diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 9e6b49d9790..404239c04ed 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-0526d03bec8ec0e642b8c32c7ece396e0ba914f6
+98e4597b4ab1d5a87be725ae0aa58ba3f2566210
diff --git a/app/assets/javascripts/ci/job_details/components/empty_state.vue b/app/assets/javascripts/ci/job_details/components/empty_state.vue
index 89c687c1be5..9a8a2d4ffbf 100644
--- a/app/assets/javascripts/ci/job_details/components/empty_state.vue
+++ b/app/assets/javascripts/ci/job_details/components/empty_state.vue
@@ -1,15 +1,12 @@
 <script>
 import { GlButton } from '@gitlab/ui';
 import ManualJobForm from '~/ci/job_details/components/manual_job_form.vue';
-import PipelineVariablesPermissionsMixin from '~/ci/mixins/pipeline_variables_permissions_mixin';
 
 export default {
   components: {
     GlButton,
     ManualJobForm,
   },
-  mixins: [PipelineVariablesPermissionsMixin],
-  inject: ['projectPath', 'userRole'],
   props: {
     illustrationPath: {
       type: String,
@@ -73,9 +70,6 @@ export default {
     shouldRenderManualVariables() {
       return this.playable && !this.scheduled;
     },
-    shouldRenderPipelineVariablesText() {
-      return this.canViewPipelineVariables && this.shouldRenderManualVariables && !this.isRetryable;
-    },
   },
 };
 </script>
@@ -97,11 +91,6 @@ export default {
       </h2>
       <p v-if="content" class="gl-mb-0 gl-mt-4" data-testid="job-empty-state-content">
         {{ content }}
-        <template v-if="shouldRenderPipelineVariablesText">{{
-          s__(
-            'CiVariables|You can add CI/CD variables below for last-minute configuration changes before starting the job.',
-          )
-        }}</template>
       </p>
       <manual-job-form
         v-if="shouldRenderManualVariables"
@@ -109,7 +98,6 @@ export default {
         :job-id="jobId"
         :job-name="jobName"
         :confirmation-message="confirmationMessage"
-        :can-view-pipeline-variables="canViewPipelineVariables"
         @hideManualVariablesForm="$emit('hideManualVariablesForm')"
       />
       <div
diff --git a/app/assets/javascripts/ci/job_details/components/manual_job_form.vue b/app/assets/javascripts/ci/job_details/components/manual_job_form.vue
index 2b42fd5e5e9..91f82df2f4b 100644
--- a/app/assets/javascripts/ci/job_details/components/manual_job_form.vue
+++ b/app/assets/javascripts/ci/job_details/components/manual_job_form.vue
@@ -21,6 +21,7 @@ export default {
     GlButton,
     JobVariablesForm,
   },
+  inject: ['canSetPipelineVariables'],
   props: {
     isRetryable: {
       type: Boolean,
@@ -39,11 +40,6 @@ export default {
       required: false,
       default: null,
     },
-    canViewPipelineVariables: {
-      type: Boolean,
-      required: false,
-      default: false,
-    },
   },
   data() {
     return {
@@ -136,7 +132,7 @@ export default {
 <template>
   <div>
     <job-variables-form
-      v-if="canViewPipelineVariables"
+      v-if="canSetPipelineVariables"
       :job-id="jobId"
       @update-variables="onVariablesUpdate"
     />
diff --git a/app/assets/javascripts/ci/job_details/components/sidebar/job_sidebar_retry_button.vue b/app/assets/javascripts/ci/job_details/components/sidebar/job_sidebar_retry_button.vue
index 03a23ab621e..e26ce5a6e2b 100644
--- a/app/assets/javascripts/ci/job_details/components/sidebar/job_sidebar_retry_button.vue
+++ b/app/assets/javascripts/ci/job_details/components/sidebar/job_sidebar_retry_button.vue
@@ -7,7 +7,6 @@ import { s__, __ } from '~/locale';
 import axios from '~/lib/utils/axios_utils';
 import { visitUrl } from '~/lib/utils/url_utility';
 import { confirmJobConfirmationMessage } from '~/ci/pipeline_details/graph/utils';
-import PipelineVariablesPermissionsMixin from '~/ci/mixins/pipeline_variables_permissions_mixin';
 
