From 0636ab91ee1fc76b5561d8de1920f36a5cc409cb Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Thu, 25 Jul 2024 15:11:46 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../release-environments/main.gitlab-ci.yml   |   2 +-
 .../security.gitlab-ci.yml                    |   2 +-
 .rubocop_todo/layout/line_length.yml          |   1 -
 .../components/access_token_table_app.vue     |   4 -
 .../inactive_access_token_table_app.vue       |   4 -
 .../admin/abuse_reports/components/app.vue    |   4 -
 .../admin/deploy_keys/components/table.vue    |   6 -
 .../badges/components/badge_list.vue          |   4 -
 .../components/cells/runner_status_cell.vue   |   8 +-
 .../components/cells/runner_summary_field.vue |   2 +-
 .../components/runner_job_status_badge.vue    |   6 +-
 .../runner/components/runner_status_badge.vue |   4 +-
 .../ci/runner/components/runner_tag.vue       |  11 +-
 .../ci/runner/components/runner_tags.vue      |   2 +-
 .../components/secure_files_list.vue          |   6 -
 .../clusters_list/components/clusters.vue     |   2 -
 app/assets/javascripts/commons/gitlab_ui.js   |  17 ++-
 .../deploy_keys/components/app.vue            |  10 +-
 .../components/environments_app.vue           |   8 --
 .../components/table/members_pagination.vue   |   4 -
 .../javascripts/profile/components/follow.vue |   7 -
 .../commit_box/info/components/refs_list.vue  |   2 +-
 .../pagination/table_pagination.vue           |  20 ---
 .../components/pagination_links.vue           |  14 --
 .../instructions/runner_aws_instructions.vue  |  10 +-
 .../instructions/runner_cli_instructions.vue  |  28 ++--
 .../runner_docker_instructions.vue            |   2 +-
 .../runner_kubernetes_instructions.vue        |   2 +-
 .../components/work_item_labels.vue           |  48 +++++--
 .../framework/broadcast_messages.scss         |  10 +-
 app/assets/stylesheets/framework/mixins.scss  |   2 +-
 .../page_bundles/_pipeline_mixins.scss        |   2 +-
 .../stylesheets/page_bundles/build.scss       |   2 +-
 .../stylesheets/page_bundles/ci_status.scss   |   2 +-
 .../page_bundles/commit_description.scss      |   2 +-
 .../page_bundles/issuable_list.scss           |   2 +-
 .../page_bundles/merge_conflicts.scss         |   2 +-
 .../page_bundles/merge_requests.scss          |  12 +-
 .../stylesheets/page_bundles/pipeline.scss    |  19 ---
 .../stylesheets/page_bundles/project.scss     |   4 +-
 .../stylesheets/page_bundles/projects.scss    |   4 +-
 .../stylesheets/page_bundles/search.scss      |   4 +-
 .../stylesheets/page_bundles/todos.scss       |   4 +-
 app/assets/stylesheets/page_bundles/tree.scss |   2 +-
 .../themes/dark_mode_overrides.scss           |   2 -
 .../broadcast_banner_component.html.haml      |   3 +-
 .../pajamas/broadcast_banner_component.rb     |   6 +-
 app/controllers/graphql_controller.rb         |   9 +-
 app/models/deploy_token.rb                    |   3 +-
 .../packages/maven/cached_response.rb         |  52 +++++++
 .../packages/maven/upstream.rb                |   3 +
 .../packages/policies/group.rb                |  17 +++
 .../packages/policies/group_policy.rb         |  41 ++++++
 .../nuget/search_results_presenter.rb         |  40 ++++--
 .../cached_response_uploader.rb               |  27 ++++
 .../projects/commit/_commit_box.html.haml     |   4 +-
 app/views/shared/_broadcast_message.html.haml |  56 ++------
 app/views/shared/icons/_mr_bold.svg           |   1 -
 ...stries_packages_maven_cached_responses.yml |  12 ++
 ..._read_virtual_registry_to_deploy_tokens.rb |   9 ++
 ...istries_packages_maven_cached_responses.rb |  48 +++++++
 db/schema_migrations/20240628112814           |   1 +
 db/schema_migrations/20240712172152           |   1 +
 db/structure.sql                              |  51 ++++++-
 doc/administration/appearance.md              |   4 +-
 doc/administration/moderate_users.md          |   2 +-
 .../reporting/git_abuse_rate_limit.md         |   2 +-
 .../self_hosted_models/index.md               |   2 +-
 doc/api/search.md                             |   3 -
 doc/ci/runners/runners_scope.md               |   2 +-
 .../packages/new_format_development.md        |   2 +-
 .../testing_guide/best_practices.md           |   7 +
 .../end_to_end/rspec_metadata_tests.md        |   4 +-
 ...lue_stream_analytics_aggregated_backend.md |   2 +-
 .../responding_to_security_incidents.md       |   2 +-
 .../cloud_deployments/auto_devops_with_gke.md |   4 +-
 doc/topics/autodevops/prepare_deployment.md   |   6 +-
 .../observability_java_tutorial.md            | 127 +++++++++++++++++
 .../observabillty_java_tutorial.md            | 130 +-----------------
 doc/user/analytics/dora_metrics.md            |   2 +-
 .../offline_deployments/index.md              |   2 +-
 doc/user/profile/notifications.md             |   4 +-
 locale/gitlab.pot                             |   6 -
 .../group/transfer_group_spec.rb              |   4 +
 scripts/run-fast-specs.sh                     |  97 +++++++++++++
 spec/bin/sidekiq_cluster_spec.rb              |   2 +-
 .../diagnostic_reports/uploader_smoke_spec.rb |   2 +-
 .../broadcast_banner_component_spec.rb        |   8 +-
 spec/controllers/graphql_controller_spec.rb   |  29 ++++
 spec/dot_gitlab_ci/rules_spec.rb              |   5 +-
 spec/factories/deploy_tokens.rb               |   2 +
 .../packages/maven/cached_responses.rb        |  23 ++++
 .../abuse_reports/components/app_spec.js      |   2 +-
 .../deploy_keys/components/table_spec.js      |   2 -
 .../runner_job_status_badge_spec.js           |   8 +-
 .../ci/runner/components/runner_tag_spec.js   |   8 +-
 .../table/members_pagination_spec.js          |   2 +-
 .../profile/components/follow_spec.js         |   2 -
 .../components/work_item_labels_spec.js       |  27 +++-
 .../linter/inline_javascript_spec.rb          |   2 +-
 .../ci/config/entry/include/rules_spec.rb     |   3 +-
 .../gitlab/graphql/known_operations_spec.rb   |   3 +-
 spec/lib/gitlab/i18n/pluralization_spec.rb    |   3 +-
 .../redis_cluster_validator_spec.rb           |   4 +-
 .../pagination/offset_header_builder_spec.rb  |   3 +-
 spec/lib/remote_development/settings_spec.rb  |   2 +-
 .../concerns/super_sidebar_panel_spec.rb      |   3 +-
 .../packages/maven/cached_response_spec.rb    |  88 ++++++++++++
 .../packages/maven/upstream_spec.rb           |   6 +
 .../packages/policies/group_policy_spec.rb    | 122 ++++++++++++++++
 .../nuget/search_results_presenter_spec.rb    |  38 ++++-
 .../graphql/project/merge_requests_spec.rb    |   2 +-
 .../lib/glfm/update_example_snapshots_spec.rb |   2 +-
 .../lib/glfm/update_specification_spec.rb     |   2 +-
 .../cached_response_uploader_spec.rb          |  24 ++++
 115 files changed, 1081 insertions(+), 461 deletions(-)
 create mode 100644 app/models/virtual_registries/packages/maven/cached_response.rb
 create mode 100644 app/models/virtual_registries/packages/policies/group.rb
 create mode 100644 app/policies/virtual_registries/packages/policies/group_policy.rb
 create mode 100644 app/uploaders/virtual_registries/cached_response_uploader.rb
 delete mode 100644 app/views/shared/icons/_mr_bold.svg
 create mode 100644 db/docs/virtual_registries_packages_maven_cached_responses.yml
 create mode 100644 db/migrate/20240628112814_add_read_virtual_registry_to_deploy_tokens.rb
 create mode 100644 db/migrate/20240712172152_create_virtual_registries_packages_maven_cached_responses.rb
 create mode 100644 db/schema_migrations/20240628112814
 create mode 100644 db/schema_migrations/20240712172152
 create mode 100644 doc/tutorials/observability/observability_java_tutorial.md
 create mode 100755 scripts/run-fast-specs.sh
 create mode 100644 spec/factories/virtual_registries/packages/maven/cached_responses.rb
 create mode 100644 spec/models/virtual_registries/packages/maven/cached_response_spec.rb
 create mode 100644 spec/policies/virtual_registries/packages/policies/group_policy_spec.rb
 create mode 100644 spec/uploaders/virtual_registries/cached_response_uploader_spec.rb

diff --git a/.gitlab/ci/release-environments/main.gitlab-ci.yml b/.gitlab/ci/release-environments/main.gitlab-ci.yml
index a8a05965132..31de1a335a2 100644
--- a/.gitlab/ci/release-environments/main.gitlab-ci.yml
+++ b/.gitlab/ci/release-environments/main.gitlab-ci.yml
@@ -4,7 +4,7 @@ include:
     inputs:
       cng_path: 'build/CNG-mirror'
   - project: 'gitlab-org/quality/pipeline-common'
-    ref: '8.18.4'
+    ref: '8.18.5'
     file: ci/base.gitlab-ci.yml
 
 stages:
diff --git a/.gitlab/ci/release-environments/security.gitlab-ci.yml b/.gitlab/ci/release-environments/security.gitlab-ci.yml
index 0b68cab6e4b..cca5389d88a 100644
--- a/.gitlab/ci/release-environments/security.gitlab-ci.yml
+++ b/.gitlab/ci/release-environments/security.gitlab-ci.yml
@@ -7,7 +7,7 @@ include:
     inputs:
       cng_path: 'charts/components/images'
   - project: 'gitlab-org/quality/pipeline-common'
-    ref: '8.18.4'
+    ref: '8.18.5'
     file: ci/base.gitlab-ci.yml
 
 stages:
diff --git a/.rubocop_todo/layout/line_length.yml b/.rubocop_todo/layout/line_length.yml
index 3cac683eca5..1fefb8eef21 100644
--- a/.rubocop_todo/layout/line_length.yml
+++ b/.rubocop_todo/layout/line_length.yml
@@ -3904,7 +3904,6 @@ Layout/LineLength:
     - 'spec/presenters/packages/helm/index_presenter_spec.rb'
     - 'spec/presenters/packages/nuget/package_metadata_presenter_spec.rb'
     - 'spec/presenters/packages/nuget/packages_metadata_presenter_spec.rb'
-    - 'spec/presenters/packages/nuget/search_results_presenter_spec.rb'
     - 'spec/presenters/projects/security/configuration_presenter_spec.rb'
     - 'spec/presenters/prometheus_alert_presenter_spec.rb'
     - 'spec/presenters/snippet_blob_presenter_spec.rb'
diff --git a/app/assets/javascripts/access_tokens/components/access_token_table_app.vue b/app/assets/javascripts/access_tokens/components/access_token_table_app.vue
index d21f94b736f..f28893206da 100644
--- a/app/assets/javascripts/access_tokens/components/access_token_table_app.vue
+++ b/app/assets/javascripts/access_tokens/components/access_token_table_app.vue
@@ -172,10 +172,6 @@ export default {
         v-model="currentPage"
         :per-page="$options.PAGE_SIZE"
         :total-items="activeAccessTokens.length"
-        :prev-text="__('Prev')"
-        :next-text="__('Next')"
-        :label-next-page="__('Go to next page')"
-        :label-prev-page="__('Go to previous page')"
         align="center"
         class="gl-mt-5"
       />
diff --git a/app/assets/javascripts/access_tokens/components/inactive_access_token_table_app.vue b/app/assets/javascripts/access_tokens/components/inactive_access_token_table_app.vue
index bfb4aac75e8..eb57b778e33 100644
--- a/app/assets/javascripts/access_tokens/components/inactive_access_token_table_app.vue
+++ b/app/assets/javascripts/access_tokens/components/inactive_access_token_table_app.vue
@@ -114,10 +114,6 @@ export default {
       v-model="currentPage"
       :per-page="$options.PAGE_SIZE"
       :total-items="inactiveAccessTokens.length"
-      :prev-text="__('Prev')"
-      :next-text="__('Next')"
-      :label-next-page="__('Go to next page')"
-      :label-prev-page="__('Go to previous page')"
       align="center"
       class="gl-mt-5"
     />
diff --git a/app/assets/javascripts/admin/abuse_reports/components/app.vue b/app/assets/javascripts/admin/abuse_reports/components/app.vue
index d42ae7c1ba9..ce0972808a4 100644
--- a/app/assets/javascripts/admin/abuse_reports/components/app.vue
+++ b/app/assets/javascripts/admin/abuse_reports/components/app.vue
@@ -51,10 +51,6 @@ export default {
       :per-page="pagination.perPage"
       :total-items="pagination.totalItems"
       :link-gen="paginationLinkGenerator"
-      :prev-text="__('Prev')"
-      :next-text="__('Next')"
-      :label-next-page="__('Go to next page')"
-      :label-prev-page="__('Go to previous page')"
       align="center"
       class="gl-mt-3"
     />
diff --git a/app/assets/javascripts/admin/deploy_keys/components/table.vue b/app/assets/javascripts/admin/deploy_keys/components/table.vue
index e045a19c97e..bca50af5479 100644
--- a/app/assets/javascripts/admin/deploy_keys/components/table.vue
+++ b/app/assets/javascripts/admin/deploy_keys/components/table.vue
@@ -30,10 +30,6 @@ export default {
     ),
     delete: __('Delete deploy key'),
     edit: __('Edit deploy key'),
-    pagination: {
-      next: __('Next'),
-      prev: __('Prev'),
-    },
     modal: {
       title: __('Are you sure?'),
       body: __('Are you sure you want to delete this deploy key?'),
@@ -289,8 +285,6 @@ export default {
       v-model="page"
       :per-page="$options.DEFAULT_PER_PAGE"
       :total-items="totalItems"
-      :next-text="$options.i18n.pagination.next"
-      :prev-text="$options.i18n.pagination.prev"
       align="center"
       class="gl-mt-5"
     />
diff --git a/app/assets/javascripts/badges/components/badge_list.vue b/app/assets/javascripts/badges/components/badge_list.vue
index 33257e78aa4..adabbf39902 100644
--- a/app/assets/javascripts/badges/components/badge_list.vue
+++ b/app/assets/javascripts/badges/components/badge_list.vue
@@ -165,10 +165,6 @@ export default {
         v-model="currentPage"
         :per-page="$options.PAGE_SIZE"
         :total-items="badges.length"
-        :prev-text="__('Prev')"
-        :next-text="__('Next')"
-        :label-next-page="__('Go to next page')"
-        :label-prev-page="__('Go to previous page')"
         align="center"
         class="gl-mt-5"
       />
diff --git a/app/assets/javascripts/ci/runner/components/cells/runner_status_cell.vue b/app/assets/javascripts/ci/runner/components/cells/runner_status_cell.vue
index 63957d9b7fc..bcd556f1822 100644
--- a/app/assets/javascripts/ci/runner/components/cells/runner_status_cell.vue
+++ b/app/assets/javascripts/ci/runner/components/cells/runner_status_cell.vue
@@ -34,12 +34,8 @@ export default {
 
 <template>
   <div class="gl-display-flex gl-flex-wrap gl-gap-2">
-    <runner-status-badge
-      :contacted-at="contactedAt"
-      :status="status"
-      class="gl-max-w-full gl-text-truncate"
-    />
-    <runner-paused-badge v-if="paused" class="gl-max-w-full gl-text-truncate" />
+    <runner-status-badge :contacted-at="contactedAt" :status="status" />
+    <runner-paused-badge v-if="paused" />
     <slot :runner="runner" name="runner-job-status-badge"></slot>
   </div>
 </template>
diff --git a/app/assets/javascripts/ci/runner/components/cells/runner_summary_field.vue b/app/assets/javascripts/ci/runner/components/cells/runner_summary_field.vue
index 23ea9e735b9..1097c2c7d59 100644
--- a/app/assets/javascripts/ci/runner/components/cells/runner_summary_field.vue
+++ b/app/assets/javascripts/ci/runner/components/cells/runner_summary_field.vue
@@ -24,7 +24,7 @@ export default {
 </script>
 
