Management.Routing;
@@ -19,29 +18,4 @@ public abstract class MemberTypeControllerBase : ManagementApiControllerBase
 
     protected IActionResult StructureOperationStatusResult(ContentTypeStructureOperationStatus status)
         => DocumentTypeControllerBase.ContentTypeStructureOperationStatusResult(status, "member");
-
-    protected IActionResult MemberTypeImportOperationStatusResult(MemberTypeImportOperationStatus operationStatus) =>
-        OperationStatusResult(operationStatus, problemDetailsBuilder => operationStatus switch
-        {
-            MemberTypeImportOperationStatus.TemporaryFileNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("Temporary file not found")
-                .Build()),
-            MemberTypeImportOperationStatus.TemporaryFileConversionFailure => BadRequest(problemDetailsBuilder
-                .WithTitle("Failed to convert the specified file")
-                .WithDetail("The import failed due to not being able to convert the file into proper xml.")
-                .Build()),
-            MemberTypeImportOperationStatus.MemberTypeExists => BadRequest(problemDetailsBuilder
-                .WithTitle("Failed to import because member type exists")
-                .WithDetail("The import failed because the member type that was being imported already exits.")
-                .Build()),
-            MemberTypeImportOperationStatus.TypeMismatch => BadRequest(problemDetailsBuilder
-                .WithTitle("Type Mismatch")
-                .WithDetail("The import failed because the file contained an entity that is not a member type.")
-                .Build()),
-            MemberTypeImportOperationStatus.IdMismatch => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid Id")
-                .WithDetail("The import failed because the id of the member type you are trying to update did not match the id in the file.")
-                .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, "Unknown member type import operation status."),
-        });
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberType/MoveMemberTypeController.cs

@@ -1,39 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.MemberType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType;
-
-[ApiVersion("1.0")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessMemberTypes)]
-public class MoveMemberTypeController : MemberTypeControllerBase
-{
-    private readonly IMemberTypeService _memberTypeService;
-
-    public MoveMemberTypeController(IMemberTypeService memberTypeService)
-        => _memberTypeService = memberTypeService;
-
-    [HttpPut("{id:guid}/move")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Move(
-        CancellationToken cancellationToken,
-        Guid id,
-        MoveMemberTypeRequestModel moveMemberTypeRequestModel)
-    {
-        Attempt<IMemberType?, ContentTypeStructureOperationStatus> result = await _memberTypeService.MoveAsync(id, moveMemberTypeRequestModel.Target?.Id);
-
-        return result.Success
-            ? Ok()
-            : StructureOperationStatusResult(result.Status);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/AncestorsMemberTypeTreeController.cs

@@ -1,23 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Services.Flags;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
-
-[ApiVersion("1.0")]
-public class AncestorsMemberTypeTreeController : MemberTypeTreeControllerBase
-{
-    public AncestorsMemberTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMemberTypeService memberTypeService)
-        : base(entityService, flagProviders, memberTypeService)
-    {
-    }
-
-    [HttpGet("ancestors")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<MemberTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<IEnumerable<MemberTypeTreeItemResponseModel>>> Ancestors(CancellationToken cancellationToken, Guid descendantId)
-        => await GetAncestors(descendantId);
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/ChildrenMemberTypeTreeController.cs

@@ -1,31 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.Services.Flags;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
-
-[ApiVersion("1.0")]
-public class ChildrenMemberTypeTreeController : MemberTypeTreeControllerBase
-{
-    public ChildrenMemberTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMemberTypeService memberTypeService)
-        : base(entityService, flagProviders, memberTypeService)
-    { }
-
-    [HttpGet("children")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<MemberTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedViewModel<MemberTypeTreeItemResponseModel>>> Children(
-        CancellationToken cancellationToken,
-        Guid parentId,
-        int skip = 0,
-        int take = 100,
-        bool foldersOnly = false)
-    {
-        RenderFoldersOnly(foldersOnly);
-        return await GetChildren(parentId, skip, take);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/MemberTypeTreeControllerBase.cs

@@ -17,7 +17,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
 [VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/{Constants.UdiEntityType.MemberType}")]
 [ApiExplorerSettings(GroupName = "Member Type")]
 [Authorize(Policy = AuthorizationPolicies.TreeAccessMembersOrMemberTypes)]
-public class MemberTypeTreeControllerBase : FolderTreeControllerBase<MemberTypeTreeItemResponseModel>
+public class MemberTypeTreeControllerBase : NamedEntityTreeControllerBase<MemberTypeTreeItemResponseModel>
 {
     private readonly IMemberTypeService _memberTypeService;
 
@@ -37,8 +37,6 @@ public class MemberTypeTreeControllerBase : FolderTreeControllerBase<MemberTypeT
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.MemberType;
 
-    protected override UmbracoObjectTypes FolderObjectType => UmbracoObjectTypes.MemberTypeContainer;
-
     protected override MemberTypeTreeItemResponseModel[] MapTreeItemViewModels(Guid? parentKey, IEntitySlim[] entities)
     {
         var memberTypes = _memberTypeService