 export default {
   name: 'JobSidebarRetryButton',
@@ -21,8 +20,7 @@ export default {
     GlModal: GlModalDirective,
     GlTooltip: GlTooltipDirective,
   },
-  mixins: [PipelineVariablesPermissionsMixin],
-  inject: ['projectPath', 'userRole'],
+  inject: ['canSetPipelineVariables'],
   props: {
     modalId: {
       type: String,
@@ -96,7 +94,7 @@ export default {
   />
   <div v-else-if="isManualJob" class="gl-flex gl-gap-3">
     <gl-button
-      v-if="canViewPipelineVariables"
+      v-if="canSetPipelineVariables"
       v-gl-tooltip.bottom
       :title="$options.i18n.updateVariables"
       :aria-label="$options.i18n.updateVariables"
diff --git a/app/assets/javascripts/ci/job_details/index.js b/app/assets/javascripts/ci/job_details/index.js
index 87e4c3815a9..aec257064a2 100644
--- a/app/assets/javascripts/ci/job_details/index.js
+++ b/app/assets/javascripts/ci/job_details/index.js
@@ -34,7 +34,7 @@ export const initJobDetails = () => {
     pipelineTestReportUrl,
     logViewerPath,
     duoFeaturesEnabled,
-    userRole,
+    canSetPipelineVariables,
   } = el.dataset;
 
   const fullScreenAPIAvailable = document.fullscreenEnabled;
@@ -59,7 +59,7 @@ export const initJobDetails = () => {
       aiRootCauseAnalysisAvailable: parseBoolean(aiRootCauseAnalysisAvailable),
       duoFeaturesEnabled: parseBoolean(duoFeaturesEnabled),
       pipelineTestReportUrl,
-      userRole,
+      canSetPipelineVariables: parseBoolean(canSetPipelineVariables),
     },
     render(h) {
       return h(JobApp, {
diff --git a/app/assets/javascripts/emoji/components/picker.vue b/app/assets/javascripts/emoji/components/picker.vue
index f08856d7bae..3e67d38f3d2 100644
--- a/app/assets/javascripts/emoji/components/picker.vue
+++ b/app/assets/javascripts/emoji/components/picker.vue
@@ -50,6 +50,11 @@ export default {
       required: false,
       default: true,
     },
+    customEmojiPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
   },
   data() {
     return {
@@ -61,6 +66,9 @@ export default {
     };
   },
   computed: {
+    newEmojiPath() {
+      return this.newCustomEmojiPath || this.customEmojiPath;
+    },
     categoryNames() {
       return CATEGORY_NAMES.filter((c) => {
         if (c === FREQUENTLY_USED_KEY) return hasFrequentlyUsedEmojis();
@@ -77,7 +85,7 @@ export default {
     newCustomEmoji() {
       return {
         text: __('Create new emoji'),
-        href: this.newCustomEmojiPath,
+        href: this.newEmojiPath,
         extraAttrs: {
           'data-testid': 'create-new-emoji',
         },
@@ -225,12 +233,12 @@ export default {
         </template>
       </emoji-list>
 