 <template>
-  <div v-gl-tooltip="tooltip" class="gl-display-inline-block gl-text-secondary gl-mb-3 gl-mr-4">
+  <div v-gl-tooltip="tooltip" class="gl-inline-block gl-text-secondary gl-mb-3 gl-mr-4">
     <gl-icon v-if="icon" :name="icon" :size="12" />
     <!-- display tooltip as a label for screen readers and make it unavailable for copying -->
     <span class="gl-sr-only gl-select-none">{{ tooltip }}</span>
diff --git a/app/assets/javascripts/ci/runner/components/runner_job_status_badge.vue b/app/assets/javascripts/ci/runner/components/runner_job_status_badge.vue
index fac31497552..e805c1a52b8 100644
--- a/app/assets/javascripts/ci/runner/components/runner_job_status_badge.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_job_status_badge.vue
@@ -45,10 +45,12 @@ export default {
   <gl-badge
     v-if="badge"
     v-bind="$attrs"
-    class="gl-max-w-full gl-text-truncate gl-bg-transparent!"
+    class="!gl-bg-transparent"
     variant="muted"
     :class="badge.classes"
   >
-    {{ badge.label }}
+    <span class="gl-truncate">
+      {{ badge.label }}
+    </span>
   </gl-badge>
 </template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_status_badge.vue b/app/assets/javascripts/ci/runner/components/runner_status_badge.vue
index 8b775197386..2272d4a757d 100644
--- a/app/assets/javascripts/ci/runner/components/runner_status_badge.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_status_badge.vue
@@ -122,6 +122,8 @@ export default {
     :icon="badge.icon"
     v-bind="$attrs"
   >
-    {{ badge.label }}
+    <span class="gl-truncate">
+      {{ badge.label }}
+    </span>
   </gl-badge>
 </template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_tag.vue b/app/assets/javascripts/ci/runner/components/runner_tag.vue
index 3fe09e03001..d7d7f703ee1 100644
--- a/app/assets/javascripts/ci/runner/components/runner_tag.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_tag.vue
@@ -30,8 +30,8 @@ export default {
     },
   },
   methods: {
-    onResize() {
-      const { scrollWidth, offsetWidth } = this.$el;
+    onResize({ target }) {
+      const { scrollWidth, offsetWidth } = target;
       this.overflowing = scrollWidth > offsetWidth;
     },
   },
@@ -41,10 +41,11 @@ export default {
 <template>
   <gl-badge
     v-gl-tooltip="tooltip"
-    v-gl-resize-observer="onResize"
-    class="gl-display-inline-block gl-max-w-full gl-text-truncate"
+    class="gl-inline-block gl-overflow-hidden"
     :variant="$options.RUNNER_TAG_BADGE_VARIANT"
   >
-    {{ tag }}
+    <span v-gl-resize-observer="onResize" class="gl-truncate">
+      {{ tag }}
+    </span>
   </gl-badge>
 </template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_tags.vue b/app/assets/javascripts/ci/runner/components/runner_tags.vue
index 7d762d792a4..2b3070a1426 100644
--- a/app/assets/javascripts/ci/runner/components/runner_tags.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_tags.vue
@@ -16,6 +16,6 @@ export default {
 </script>
 <template>
   <span v-if="tagList && tagList.length">
-    <runner-tag v-for="tag in tagList" :key="tag" class="gl-display-inline gl-mr-1" :tag="tag" />
+    <runner-tag v-for="tag in tagList" :key="tag" class="gl-mr-1" :tag="tag" />
   </span>
 </template>
diff --git a/app/assets/javascripts/ci_secure_files/components/secure_files_list.vue b/app/assets/javascripts/ci_secure_files/components/secure_files_list.vue
index 874a339ae12..57a325d4546 100644
--- a/app/assets/javascripts/ci_secure_files/components/secure_files_list.vue
+++ b/app/assets/javascripts/ci_secure_files/components/secure_files_list.vue
@@ -49,10 +49,6 @@ export default {
     uploadLabel: __('Upload File'),
     uploadingLabel: __('Uploading...'),
     noFilesMessage: __('There are no secure files yet.'),
-    pagination: {
-      next: __('Next'),
-      prev: __('Prev'),
-    },
     uploadErrorMessages: {
       duplicate: __('A file with this name already exists.'),
       tooLarge: __('File too large. Secure Files must be less than %{limit} MB.'),
@@ -281,8 +277,6 @@ export default {
       v-model="page"
       :per-page="$options.DEFAULT_PER_PAGE"
       :total-items="totalItems"
-      :next-text="$options.i18n.pagination.next"
-      :prev-text="$options.i18n.pagination.prev"
       align="center"
       class="gl-mt-5"
     />
diff --git a/app/assets/javascripts/clusters_list/components/clusters.vue b/app/assets/javascripts/clusters_list/components/clusters.vue
index 77c962e4056..e100d36fc80 100644
--- a/app/assets/javascripts/clusters_list/components/clusters.vue
+++ b/app/assets/javascripts/clusters_list/components/clusters.vue
@@ -334,8 +334,6 @@ export default {
       v-model="currentPage"
       :per-page="clustersPerPage"
       :total-items="totalClusters"
-      :prev-text="__('Prev')"
-      :next-text="__('Next')"
       align="center"
     />
   </section>
diff --git a/app/assets/javascripts/commons/gitlab_ui.js b/app/assets/javascripts/commons/gitlab_ui.js
index e0637edd111..29218c6424d 100644
--- a/app/assets/javascripts/commons/gitlab_ui.js
+++ b/app/assets/javascripts/commons/gitlab_ui.js
@@ -1,6 +1,13 @@
 import applyGitLabUIConfig from '@gitlab/ui/dist/config';
 import { __, s__, n__ } from '~/locale';
-import { NEXT, PREV } from '~/vue_shared/components/pagination/constants';
+import {
+  PREV,
+  NEXT,
+  LABEL_FIRST_PAGE,
+  LABEL_PREV_PAGE,
+  LABEL_NEXT_PAGE,
+  LABEL_LAST_PAGE,
+} from '~/vue_shared/components/pagination/constants';
 
 applyGitLabUIConfig({
   translations: {
@@ -12,7 +19,15 @@ applyGitLabUIConfig({
     'GlKeysetPagination.prevText': PREV,
     'GlKeysetPagination.navigationLabel': s__('Pagination|Pagination'),
     'GlKeysetPagination.nextText': NEXT,
+
+    'GlPagination.labelFirstPage': LABEL_FIRST_PAGE,
+    'GlPagination.labelLastPage': LABEL_LAST_PAGE,
+    'GlPagination.labelNextPage': LABEL_NEXT_PAGE,
     'GlPagination.labelPage': s__('Pagination|Go to page %{page}'),
+    'GlPagination.labelPrevPage': LABEL_PREV_PAGE,
+    'GlPagination.nextText': NEXT,
+    'GlPagination.prevText': PREV,
+
     'GlCollapsibleListbox.srOnlyResultsLabel': (count) => n__('%d result', '%d results', count),
   },
 });
diff --git a/app/assets/javascripts/deploy_keys/components/app.vue b/app/assets/javascripts/deploy_keys/components/app.vue
index 256fdedc7ab..93d7aed9289 100644
--- a/app/assets/javascripts/deploy_keys/components/app.vue
+++ b/app/assets/javascripts/deploy_keys/components/app.vue
@@ -1,7 +1,7 @@
 <script>
 import { GlIcon, GlLoadingIcon, GlPagination } from '@gitlab/ui';
 import { createAlert } from '~/alert';
-import { s__, __ } from '~/locale';
+import { s__ } from '~/locale';
 import { captureException } from '~/sentry/sentry_browser_wrapper';
 import pageInfoQuery from '~/graphql_shared/client/page_info.query.graphql';
 import NavigationTabs from '~/vue_shared/components/navigation_tabs.vue';
@@ -89,10 +89,6 @@ export default {
   },
   i18n: {
     loading: s__('DeployKeys|Loading deploy keys'),
-    prevPage: __('Go to previous page'),
-    nextPage: __('Go to next page'),
-    next: __('Next'),
-    prev: __('Prev'),
   },
   computed: {
     tabs() {
@@ -204,10 +200,6 @@ export default {
         :total-items="pageInfo.total"
         :per-page="pageInfo.perPage"
         :value="currentPage"
-        :next="$options.i18n.next"
-        :prev="$options.i18n.prev"
-        :label-previous-page="$options.i18n.prevPage"
-        :label-next-page="$options.i18n.nextPage"
         @next="moveNext()"
         @previous="movePrevious()"
         @input="moveToPage"
diff --git a/app/assets/javascripts/environments/components/environments_app.vue b/app/assets/javascripts/environments/components/environments_app.vue
index 24c6f545c03..a38079ae51c 100644
--- a/app/assets/javascripts/environments/components/environments_app.vue
+++ b/app/assets/javascripts/environments/components/environments_app.vue
@@ -85,10 +85,6 @@ export default {
     cleanUpEnvsButtonLabel: s__('Environments|Clean up environments'),
     active: __('Active'),
     stopped: __('Stopped'),
-    prevPage: __('Go to previous page'),
-    nextPage: __('Go to next page'),
-    next: __('Next'),
-    prev: __('Prev'),
     searchPlaceholder: s__('Environments|Search by environment name'),
   },
   modalId: 'enable-review-app-info',
@@ -339,10 +335,6 @@ export default {
       :total-items="totalItems"
       :per-page="itemsPerPage"
       :value="page"
-      :next="$options.i18n.next"
-      :prev="$options.i18n.prev"
-      :label-previous-page="$options.prevPage"
-      :label-next-page="$options.nextPage"
       @next="movePage('next')"
       @previous="movePage('previous')"
       @input="moveToPage"
diff --git a/app/assets/javascripts/members/components/table/members_pagination.vue b/app/assets/javascripts/members/components/table/members_pagination.vue
index ac5f78b89ff..7761d89cf8c 100644
--- a/app/assets/javascripts/members/components/table/members_pagination.vue
+++ b/app/assets/javascripts/members/components/table/members_pagination.vue
@@ -46,10 +46,6 @@ export default {
     :per-page="pagination.perPage"
     :total-items="pagination.totalItems"
     :link-gen="paginationLinkGenerator"
-    :prev-text="__('Prev')"
-    :next-text="__('Next')"
-    :label-next-page="__('Go to next page')"
-    :label-prev-page="__('Go to previous page')"
     align="center"
   />
 </template>
diff --git a/app/assets/javascripts/profile/components/follow.vue b/app/assets/javascripts/profile/components/follow.vue
index 4d010fd7132..b130e985cb5 100644
--- a/app/assets/javascripts/profile/components/follow.vue
+++ b/app/assets/javascripts/profile/components/follow.vue
@@ -8,14 +8,9 @@ import {
   GlEmptyState,
 } from '@gitlab/ui';
 import { DEFAULT_PER_PAGE } from '~/api';
-import { NEXT, PREV } from '~/vue_shared/components/pagination/constants';
 import { isCurrentUser } from '~/lib/utils/common_utils';
 
 export default {
-  i18n: {
-    prev: PREV,
-    next: NEXT,
-  },
   components: {
     GlAvatarLabeled,
     GlAvatarLink,
@@ -112,8 +107,6 @@ export default {
       :value="page"
       :total-items="totalItems"
       :per-page="perPage"
-      :prev-text="$options.i18n.prev"
-      :next-text="$options.i18n.next"
       @input="$emit('pagination-input', $event)"
     />
   </div>
diff --git a/app/assets/javascripts/projects/commit_box/info/components/refs_list.vue b/app/assets/javascripts/projects/commit_box/info/components/refs_list.vue
index 8d88d9b727b..45766a57df0 100644
--- a/app/assets/javascripts/projects/commit_box/info/components/refs_list.vue
+++ b/app/assets/javascripts/projects/commit_box/info/components/refs_list.vue
@@ -79,7 +79,7 @@ export default {
 
 <template>
   <div class="well-segment">
-    <gl-icon :name="refIcon" :size="14" class="gl-ml-2 gl-mr-3" />
+    <gl-icon :name="refIcon" class="gl-ml-2 gl-mr-3" />
     <span data-testid="title" class="gl-mr-2">{{ namespace }}</span>
     <gl-badge
       v-for="ref in tippingRefs"
diff --git a/app/assets/javascripts/vue_shared/components/pagination/table_pagination.vue b/app/assets/javascripts/vue_shared/components/pagination/table_pagination.vue
index 76bedc0feeb..a690dd1fec7 100644
--- a/app/assets/javascripts/vue_shared/components/pagination/table_pagination.vue
+++ b/app/assets/javascripts/vue_shared/components/pagination/table_pagination.vue
@@ -1,13 +1,5 @@
 <script>
 import { GlPagination } from '@gitlab/ui';
-import {
-  PREV,
-  NEXT,
-  LABEL_FIRST_PAGE,
-  LABEL_PREV_PAGE,
-  LABEL_NEXT_PAGE,
-  LABEL_LAST_PAGE,
-} from '~/vue_shared/components/pagination/constants';
 
 export default {
   components: {
@@ -53,12 +45,6 @@ export default {
       return this.pageInfo.nextPage || this.pageInfo.previousPage;
     },
   },
-  prevText: PREV,
-  nextText: NEXT,
-  labelFirstPage: LABEL_FIRST_PAGE,
-  labelPrevPage: LABEL_PREV_PAGE,
-  labelNextPage: LABEL_NEXT_PAGE,
-  labelLastPage: LABEL_LAST_PAGE,
 };
 </script>
 <template>
@@ -71,13 +57,7 @@ export default {
     :per-page="pageInfo.perPage"
     :total-items="pageInfo.total"
     :prev-page="pageInfo.previousPage"
-    :prev-text="$options.prevText"
     :next-page="pageInfo.nextPage"
-    :next-text="$options.nextText"
-    :label-first-page="$options.labelFirstPage"
-    :label-prev-page="$options.labelPrevPage"
-    :label-next-page="$options.labelNextPage"
-    :label-last-page="$options.labelLastPage"
     @input="change"
   />
 </template>
diff --git a/app/assets/javascripts/vue_shared/components/pagination_links.vue b/app/assets/javascripts/vue_shared/components/pagination_links.vue
index 5cfaf95f300..e6bbd962945 100644
--- a/app/assets/javascripts/vue_shared/components/pagination_links.vue
+++ b/app/assets/javascripts/vue_shared/components/pagination_links.vue
@@ -1,13 +1,5 @@
 <script>
 import { GlPagination } from '@gitlab/ui';
-import {
-  PREV,
-  NEXT,
-  LABEL_FIRST_PAGE,
-  LABEL_PREV_PAGE,
-  LABEL_NEXT_PAGE,
-  LABEL_LAST_PAGE,
-} from '~/vue_shared/components/pagination/constants';
 
 export default {
   components: {
@@ -28,12 +20,6 @@ export default {
       const baseProps = {
         ...this.$attrs,
         value: this.pageInfo.page,
-        prevText: PREV,
-        nextText: NEXT,
-        labelFirstPage: LABEL_FIRST_PAGE,
-        labelPrevPage: LABEL_PREV_PAGE,
-        labelNextPage: LABEL_NEXT_PAGE,
-        labelLastPage: LABEL_LAST_PAGE,
       };
 
       if (this.pageInfo.total) {
diff --git a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_aws_instructions.vue b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_aws_instructions.vue
index 0d049e9e0b1..fb109c70dfe 100644
--- a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_aws_instructions.vue
+++ b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_aws_instructions.vue
@@ -107,7 +107,7 @@ export default {
         class="gl-py-5 gl-pl-8"
         :class="{ 'gl-border-b': borderBottom(idx) }"
       >
-        <div class="-gl-mt-1 gl-pl-4 gl-pb-2 gl-font-bold">
+        <div class="-gl-mt-1 gl-pb-2 gl-pl-4 gl-font-bold">
           {{ easyButton.description }}
           <gl-accordion :header-level="3" class="gl-pt-3">
             <gl-accordion-item
@@ -131,17 +131,17 @@ export default {
     </p>
     <template v-if="registrationToken">
       <h5 class="gl-mb-3">{{ $options.i18n.runnerRegistrationToken }}</h5>
-      <div class="gl-display-flex">
-        <pre class="gl-bg-gray gl-flex-grow-1 gl-whitespace-pre-line">{{ registrationToken }}</pre>
+      <div class="gl-flex">
+        <pre class="gl-bg-gray gl-grow gl-whitespace-pre-line">{{ registrationToken }}</pre>
         <modal-copy-button
           :title="$options.i18n.copyInstructions"
           :text="registrationToken"
-          css-classes="gl-align-self-start gl-ml-2 gl-mt-2"
+          css-classes="gl-self-start gl-ml-2 gl-mt-2"
           category="tertiary"
         />
       </div>
     </template>
-    <footer class="gl-display-flex gl-justify-content-end gl-pt-3 gl-gap-3">
+    <footer class="gl-flex gl-justify-end gl-gap-3 gl-pt-3">
       <gl-button @click="onClose()">{{ $options.i18n.close }}</gl-button>
       <gl-button variant="confirm" @click="onOk()">
         {{ $options.i18n.deployRunnerInAws }}
diff --git a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_cli_instructions.vue b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_cli_instructions.vue
index 24ff101f34e..ef3b1675136 100644
--- a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_cli_instructions.vue
+++ b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_cli_instructions.vue
@@ -109,7 +109,7 @@ export default {
     </h5>
 
     <gl-collapsible-listbox v-model="selectedArchName" class="gl-mb-3" :items="listboxItems" />
-    <div class="sm:gl-flex gl-align-items-center gl-mb-3">
+    <div class="gl-mb-3 gl-items-center sm:gl-flex">
       <h5>{{ $options.i18n.downloadInstallBinary }}</h5>
       <gl-button
         v-if="binaryUrl"
@@ -124,38 +124,34 @@ export default {
     </div>
 
     <template v-if="instructions">
-      <div class="gl-display-flex">
-        <pre
-          class="gl-bg-gray gl-flex-grow-1 gl-whitespace-pre-line"
-          data-testid="binary-instructions"
-          >{{ instructions.installInstructions }}</pre
-        >
+      <div class="gl-flex">
+        <pre class="gl-bg-gray gl-grow gl-whitespace-pre-line" data-testid="binary-instructions">{{
+          instructions.installInstructions
+        }}</pre>
         <modal-copy-button
           :title="$options.i18n.copyInstructions"
           :text="instructions.installInstructions"
           :modal-id="$options.modalId"
-          css-classes="gl-align-self-start gl-ml-2 gl-mt-2"
+          css-classes="gl-self-start gl-ml-2 gl-mt-2"
           category="tertiary"
         />
       </div>
       <h5 class="gl-mb-3">{{ $options.i18n.registerRunnerCommand }}</h5>
-      <div class="gl-display-flex">
-        <pre
-          class="gl-bg-gray gl-flex-grow-1 gl-whitespace-pre-line"
-          data-testid="register-command"
-          >{{ registerInstructionsWithToken }}</pre
-        >
+      <div class="gl-flex">
+        <pre class="gl-bg-gray gl-grow gl-whitespace-pre-line" data-testid="register-command">{{
+          registerInstructionsWithToken
+        }}</pre>
         <modal-copy-button
           :title="$options.i18n.copyInstructions"
           :text="registerInstructionsWithToken"
           :modal-id="$options.modalId"
-          css-classes="gl-align-self-start gl-ml-2 gl-mt-2"
+          css-classes="gl-self-start gl-ml-2 gl-mt-2"
           category="tertiary"
         />
       </div>
     </template>
 