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/RootMemberTypeTreeController.cs

@@ -30,10 +30,6 @@ public class RootMemberTypeTreeController : MemberTypeTreeControllerBase
     public async Task<ActionResult<PagedViewModel<MemberTypeTreeItemResponseModel>>> Root(
         CancellationToken cancellationToken,
         int skip = 0,
-        int take = 100,
-        bool foldersOnly = false)
-    {
-        RenderFoldersOnly(foldersOnly);
-        return await GetRoot(skip, take);
-    }
+        int take = 100)
+        => await GetRoot(skip, take);
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/SiblingMemberTypeTreeController.cs

@@ -1,6 +1,5 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
@@ -10,14 +9,10 @@ namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
 
 public class SiblingMemberTypeTreeController : MemberTypeTreeControllerBase
 {
-    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
-    public SiblingMemberTypeTreeController(IEntityService entityService, IMemberTypeService memberTypeService)
-        : base(entityService, memberTypeService)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
-    public SiblingMemberTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMemberTypeService memberTypeService)
+    public SiblingMemberTypeTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IMemberTypeService memberTypeService)
         : base(entityService, flagProviders, memberTypeService)
     {
     }
@@ -28,10 +23,6 @@ public class SiblingMemberTypeTreeController : MemberTypeTreeControllerBase
         CancellationToken cancellationToken,
         Guid target,
         int before,
-        int after,
-        bool foldersOnly = false)
-    {
-        RenderFoldersOnly(foldersOnly);
-        return await GetSiblings(target, before, after);
-    }
+        int after)
+        => await GetSiblings(target, before, after);
 }

src/Umbraco.Cms.Api.Management/Controllers/ModelsBuilder/BuildModelsBuilderController.cs

@@ -1,18 +1,22 @@
+using System;
+using System.Threading.Tasks;
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Infrastructure.ModelsBuilder;
 using Umbraco.Cms.Infrastructure.ModelsBuilder.Building;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.ModelsBuilder;
 
 [ApiVersion("1.0")]
 public class BuildModelsBuilderController : ModelsBuilderControllerBase
 {
-    private readonly ModelsBuilderSettings _modelsBuilderSettings;
+    private ModelsBuilderSettings _modelsBuilderSettings;
     private readonly ModelsGenerationError _mbErrors;
     private readonly IModelsGenerator _modelGenerator;
 
@@ -24,6 +28,8 @@ public class BuildModelsBuilderController : ModelsBuilderControllerBase
         _mbErrors = mbErrors;
         _modelGenerator = modelGenerator;
         _modelsBuilderSettings = modelsBuilderSettings.CurrentValue;
+
+        modelsBuilderSettings.OnChange(x => _modelsBuilderSettings = x);
     }
 
     [HttpPost("build")]

src/Umbraco.Cms.Api.Management/Controllers/Package/AllMigrationStatusPackageController.cs

@@ -41,7 +41,6 @@ public class AllMigrationStatusPackageController : PackageControllerBase
     /// <summary>
     ///     Gets a paginated list of the migration status of each installed package.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of the installed packages migration status.</returns>

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/AllCreatedPackageController.cs

@@ -25,7 +25,6 @@ public class AllCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Gets a paginated list of all created packages.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="skip">The amount of items to skip.</param>
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of the created packages.</returns>

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/ByKeyCreatedPackageController.cs

@@ -23,7 +23,6 @@ public class ByKeyCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Gets a package by id.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="id">The id of the package.</param>
     /// <returns>The package or not found result.</returns>
     [HttpGet("{id:guid}")]

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/CreateCreatedPackageController.cs

@@ -31,7 +31,6 @@ public class CreateCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Creates a package.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="createPackageRequestModel">The model containing the data for a new package.</param>
     /// <returns>The created package.</returns>
     [HttpPost]

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/DeleteCreatedPackageController.cs

@@ -24,7 +24,6 @@ public class DeleteCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Deletes a package with a given id.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="id">The id of the package.</param>
     /// <returns>The result of the deletion.</returns>
     [HttpDelete("{id:guid}")]

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/DownloadCreatedPackageController.cs

@@ -21,7 +21,6 @@ public class DownloadCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Downloads a package XML or ZIP file.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="id">The id of the package.</param>
     /// <returns>The XML or ZIP file of the package or not found result.</returns>
     [HttpGet("{id:guid}/download")]

src/Umbraco.Cms.Api.Management/Controllers/Package/Created/UpdateCreatedPackageController.cs

@@ -31,7 +31,6 @@ public class UpdateCreatedPackageController : CreatedPackageControllerBase
     /// <summary>
     ///     Updates a package.
     /// </summary>
-    /// <param name="cancellationToken">The cancellation token.</param>
     /// <param name="id">The id of the package.</param>
     /// <param name="updatePackageRequestModel">The model containing the data for updating a package.</param>
     /// <returns>The created package.</returns>