-      <template v-if="newCustomEmojiPath" #footer>
+      <template v-if="newEmojiPath" #footer>
         <div
           class="gl-flex gl-flex-col gl-border-t-1 gl-border-t-dropdown !gl-p-2 !gl-pt-0 gl-border-t-solid"
         >
           <gl-button
-            :href="newCustomEmojiPath"
+            :href="newEmojiPath"
             category="tertiary"
             block
             data-testid="create-new-emoji"
diff --git a/app/assets/javascripts/issuable/popover/components/issue_popover.vue b/app/assets/javascripts/issuable/popover/components/issue_popover.vue
index 7312653eef9..cb2299316b0 100644
--- a/app/assets/javascripts/issuable/popover/components/issue_popover.vue
+++ b/app/assets/javascripts/issuable/popover/components/issue_popover.vue
@@ -15,6 +15,7 @@ import {
 import { WORK_ITEM_TYPE_NAME_EPIC } from '~/work_items/constants';
 
 export default {
+  name: 'IssuePopover',
   components: {
     GlIcon,
     GlPopover,
@@ -31,7 +32,7 @@ export default {
   mixins: [timeagoMixin],
   props: {
     target: {
-      type: HTMLAnchorElement,
+      type: [HTMLElement, Function, Object, String],
       required: true,
     },
     namespacePath: {
@@ -44,7 +45,13 @@ export default {
     },
     cachedTitle: {
       type: String,
-      required: true,
+      required: false,
+      default: '',
+    },
+    show: {
+      type: Boolean,
+      required: false,
+      default: false,
     },
   },
   data() {
@@ -96,7 +103,7 @@ export default {
 </script>
 
 <template>
-  <gl-popover :target="target" boundary="viewport" placement="top" show>
+  <gl-popover :target="target" boundary="viewport" placement="top" :show="show">
     <gl-skeleton-loader v-if="$apollo.queries.workItem.loading" :height="15">
       <rect width="250" height="15" rx="4" />
     </gl-skeleton-loader>
@@ -115,7 +122,7 @@ export default {
           {{ __('Opened') }} <time :datetime="workItem.createdAt">{{ formattedTime }}</time>
         </span>
       </div>
-      <div class="gl-heading-5 gl-my-3">{{ title }}</div>
+      <div class="gl-heading-5 gl-my-3" data-testid="popover-title">{{ title }}</div>
       <div>
         <work-item-type-icon :work-item-type="type" />
         <span class="gl-text-subtle">{{ reference }}</span>
diff --git a/app/assets/javascripts/issuable/popover/index.js b/app/assets/javascripts/issuable/popover/index.js
index df0c1b72213..40b9c67856a 100644
--- a/app/assets/javascripts/issuable/popover/index.js
+++ b/app/assets/javascripts/issuable/popover/index.js
@@ -79,6 +79,7 @@ export const handleIssuablePopoverMount = ({
           placement,
           milestoneId: milestone,
           cachedTitle: title || innerText,
+          show: true,
         },
         apolloProvider,
       }).$mount();
diff --git a/app/assets/javascripts/vue_shared/components/awards_list.vue b/app/assets/javascripts/vue_shared/components/awards_list.vue
index 2672a50c2db..ddcc8b75fa2 100644
--- a/app/assets/javascripts/vue_shared/components/awards_list.vue
+++ b/app/assets/javascripts/vue_shared/components/awards_list.vue
@@ -24,6 +24,11 @@ export default {
     SafeHtml,
   },
   props: {
+    customEmojiPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
     awards: {
       type: Array,
       required: true,
@@ -194,6 +199,7 @@ export default {
     <div v-if="canAwardEmoji" class="award-menu-holder gl-my-2">
       <emoji-picker
         :right="false"
+        :custom-emoji-path="customEmojiPath"
         data-testid="emoji-picker"
         @click="handleAward"
         @shown="setIsMenuOpen(true)"
diff --git a/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue b/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
index fff16028d19..576535d2dfb 100644
--- a/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
+++ b/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
@@ -10,7 +10,7 @@ import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import { __, sprintf } from '~/locale';
 import UserAccessRoleBadge from '~/vue_shared/components/user_access_role_badge.vue';
 import ReplyButton from '~/notes/components/note_actions/reply_button.vue';
-import { getMutation, optimisticAwardUpdate } from '../../notes/award_utils';
+import { getMutation, optimisticAwardUpdate, getNewCustomEmojiPath } from '../../notes/award_utils';
 