-    <footer class="gl-display-flex gl-justify-content-end gl-pt-3">
+    <footer class="gl-flex gl-justify-end gl-pt-3">
       <gl-button @click="onClose()">{{ __('Close') }}</gl-button>
     </footer>
   </div>
diff --git a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_docker_instructions.vue b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_docker_instructions.vue
index 5d04fd1d8e7..bb9e021d0a2 100644
--- a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_docker_instructions.vue
+++ b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_docker_instructions.vue
@@ -29,7 +29,7 @@ export default {
       <gl-icon name="external-link" />
       {{ $options.I18N_VIEW_INSTRUCTIONS }}
     </gl-button>
-    <footer class="gl-display-flex gl-justify-content-end gl-pt-3">
+    <footer class="gl-flex gl-justify-end gl-pt-3">
       <gl-button @click="onClose()">{{ __('Close') }}</gl-button>
     </footer>
   </div>
diff --git a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_kubernetes_instructions.vue b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_kubernetes_instructions.vue
index a769b4a6ad8..e5b48d7bc39 100644
--- a/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_kubernetes_instructions.vue
+++ b/app/assets/javascripts/vue_shared/components/runner_instructions/instructions/runner_kubernetes_instructions.vue
@@ -29,7 +29,7 @@ export default {
       <gl-icon name="external-link" />
       {{ $options.I18N_VIEW_INSTRUCTIONS }}
     </gl-button>
-    <footer class="gl-display-flex gl-justify-content-end gl-pt-3">
+    <footer class="gl-flex gl-justify-end gl-pt-3">
       <gl-button @click="onClose()">{{ __('Close') }}</gl-button>
     </footer>
   </div>
diff --git a/app/assets/javascripts/work_items/components/work_item_labels.vue b/app/assets/javascripts/work_items/components/work_item_labels.vue
index 873f05a3811..dfb46e6779b 100644
--- a/app/assets/javascripts/work_items/components/work_item_labels.vue
+++ b/app/assets/javascripts/work_items/components/work_item_labels.vue
@@ -1,7 +1,7 @@
 <script>
 import { GlButton, GlDisclosureDropdown, GlLabel } from '@gitlab/ui';
 import fuzzaldrinPlus from 'fuzzaldrin-plus';
-import { difference } from 'lodash';
+import { difference, unionBy } from 'lodash';
 import { WORKSPACE_GROUP, WORKSPACE_PROJECT } from '~/issues/constants';
 import { __, n__ } from '~/locale';
 import WorkItemSidebarDropdownWidget from '~/work_items/components/shared/work_item_sidebar_dropdown_widget.vue';
@@ -16,6 +16,14 @@ import updateNewWorkItemMutation from '../graphql/update_new_work_item.mutation.
 import { i18n, I18N_WORK_ITEM_ERROR_FETCHING_LABELS, TRACKING_CATEGORY_SHOW } from '../constants';
 import { isLabelsWidget, newWorkItemId, newWorkItemFullPath } from '../utils';
 
+function formatLabelForListbox(label) {
+  return {
+    text: label.title || label.text,
+    value: label.id || label.value,
+    color: label.color,
+  };
+}
+
 export default {
   components: {
     DropdownContentsCreateView,
@@ -63,6 +71,8 @@ export default {
       createdLabelId: undefined,
       removeLabelIds: [],
       addLabelIds: [],
+      labelsCache: [],
+      labelsToShowAtTopOfTheListbox: [],
     };
   },
   computed: {
@@ -103,20 +113,15 @@ export default {
       return this.searchLabels;
     },
     labelsList() {
-      const visibleLabels =
-        this.visibleLabels?.map(({ id, title, color }) => ({
-          value: id,
-          text: title,
-          color,
-        })) || [];
+      const visibleLabels = this.visibleLabels?.map(formatLabelForListbox) || [];
 
       if (this.searchTerm || this.itemValues.length === 0) {
         return visibleLabels;
       }
 
-      const selectedLabels = visibleLabels.filter(({ value }) => this.itemValues.includes(value));
+      const selectedLabels = this.labelsToShowAtTopOfTheListbox.map(formatLabelForListbox) || [];
       const unselectedLabels = visibleLabels.filter(
-        ({ value }) => !this.itemValues.includes(value),
+        ({ value }) => !this.labelsToShowAtTopOfTheListbox.find((l) => l.id === value),
       );
 
       return [
@@ -146,6 +151,22 @@ export default {
       return this.isGroup ? WORKSPACE_GROUP : WORKSPACE_PROJECT;
     },
   },
+  watch: {
+    searchTerm(newVal, oldVal) {
+      if (newVal === '' && oldVal !== '') {
+        const selectedIds = [...this.itemValues, ...this.addLabelIds].filter(
+          (x) => !this.removeLabelIds.includes(x),
+        );
+
+        this.labelsToShowAtTopOfTheListbox = this.labelsCache.filter(({ id }) =>
+          selectedIds.includes(id),
+        );
+      }
+    },
+    localLabels(newVal) {
+      this.labelsToShowAtTopOfTheListbox = newVal;
+    },
+  },
   apollo: {
     workItem: {
       query: workItemByIidQuery,
@@ -158,6 +179,11 @@ export default {
       update(data) {
         return data.workspace?.workItem || {};
       },
+      result({ data }) {
+        const labels =
+          data?.workspace?.workItem?.widgets?.find(isLabelsWidget)?.labels?.nodes || [];
+        this.labelsCache = unionBy(this.labelsCache, labels, 'id');
+      },
       skip() {
         return !this.workItemIid;
       },
@@ -181,6 +207,10 @@ export default {
       update(data) {
         return data.workspace?.labels?.nodes;
       },
+      result({ data }) {
+        const labels = data?.workspace?.labels?.nodes || [];
+        this.labelsCache = unionBy(this.labelsCache, labels, 'id');
+      },
       error() {
         this.$emit('error', I18N_WORK_ITEM_ERROR_FETCHING_LABELS);
       },
diff --git a/app/assets/stylesheets/framework/broadcast_messages.scss b/app/assets/stylesheets/framework/broadcast_messages.scss
index 82bf932bdd5..d5cd28718aa 100644
--- a/app/assets/stylesheets/framework/broadcast_messages.scss
+++ b/app/assets/stylesheets/framework/broadcast_messages.scss
@@ -30,14 +30,14 @@
   right: $gl-padding;
   max-width: 300px;
   width: auto;
-  background: $white;
-  border: 1px solid $gray-100;
-  box-shadow: 0 1px 2px 0 rgba($black, 0.1);
+  background: var(--gl-background-color-default);
+  border: 1px solid var(--gl-border-color-default);
+  box-shadow: 0 1px 2px 0 var(--gl-shadow-color-default);
   border-radius: $gl-border-radius-base;
   z-index: 999;
 
-  &.preview {
-    position: static;
+  .gl-broadcast-message.banner {
+    color: $gl-text-color;
   }
 }
 
diff --git a/app/assets/stylesheets/framework/mixins.scss b/app/assets/stylesheets/framework/mixins.scss
index d30f41d7cad..3445f9f3add 100644
--- a/app/assets/stylesheets/framework/mixins.scss
+++ b/app/assets/stylesheets/framework/mixins.scss
@@ -247,7 +247,7 @@
   min-height: $height;
   background: var(--white, $white);
   border: 1px solid var(--gl-border-color-default);
-  color: var(--gl-text-color, $gl-text-color);
+  color: var(--gl-text-color-default);
   padding: $grid-size;
 }
 
diff --git a/app/assets/stylesheets/page_bundles/_pipeline_mixins.scss b/app/assets/stylesheets/page_bundles/_pipeline_mixins.scss
index 9a074195c42..d53e074dfb2 100644
--- a/app/assets/stylesheets/page_bundles/_pipeline_mixins.scss
+++ b/app/assets/stylesheets/page_bundles/_pipeline_mixins.scss
@@ -9,7 +9,7 @@
   &:hover {
     background-color: var(--gray-50, $gray-50);
     border: 1px solid $dropdown-toggle-active-border-color;
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
   }
 }
 
diff --git a/app/assets/stylesheets/page_bundles/build.scss b/app/assets/stylesheets/page_bundles/build.scss
index 43fc605761d..12b95ddeceb 100644
--- a/app/assets/stylesheets/page_bundles/build.scss
+++ b/app/assets/stylesheets/page_bundles/build.scss
@@ -61,7 +61,7 @@
 
   .header-content {
     a {
-      color: var(--gl-text-color, $gl-text-color);
+      color: var(--gl-text-color-heading);
 
       &:hover {
         color: var(--blue-600, $blue-600);
diff --git a/app/assets/stylesheets/page_bundles/ci_status.scss b/app/assets/stylesheets/page_bundles/ci_status.scss
index 65feaa19fe4..bca76d383dd 100644
--- a/app/assets/stylesheets/page_bundles/ci_status.scss
+++ b/app/assets/stylesheets/page_bundles/ci_status.scss
@@ -29,7 +29,7 @@
   &.ci-disabled,
   &.ci-scheduled,
   &.ci-manual {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
     border-color: currentColor;
 
     &:not(span):hover {
diff --git a/app/assets/stylesheets/page_bundles/commit_description.scss b/app/assets/stylesheets/page_bundles/commit_description.scss
index bc7329e5688..4acf2d20add 100644
--- a/app/assets/stylesheets/page_bundles/commit_description.scss
+++ b/app/assets/stylesheets/page_bundles/commit_description.scss
@@ -19,7 +19,7 @@
 
   .commit-title {
     margin: 0;
-    color: var(--gl-text-color);
+    color: var(--gl-text-color-default);
   }
 }
 
diff --git a/app/assets/stylesheets/page_bundles/issuable_list.scss b/app/assets/stylesheets/page_bundles/issuable_list.scss
index 8c9268dfa07..313c7b7d0a1 100644
--- a/app/assets/stylesheets/page_bundles/issuable_list.scss
+++ b/app/assets/stylesheets/page_bundles/issuable_list.scss
@@ -56,7 +56,7 @@
       color: var(--gray-500, $gl-text-color-secondary);
 
       a {
-        color: var(--gl-text-color, $gl-text-color);
+        color: var(--gl-text-color-default);
       }
 
       // stylelint-disable-next-line gitlab/no-gl-class
diff --git a/app/assets/stylesheets/page_bundles/merge_conflicts.scss b/app/assets/stylesheets/page_bundles/merge_conflicts.scss
index 9fe56fd337f..5aa69bb12dc 100644
--- a/app/assets/stylesheets/page_bundles/merge_conflicts.scss
+++ b/app/assets/stylesheets/page_bundles/merge_conflicts.scss
@@ -172,6 +172,6 @@
     background-color: var(--gray-10, $gray-10);
     text-align: right;
     padding: $gl-padding-top $gl-padding;
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
   }
 }
diff --git a/app/assets/stylesheets/page_bundles/merge_requests.scss b/app/assets/stylesheets/page_bundles/merge_requests.scss
index 6836d1f39d0..dafc4638691 100644
--- a/app/assets/stylesheets/page_bundles/merge_requests.scss
+++ b/app/assets/stylesheets/page_bundles/merge_requests.scss
@@ -495,7 +495,7 @@
 }
 
 .mr-state-widget {
-  color: var(--gl-text-color, $gl-text-color);
+  color: var(--gl-text-color-default);
 
   .commit-message-edit {
     border-radius: $gl-border-radius-base;
@@ -547,7 +547,7 @@
   }
 
   .ci-widget {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
     display: flex;
     align-items: center;
     justify-content: space-between;
@@ -726,11 +726,11 @@
   }
 
   .stop-env-container {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
     float: right;
 
     a {
-      color: var(--gl-text-color, $gl-text-color);
+      color: var(--gl-text-color-default);
     }
   }
 }
@@ -810,7 +810,7 @@
 }
 
 .mr-version-controls {
-  color: var(--gl-text-color, $gl-text-color);
+  color: var(--gl-text-color-default);
 
   .mr-version-menus-container {
     display: flex;
@@ -854,7 +854,7 @@
   }
 
   .dropdown-title {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-strong);
   }
 }
 
diff --git a/app/assets/stylesheets/page_bundles/pipeline.scss b/app/assets/stylesheets/page_bundles/pipeline.scss
index 066344e8d6c..a2cd4470cba 100644
--- a/app/assets/stylesheets/page_bundles/pipeline.scss
+++ b/app/assets/stylesheets/page_bundles/pipeline.scss
@@ -28,10 +28,6 @@
   .build-state {
     padding: 20px 2px;
 
-    .build-name {
-      font-weight: $gl-font-weight-normal;
-    }
-
     .stage {
       color: var(--gray-500, $gray-500);
       font-weight: $gl-font-weight-normal;
@@ -57,21 +53,6 @@
     margin-top: $gl-padding;
   }
 
-  .build-name {
-    width: 196px;
-
-    a {
-      font-weight: $gl-font-weight-bold;
-      color: var(--gl-text-color, $gl-text-color);
-      text-decoration: none;
-
-      &:focus,
-      &:hover {
-        text-decoration: underline;
-      }
-    }
-  }
-
   .build-actions {
     width: 70px;
     text-align: right;
diff --git a/app/assets/stylesheets/page_bundles/project.scss b/app/assets/stylesheets/page_bundles/project.scss
index fb9d11c0ff8..598479e856c 100644
--- a/app/assets/stylesheets/page_bundles/project.scss
+++ b/app/assets/stylesheets/page_bundles/project.scss
@@ -130,7 +130,7 @@
       }
 
       .project-stat-value {
-        color: var(--gl-text-color, $gl-text-color);
+        color: var(--gl-text-color-default);
       }
 
       .icon {
@@ -153,7 +153,7 @@
   margin-bottom: 7px;
 
   h5 {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-heading);
   }
 }
 
diff --git a/app/assets/stylesheets/page_bundles/projects.scss b/app/assets/stylesheets/page_bundles/projects.scss
index 854c03634eb..d62542a2ff5 100644
--- a/app/assets/stylesheets/page_bundles/projects.scss
+++ b/app/assets/stylesheets/page_bundles/projects.scss
@@ -115,7 +115,7 @@
   margin: 0;
 
   a {
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
   }
 
   .dropdown-menu {
@@ -264,7 +264,7 @@
 .project-row {
   .description p {
     margin-bottom: 0;
-    color: var(--gl-text-color-secondary, $gl-text-color-secondary);
+    color: var(--gl-text-color-subtle);
     @include str-truncated(100%);
   }
 }
diff --git a/app/assets/stylesheets/page_bundles/search.scss b/app/assets/stylesheets/page_bundles/search.scss
index c544e012ae0..f906a8f3875 100644
--- a/app/assets/stylesheets/page_bundles/search.scss
+++ b/app/assets/stylesheets/page_bundles/search.scss
@@ -164,7 +164,7 @@ $language-filter-max-height: 20rem;
     .dropdown-header {
       // Necessary because deprecatedJQueryDropdown doesn't support a second style of headers
       font-weight: $gl-font-weight-bold;
-      color: var(--gl-text-color, $gl-text-color);
+      color: var(--gl-text-color-strong);
       font-size: $gl-font-size;
       line-height: 16px;
     }
@@ -199,7 +199,7 @@ $language-filter-max-height: 20rem;
       }
 
       .search-input {
-        color: var(--gl-text-color, $gl-text-color);
+        color: var(--gl-text-color-default);
         transition: color ease-in-out $default-transition-duration;
       }
 
diff --git a/app/assets/stylesheets/page_bundles/todos.scss b/app/assets/stylesheets/page_bundles/todos.scss
index 3371e45dfc7..46ed8480f6e 100644
--- a/app/assets/stylesheets/page_bundles/todos.scss
+++ b/app/assets/stylesheets/page_bundles/todos.scss
@@ -73,7 +73,7 @@
 .todo-body {
   p {
     display: inline;
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
   }
 
   pre.code.highlight {
@@ -86,7 +86,7 @@
     border-radius: $gl-border-radius-base;
     display: inline-flex;
     background: var(--gray-50, $gray-50);
-    color: var(--gl-text-color, $gl-text-color);
+    color: var(--gl-text-color-default);
   }
 
   // stylelint-disable-next-line gitlab/no-gl-class
diff --git a/app/assets/stylesheets/page_bundles/tree.scss b/app/assets/stylesheets/page_bundles/tree.scss
index eb4288a252b..fa615d3140f 100644
--- a/app/assets/stylesheets/page_bundles/tree.scss
+++ b/app/assets/stylesheets/page_bundles/tree.scss
@@ -161,7 +161,7 @@
 
       i,
       a {
-        color: var(--gl-text-color, $gl-text-color);
+        color: var(--gl-text-color-default);
       }
 
       img {
diff --git a/app/assets/stylesheets/themes/dark_mode_overrides.scss b/app/assets/stylesheets/themes/dark_mode_overrides.scss
index cf1bf9daac1..7ed644969be 100644
--- a/app/assets/stylesheets/themes/dark_mode_overrides.scss
+++ b/app/assets/stylesheets/themes/dark_mode_overrides.scss
@@ -10,8 +10,6 @@
   --dark-icon-color-orange-1: #665349;
   --dark-icon-color-orange-2: #b37a5d;
 
-  --gl-text-color: #{$gray-900};
-
   --svg-status-bg: #{$white};
 }
 
diff --git a/app/components/pajamas/broadcast_banner_component.html.haml b/app/components/pajamas/broadcast_banner_component.html.haml
index 8d44877dda2..f34ff41cd98 100644
--- a/app/components/pajamas/broadcast_banner_component.html.haml
+++ b/app/components/pajamas/broadcast_banner_component.html.haml
@@ -15,5 +15,6 @@
         data: { id: @id,
                 expire_date: @expire_date,
                 dismissal_path: @dismissal_path,
-                cookie_key: @cookie_key } },
+                cookie_key: @cookie_key,
+                testid: @button_testid } },
       icon_classes: 'gl-text-white')
diff --git a/app/components/pajamas/broadcast_banner_component.rb b/app/components/pajamas/broadcast_banner_component.rb
index d86a29f0d93..1b011d72042 100644
--- a/app/components/pajamas/broadcast_banner_component.rb
+++ b/app/components/pajamas/broadcast_banner_component.rb
@@ -9,7 +9,10 @@ module Pajamas
     # @param [String] expire_date
     # @param [String] cookie_key
     # @param [String] dismissal_path
-    def initialize(message:, id:, theme:, dismissable:, expire_date:, cookie_key:, dismissal_path: nil)
+    # @param [String] button_testid
+    def initialize(
+      message:, id:, theme:, dismissable:, expire_date:, cookie_key:, dismissal_path: nil,
+      button_testid: nil)
       @message = message
       @id = id
       @theme = theme
@@ -17,6 +20,7 @@ module Pajamas
       @expire_date = expire_date
       @cookie_key = cookie_key
       @dismissal_path = dismissal_path
+      @button_testid = button_testid
     end
 
     delegate :sprite_icon, to: :helpers
diff --git a/app/controllers/graphql_controller.rb b/app/controllers/graphql_controller.rb
index def0d9ec50b..6bd47df8132 100644
--- a/app/controllers/graphql_controller.rb
+++ b/app/controllers/graphql_controller.rb
@@ -190,11 +190,12 @@ class GraphqlController < ApplicationController
     disable_reference = request.headers[DISABLE_SQL_QUERY_LIMIT_HEADER]
     return unless disable_reference
 
-    disable_issue, new_threshold = disable_reference.split(';')
-    if new_threshold
-      Gitlab::QueryLimiting.disable!(disable_issue, new_threshold: new_threshold&.to_i)
+    first, second = disable_reference.split(',')
+
+    if first.match?(/^\d+$/)
+      Gitlab::QueryLimiting.disable!(second, new_threshold: first&.to_i)
     else
-      Gitlab::QueryLimiting.disable!(disable_issue)
+      Gitlab::QueryLimiting.disable!(first)
     end
   end
 
diff --git a/app/models/deploy_token.rb b/app/models/deploy_token.rb
index 5928b27c0ec..d8112f7ef8f 100644
--- a/app/models/deploy_token.rb
+++ b/app/models/deploy_token.rb
@@ -7,7 +7,8 @@ class DeployToken < ApplicationRecord
   include Gitlab::Utils::StrongMemoize
 
   AVAILABLE_SCOPES = %i[read_repository read_registry write_registry
-    read_package_registry write_package_registry].freeze
+    read_package_registry write_package_registry
+    read_virtual_registry].freeze
   GITLAB_DEPLOY_TOKEN_NAME = 'gitlab-deploy-token'
   DEPLOY_TOKEN_PREFIX = 'gldt-'
 
diff --git a/app/models/virtual_registries/packages/maven/cached_response.rb b/app/models/virtual_registries/packages/maven/cached_response.rb
new file mode 100644
index 00000000000..35d5e2cec24
--- /dev/null
+++ b/app/models/virtual_registries/packages/maven/cached_response.rb
@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module VirtualRegistries
+  module Packages
+    module Maven
+      class CachedResponse < ApplicationRecord
+        include FileStoreMounter
+
+        belongs_to :group
+        belongs_to :upstream, class_name: 'VirtualRegistries::Packages::Maven::Upstream', inverse_of: :cached_responses
+
+        validates :group, top_level_group: true, presence: true
+        validates :relative_path,
+          :object_storage_key,
+          :content_type,
+          :downloads_count,
+          :size,
+          presence: true
+        validates :relative_path,
+          :object_storage_key,
+          :upstream_etag,
+          :content_type,
+          length: { maximum: 255 }
+        validates :downloads_count, numericality: { greater_than: 0, only_integer: true }
+        validates :relative_path, uniqueness: { scope: :upstream_id }
+        validates :file, presence: true
+
+        mount_file_store_uploader ::VirtualRegistries::CachedResponseUploader
+
+        before_validation :set_object_storage_key,
+          if: -> { object_storage_key.blank? && relative_path && upstream && upstream.registry }
+        attr_readonly :object_storage_key
+
+        private
+
+        def set_object_storage_key
+          self.object_storage_key = Gitlab::HashedPath.new(
+            'virtual_registries',
+            'packages',
+            'maven',
+            upstream.registry.id,
+            'upstream',
+            upstream.id,
+            'cached_response',
+            OpenSSL::Digest::SHA256.hexdigest(relative_path),
+            root_hash: upstream.registry.id
+          ).to_s
+        end
+      end
+    end
+  end
+end
diff --git a/app/models/virtual_registries/packages/maven/upstream.rb b/app/models/virtual_registries/packages/maven/upstream.rb
index 0a19e8f3193..16f1a4187ef 100644
--- a/app/models/virtual_registries/packages/maven/upstream.rb
+++ b/app/models/virtual_registries/packages/maven/upstream.rb
@@ -9,6 +9,9 @@ module VirtualRegistries
           class_name: 'VirtualRegistries::Packages::Maven::RegistryUpstream',
           inverse_of: :upstream
         has_one :registry, class_name: 'VirtualRegistries::Packages::Maven::Registry', through: :registry_upstream
+        has_many :cached_responses,
+          class_name: 'VirtualRegistries::Packages::Maven::CachedResponse',
+          inverse_of: :upstream
 
         attr_encrypted :credentials,
           mode: :per_attribute_iv,
diff --git a/app/models/virtual_registries/packages/policies/group.rb b/app/models/virtual_registries/packages/policies/group.rb
new file mode 100644
index 00000000000..facf1e10f51
--- /dev/null
+++ b/app/models/virtual_registries/packages/policies/group.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module VirtualRegistries
+  module Packages
+    module Policies
+      class Group
+        attr_reader :group
+
+        delegate_missing_to :group
+
+        def initialize(group)
+          @group = group.root_ancestor
+        end
+      end
+    end
+  end
+end
diff --git a/app/policies/virtual_registries/packages/policies/group_policy.rb b/app/policies/virtual_registries/packages/policies/group_policy.rb
new file mode 100644
index 00000000000..d14e22d50c8
--- /dev/null
+++ b/app/policies/virtual_registries/packages/policies/group_policy.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module VirtualRegistries
+  module Packages
+    module Policies
+      class GroupPolicy < ::BasePolicy
+        include CrudPolicyHelpers
+
+        delegate(:group) { @subject.group }
+
+        condition(:deploy_token_user, scope: :user, score: 0) { @user.is_a?(DeployToken) }
+
+        condition(:deploy_token_can_read_virtual_registry, score: 10) do
+          @user.read_virtual_registry && @user.has_access_to_group?(@subject.group)
+        end
+
+        rule { anonymous }.policy do
+          prevent(*create_read_update_admin_destroy(:virtual_registry))
+        end
+
+        rule { can?(:read_group) }.policy do
+          enable :read_virtual_registry
+        end
+
+        rule { group.maintainer }.policy do
+          enable :create_virtual_registry
+          enable :update_virtual_registry
+          enable :destroy_virtual_registry
+        end
+
+        rule { deploy_token_user & deploy_token_can_read_virtual_registry }.policy do
+          enable :read_virtual_registry
+        end
+
+        rule { deploy_token_user & ~deploy_token_can_read_virtual_registry }.policy do
+          prevent :read_virtual_registry
+        end
+      end
+    end
+  end
+end
diff --git a/app/presenters/packages/nuget/search_results_presenter.rb b/app/presenters/packages/nuget/search_results_presenter.rb
index 020e8656a36..06ac23c4f8a 100644
--- a/app/presenters/packages/nuget/search_results_presenter.rb
+++ b/app/presenters/packages/nuget/search_results_presenter.rb
@@ -10,19 +10,19 @@ module Packages
 
       def initialize(search)
         @search = search
-        @package_versions = {}
       end
 
       def data
-        @search.results.group_by(&:name).map do |package_name, packages|
-          latest_version = latest_version(packages)
-          latest_package = packages.find { |pkg| pkg.version == latest_version }
+        return [] if total_count == 0
+
+        grouped_packages.map do |package_name, packages|
+          package_versions, latest_version, latest_package = extract_package_details(packages)
 
           {
             type: 'Package',
             name: package_name,
             version: latest_version,
-            versions: build_package_versions(packages),
+            versions: package_versions,
             total_downloads: 0,
             verified: true,
             tags: tags_for(latest_package),
@@ -34,19 +34,33 @@ module Packages
 
       private
 
-      def build_package_versions(packages)
-        packages.map do |pkg|
-          {
+      def grouped_packages
+        @search
+          .results
+          .preload_nuget_metadatum
+          .preload_tags
+          .group_by(&:name)
+      end
+
+      def extract_package_details(packages)
+        package_versions = []
+        latest_version = nil
+        latest_package = nil
+
+        packages.each do |pkg|
+          package_versions << {
             json_url: json_url_for(pkg),
             downloads: 0,
             version: pkg.version
           }
-        end
-      end
 
-      def latest_version(packages)
-        versions = packages.filter_map(&:version)
-        sort_versions(versions).last
+          if sort_versions([latest_version, pkg.version]).last == pkg.version
+            latest_version = pkg.version
+            latest_package = pkg
+          end
+        end
+
+        [package_versions, latest_version, latest_package]
       end
     end
   end
diff --git a/app/uploaders/virtual_registries/cached_response_uploader.rb b/app/uploaders/virtual_registries/cached_response_uploader.rb
new file mode 100644
index 00000000000..4a41a68e433
--- /dev/null
+++ b/app/uploaders/virtual_registries/cached_response_uploader.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module VirtualRegistries
+  class CachedResponseUploader < GitlabUploader
+    include ObjectStorage::Concern
+
+    storage_location :dependency_proxy
+
+    alias_method :upload, :model
+
+    before :cache, :set_content_type
+
+    def store_dir
+      dynamic_segment
+    end
+
+    private
+
+    def set_content_type(file)
+      file.content_type = model.content_type
+    end
+
+    def dynamic_segment
+      model.object_storage_key
+    end
+  end
+end
diff --git a/app/views/projects/commit/_commit_box.html.haml b/app/views/projects/commit/_commit_box.html.haml
index 623c7c02d65..a785f2818a8 100644
--- a/app/views/projects/commit/_commit_box.html.haml
+++ b/app/views/projects/commit/_commit_box.html.haml
@@ -34,7 +34,7 @@
 .info-well
   .well-segment
     .icon-container.commit-icon
-      = custom_icon("icon_commit")
+      = sprite_icon('commit')
     %span.cgray= n_('parent', 'parents', @commit.parents.count)
     - @commit.parents.each do |parent|
       = link_to parent.short_id, project_commit_path(@project, parent), class: "commit-sha"
@@ -42,7 +42,7 @@
 
   .well-segment.merge-request-info
     .icon-container
-      = custom_icon('mr_bold')
+      = sprite_icon('merge-request')
     %span.commit-info.merge-requests{ 'data-project-commit-path' => merge_requests_project_commit_path(@project, @commit.id, format: :json) }
       = gl_loading_icon(inline: true, css_class: 'gl-align-middle')
 
diff --git a/app/views/shared/_broadcast_message.html.haml b/app/views/shared/_broadcast_message.html.haml
index 673d73d6008..51c188341d1 100644
--- a/app/views/shared/_broadcast_message.html.haml
+++ b/app/views/shared/_broadcast_message.html.haml
@@ -1,51 +1,11 @@
-- icon_name = 'bullhorn'
-- dismissable = message.dismissable?
-- preview = local_assigns.fetch(:preview, false)
-- dismissal_data = current_user ? { dismissal_path: broadcast_message_dismissals_path } : {}
+- content = render_broadcast_message(message)
+- expire_date = message.ends_at.iso8601
+- cookie_key = Users::BroadcastMessageDismissal.get_cookie_key(message.id)
+- dismissal_path = current_user ? broadcast_message_dismissals_path : nil
 
-- data = { id: message.id,
-  expire_date: message.ends_at.iso8601,
-  cookie_key: Users::BroadcastMessageDismissal.get_cookie_key(message.id),
-  testid: 'close-button' }.merge(dismissal_data)
+- if message.notification?
+  .broadcast-notification-message{ data: { testid: 'broadcast-notification-container' } }
+    = render Pajamas::BroadcastBannerComponent.new(message: content, id: message.id, theme: nil, dismissable: true, expire_date: expire_date, cookie_key: cookie_key, dismissal_path: dismissal_path, button_testid: 'close-button')
 
-- unless message.notification?
-  .gl-broadcast-message.broadcast-banner-message.banner{ role: "alert",
-    class: "js-broadcast-notification-#{message.id} #{message.theme}", data: { testid: 'banner-broadcast-message' } }
-    .gl-broadcast-message-content
-      .gl-broadcast-message-icon
-        = sprite_icon(icon_name)
-      .gl-broadcast-message-text.js-broadcast-message-preview
-        - if message.message.present?
-          %h2.gl-sr-only
-            = s_("Admin message")
-          = render_broadcast_message(message)
-        - else
-          = yield
-    - if dismissable && !preview
-      = render Pajamas::ButtonComponent.new(category: :tertiary,
-        icon: 'close',
-        size: :small,
-        button_options: { class: 'gl-close-btn-color-inherit gl-broadcast-message-dismiss js-dismiss-current-broadcast-notification',
-          'aria-label': _('Close'),
-          data: data },
-        icon_classes: 'gl-text-white')
 - else
-  - notification_class = "js-broadcast-notification-#{message.id}"
-  - notification_class << ' preview' if preview
-  .gl-broadcast-message.broadcast-notification-message.gl-mt-3{ role: "alert", class: notification_class, data: { testid: 'broadcast-notification-container' } }
-    .gl-broadcast-message-content
-      .gl-broadcast-message-icon
-        = sprite_icon(icon_name, css_class: 'vertical-align-text-top')
-      - if message.message.present?
-        %h2.gl-sr-only
-          = s_("Admin message")
-        = render_broadcast_message(message)
-      - else
-        = yield
-    - if !preview
-      = render Pajamas::ButtonComponent.new(category: :tertiary,
-        icon: 'close',
-        size: :small,
-        button_options: { class: 'js-dismiss-current-broadcast-notification',
-          'aria-label': _('Close'),
-          data: data })
+  = render Pajamas::BroadcastBannerComponent.new(message: content, id: message.id, theme: message.theme, dismissable: message.dismissable?, expire_date: expire_date, cookie_key: cookie_key, dismissal_path: dismissal_path)
diff --git a/app/views/shared/icons/_mr_bold.svg b/app/views/shared/icons/_mr_bold.svg
deleted file mode 100644
index 0f5be6e2bc8..00000000000
--- a/app/views/shared/icons/_mr_bold.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" height="16" width="16" viewBox="0 0 16 16"><path d="m5 5.563v4.875c1.024.4 1.75 1.397 1.75 2.563 0 1.519-1.231 2.75-2.75 2.75-1.519 0-2.75-1.231-2.75-2.75 0-1.166.726-2.162 1.75-2.563v-4.875c-1.024-.4-1.75-1.397-1.75-2.563 0-1.519 1.231-2.75 2.75-2.75 1.519 0 2.75 1.231 2.75 2.75 0 1.166-.726 2.162-1.75 2.563m-1 8.687c.69 0 1.25-.56 1.25-1.25 0-.69-.56-1.25-1.25-1.25-.69 0-1.25.56-1.25 1.25 0 .69.56 1.25 1.25 1.25m0-10c.69 0 1.25-.56 1.25-1.25 0-.69-.56-1.25-1.25-1.25-.69 0-1.25.56-1.25 1.25 0 .69.56 1.25 1.25 1.25"/><path d="m10.501 2c1.381.001 2.499 1.125 2.499 2.506v5.931c1.024.4 1.75 1.397 1.75 2.563 0 1.519-1.231 2.75-2.75 2.75-1.519 0-2.75-1.231-2.75-2.75 0-1.166.726-2.162 1.75-2.563v-5.931c0-.279-.225-.506-.499-.506v.926c0 .346-.244.474-.569.271l-2.952-1.844c-.314-.196-.325-.507 0-.71l2.952-1.844c.314-.196.569-.081.569.271v.93m1.499 12.25c.69 0 1.25-.56 1.25-1.25 0-.69-.56-1.25-1.25-1.25-.69 0-1.25.56-1.25 1.25 0 .69.56 1.25 1.25 1.25"/></svg>
diff --git a/db/docs/virtual_registries_packages_maven_cached_responses.yml b/db/docs/virtual_registries_packages_maven_cached_responses.yml
new file mode 100644
index 00000000000..ca2f0a3538b
--- /dev/null
+++ b/db/docs/virtual_registries_packages_maven_cached_responses.yml
@@ -0,0 +1,12 @@
+---
+table_name: virtual_registries_packages_maven_cached_responses
+classes:
+- VirtualRegistries::Packages::Maven::CachedResponse
+feature_categories:
+- virtual_registry
+description: Cached response from a Maven upstream. Contains references to an object storage file.
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/157055
+milestone: '17.3'
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  group_id: namespaces
diff --git a/db/migrate/20240628112814_add_read_virtual_registry_to_deploy_tokens.rb b/db/migrate/20240628112814_add_read_virtual_registry_to_deploy_tokens.rb
new file mode 100644
index 00000000000..9db55d3694f
--- /dev/null
+++ b/db/migrate/20240628112814_add_read_virtual_registry_to_deploy_tokens.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddReadVirtualRegistryToDeployTokens < Gitlab::Database::Migration[2.2]
+  milestone '17.3'
+
+  def change
+    add_column :deploy_tokens, :read_virtual_registry, :boolean, default: false, null: false
+  end
+end
diff --git a/db/migrate/20240712172152_create_virtual_registries_packages_maven_cached_responses.rb b/db/migrate/20240712172152_create_virtual_registries_packages_maven_cached_responses.rb
new file mode 100644
index 00000000000..1e8b05785b9
--- /dev/null
+++ b/db/migrate/20240712172152_create_virtual_registries_packages_maven_cached_responses.rb
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+class CreateVirtualRegistriesPackagesMavenCachedResponses < Gitlab::Database::Migration[2.2]
+  milestone '17.3'
+  disable_ddl_transaction!
+
+  TABLE_NAME = :virtual_registries_packages_maven_cached_responses
+
+  def up
+    with_lock_retries do
+      create_table TABLE_NAME, if_not_exists: true do |t|
+        t.references :group,
+          null: false,
+          index: { name: 'index_virtual_reg_pkgs_maven_cached_responses_on_group_id' },
+          foreign_key: { to_table: :namespaces, on_delete: :cascade }
+        t.references :upstream,
+          null: false,
+          index: false,
+          foreign_key: { to_table: :virtual_registries_packages_maven_upstreams, on_delete: :nullify }
+        t.datetime_with_timezone :upstream_checked_at, null: false, default: -> { 'NOW()' }
+        t.datetime_with_timezone :downloaded_at, null: false, default: -> { 'NOW()' }
+        t.timestamps_with_timezone null: false
+        t.integer :file_store, null: false, default: 1
+        t.integer :size, null: false
+        t.integer :downloads_count, null: false, default: 1
+        t.text :relative_path, null: false, limit: 255
+        t.text :file, null: false, limit: 255
+        t.text :object_storage_key, null: false, limit: 255
+        t.text :upstream_etag, limit: 255
+        t.text :content_type, limit: 255, null: false, default: 'application/octet-stream'
+      end
+    end
+
+    add_concurrent_index(
+      TABLE_NAME,
+      [:upstream_id, :relative_path],
+      unique: true,
+      name: 'idx_vregs_pkgs_mvn_cached_resp_on_uniq_upstrm_id_and_rel_path'
+    )
+
+    constraint = check_constraint_name(TABLE_NAME.to_s, 'downloads_count', 'positive')
+    add_check_constraint(TABLE_NAME, 'downloads_count > 0', constraint)
+  end
+
+  def down
+    drop_table TABLE_NAME
+  end
+end
diff --git a/db/schema_migrations/20240628112814 b/db/schema_migrations/20240628112814
new file mode 100644
index 00000000000..86f06eb4ee9
--- /dev/null
+++ b/db/schema_migrations/20240628112814
@@ -0,0 +1 @@
+4676a59779081ea366775cd96b1983520c6bf139e92c4ada4e6059eb3b7ed56f
\ No newline at end of file
diff --git a/db/schema_migrations/20240712172152 b/db/schema_migrations/20240712172152
new file mode 100644
index 00000000000..ed0e9ec9e56
--- /dev/null
+++ b/db/schema_migrations/20240712172152
@@ -0,0 +1 @@
+5f9eae6817962776ac40c7644122617cd042fb48af5db9d987367c710e8397d8
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 306367cf330..ac89c2754c6 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -9678,7 +9678,8 @@ CREATE TABLE deploy_tokens (
     write_registry boolean DEFAULT false NOT NULL,
     read_package_registry boolean DEFAULT false NOT NULL,
     write_package_registry boolean DEFAULT false NOT NULL,
-    creator_id bigint
+    creator_id bigint,
+    read_virtual_registry boolean DEFAULT false NOT NULL
 );
 