 export default {
   name: 'WorkItemNoteActions',
@@ -160,6 +160,13 @@ export default {
         ? __('Resolved by ') + this.resolvedBy.name
         : this.$options.i18n.resolveThreadTitle;
     },
+    customEmojiPath() {
+      return getNewCustomEmojiPath({
+        cache: this.$apollo.provider.clients.defaultClient,
+        fullPath: this.fullPath,
+        workItemIid: this.workItemIid,
+      });
+    },
   },
   methods: {
     async setAwardEmoji(name) {
@@ -244,6 +251,7 @@ export default {
       v-if="showAwardEmoji"
       toggle-class="add-reaction-button btn-default-tertiary"
       data-testid="note-emoji-button"
+      :custom-emoji-path="customEmojiPath"
       @click="setAwardEmoji"
     />
     <reply-button v-if="showReply" ref="replyButton" @startReplying="$emit('startReplying')" />
diff --git a/app/assets/javascripts/work_items/components/notes/work_item_note_awards_list.vue b/app/assets/javascripts/work_items/components/notes/work_item_note_awards_list.vue
index 3ecb1650099..dd437a72350 100644
--- a/app/assets/javascripts/work_items/components/notes/work_item_note_awards_list.vue
+++ b/app/assets/javascripts/work_items/components/notes/work_item_note_awards_list.vue
@@ -2,7 +2,7 @@
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import AwardsList from '~/vue_shared/components/awards_list.vue';
-import { getMutation, optimisticAwardUpdate } from '../../notes/award_utils';
+import { getMutation, optimisticAwardUpdate, getNewCustomEmojiPath } from '../../notes/award_utils';
 
 export default {
   components: {
@@ -37,6 +37,13 @@ export default {
     hasAwardEmojiPermission() {
       return this.note.userPermissions.awardEmoji;
     },
+    customEmojiPath() {
+      return getNewCustomEmojiPath({
+        cache: this.$apollo.provider.clients.defaultClient,
+        fullPath: this.fullPath,
+        workItemIid: this.workItemIid,
+      });
+    },
     currentUserId() {
       return window.gon.current_user_id;
     },
@@ -83,6 +90,7 @@ export default {
     :awards="awards"
     :can-award-emoji="hasAwardEmojiPermission"
     :current-user-id="currentUserId"
+    :custom-emoji-path="customEmojiPath"
     @award="handleAward($event)"
   />
 </template>
diff --git a/app/assets/javascripts/work_items/components/work_item_award_emoji.vue b/app/assets/javascripts/work_items/components/work_item_award_emoji.vue
index 70e21da1254..8383c473b68 100644
--- a/app/assets/javascripts/work_items/components/work_item_award_emoji.vue
+++ b/app/assets/javascripts/work_items/components/work_item_award_emoji.vue
@@ -37,6 +37,7 @@ export default {
   },
   data() {
     return {
+      newCustomEmojiPath: '',
       isLoading: false,
     };
   },
@@ -63,6 +64,9 @@ export default {
         },
       }));
     },
+    customEmojiPath() {
+      return this.newCustomEmojiPath;
+    },
     pageInfo() {
       return this.awardEmoji?.pageInfo;
     },
@@ -95,6 +99,8 @@ export default {
           this.isLoading = false;
         }
         if (data) {
+          this.newCustomEmojiPath =
+            findAwardEmojiWidget(data.workspace?.workItem)?.newCustomEmojiPath || '';
           this.$emit('emoji-updated', data.workspace?.workItem);
         }
       },
@@ -244,6 +250,7 @@ export default {
       :can-award-emoji="$options.isLoggedIn"
       :current-user-id="currentUserId"
       :default-awards="$options.defaultAwards"
+      :custom-emoji-path="customEmojiPath"
       selected-class="selected"
       @award="handleAward"
     />
diff --git a/app/assets/javascripts/work_items/components/work_item_detail.vue b/app/assets/javascripts/work_items/components/work_item_detail.vue
index e880d3e9267..62aeeab54cd 100644
--- a/app/assets/javascripts/work_items/components/work_item_detail.vue
+++ b/app/assets/javascripts/work_items/components/work_item_detail.vue
@@ -90,8 +90,6 @@ import DesignUploadButton from './design_management/upload_button.vue';
 import WorkItemDevelopment from './work_item_development/work_item_development.vue';
 import WorkItemCreateBranchMergeRequestSplitButton from './work_item_development/work_item_create_branch_merge_request_split_button.vue';
 