 CREATE SEQUENCE deploy_tokens_id_seq
@@ -18931,6 +18932,39 @@ CREATE SEQUENCE value_stream_dashboard_counts_id_seq
 
 ALTER SEQUENCE value_stream_dashboard_counts_id_seq OWNED BY value_stream_dashboard_counts.id;
 
+CREATE TABLE virtual_registries_packages_maven_cached_responses (
+    id bigint NOT NULL,
+    group_id bigint NOT NULL,
+    upstream_id bigint NOT NULL,
+    upstream_checked_at timestamp with time zone DEFAULT now() NOT NULL,
+    downloaded_at timestamp with time zone DEFAULT now() NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    file_store integer DEFAULT 1 NOT NULL,
+    size integer NOT NULL,
+    downloads_count integer DEFAULT 1 NOT NULL,
+    relative_path text NOT NULL,
+    file text NOT NULL,
+    object_storage_key text NOT NULL,
+    upstream_etag text,
+    content_type text DEFAULT 'application/octet-stream'::text NOT NULL,
+    CONSTRAINT check_28c64d513d CHECK ((char_length(object_storage_key) <= 255)),
+    CONSTRAINT check_30b7e853d9 CHECK ((char_length(upstream_etag) <= 255)),
+    CONSTRAINT check_68b105cda6 CHECK ((char_length(file) <= 255)),
+    CONSTRAINT check_731cd48dbf CHECK ((char_length(content_type) <= 255)),
+    CONSTRAINT check_c2aad543bf CHECK ((downloads_count > 0)),
+    CONSTRAINT check_d35a8e931f CHECK ((char_length(relative_path) <= 255))
+);
+
+CREATE SEQUENCE virtual_registries_packages_maven_cached_responses_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE virtual_registries_packages_maven_cached_responses_id_seq OWNED BY virtual_registries_packages_maven_cached_responses.id;
+
 CREATE TABLE virtual_registries_packages_maven_registries (
     id bigint NOT NULL,
     group_id bigint NOT NULL,
@@ -21652,6 +21686,8 @@ ALTER TABLE ONLY users_statistics ALTER COLUMN id SET DEFAULT nextval('users_sta
 
 ALTER TABLE ONLY value_stream_dashboard_counts ALTER COLUMN id SET DEFAULT nextval('value_stream_dashboard_counts_id_seq'::regclass);
 
+ALTER TABLE ONLY virtual_registries_packages_maven_cached_responses ALTER COLUMN id SET DEFAULT nextval('virtual_registries_packages_maven_cached_responses_id_seq'::regclass);
+
 ALTER TABLE ONLY virtual_registries_packages_maven_registries ALTER COLUMN id SET DEFAULT nextval('virtual_registries_packages_maven_registries_id_seq'::regclass);
 
 ALTER TABLE ONLY virtual_registries_packages_maven_registry_upstreams ALTER COLUMN id SET DEFAULT nextval('virtual_registries_packages_maven_registry_upstreams_id_seq'::regclass);
@@ -24366,6 +24402,9 @@ ALTER TABLE ONLY value_stream_dashboard_counts
 ALTER TABLE ONLY verification_codes
     ADD CONSTRAINT verification_codes_pkey PRIMARY KEY (created_at, visitor_id_code, code, phone);
 
+ALTER TABLE ONLY virtual_registries_packages_maven_cached_responses
+    ADD CONSTRAINT virtual_registries_packages_maven_cached_responses_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY virtual_registries_packages_maven_registries
     ADD CONSTRAINT virtual_registries_packages_maven_registries_pkey PRIMARY KEY (id);
 
@@ -26026,6 +26065,8 @@ CREATE INDEX idx_user_credit_card_validations_on_similar_to_meta_data ON user_cr
 
 CREATE INDEX idx_user_details_on_provisioned_by_group_id_user_id ON user_details USING btree (provisioned_by_group_id, user_id);
 
+CREATE UNIQUE INDEX idx_vregs_pkgs_mvn_cached_resp_on_uniq_upstrm_id_and_rel_path ON virtual_registries_packages_maven_cached_responses USING btree (upstream_id, relative_path);
+
 CREATE INDEX idx_vuln_reads_for_filtering ON vulnerability_reads USING btree (project_id, state, dismissal_reason, severity DESC, vulnerability_id DESC NULLS LAST);
 
 CREATE UNIQUE INDEX idx_vuln_signatures_uniqueness_signature_sha ON vulnerability_finding_signatures USING btree (finding_id, algorithm_type, signature_sha);
@@ -29676,6 +29717,8 @@ CREATE UNIQUE INDEX index_verification_codes_on_phone_and_visitor_id_code ON ONL
 
 COMMENT ON INDEX index_verification_codes_on_phone_and_visitor_id_code IS 'JiHu-specific index';
 
+CREATE INDEX index_virtual_reg_pkgs_maven_cached_responses_on_group_id ON virtual_registries_packages_maven_cached_responses USING btree (group_id);
+
 CREATE INDEX index_virtual_reg_pkgs_maven_reg_upstreams_on_group_id ON virtual_registries_packages_maven_registry_upstreams USING btree (group_id);
 
 CREATE INDEX index_virtual_reg_pkgs_maven_upstreams_on_group_id ON virtual_registries_packages_maven_upstreams USING btree (group_id);
@@ -33574,6 +33617,9 @@ ALTER TABLE ONLY search_namespace_index_assignments
 ALTER TABLE ONLY issue_assignment_events
     ADD CONSTRAINT fk_rails_07683f8e80 FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL;
 
+ALTER TABLE ONLY virtual_registries_packages_maven_cached_responses
+    ADD CONSTRAINT fk_rails_0816e694a3 FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY security_policies
     ADD CONSTRAINT fk_rails_08722e8ac7 FOREIGN KEY (security_policy_management_project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
@@ -33646,6 +33692,9 @@ ALTER TABLE ONLY audit_events_streaming_headers
 ALTER TABLE ONLY ci_sources_projects
     ADD CONSTRAINT fk_rails_10a1eb379a_p FOREIGN KEY (partition_id, pipeline_id) REFERENCES ci_pipelines(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE;
 
+ALTER TABLE ONLY virtual_registries_packages_maven_cached_responses
+    ADD CONSTRAINT fk_rails_1167f21441 FOREIGN KEY (upstream_id) REFERENCES virtual_registries_packages_maven_upstreams(id) ON DELETE SET NULL;
+
 ALTER TABLE ONLY zoom_meetings
     ADD CONSTRAINT fk_rails_1190f0e0fa FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
diff --git a/doc/administration/appearance.md b/doc/administration/appearance.md
index 3c97a411805..95ef3f3844d 100644
--- a/doc/administration/appearance.md
+++ b/doc/administration/appearance.md
@@ -143,8 +143,8 @@ You can use [Markdown](../user/markdown.md) in the description.
 
 The member guidelines are visible to users who have the [permission](../user/permissions.md) to manage either:
 
-- Group members at the group level.
-- Project members at the project level.
+- A group's members.
+- A project's members.
 
 You should add member guidelines if you manage group and project membership using either:
 
diff --git a/doc/administration/moderate_users.md b/doc/administration/moderate_users.md
index 39673a7d7f6..c3d18c6a2b4 100644
--- a/doc/administration/moderate_users.md
+++ b/doc/administration/moderate_users.md
@@ -10,7 +10,7 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed
 
-This is the administration documentation. For information about moderating users at the group level, see the [group-level documentation](../user/group/moderate_users.md).
+This is the administration documentation. For information about moderating users in a group, see the [group documentation](../user/group/moderate_users.md).
 
 GitLab administrators can moderate user access by approving, blocking, banning, or deactivating
 users.
diff --git a/doc/administration/reporting/git_abuse_rate_limit.md b/doc/administration/reporting/git_abuse_rate_limit.md
index a4b75f58828..c49e6b6e719 100644
--- a/doc/administration/reporting/git_abuse_rate_limit.md
+++ b/doc/administration/reporting/git_abuse_rate_limit.md
@@ -13,7 +13,7 @@ DETAILS:
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/8066) in GitLab 15.2 [with a flag](../../administration/feature_flags.md) named `git_abuse_rate_limit_feature_flag`. Disabled by default.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/394996) in GitLab 15.11. Feature flag `git_abuse_rate_limit_feature_flag` removed.
 
-This is the administration documentation. For information about Git abuse rate limiting at the group level, see the [group-level documentation](../../user/group/reporting/git_abuse_rate_limit.md).
+This is the administration documentation. For information about Git abuse rate limiting for a group, see the [group documentation](../../user/group/reporting/git_abuse_rate_limit.md).
 
 Git abuse rate limiting is a feature to automatically [ban users](../../administration/moderate_users.md#ban-and-unban-users) who download, clone, or fork more than a specified number of repositories in any project in the instance in a given time frame. Banned users cannot sign in to the instance and cannot access any non-public group via HTTP or SSH. The rate limit also applies to users who authenticate with a [personal](../../user/profile/personal_access_tokens.md) or [group access token](../../user/group/settings/group_access_tokens.md).
 
diff --git a/doc/administration/self_hosted_models/index.md b/doc/administration/self_hosted_models/index.md
index ad9dd3831f2..e346b733e51 100644
--- a/doc/administration/self_hosted_models/index.md
+++ b/doc/administration/self_hosted_models/index.md
@@ -57,7 +57,7 @@ more information about this offering, see [subscriptions](../../subscriptions/se
 To deploy a self-hosted large language model:
 
 1. [Set up your self-hosted model deployment infrastructure](../../administration/self_hosted_models/install_infrastructure.md) and connect it to your GitLab instance.
-1. [Configure your GitLab instance to access self-hosted models](../../administration/self_hosted_models/configure_duo_features.md) using instance and group level settings.
+1. [Configure your GitLab instance to access self-hosted models](../../administration/self_hosted_models/configure_duo_features.md) using instance and group settings.
 
 ## Self-hosted models compared to the default GitLab AI vendor architecture
 
diff --git a/doc/api/search.md b/doc/api/search.md
index 38a3c93915a..ff044079e03 100644
--- a/doc/api/search.md
+++ b/doc/api/search.md
@@ -23,9 +23,6 @@ these additional scopes are available for the [advanced search](#advanced-search
 
 ## Advanced search API
 
-DETAILS:
-**Tier:** Premium, Ultimate
-
 Search for a [term](../user/search/advanced_search.md#syntax) across the entire GitLab instance.
 The response depends on the requested scope.
 
diff --git a/doc/ci/runners/runners_scope.md b/doc/ci/runners/runners_scope.md
index 42f734b9f11..b8ecaaf3000 100644
--- a/doc/ci/runners/runners_scope.md
+++ b/doc/ci/runners/runners_scope.md
@@ -379,7 +379,7 @@ Prerequisites:
 
 You can clean up group runners that have been inactive for more than three months.
 
-Group runners are those that were created at the group level.
+Group runners are those that were created in a specific group.
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Settings > CI/CD**.
diff --git a/doc/development/packages/new_format_development.md b/doc/development/packages/new_format_development.md
index 44d4f82794b..dd55be92314 100644
--- a/doc/development/packages/new_format_development.md
+++ b/doc/development/packages/new_format_development.md
@@ -181,7 +181,7 @@ supports this case.
 
 #### Authorization
 
-Project and group level permissions exist for `read_package`, `create_package`, and `destroy_package`. Each
+Project permissions and group permissions exist for `read_package`, `create_package`, and `destroy_package`. Each
 endpoint should
 [authorize the requesting user](https://gitlab.com/gitlab-org/gitlab/-/blob/398fef1ca26ae2b2c3dc89750f6b20455a1e5507/ee/lib/api/conan_packages.rb)
 against the project or group before continuing.
diff --git a/doc/development/testing_guide/best_practices.md b/doc/development/testing_guide/best_practices.md
index be19b1f674f..e76fd443305 100644
--- a/doc/development/testing_guide/best_practices.md
+++ b/doc/development/testing_guide/best_practices.md
@@ -871,6 +871,13 @@ To verify that code and its specs are well-isolated from Rails, run the spec
 individually via `bin/rspec`. Don't use `bin/spring rspec` as it loads
 `spec_helper` automatically.
 
+#### Maintaining fast_spec_helper specs
+
+There is a utility script `scripts/run-fast-specs.sh` which can be used to run
+all specs which use `fast_spec_helper`, in various ways. This script is useful
+to help identify `fast_spec_helper` specs which have problems, such as not
+running successfully in isolation. See the script for more details.
+
 ### `subject` and `let` variables
 
 The GitLab RSpec suite has made extensive use of `let`(along with its strict, non-lazy
diff --git a/doc/development/testing_guide/end_to_end/rspec_metadata_tests.md b/doc/development/testing_guide/end_to_end/rspec_metadata_tests.md
index e6e466e67d5..e17103eaf46 100644
--- a/doc/development/testing_guide/end_to_end/rspec_metadata_tests.md
+++ b/doc/development/testing_guide/end_to_end/rspec_metadata_tests.md
@@ -21,8 +21,8 @@ This is a partial list of the [RSpec metadata](https://rspec.info/features/3-12/
 | `:geo`                         | The test requires two GitLab Geo instances - a primary and a secondary - to be spun up.                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `:gitaly_cluster`              | The test runs against a GitLab instance where repositories are stored on redundant Gitaly nodes behind a Praefect node. All nodes are [separate containers](../../../administration/gitaly/praefect.md#requirements). Tests that use this tag have a longer setup time since there are three additional containers that need to be started.                                                                                                                                                                      |
 | `:github`                      | The test requires a GitHub personal access token.                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `:group_saml`                  | The test requires a GitLab instance that has SAML SSO enabled at the group level. Interacts with an external SAML identity provider. Paired with the `:orchestrated` tag.                                                                                                                                                                                                                                                                                                                                        |
-| `:instance_saml`               | The test requires a GitLab instance that has SAML SSO enabled at the instance level. Interacts with an external SAML identity provider. Paired with the `:orchestrated` tag.                                                                                                                                                                                                                                                                                                                                     |
+| `:group_saml`                  | The test requires a GitLab instance that has SAML SSO enabled for the group. Interacts with an external SAML identity provider. Paired with the `:orchestrated` tag.                                                                                                                                                                                                                                                                                                                                        |
+| `:instance_saml`               | The test requires a GitLab instance that has SAML SSO enabled for the instance. Interacts with an external SAML identity provider. Paired with the `:orchestrated` tag.                                                                                                                                                                                                                                                                                                                                     |
 | `:integrations`                | This aims to test the available [integrations](../../../user/project/integrations/index.md#available-integrations). The test requires Docker to be installed in the run context. It will provision the containers and can be run against a local instance or using the `gitlab-qa` scenario `Test::Integration::Integrations`.                                                                                                                                                                                   |
 | `:issue`, `:issue_${num}`      | Optional links to issues which might be related to the spec. Helps keep track of related issues and can also be used by tools that create test reports. Currently added automatically to `Allure` test report. Multiple tags can be used by adding an optional numeric suffix like `issue_1`, `issue_2` etc.                                                                                                                                                                                                     |
 | `:service_ping_disabled`       | The test interacts with the GitLab configuration service ping at the instance level to turn Admin area setting service ping checkbox on or off. This tag will have the test run only in the `service_ping_disabled` job and must be paired with the `:orchestrated` and `:requires_admin` tags.                                                                                                                                                                                                                  |
diff --git a/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
index 888b864e8d0..255059efc72 100644
--- a/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
+++ b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
@@ -212,7 +212,7 @@ consistency is ensured by a background job (eventually consistent).
 The base query always includes the following filters:
 
 - `stage_event_hash_id` - partition key
-- `project_id` or `group_id` - depending if it's a project or group level query
+- `project_id` or `group_id` - depending on whether it's a project or group query
 - `end_event_timestamp` - date range filter (last 30 days)
 
 Example: Selecting review stage duration for the GitLab project
diff --git a/doc/security/responding_to_security_incidents.md b/doc/security/responding_to_security_incidents.md
index f93f5d28e8c..7cab875ca5f 100644
--- a/doc/security/responding_to_security_incidents.md
+++ b/doc/security/responding_to_security_incidents.md
@@ -69,7 +69,7 @@ If you suspect that a user account or bot account has been compromised, you shou
 - [Block the user](../administration/moderate_users.md#block-a-user) to mitigate any current risk.
 - Reset any credentials the user might have had access to. For example, users with at least the Maintainer role can view protected [CI/CD variables](../ci/variables/index.md) and [runner registration tokens](../security/token_overview.md#runner-registration-tokens-deprecated).
 - [Reset the user's password](../security/reset_user_password.md).
-- Get the user to [enable two factor authentication](../user/profile/account/two_factor_authentication.md) (2FA), and consider [enforcing 2FA at the instance or group level](../security/two_factor_authentication.md).
+- Get the user to [enable two factor authentication](../user/profile/account/two_factor_authentication.md) (2FA), and consider [enforcing 2FA for an instance or group](../security/two_factor_authentication.md).
 - After completing an investigation and mitigating impacts, unblock the user.
 
 #### Event types
diff --git a/doc/topics/autodevops/cloud_deployments/auto_devops_with_gke.md b/doc/topics/autodevops/cloud_deployments/auto_devops_with_gke.md
index e3fce17e014..0eb4e6b1fa4 100644
--- a/doc/topics/autodevops/cloud_deployments/auto_devops_with_gke.md
+++ b/doc/topics/autodevops/cloud_deployments/auto_devops_with_gke.md
@@ -136,8 +136,8 @@ Follow these steps to configure the base domain and other settings required for
 
 ## Enable Auto DevOps and run the pipeline
 
-While Auto DevOps is enabled by default, Auto DevOps can be disabled at both
-the instance level (for self-managed instances) and the group level. Complete
+While Auto DevOps is enabled by default, Auto DevOps can be disabled for both
+the instance (for self-managed instances) and the group. Complete
 these steps to enable Auto DevOps if it's disabled:
 
 1. On the left sidebar, select **Search or go to** and find the application project.
diff --git a/doc/topics/autodevops/prepare_deployment.md b/doc/topics/autodevops/prepare_deployment.md
index e0231817b1d..44ad68821ed 100644
--- a/doc/topics/autodevops/prepare_deployment.md
+++ b/doc/topics/autodevops/prepare_deployment.md
@@ -43,9 +43,9 @@ The Auto DevOps base domain is required to use
 
 To define the base domain, either:
 
-- In the project, group, or instance level: go to your cluster settings and add it there.
-- In the project or group level: add it as an environment variable: `KUBE_INGRESS_BASE_DOMAIN`.
-- In the instance level: go to the Admin area, then **Settings > CI/CD > Continuous Integration and Delivery** and add it there.
+- In the project, group, or instance: go to your cluster settings and add it there.
+- In the project or group: add it as an environment variable: `KUBE_INGRESS_BASE_DOMAIN`.
+- In the instance: go to the Admin area, then **Settings > CI/CD > Continuous Integration and Delivery** and add it there.
 
 The base domain variable `KUBE_INGRESS_BASE_DOMAIN` follows the same order of precedence
 as other environment [variables](../../ci/variables/index.md#cicd-variable-precedence).
diff --git a/doc/tutorials/observability/observability_java_tutorial.md b/doc/tutorials/observability/observability_java_tutorial.md
new file mode 100644
index 00000000000..6a067e4dc9a
--- /dev/null
+++ b/doc/tutorials/observability/observability_java_tutorial.md
@@ -0,0 +1,127 @@
+---
+stage: Monitor
+group: Observability
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# Tutorial: Use GitLab Observability with a Java Spring application
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab.com
+**Status:** Beta
+
+> - Observability [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/124966) in GitLab 16.2 [with a flag](../../administration/feature_flags.md) named `observability_features`. Disabled by default.
+
+FLAG:
+The availability of this feature is controlled by a feature flag.
+For more information, see the history.
+This feature is available for testing, but not ready for production use.
+
+In this tutorial, you'll learn how to create, configure, instrument, and monitor a Java Spring application using GitLab Observability features.
+
+## Before you begin
+
+To follow along this tutorial, you must have:
+
+- A GitLab Ultimate subscription for GitLab.com
+- A local installation of Ruby on Rails
+- Basic knowledge of Git, Java Spring, and the core concepts of [OpenTelemetry](https://opentelemetry.io/)
+
+## Create a GitLab project
+
+First, create a GitLab project and a corresponding access token.
+
+1. On the left sidebar, at the top, select **Create new** (**{plus}**) and **New project/repository**.
+1. Select **Create from template**.
+1. Select **Spring** and then **Use template**.
+1. Enter the project details.
+    - In the **Project name** field, enter a name such as `test-spring-o11y`
+1. Select **Create project**.
+1. In the `test-sprint-o11y` project, on the left sidebar, select **Settings > Access tokens**.
+1. Create a new access token with the Owner role and the `read_api` and `write_observability` scopes. Store the token value somewhere safe—you'll need it later.
+
+## Run the application
+
+Next, we'll run the application to ensure that it works.
+
+1. After cloning the project from GitLab, open it in IntelliJ (or your preferred IDE).
+1. Open `src/main/java/com.example.demo/DemoApplication` and run the application:
+    ![Run application screenshot](img/java_start_application.png)
+1. After initialization, the application should be available at `http://localhost:8000`. Test it out, then in the IDE select the **Stop** button.
+
+## Add the OpenTelemetry dependencies
+
+Use auto-instrumentation to instrument the application: 
+
+1. In the `pom.xml` file, add the required dependencies:
+
+    ```xml
+    <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-api</artifactId>
+    </dependency>
+    <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-sdk-extension-autoconfigure</artifactId>
+    </dependency>
+    <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-sdk-extension-autoconfigure-spi</artifactId>
+    </dependency>
+    ```
+
+    ```xml
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.opentelemetry</groupId>
+                <artifactId>opentelemetry-bom</artifactId>
+                <version>1.40.0</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+    ```
+
+1. Update dependencies by selecting **Update Maven Changes**:
+
+    ![Maven changes update UI](img/maven_changes.png)
+
+1. Download the OpenTelemetry java agent file from the OpenTelemetry repository.
+
+    ```shell
+    curl --location --http1.0 "https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/latest/download/opentelemetry-javaagent.jar"
+    ```
+
+## Define environment variables
+
+The OpenTelemetry autoconfigure libraries read their configuration from environment variables.
+
+1. From the top-right menu, select **Edit Configurations...**:
+
+    ![Edit configuration](img/java_edit_configuration.png)
+
+1. In the configuration menu, select the icon in the **Environment Variables** field.
+
+    ![Configuration menu](img/java_configuration_menu.png)
+
+1. Add the following set of environment variables, replacing `{{PATH_TO_JAVA_AGENT}}`, `{{NAMESPACE_ID}}`, `{{PROJECT_ID}}`, `{{PROJECT_ACCESS_TOKEN}}` and `{{SERVICE_NAME}}` with the correct values.
+   - `JAVA_TOOL_OPTIONS=-javaagent:{{PATH_TO_JAVA_AGENT}}/opentelemetry-javaagent.jar`
+   - `OTEL_EXPORTER_OTLP_ENDPOINT=https://observe.gitlab.com/v3/{{NAMESPACE_ID}}/{{PROJECT_ID}}/ingest`
+   - `OTEL_EXPORTER_OTLP_HEADERS=PRIVATE-TOKEN\={{PROJECT_ACCESS_TOKEN}}`
+   - `OTEL_LOGS_EXPORTER=otlp`
+   - `OTEL_METRIC_EXPORT_INTERVAL=15000`
+   - `OTEL_METRICS_EXPORTER=otlp`
+   - `OTEL_SERVICE_NAME=example-java-application`
+   - `OTEL_TRACES_EXPORTER=otlp`
+
+1. Restart the application and reload the page at `http://localhost:8000` a few times.
+
+## View the information in GitLab
+
+To view the exported information from your test project:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Monitor**, then either **Logs**, **Metrics**, or **Traces**.
diff --git a/doc/tutorials/observability/observabillty_java_tutorial.md b/doc/tutorials/observability/observabillty_java_tutorial.md
index 6a067e4dc9a..e46c49f511f 100644
--- a/doc/tutorials/observability/observabillty_java_tutorial.md
+++ b/doc/tutorials/observability/observabillty_java_tutorial.md
@@ -1,127 +1,11 @@
 ---
-stage: Monitor
-group: Observability
-info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+redirect_to: 'observability_java_tutorial.md'
+remove_date: '2024-10-25'
 ---
 
-# Tutorial: Use GitLab Observability with a Java Spring application
+This document was moved to [another location](observability_java_tutorial.md).
 
-DETAILS:
-**Tier:** Ultimate
-**Offering:** GitLab.com
-**Status:** Beta
-
-> - Observability [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/124966) in GitLab 16.2 [with a flag](../../administration/feature_flags.md) named `observability_features`. Disabled by default.
-
-FLAG:
-The availability of this feature is controlled by a feature flag.
-For more information, see the history.
-This feature is available for testing, but not ready for production use.
-
-In this tutorial, you'll learn how to create, configure, instrument, and monitor a Java Spring application using GitLab Observability features.
-
-## Before you begin
-
-To follow along this tutorial, you must have:
-
-- A GitLab Ultimate subscription for GitLab.com
-- A local installation of Ruby on Rails
-- Basic knowledge of Git, Java Spring, and the core concepts of [OpenTelemetry](https://opentelemetry.io/)
-
-## Create a GitLab project
-
-First, create a GitLab project and a corresponding access token.
-
-1. On the left sidebar, at the top, select **Create new** (**{plus}**) and **New project/repository**.
-1. Select **Create from template**.
-1. Select **Spring** and then **Use template**.
-1. Enter the project details.
-    - In the **Project name** field, enter a name such as `test-spring-o11y`
-1. Select **Create project**.
-1. In the `test-sprint-o11y` project, on the left sidebar, select **Settings > Access tokens**.
-1. Create a new access token with the Owner role and the `read_api` and `write_observability` scopes. Store the token value somewhere safe—you'll need it later.
-
-## Run the application
-
-Next, we'll run the application to ensure that it works.
-
-1. After cloning the project from GitLab, open it in IntelliJ (or your preferred IDE).
-1. Open `src/main/java/com.example.demo/DemoApplication` and run the application:
-    ![Run application screenshot](img/java_start_application.png)
-1. After initialization, the application should be available at `http://localhost:8000`. Test it out, then in the IDE select the **Stop** button.
-
-## Add the OpenTelemetry dependencies
-
-Use auto-instrumentation to instrument the application: 
-
-1. In the `pom.xml` file, add the required dependencies:
-
-    ```xml
-    <dependency>
-        <groupId>io.opentelemetry</groupId>
-        <artifactId>opentelemetry-api</artifactId>
-    </dependency>
-    <dependency>
-        <groupId>io.opentelemetry</groupId>
-        <artifactId>opentelemetry-sdk-extension-autoconfigure</artifactId>
-    </dependency>
-    <dependency>
-        <groupId>io.opentelemetry</groupId>
-        <artifactId>opentelemetry-sdk-extension-autoconfigure-spi</artifactId>
-    </dependency>
-    ```
-
-    ```xml
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>io.opentelemetry</groupId>
-                <artifactId>opentelemetry-bom</artifactId>
-                <version>1.40.0</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-    ```
-
-1. Update dependencies by selecting **Update Maven Changes**:
-
-    ![Maven changes update UI](img/maven_changes.png)
-
-1. Download the OpenTelemetry java agent file from the OpenTelemetry repository.
-
-    ```shell
-    curl --location --http1.0 "https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/latest/download/opentelemetry-javaagent.jar"
-    ```
-
-## Define environment variables
-
-The OpenTelemetry autoconfigure libraries read their configuration from environment variables.
-
-1. From the top-right menu, select **Edit Configurations...**:
-
-    ![Edit configuration](img/java_edit_configuration.png)
-
-1. In the configuration menu, select the icon in the **Environment Variables** field.
-
-    ![Configuration menu](img/java_configuration_menu.png)
-
-1. Add the following set of environment variables, replacing `{{PATH_TO_JAVA_AGENT}}`, `{{NAMESPACE_ID}}`, `{{PROJECT_ID}}`, `{{PROJECT_ACCESS_TOKEN}}` and `{{SERVICE_NAME}}` with the correct values.
-   - `JAVA_TOOL_OPTIONS=-javaagent:{{PATH_TO_JAVA_AGENT}}/opentelemetry-javaagent.jar`
-   - `OTEL_EXPORTER_OTLP_ENDPOINT=https://observe.gitlab.com/v3/{{NAMESPACE_ID}}/{{PROJECT_ID}}/ingest`
-   - `OTEL_EXPORTER_OTLP_HEADERS=PRIVATE-TOKEN\={{PROJECT_ACCESS_TOKEN}}`
-   - `OTEL_LOGS_EXPORTER=otlp`
-   - `OTEL_METRIC_EXPORT_INTERVAL=15000`
-   - `OTEL_METRICS_EXPORTER=otlp`
-   - `OTEL_SERVICE_NAME=example-java-application`
-   - `OTEL_TRACES_EXPORTER=otlp`
-
-1. Restart the application and reload the page at `http://localhost:8000` a few times.
-
-## View the information in GitLab
-
-To view the exported information from your test project:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select **Monitor**, then either **Logs**, **Metrics**, or **Traces**.
+<!-- This redirect file can be deleted after <2024-10-25>. -->
+<!-- Redirects that point to other docs in the same project expire in three months. -->
+<!-- Redirects that point to docs in a different project or site (for example, link is not relative and starts with `https:`) expire in one year. -->
+<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/redirects.html -->
diff --git a/doc/user/analytics/dora_metrics.md b/doc/user/analytics/dora_metrics.md
index 66189531a14..afccb020b88 100644
--- a/doc/user/analytics/dora_metrics.md
+++ b/doc/user/analytics/dora_metrics.md
@@ -248,7 +248,7 @@ and use it to automatically:
 
 ## DORA metrics availability
 
-The table below provides an overview of the DORA metrics' availability at project and group level:
+The table below provides an overview of the DORA metrics' availability in projects and groups:
 
 | Metric                    | Level             | Comments |
 |---------------------------|-------------------|----------|
diff --git a/doc/user/application_security/offline_deployments/index.md b/doc/user/application_security/offline_deployments/index.md
index 1d4cc01cd58..08311b2a81b 100644
--- a/doc/user/application_security/offline_deployments/index.md
+++ b/doc/user/application_security/offline_deployments/index.md
@@ -157,7 +157,7 @@ GitLab.com. To do so, set the CI/CD variable `SECURE_ANALYZERS_PREFIX` with the
 project [container registry](../../packages/container_registry/index.md).
 
 You can set this variable in the projects' `.gitlab-ci.yml`, or
-in the GitLab UI at the project or group level. See the [GitLab CI/CD variables page](../../../ci/variables/index.md#define-a-cicd-variable-in-the-ui)
+in the GitLab UI in the project or group. See the [GitLab CI/CD variables page](../../../ci/variables/index.md#define-a-cicd-variable-in-the-ui)
 for more information.
 
 #### Variables
diff --git a/doc/user/profile/notifications.md b/doc/user/profile/notifications.md
index dde8b1c2b36..58811322c18 100644
--- a/doc/user/profile/notifications.md
+++ b/doc/user/profile/notifications.md
@@ -172,8 +172,8 @@ Users are notified of the following events:
 | Personal access tokens have been created | User            | Security email, always sent.                                                                                                            |
 | Personal access tokens have expired      | User            | Security email, always sent.                                                                                                            |
 | Personal access token has been revoked   | User            | Security email, always sent.  [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/98911) in GitLab 15.5.                 |
-| Group access tokens expiring soon        | Group owners, maintainers, and administrators | Security email, always sent.  [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/367705) in GitLab 16.4.                 |
-| Project access tokens expiring soon      | Group owners, maintainers, and administrators | Security email, always sent.  [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/367705) in GitLab 16.4.                 |
+| Group access tokens expiring soon        | Group Owners, Maintainers, and administrators | Security email, always sent.  [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/367705) in GitLab 16.4.                 |
+| Project access tokens expiring soon      | Project Owners and Maintainers | Security email, always sent.  [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/367706) in GitLab 16.4.                 |
 | Project access level changed             | User            | Sent when user project access level is changed.                                                                                         |
 | SSH key has expired                      | User            | Security email, always sent.                                                                                                            |
 | Two-factor authentication disabled       | User            | Security email, always sent.                                                                                                            |
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 8d745e960f2..2fe6ecef823 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -24536,9 +24536,6 @@ msgstr ""
 msgid "Go to merge requests"
 msgstr ""
 
-msgid "Go to next page"
-msgstr ""
-
 msgid "Go to parent"
 msgstr ""
 
@@ -24551,9 +24548,6 @@ msgstr ""
 msgid "Go to pipelines"
 msgstr ""
 
-msgid "Go to previous page"
-msgstr ""
-
 msgid "Go to project"
 msgstr ""
 
diff --git a/qa/qa/specs/features/browser_ui/9_data_stores/group/transfer_group_spec.rb b/qa/qa/specs/features/browser_ui/9_data_stores/group/transfer_group_spec.rb
index a7783650e34..b7683aeeea7 100644
--- a/qa/qa/specs/features/browser_ui/9_data_stores/group/transfer_group_spec.rb
+++ b/qa/qa/specs/features/browser_ui/9_data_stores/group/transfer_group_spec.rb
@@ -17,6 +17,10 @@ module QA
       end
 
       it 'transfers a subgroup to another group', :blocking,
+        quarantine: {
+          issue: 'https://gitlab.com/gitlab-org/gitlab/-/issues/471699',
+          type: :investigating
+        },
         testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347692' do
         Page::Group::Menu.perform(&:go_to_general_settings)
         Page::Group::Settings::General.perform do |general|
diff --git a/scripts/run-fast-specs.sh b/scripts/run-fast-specs.sh
new file mode 100755
index 00000000000..c46da331ef7
--- /dev/null
+++ b/scripts/run-fast-specs.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+
+# shellcheck disable=SC2059
+
+BCyan='\033[1;36m'
+BRed='\033[1;31m'
+BGreen='\033[1;32m'
+BBlue='\033[1;34m'
+Color_Off='\033[0m'
+
+set -o errexit
+set -o pipefail
+trap onexit_err ERR
+
+# Exit handling
+function onexit_err() {
+  local exit_status=${1:-$?}
+  printf "\n❌❌❌ ${BRed}Run of fast_spec_helper specs failed!${Color_Off} ❌❌❌\n"
+  exit "${exit_status}"
+}
+
+function print_start_message {
+  trap onexit_err ERR
+
+  printf "${BCyan}\nStarting run of fast_spec_helper specs...${Color_Off}\n"
+}
+
+function run_fast_spec_helper_specs {
+  trap onexit_err ERR
+
+  printf "\n\n${BBlue}Running specs which use fast_spec_helper and also run fast...${Color_Off}\n\n"
+
+  # TIP: Add '--format=documentation --order=stable' when debugging flaky interaction between specs
+  bin/rspec --tag=~uses_fast_spec_helper_but_runs_slow "${fast_spec_helper_specs[@]}"
+}
+
+function run_fast_spec_helper_specs_which_are_slow {
+  trap onexit_err ERR
+
+  printf "\n\n${BBlue}Running specs which use fast_spec_helper but actually run slow...${Color_Off}\n\n"
+
+  # NOTE: fails_if_sidekiq_not_configured tag is used to skip specs which require special local config for sidekiq
+  bin/rspec --tag=uses_fast_spec_helper_but_runs_slow --tag=~fails_if_sidekiq_not_configured "${fast_spec_helper_specs[@]}"
+}
+
+function run_all_fast_spec_helper_specs_individually {
+  trap onexit_err ERR
+
+  printf "\n\n${BBlue}INDIVIDUALLY running all specs which use fast_spec_helper to ensure they run in isolation (this will be SLOW! Set SPEC_FILE_TO_START_AT to skip known-good spec files)...${Color_Off}\n\n"
+
+  # NOTE: Override `SPEC_FILE_TO_START_AT` to the relative path of a specific file in order to skip specs which are already known to be passing
+  SPEC_FILE_TO_START_AT="${SPEC_FILE_TO_START_AT:-${fast_spec_helper_specs[0]}}"
+
+  for spec_file in "${fast_spec_helper_specs[@]}"; do
+    if [ "${spec_file}" = "${SPEC_FILE_TO_START_AT}" ]; then
+      printf "${BBlue}Starting individual spec runs at SPEC_FILE_TO_START_AT: '${SPEC_FILE_TO_START_AT}'${Color_Off}\n\n"
+      START_RUNNING=true
+    fi
+
+    if [ -n "${START_RUNNING}" ]; then
+      printf "${BBlue}Running spec '${spec_file}' individually:${Color_Off}\n"
+      bin/rspec --tag=~fails_if_sidekiq_not_configured "$spec_file"
+    fi
+  done
+}
+
+function print_success_message {
+  trap onexit_err ERR
+
+  printf "\n✅✅✅ ${BGreen}All executed fast_spec_helper specs passed successfully!${Color_Off} ✅✅✅\n"
+}
+
+function main {
+  trap onexit_err ERR
+
+  # cd to gitlab root directory
+  cd "$(dirname "${BASH_SOURCE[0]}")"/..
+
+  # See https://github.com/koalaman/shellcheck/wiki/SC2207 for more context on this approach of creating an array
+  fast_spec_helper_specs=()
+  while IFS='' read -r line; do
+      fast_spec_helper_specs+=("$line")
+  done < <(git grep -l -E '^require .fast_spec_helper' -- '**/*_spec.rb')
+
+  print_start_message
+
+  if [ -n "${RUN_ALL_FAST_SPECS_INDIVIDUALLY}" ]; then
+    run_all_fast_spec_helper_specs_individually
+  else
+    run_fast_spec_helper_specs
+    run_fast_spec_helper_specs_which_are_slow
+  fi
+
+  print_success_message
+}
+
+main "$@"
diff --git a/spec/bin/sidekiq_cluster_spec.rb b/spec/bin/sidekiq_cluster_spec.rb
index 3379fee1263..2e0c1f67a95 100644
--- a/spec/bin/sidekiq_cluster_spec.rb
+++ b/spec/bin/sidekiq_cluster_spec.rb
@@ -4,7 +4,7 @@ require 'fast_spec_helper'
 require 'shellwords'
 require 'rspec-parameterized'
 