-const WorkItemErrorTracking = () => import('~/work_items/components/work_item_error_tracking.vue');
-
 const defaultWorkspacePermissions = {
   createDesign: false,
   moveDesign: false,
@@ -128,7 +126,7 @@ export default {
     WorkItemTree,
     WorkItemNotes,
     WorkItemRelationships,
-    WorkItemErrorTracking,
+    WorkItemErrorTracking: () => import('~/work_items/components/work_item_error_tracking.vue'),
     WorkItemStickyHeader,
     WorkItemAncestors,
     WorkItemTitle,
diff --git a/app/assets/javascripts/work_items/components/work_item_parent.vue b/app/assets/javascripts/work_items/components/work_item_parent.vue
index 729de2ce3af..d9fe9f6d39f 100644
--- a/app/assets/javascripts/work_items/components/work_item_parent.vue
+++ b/app/assets/javascripts/work_items/components/work_item_parent.vue
@@ -1,5 +1,5 @@
 <script>
-import { GlLink, GlIcon, GlPopover } from '@gitlab/ui';
+import { GlIcon, GlLink, GlPopover } from '@gitlab/ui';
 
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import { s__ } from '~/locale';
@@ -15,31 +15,21 @@ import workItemsByReferencesQuery from '../graphql/work_items_by_references.quer
 import workItemAllowedParentTypesQuery from '../graphql/work_item_allowed_parent_types.query.graphql';
 import {
   I18N_WORK_ITEM_ERROR_UPDATING,
+  NAME_TO_ENUM_MAP,
+  NO_WORK_ITEM_IID,
   sprintfWorkItem,
   WORK_ITEM_TYPE_ENUM_EPIC,
   WORK_ITEM_TYPE_NAME_ISSUE,
-  NAME_TO_ENUM_MAP,
 } from '../constants';
-import { isReference, findHierarchyWidgetDefinition, newWorkItemId } from '../utils';
+import { findHierarchyWidgetDefinition, isReference, newWorkItemId } from '../utils';
 
 export default {
   name: 'WorkItemParent',
-  inputId: 'work-item-parent-listbox-value',
-  noWorkItemId: 'no-work-item-id',
-  i18n: {
-    assignParentLabel: s__('WorkItem|Select parent'),
-    parentLabel: s__('WorkItem|Parent'),
-    none: s__('WorkItem|None'),
-    unAssign: s__('WorkItem|Clear'),
-    workItemsFetchError: s__(
-      'WorkItem|Something went wrong while fetching items. Please try again.',
-    ),
-    searchPlaceholder: s__('WorkItem|Search or paste URL'),
-  },
   components: {
     GlLink,
     GlIcon,
     GlPopover,
+    IssuePopover: () => import('~/issuable/popover/components/issue_popover.vue'),
     WorkItemSidebarDropdownWidget,
   },
   inject: ['fullPath'],
@@ -108,12 +98,15 @@ export default {
       return (
         this.workItems.find(({ value }) => this.localSelectedItem === value)?.text ||
         this.parent?.title ||
-        this.$options.i18n.none
+        s__('WorkItem|None')
       );
     },
     workItems() {
       return this.availableWorkItems?.map(({ id, title }) => ({ text: title, value: id })) || [];
     },
+    parentFullPath() {
+      return this.parent?.namespace.fullPath;
+    },
     parentWebUrl() {
       return this.parent?.webUrl;
     },
@@ -159,7 +152,10 @@ export default {
         return data.workspace.workItems.nodes.filter((wi) => this.workItemId !== wi.id) || [];
       },
       error() {
-        this.$emit('error', this.$options.i18n.workItemsFetchError);
+        this.$emit(
+          'error',
+          s__('WorkItem|Something went wrong while fetching items. Please try again.'),
+        );
       },
     },
     workItemsByReference: {
@@ -177,7 +173,10 @@ export default {
         return data?.workItemsByReference?.nodes || [];
       },
       error() {
-        this.$emit('error', this.$options.i18n.workItemsFetchError);
+        this.$emit(
+          'error',
+          s__('WorkItem|Something went wrong while fetching items. Please try again.'),
+        );
       },
     },
     allowedParentTypes: {
@@ -255,9 +254,7 @@ export default {
               id: this.workItemId,
               hierarchyWidget: {
                 parentId:
-                  this.localSelectedItem === this.$options.noWorkItemId
-                    ? null
-                    : this.localSelectedItem,
+                  this.localSelectedItem === NO_WORK_ITEM_IID ? null : this.localSelectedItem,
               },
             },
           },
@@ -272,7 +269,7 @@ export default {
 