-RSpec.describe 'bin/sidekiq-cluster', :aggregate_failures do
+RSpec.describe 'bin/sidekiq-cluster', :uses_fast_spec_helper_but_runs_slow, :fails_if_sidekiq_not_configured, :aggregate_failures do
   using RSpec::Parameterized::TableSyntax
 
   let(:root) { File.expand_path('../..', __dir__) }
diff --git a/spec/commands/diagnostic_reports/uploader_smoke_spec.rb b/spec/commands/diagnostic_reports/uploader_smoke_spec.rb
index 1ec4eb407d8..e9d157bda08 100644
--- a/spec/commands/diagnostic_reports/uploader_smoke_spec.rb
+++ b/spec/commands/diagnostic_reports/uploader_smoke_spec.rb
@@ -5,7 +5,7 @@ require 'tempfile'
 
 # We need to capture pid from Process.spawn and then clean up by killing the process, which requires instance variables.
 # rubocop: disable RSpec/InstanceVariable
-RSpec.describe 'bin/diagnostic-reports-uploader' do
+RSpec.describe 'bin/diagnostic-reports-uploader', :uses_fast_spec_helper_but_runs_slow do
   # This is a smoke test for 'bin/diagnostic-reports-uploader'.
   # We intend to run this binary with `ruby bin/diagnostic-reports-uploader`, without preloading the entire Rails app.
   # Also, we use inline gemfile, to avoid pulling full Gemfile from the main app into memory.
diff --git a/spec/components/pajamas/broadcast_banner_component_spec.rb b/spec/components/pajamas/broadcast_banner_component_spec.rb
index a72ee3776f7..cd030fe116a 100644
--- a/spec/components/pajamas/broadcast_banner_component_spec.rb
+++ b/spec/components/pajamas/broadcast_banner_component_spec.rb
@@ -10,7 +10,8 @@ RSpec.describe Pajamas::BroadcastBannerComponent, :aggregate_failures, type: :co
       dismissable: dismissable,
       expire_date: expire_date,
       cookie_key: cookie_key,
-      dismissal_path: dismissal_path
+      dismissal_path: dismissal_path,
+      button_testid: button_testid
     )
   end
 
@@ -21,6 +22,7 @@ RSpec.describe Pajamas::BroadcastBannerComponent, :aggregate_failures, type: :co
   let(:expire_date) { Time.now.iso8601 }
   let(:cookie_key) { '_cookie_key_' }
   let(:dismissal_path) { '/-/my-path' }
+  let(:button_testid) { 'my-close-button' }
 
   it 'sets the correct classes' do
     expect(page).to have_selector(".js-broadcast-notification-#{id}")
@@ -60,4 +62,8 @@ RSpec.describe Pajamas::BroadcastBannerComponent, :aggregate_failures, type: :co
       expect(page).not_to have_selector('button.js-dismiss-current-broadcast-notification')
     end
   end
+
+  it 'sets the button testid' do
+    expect(page).to have_selector("button[data-testid='#{button_testid}']")
+  end
 end
diff --git a/spec/controllers/graphql_controller_spec.rb b/spec/controllers/graphql_controller_spec.rb
index 958a2b5eee2..be32165c542 100644
--- a/spec/controllers/graphql_controller_spec.rb
+++ b/spec/controllers/graphql_controller_spec.rb
@@ -682,6 +682,35 @@ RSpec.describe GraphqlController, feature_category: :integrations do
         expect(GraphiQL::Rails::VERSION).to eq("1.10.0")
       end
     end
+
+    context 'when X_GITLAB_DISABLE_SQL_QUERY_LIMIT is set' do
+      let(:issue_url) { "http://some/issue/url" }
+      let(:limit) { 205 }
+
+      context 'and it specifies a new query limit' do
+        let(:header_value) { "#{limit},#{issue_url}" }
+
+        it 'respects the new query limit' do
+          expect(Gitlab::QueryLimiting).to receive(:disable!).with(issue_url, new_threshold: limit)
+
+          request.env['HTTP_X_GITLAB_DISABLE_SQL_QUERY_LIMIT'] = header_value
+
+          post :execute
+        end
+      end
+
+      context 'and it does not specify a new limit' do
+        let(:header_value) { issue_url }
+
+        it 'disables limit' do
+          expect(Gitlab::QueryLimiting).to receive(:disable!).with(issue_url)
+
+          request.env['HTTP_X_GITLAB_DISABLE_SQL_QUERY_LIMIT'] = header_value
+
+          post :execute
+        end
+      end
+    end
   end
 
   describe 'Admin Mode' do
diff --git a/spec/dot_gitlab_ci/rules_spec.rb b/spec/dot_gitlab_ci/rules_spec.rb
index 85a72fa32ad..d5892b5a42a 100644
--- a/spec/dot_gitlab_ci/rules_spec.rb
+++ b/spec/dot_gitlab_ci/rules_spec.rb
@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# NOTE: Do not remove the parentheses from this require statement!
+#       They are necessary so it doesn't match the regex in `scripts/run-fast-specs.sh`,
+#       and make the "fast" portion of that suite run slow.
+require('fast_spec_helper') # NOTE: Do not remove the parentheses from this require statement!
 
 PatternsList = Struct.new(:name, :patterns)
 
diff --git a/spec/factories/deploy_tokens.rb b/spec/factories/deploy_tokens.rb
index f8366d43b05..d0a8a57102f 100644
--- a/spec/factories/deploy_tokens.rb
+++ b/spec/factories/deploy_tokens.rb
@@ -8,6 +8,7 @@ FactoryBot.define do
     write_registry { false }
     read_package_registry { false }
     write_package_registry { false }
+    read_virtual_registry { false }
     revoked { false }
     expires_at { 5.days.from_now.to_datetime }
     deploy_token_type { DeployToken.deploy_token_types[:project_type] }
@@ -36,6 +37,7 @@ FactoryBot.define do
       write_registry { true }
       read_package_registry { true }
       write_package_registry { true }
+      read_virtual_registry { true }
     end
 
     trait :dependency_proxy_scopes do
diff --git a/spec/factories/virtual_registries/packages/maven/cached_responses.rb b/spec/factories/virtual_registries/packages/maven/cached_responses.rb
new file mode 100644
index 00000000000..bd16e4892e8
--- /dev/null
+++ b/spec/factories/virtual_registries/packages/maven/cached_responses.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :virtual_registries_packages_maven_cached_response,
+    class: 'VirtualRegistries::Packages::Maven::CachedResponse' do
+    upstream { association :virtual_registries_packages_maven_upstream }
+    group { upstream.group }
+    relative_path { '/a/relative/path/test.txt' }
+    size { 1.kilobyte }
+    upstream_etag { OpenSSL::Digest.hexdigest('SHA256', 'test') }
+    content_type { 'text/plain' }
+    downloads_count { 5 }
+
+    transient do
+      file_fixture { 'spec/fixtures/bfg_object_map.txt' }
+    end
+
+    after(:build) do |entry, evaluator|
+      entry.upstream.registry_upstream.group = entry.group
+      entry.file = fixture_file_upload(evaluator.file_fixture)
+    end
+  end
+end
diff --git a/spec/frontend/admin/abuse_reports/components/app_spec.js b/spec/frontend/admin/abuse_reports/components/app_spec.js
index 41728baaf33..2ed4fa8fbe7 100644
--- a/spec/frontend/admin/abuse_reports/components/app_spec.js
+++ b/spec/frontend/admin/abuse_reports/components/app_spec.js
@@ -62,7 +62,7 @@ describe('AbuseReportsApp', () => {
         value: pagination.currentPage,
         perPage: pagination.perPage,
         totalItems: pagination.totalItems,
-        prevText: 'Prev',
+        prevText: 'Previous',
         nextText: 'Next',
         labelNextPage: 'Go to next page',
         labelPrevPage: 'Go to previous page',
diff --git a/spec/frontend/admin/deploy_keys/components/table_spec.js b/spec/frontend/admin/deploy_keys/components/table_spec.js
index d30da4217a6..95a999d5a69 100644
--- a/spec/frontend/admin/deploy_keys/components/table_spec.js
+++ b/spec/frontend/admin/deploy_keys/components/table_spec.js
@@ -189,8 +189,6 @@ describe('DeployKeysTable', () => {
           value: 1,
           perPage: DEFAULT_PER_PAGE,
           totalItems: responseBody.length,
-          nextText: DeployKeysTable.i18n.pagination.next,
-          prevText: DeployKeysTable.i18n.pagination.prev,
           align: 'center',
         });
       });
diff --git a/spec/frontend/ci/runner/components/runner_job_status_badge_spec.js b/spec/frontend/ci/runner/components/runner_job_status_badge_spec.js
index 89f015e21cc..36bc8aba940 100644
--- a/spec/frontend/ci/runner/components/runner_job_status_badge_spec.js
+++ b/spec/frontend/ci/runner/components/runner_job_status_badge_spec.js
@@ -33,13 +33,7 @@ describe('RunnerTypeBadge', () => {
 
       expect(findBadge().props()).toMatchObject({ variant: 'muted' });
       expect(findBadge().classes().sort()).toEqual(
-        [
-          ...classes,
-          'gl-shadow-inner-1-gray-400',
-          'gl-max-w-full',
-          'gl-text-truncate',
-          'gl-bg-transparent!',
-        ].sort(),
+        [...classes, 'gl-shadow-inner-1-gray-400', '!gl-bg-transparent'].sort(),
       );
       expect(findBadge().text()).toBe(text);
     },
diff --git a/spec/frontend/ci/runner/components/runner_tag_spec.js b/spec/frontend/ci/runner/components/runner_tag_spec.js
index 5f653ec38cc..7facc5bb452 100644
--- a/spec/frontend/ci/runner/components/runner_tag_spec.js
+++ b/spec/frontend/ci/runner/components/runner_tag_spec.js
@@ -15,11 +15,13 @@ describe('RunnerTag', () => {
   const getTooltipValue = () => getBinding(findBadge().element, 'gl-tooltip').value;
 
   const setDimensions = ({ scrollWidth, offsetWidth }) => {
-    jest.spyOn(findBadge().element, 'scrollWidth', 'get').mockReturnValue(scrollWidth);
-    jest.spyOn(findBadge().element, 'offsetWidth', 'get').mockReturnValue(offsetWidth);
+    const content = findBadge().element.querySelector('span');
+
+    jest.spyOn(content, 'scrollWidth', 'get').mockReturnValue(scrollWidth);
+    jest.spyOn(content, 'offsetWidth', 'get').mockReturnValue(offsetWidth);
 
     // Mock trigger resize
-    getBinding(findBadge().element, 'gl-resize-observer').value();
+    getBinding(content, 'gl-resize-observer').value({ target: content });
   };
 
   const createComponent = ({ props = {} } = {}) => {
diff --git a/spec/frontend/members/components/table/members_pagination_spec.js b/spec/frontend/members/components/table/members_pagination_spec.js
index e5d1619cde1..0ab1f0c7489 100644
--- a/spec/frontend/members/components/table/members_pagination_spec.js
+++ b/spec/frontend/members/components/table/members_pagination_spec.js
@@ -41,7 +41,7 @@ describe('MembersPagination', () => {
       value: mockPagination.currentPage,
       perPage: mockPagination.perPage,
       totalItems: mockPagination.totalItems,
-      prevText: 'Prev',
+      prevText: 'Previous',
       nextText: 'Next',
       labelNextPage: 'Go to next page',
       labelPrevPage: 'Go to previous page',
diff --git a/spec/frontend/profile/components/follow_spec.js b/spec/frontend/profile/components/follow_spec.js
index dd7bc40f2cf..260c9cd504b 100644
--- a/spec/frontend/profile/components/follow_spec.js
+++ b/spec/frontend/profile/components/follow_spec.js
@@ -98,8 +98,6 @@ describe('FollowersTab', () => {
         value: defaultPropsData.page,
         totalItems: defaultPropsData.totalItems,
         perPage: DEFAULT_PER_PAGE,
-        prevText: Follow.i18n.prev,
-        nextText: Follow.i18n.next,
       });
     });
 
diff --git a/spec/frontend/work_items/components/work_item_labels_spec.js b/spec/frontend/work_items/components/work_item_labels_spec.js
index 1890c2c1aeb..360a7b287a4 100644
--- a/spec/frontend/work_items/components/work_item_labels_spec.js
+++ b/spec/frontend/work_items/components/work_item_labels_spec.js
@@ -335,25 +335,40 @@ describe('WorkItemLabels component', () => {
   });
 
   it('shows selected labels at top of list', async () => {
+    const [label1, label2, label3] = mockLabels;
+    const label999 = {
+      __typename: 'Label',
+      id: 'gid://gitlab/Label/999',
+      title: 'Label 999',
+      description: 'Label not in the label query result',
+      color: '#fff',
+      textColor: '#000',
+    };
+
     createComponent({
       workItemQueryHandler: workItemQuerySuccess,
-      updateWorkItemMutationHandler: successAddRemoveLabelWorkItemMutationHandler,
+      updateWorkItemMutationHandler: jest.fn().mockResolvedValue(
+        updateWorkItemMutationResponseFactory({
+          labels: [label1, label999],
+        }),
+      ),
     });
 
-    updateLabels([label1Id, label3Id]);
+    updateLabels([label1Id, label999.id]);
 
     showDropdown();
 
     await waitForPromises();
 
-    const [label1, label2, label3] = mockLabels;
-
     const selected = [
       { color: label1.color, text: label1.title, value: label1.id },
-      { color: label3.color, text: label3.title, value: label3.id },
+      { color: label999.color, text: label999.title, value: label999.id },
     ];
 
-    const unselected = [{ color: label2.color, text: label2.title, value: label2.id }];
+    const unselected = [
+      { color: label2.color, text: label2.title, value: label2.id },
+      { color: label3.color, text: label3.title, value: label3.id },
+    ];
 
     expect(findWorkItemSidebarDropdownWidget().props('listItems')).toEqual([
       { options: selected, text: __('Selected') },
diff --git a/spec/haml_lint/linter/inline_javascript_spec.rb b/spec/haml_lint/linter/inline_javascript_spec.rb
index fb35bb68247..9d00e3ab9d4 100644
--- a/spec/haml_lint/linter/inline_javascript_spec.rb
+++ b/spec/haml_lint/linter/inline_javascript_spec.rb
@@ -7,7 +7,7 @@ require 'rspec-parameterized'
 
 require_relative '../../../haml_lint/linter/inline_javascript'
 
-RSpec.describe HamlLint::Linter::InlineJavaScript do # rubocop:disable RSpec/FilePath
+RSpec.describe HamlLint::Linter::InlineJavaScript, :uses_fast_spec_helper_but_runs_slow do # rubocop:disable RSpec/FilePath
   using RSpec::Parameterized::TableSyntax
 
   include_context 'linter'
diff --git a/spec/lib/gitlab/ci/config/entry/include/rules_spec.rb b/spec/lib/gitlab/ci/config/entry/include/rules_spec.rb
index 503020e2202..c8e53082c93 100644
--- a/spec/lib/gitlab/ci/config/entry/include/rules_spec.rb
+++ b/spec/lib/gitlab/ci/config/entry/include/rules_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 require_dependency 'active_model'
 
 RSpec.describe Gitlab::Ci::Config::Entry::Include::Rules, feature_category: :pipeline_composition do
diff --git a/spec/lib/gitlab/graphql/known_operations_spec.rb b/spec/lib/gitlab/graphql/known_operations_spec.rb
index acb85bc737b..601cc10ef03 100644
--- a/spec/lib/gitlab/graphql/known_operations_spec.rb
+++ b/spec/lib/gitlab/graphql/known_operations_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 require 'rspec-parameterized'
 