         if (errors.length) {
           this.$emit('error', errors.join('\n'));
-          this.localSelectedItem = this.parent?.id || this.$options.noWorkItemId;
+          this.localSelectedItem = this.parent?.id || NO_WORK_ITEM_IID;
         }
       } catch (error) {
         this.$emit('error', sprintfWorkItem(I18N_WORK_ITEM_ERROR_UPDATING, this.workItemType));
@@ -289,7 +286,7 @@ export default {
       this.updateParent();
     },
     unassignParent() {
-      this.localSelectedItem = this.$options.noWorkItemId;
+      this.localSelectedItem = NO_WORK_ITEM_IID;
       this.updateParent();
     },
     onListboxShown() {
@@ -311,11 +308,11 @@ export default {
     :list-items="workItems"
     :loading="isLoading"
     :item-value="localSelectedItem"
-    :header-text="$options.i18n.assignParentLabel"
+    :header-text="s__('WorkItem|Select parent')"
     :update-in-progress="updateInProgress"
-    :reset-button-label="$options.i18n.unAssign"
+    :reset-button-label="s__('WorkItem|Clear')"
     :toggle-dropdown-text="listboxText"
-    :search-placeholder="$options.i18n.searchPlaceholder"
+    :search-placeholder="s__('WorkItem|Search or paste URL')"
     data-testid="work-item-parent"
     @dropdownShown="onListboxShown"
     @dropdownHidden="onListboxHide"
@@ -324,13 +321,21 @@ export default {
     @reset="unassignParent"
   >
     <template #readonly>
-      <gl-link
-        v-if="localSelectedItem"
-        data-testid="work-item-parent-link"
-        class="gl-inline-block gl-max-w-full gl-overflow-hidden gl-text-ellipsis gl-whitespace-nowrap gl-align-top gl-text-default"
-        :href="parentWebUrl"
-        >{{ listboxText }}</gl-link
-      >
+      <template v-if="localSelectedItem">
+        <gl-link
+          ref="link"
+          data-testid="work-item-parent-link"
+          class="gl-inline-block gl-max-w-full gl-overflow-hidden gl-text-ellipsis gl-whitespace-nowrap gl-align-top gl-text-default"
+          :href="parentWebUrl"
+          >{{ listboxText }}</gl-link
+        >
+        <issue-popover
+          :cached-title="parent.title"
+          :iid="parent.iid"
+          :namespace-path="parentFullPath"
+          :target="() => $refs.link.$el"
+        />
+      </template>
     </template>
     <template v-if="showCustomNoneValue" #none>
       <span id="parent-not-available" class="gl-cursor-help">
diff --git a/app/assets/javascripts/work_items/constants.js b/app/assets/javascripts/work_items/constants.js
index ee41686c5a8..8dd634a9dc6 100644
--- a/app/assets/javascripts/work_items/constants.js
+++ b/app/assets/javascripts/work_items/constants.js
@@ -265,8 +265,8 @@ export const RELATED_ITEM_ID_URL_QUERY_PARAM = 'related_item_id';
 export const WORK_ITEM_REFERENCE_CHAR = '#';
 
 export const NEW_WORK_ITEM_IID = 'new-work-item-iid';
-
 export const NEW_WORK_ITEM_GID = 'gid://gitlab/WorkItem/new';
+export const NO_WORK_ITEM_IID = 'no-work-item-iid';
 
 export const NEW_EPIC_FEEDBACK_PROMPT_EXPIRY = '2024-12-31';
 export const NEW_ISSUE_FEEDBACK_PROMPT_EXPIRY = '2025-04-25';
diff --git a/app/assets/javascripts/work_items/graphql/award_emoji.query.graphql b/app/assets/javascripts/work_items/graphql/award_emoji.query.graphql
index 55a8b86f116..88a2cfd269a 100644
--- a/app/assets/javascripts/work_items/graphql/award_emoji.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/award_emoji.query.graphql
@@ -10,6 +10,7 @@ query projectWorkItemAwardEmojis($fullPath: ID!, $iid: String!, $after: String,
       widgets {
         ... on WorkItemWidgetAwardEmoji {
           type
+          newCustomEmojiPath
           awardEmoji(first: $pageSize, after: $after) {
             pageInfo {
               ...PageInfo
diff --git a/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql b/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
index 0028737aed6..a6ebf4424c8 100644
--- a/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
@@ -23,6 +23,10 @@ query groupWorkItems(
         iid
         title
         confidential
+        namespace {
+          id
+          fullPath
+        }
         workItemType {
           id
           name
@@ -41,6 +45,10 @@ query groupWorkItems(
         iid
         title
         confidential
+        namespace {
+          id
+          fullPath
+        }
         workItemType {
           id
           name
diff --git a/app/assets/javascripts/work_items/graphql/project_work_items.query.graphql b/app/assets/javascripts/work_items/graphql/project_work_items.query.graphql
index 8010387f2ef..2ec6c1d567a 100644
--- a/app/assets/javascripts/work_items/graphql/project_work_items.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/project_work_items.query.graphql
@@ -15,6 +15,10 @@ query projectWorkItems(
         iid
         title
         confidential
+        namespace {
+          id
+          fullPath
+        }
         workItemType {
           id
           name
@@ -28,6 +32,10 @@ query projectWorkItems(
         iid
         title
         confidential
+        namespace {
+          id
+          fullPath
+        }
         workItemType {
           id
           name
diff --git a/app/assets/javascripts/work_items/graphql/work_item_ancestors.fragment.graphql b/app/assets/javascripts/work_items/graphql/work_item_ancestors.fragment.graphql
index 4cdcb6a97be..a4993fff4df 100644
--- a/app/assets/javascripts/work_items/graphql/work_item_ancestors.fragment.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_item_ancestors.fragment.graphql
@@ -11,6 +11,10 @@ fragment WorkItemAncestors on WorkItem {
         iid
         title
         confidential
+        namespace {
+          id
+          fullPath
+        }
         webUrl
         workItemType {
           id
diff --git a/app/assets/javascripts/work_items/graphql/work_item_widgets.fragment.graphql b/app/assets/javascripts/work_items/graphql/work_item_widgets.fragment.graphql
index e38550963b8..fc6945279fe 100644
--- a/app/assets/javascripts/work_items/graphql/work_item_widgets.fragment.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_item_widgets.fragment.graphql
@@ -67,6 +67,10 @@ fragment WorkItemWidgets on WorkItemWidget {
       iid
       title
       confidential
+      namespace {
+        id
+        fullPath
+      }
       webUrl
       workItemType {
         id
diff --git a/app/assets/javascripts/work_items/graphql/work_items_by_references.query.graphql b/app/assets/javascripts/work_items/graphql/work_items_by_references.query.graphql
index 1cb061205fd..443b64ae0ab 100644
--- a/app/assets/javascripts/work_items/graphql/work_items_by_references.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_items_by_references.query.graphql
@@ -5,6 +5,10 @@ query getWorkItemsByReferences($contextNamespacePath: ID!, $refs: [String!]!) {
       iid
       title
       confidential
+      namespace {
+        id
+        fullPath
+      }
       workItemType {
         id
         name
diff --git a/app/assets/javascripts/work_items/notes/award_utils.js b/app/assets/javascripts/work_items/notes/award_utils.js
index 6f320f96d3a..89d4cb668d8 100644
--- a/app/assets/javascripts/work_items/notes/award_utils.js
+++ b/app/assets/javascripts/work_items/notes/award_utils.js
@@ -6,8 +6,10 @@ import {
   updateCacheAfterRemovingAwardEmojiFromNote,
 } from '~/work_items/graphql/cache_utils';
 import workItemNotesByIidQuery from '../graphql/notes/work_item_notes_by_iid.query.graphql';
+import workItemAwardEmojiQuery from '../graphql/award_emoji.query.graphql';
 import addAwardEmojiMutation from '../graphql/notes/work_item_note_add_award_emoji.mutation.graphql';
 import removeAwardEmojiMutation from '../graphql/notes/work_item_note_remove_award_emoji.mutation.graphql';
+import { findAwardEmojiWidget } from '../utils';
 