 RSpec.describe Gitlab::Graphql::KnownOperations do
diff --git a/spec/lib/gitlab/i18n/pluralization_spec.rb b/spec/lib/gitlab/i18n/pluralization_spec.rb
index 6bfc500c8b8..4aab6daa21e 100644
--- a/spec/lib/gitlab/i18n/pluralization_spec.rb
+++ b/spec/lib/gitlab/i18n/pluralization_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 require 'rspec-parameterized'
 require 'rails/version'
 require 'gettext_i18n_rails'
diff --git a/spec/lib/gitlab/instrumentation/redis_cluster_validator_spec.rb b/spec/lib/gitlab/instrumentation/redis_cluster_validator_spec.rb
index ea5a32a25ff..679006f00c3 100644
--- a/spec/lib/gitlab/instrumentation/redis_cluster_validator_spec.rb
+++ b/spec/lib/gitlab/instrumentation/redis_cluster_validator_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
-require 'support/helpers/rails_helpers'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 require 'rspec-parameterized'
 
 RSpec.describe Gitlab::Instrumentation::RedisClusterValidator, feature_category: :scalability do
diff --git a/spec/lib/gitlab/pagination/offset_header_builder_spec.rb b/spec/lib/gitlab/pagination/offset_header_builder_spec.rb
index f43216702a8..dc964ad502f 100644
--- a/spec/lib/gitlab/pagination/offset_header_builder_spec.rb
+++ b/spec/lib/gitlab/pagination/offset_header_builder_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 
 RSpec.describe Gitlab::Pagination::OffsetHeaderBuilder do
   let(:request) { double(url: 'http://localhost') }
diff --git a/spec/lib/remote_development/settings_spec.rb b/spec/lib/remote_development/settings_spec.rb
index 1d95f85bf71..ef11e716a42 100644
--- a/spec/lib/remote_development/settings_spec.rb
+++ b/spec/lib/remote_development/settings_spec.rb
@@ -2,7 +2,7 @@
 
 require 'fast_spec_helper'
 
-RSpec.describe RemoteDevelopment::Settings, feature_category: :remote_development do
+RSpec.describe RemoteDevelopment::Settings, :rd_fast, feature_category: :remote_development do
   let(:response_hash) { { settings: { some_setting: 42 }, status: :success } }
   let(:get_settings_args) { { requested_setting_names: [:some_setting], options: { some_option: 42 } } }
 
diff --git a/spec/lib/sidebars/concerns/super_sidebar_panel_spec.rb b/spec/lib/sidebars/concerns/super_sidebar_panel_spec.rb
index e0c05379a9e..0536d0e67d3 100644
--- a/spec/lib/sidebars/concerns/super_sidebar_panel_spec.rb
+++ b/spec/lib/sidebars/concerns/super_sidebar_panel_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require 'fast_spec_helper'
+# require 'fast_spec_helper' -- this no longer runs under fast_spec_helper
+require 'spec_helper'
 
 RSpec.describe Sidebars::Concerns::SuperSidebarPanel, feature_category: :navigation do
   let(:menu_class_foo) { Class.new(Sidebars::Menu) }
diff --git a/spec/models/virtual_registries/packages/maven/cached_response_spec.rb b/spec/models/virtual_registries/packages/maven/cached_response_spec.rb
new file mode 100644
index 00000000000..107adcceb97
--- /dev/null
+++ b/spec/models/virtual_registries/packages/maven/cached_response_spec.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe VirtualRegistries::Packages::Maven::CachedResponse, type: :model, feature_category: :virtual_registry do
+  subject(:cached_response) { build(:virtual_registries_packages_maven_cached_response) }
+
+  it { is_expected.to include_module(FileStoreMounter) }
+
+  describe 'validations' do
+    %i[group file relative_path content_type downloads_count size].each do |attr|
+      it { is_expected.to validate_presence_of(attr) }
+    end
+
+    %i[relative_path upstream_etag content_type].each do |attr|
+      it { is_expected.to validate_length_of(attr).is_at_most(255) }
+    end
+    it { is_expected.to validate_numericality_of(:downloads_count).only_integer.is_greater_than(0) }
+
+    context 'with persisted cached response' do
+      before do
+        cached_response.save!
+      end
+
+      it { is_expected.to validate_uniqueness_of(:relative_path).scoped_to(:upstream_id) }
+    end
+  end
+
+  describe 'associations' do
+    it do
+      is_expected.to belong_to(:upstream)
+        .class_name('VirtualRegistries::Packages::Maven::Upstream')
+        .inverse_of(:cached_responses)
+    end
+  end
+
+  describe 'object storage key' do
+    it 'can not be null' do
+      cached_response.object_storage_key = nil
+      cached_response.relative_path = nil
+
+      expect(cached_response).to be_invalid
+      expect(cached_response.errors.full_messages).to include("Object storage key can't be blank")
+    end
+
+    it 'can not be too large' do
+      cached_response.object_storage_key = 'a' * 256
+      cached_response.relative_path = nil
+
+      expect(cached_response).to be_invalid
+      expect(cached_response.errors.full_messages)
+        .to include('Object storage key is too long (maximum is 255 characters)')
+    end
+
+    it 'is set before saving' do
+      expect { cached_response.save! }
+        .to change { cached_response.object_storage_key }.from(nil).to(an_instance_of(String))
+    end
+
+    context 'with a persisted cached response' do
+      let(:key) { cached_response.object_storage_key }
+
+      before do
+        cached_response.save!
+      end
+
+      it 'does not change after an update' do
+        expect(key).to be_present
+
+        cached_response.update!(
+          file: CarrierWaveStringFile.new('test'),
+          size: 2.kilobytes
+        )
+
+        expect(cached_response.object_storage_key).to eq(key)
+      end
+
+      it 'is read only' do
+        expect(key).to be_present
+
+        cached_response.object_storage_key = 'new-key'
+        cached_response.save!
+
+        expect(cached_response.reload.object_storage_key).to eq(key)
+      end
+    end
+  end
+end
diff --git a/spec/models/virtual_registries/packages/maven/upstream_spec.rb b/spec/models/virtual_registries/packages/maven/upstream_spec.rb
index bcacc8f9f00..adb8be28178 100644
--- a/spec/models/virtual_registries/packages/maven/upstream_spec.rb
+++ b/spec/models/virtual_registries/packages/maven/upstream_spec.rb
@@ -8,6 +8,12 @@ RSpec.describe VirtualRegistries::Packages::Maven::Upstream, type: :model, featu
   subject(:upstream) { build(:virtual_registries_packages_maven_upstream) }
 
   describe 'associations' do
+    it do
+      is_expected.to have_many(:cached_responses)
+        .class_name('VirtualRegistries::Packages::Maven::CachedResponse')
+        .inverse_of(:upstream)
+    end
+
     it do
       is_expected.to have_one(:registry_upstream)
         .class_name('VirtualRegistries::Packages::Maven::RegistryUpstream')
diff --git a/spec/policies/virtual_registries/packages/policies/group_policy_spec.rb b/spec/policies/virtual_registries/packages/policies/group_policy_spec.rb
new file mode 100644
index 00000000000..e1e4eeb2821
--- /dev/null
+++ b/spec/policies/virtual_registries/packages/policies/group_policy_spec.rb
@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe VirtualRegistries::Packages::Policies::GroupPolicy, feature_category: :virtual_registry do
+  include_context 'GroupPolicy context'
+  using RSpec::Parameterized::TableSyntax
+
+  let_it_be(:subgroup) { create(:group, parent: group, visibility_level: group.visibility_level) }
+  let(:policy_subject) { ::VirtualRegistries::Packages::Policies::Group.new(group) }
+
+  subject { described_class.new(current_user, policy_subject) }
+
+  describe 'read_virtual_registry' do
+    where(:group_visibility, :current_user, :allowed?) do
+      'PUBLIC' | nil                    | false
+      'PUBLIC' | ref(:non_group_member) | true
+      'PUBLIC' | ref(:guest)            | true
+      'PUBLIC' | ref(:reporter)         | true
+      'PUBLIC' | ref(:developer)        | true
+      'PUBLIC' | ref(:maintainer)       | true
+      'PUBLIC' | ref(:owner)            | true
+
+      'INTERNAL' | nil                    | false
+      'INTERNAL' | ref(:non_group_member) | true
+      'INTERNAL' | ref(:guest)            | true
+      'INTERNAL' | ref(:reporter)         | true
+      'INTERNAL' | ref(:developer)        | true
+      'INTERNAL' | ref(:maintainer)       | true
+      'INTERNAL' | ref(:owner)            | true
+
+      'PRIVATE' | nil                    | false
+      'PRIVATE' | ref(:non_group_member) | false
+      'PRIVATE' | ref(:guest)            | true
+      'PRIVATE' | ref(:reporter)         | true
+      'PRIVATE' | ref(:developer)        | true
+      'PRIVATE' | ref(:maintainer)       | true
+      'PRIVATE' | ref(:owner)            | true
+    end
+
+    with_them do
+      before do
+        group.update!(visibility_level: Gitlab::VisibilityLevel.const_get(group_visibility, false))
+      end
+
+      it { is_expected.to public_send(allowed? ? :be_allowed : :be_disallowed, :read_virtual_registry) }
+    end
+
+    context 'for deploy token' do
+      let(:deploy_token) do
+        create(:deploy_token, :group).tap do |token|
+          create(:group_deploy_token, group: target, deploy_token: token)
+        end
+      end
+
+      subject { described_class.new(deploy_token, policy_subject) }
+
+      where(:target, :group_visibility, :read_virtual_registry, :allowed?) do
+        ref(:group) | 'PUBLIC'   | true  | true
+        ref(:group) | 'PUBLIC'   | false | false
+        ref(:group) | 'INTERNAL' | true  | true
+        ref(:group) | 'INTERNAL' | false | false
+        ref(:group) | 'PRIVATE'  | true  | true
+        ref(:group) | 'PRIVATE'  | false | false
+
+        ref(:subgroup) | 'PUBLIC'   | true  | false
+        ref(:subgroup) | 'PUBLIC'   | false | false
+        ref(:subgroup) | 'INTERNAL' | true  | false
+        ref(:subgroup) | 'INTERNAL' | false | false
+        ref(:subgroup) | 'PRIVATE'  | true  | false
+        ref(:subgroup) | 'PRIVATE'  | false | false
+      end
+
+      with_them do
+        before do
+          deploy_token.read_virtual_registry = read_virtual_registry
+          group.update!(visibility_level: Gitlab::VisibilityLevel.const_get(group_visibility, false))
+        end
+
+        it { is_expected.to public_send(allowed? ? :be_allowed : :be_disallowed, :read_virtual_registry) }
+      end
+    end
+  end
+
+  %i[create update destroy].each do |action|
+    describe "#{action}_virtual_registry" do
+      where(:group_visibility, :current_user, :allowed?) do
+        'PUBLIC' | nil                    | false
+        'PUBLIC' | ref(:non_group_member) | false
+        'PUBLIC' | ref(:guest)            | false
+        'PUBLIC' | ref(:reporter)         | false
+        'PUBLIC' | ref(:developer)        | false
+        'PUBLIC' | ref(:maintainer)       | true
+        'PUBLIC' | ref(:owner)            | true
+
+        'INTERNAL' | nil                    | false
+        'INTERNAL' | ref(:non_group_member) | false
+        'INTERNAL' | ref(:guest)            | false
+        'INTERNAL' | ref(:reporter)         | false
+        'INTERNAL' | ref(:developer)        | false
+        'INTERNAL' | ref(:maintainer)       | true
+        'INTERNAL' | ref(:owner)            | true
+
+        'PRIVATE' | nil                    | false
+        'PRIVATE' | ref(:non_group_member) | false
+        'PRIVATE' | ref(:guest)            | false
+        'PRIVATE' | ref(:reporter)         | false
+        'PRIVATE' | ref(:developer)        | false
+        'PRIVATE' | ref(:maintainer)       | true
+        'PRIVATE' | ref(:owner)            | true
+      end
+
+      with_them do
+        before do
+          group.update!(visibility_level: Gitlab::VisibilityLevel.const_get(group_visibility, false))
+        end
+
+        it { is_expected.to public_send(allowed? ? :be_allowed : :be_disallowed, :"#{action}_virtual_registry") }
+      end
+    end
+  end
+end
diff --git a/spec/presenters/packages/nuget/search_results_presenter_spec.rb b/spec/presenters/packages/nuget/search_results_presenter_spec.rb
index 7501cb75682..f477a34e306 100644
--- a/spec/presenters/packages/nuget/search_results_presenter_spec.rb
+++ b/spec/presenters/packages/nuget/search_results_presenter_spec.rb
@@ -10,18 +10,30 @@ RSpec.describe Packages::Nuget::SearchResultsPresenter, feature_category: :packa
   let_it_be(:packages_b) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageB') }
   let_it_be(:packages_c) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageC') }
 
-  let(:search_results) { double('search_results', total_count: 3, results: [package_a, packages_b, packages_c].flatten) }
+  let(:package_ids) { [package_a, *packages_b, *packages_c].map(&:id) }
+  let(:packages) do
+    ::Packages::Package.for_projects(project).order(Arel.sql("POSITION(id::text IN '#{package_ids.join(',')}')"))
+  end
+
+  let(:search_results) do
+    double(
+      'search_results',
+      total_count: 3,
+      results: packages
+    )
+  end
+
   let(:presenter) { described_class.new(search_results) }
-  let(:total_count) { presenter.total_count }
-  let(:data) { presenter.data }
 
   describe '#total_count' do
-    it 'expects to have 3 total elements' do
-      expect(total_count).to eq(3)
-    end
+    subject { presenter.total_count }
+
+    it { is_expected.to eq 3 }
   end
 
   describe '#data' do
+    subject(:data) { presenter.data }
+
     it 'returns the proper data structure' do
       expect(data.size).to eq 3
       pkg_a, pkg_b, pkg_c = data
@@ -30,6 +42,20 @@ RSpec.describe Packages::Nuget::SearchResultsPresenter, feature_category: :packa
       expect_package_result(pkg_c, packages_c.first.name, packages_c.map(&:version))
     end
 
+    it 'avoids n+1 database queries', :use_sql_query_cache do
+      control = ActiveRecord::QueryRecorder.new(skip_cached: false) { data }
+
+      create_list(:nuget_package, 2, project: project, name: 'DummyPackageD')
+
+      expect { described_class.new(search_results).data }.to issue_same_number_of_queries_as(control)
+    end
+
+    context 'when total_count is 0' do
+      let(:search_results) { double('search_results', total_count: 0) }
+
+      it { is_expected.to be_empty }
+    end
+
     def expect_package_result(package_json, name, versions, tags = [], with_metadatum: false) # rubocop:disable Metrics/AbcSize
       expect(package_json[:type]).to eq 'Package'
       expect(package_json[:name]).to eq(name)
diff --git a/spec/requests/api/graphql/project/merge_requests_spec.rb b/spec/requests/api/graphql/project/merge_requests_spec.rb
index 0798772b9bd..29e2f7c7693 100644
--- a/spec/requests/api/graphql/project/merge_requests_spec.rb
+++ b/spec/requests/api/graphql/project/merge_requests_spec.rb
@@ -59,7 +59,7 @@ RSpec.describe 'getting merge request listings nested in a project', feature_cat
       # We cannot disable SQL query limiting here, since the transaction does not
       # begin until we enter the controller.
       headers = {
-        'X-GITLAB-DISABLE-SQL-QUERY-LIMIT' => 'https://gitlab.com/gitlab-org/gitlab/-/issues/469250;205'
+        'X-GITLAB-DISABLE-SQL-QUERY-LIMIT' => '205,https://gitlab.com/gitlab-org/gitlab/-/issues/469250'
       }
 
       post_graphql(query, current_user: current_user, headers: headers)
diff --git a/spec/scripts/lib/glfm/update_example_snapshots_spec.rb b/spec/scripts/lib/glfm/update_example_snapshots_spec.rb
index 82a398ea204..41466995ead 100644
--- a/spec/scripts/lib/glfm/update_example_snapshots_spec.rb
+++ b/spec/scripts/lib/glfm/update_example_snapshots_spec.rb
@@ -28,7 +28,7 @@ require_relative '../../../../scripts/lib/glfm/update_example_snapshots'
 # Also, the textual content of the individual fixture file entries is also crafted to help
 # indicate which scenarios which they are covering.
 # rubocop:disable RSpec/MultipleMemoizedHelpers
-RSpec.describe Glfm::UpdateExampleSnapshots, '#process', feature_category: :team_planning do
+RSpec.describe Glfm::UpdateExampleSnapshots, '#process', :uses_fast_spec_helper_but_runs_slow, feature_category: :team_planning do
   subject { described_class.new }
 
   # GLFM input files
diff --git a/spec/scripts/lib/glfm/update_specification_spec.rb b/spec/scripts/lib/glfm/update_specification_spec.rb
index 6b9ba8e59be..753623979f2 100644
--- a/spec/scripts/lib/glfm/update_specification_spec.rb
+++ b/spec/scripts/lib/glfm/update_specification_spec.rb
@@ -27,7 +27,7 @@ require_relative '../../../../scripts/lib/glfm/update_specification'
 # should run in sub-second time when the Spring pre-loader is used. This allows
 # logic which is not directly related to the slow sub-processes to be TDD'd with a
 # very rapid feedback cycle.
-RSpec.describe Glfm::UpdateSpecification, '#process', feature_category: :team_planning do
+RSpec.describe Glfm::UpdateSpecification, '#process', :uses_fast_spec_helper_but_runs_slow, feature_category: :team_planning do
   include NextInstanceOf
 
   subject { described_class.new }
diff --git a/spec/uploaders/virtual_registries/cached_response_uploader_spec.rb b/spec/uploaders/virtual_registries/cached_response_uploader_spec.rb
new file mode 100644
index 00000000000..799b1fec028
--- /dev/null
+++ b/spec/uploaders/virtual_registries/cached_response_uploader_spec.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ::VirtualRegistries::CachedResponseUploader, feature_category: :virtual_registry do
+  let(:object_storage_key) { 'object/storage/key' }
+  let(:cached_response) do
+    build_stubbed(
+      :virtual_registries_packages_maven_cached_response,
+      object_storage_key: object_storage_key,
+      relative_path: 'relative/path/test.txt'
+    )
+  end
+
+  subject(:uploader) { described_class.new(cached_response, :file) }
+
+  it { is_expected.to include_module(::ObjectStorage::Concern) }
+
+  describe '#store_dir' do
+    it 'uses the object_storage_key' do
+      expect(uploader.store_dir).to eq(object_storage_key)
+    end
+  end
+end