 function awardedByCurrentUser(note) {
   return (note.awardEmoji?.nodes ?? [])
@@ -66,3 +68,18 @@ export function optimisticAwardUpdate({ note, name, fullPath, workItemIid }) {
     );
   };
 }
+
+export const getNewCustomEmojiPath = ({ cache, fullPath, workItemIid }) => {
+  const query = {
+    query: workItemAwardEmojiQuery,
+    variables: { fullPath, iid: workItemIid, pageSize: 1 },
+  };
+
+  const sourceData = cache.readQuery(query);
+
+  if (!sourceData?.workspace?.workItem) {
+    return '';
+  }
+
+  return findAwardEmojiWidget(sourceData.workspace.workItem)?.newCustomEmojiPath || '';
+};
diff --git a/app/controllers/admin/groups_controller.rb b/app/controllers/admin/groups_controller.rb
index cd61bf9c7f4..32fe6304cc7 100644
--- a/app/controllers/admin/groups_controller.rb
+++ b/app/controllers/admin/groups_controller.rb
@@ -39,7 +39,7 @@ class Admin::GroupsController < Admin::ApplicationController
 
   def create
     response = ::Groups::CreateService.new(current_user,
-      group_params.with_defaults(organization_id: Current.organization&.id)).execute
+      group_params.with_defaults(organization_id: Current.organization.id)).execute
     @group = response[:group]
 
     if response.success?
diff --git a/app/controllers/admin/topics_controller.rb b/app/controllers/admin/topics_controller.rb
index 8df2456f619..523c8119932 100644
--- a/app/controllers/admin/topics_controller.rb
+++ b/app/controllers/admin/topics_controller.rb
@@ -84,6 +84,6 @@ class Admin::TopicsController < Admin::ApplicationController
   end
 
   def organization_id
-    ::Current.organization&.id
+    ::Current.organization.id
   end
 end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 6eda395f434..5975e2527fe 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -82,7 +82,7 @@ class GroupsController < Groups::ApplicationController
   def create
     response = Groups::CreateService.new(
       current_user,
-      group_params.merge(organization_id: Current.organization&.id)
+      group_params.merge(organization_id: Current.organization.id)
     ).execute
     @group = response[:group]
 
diff --git a/app/controllers/import/base_controller.rb b/app/controllers/import/base_controller.rb
index 84d61f08235..ea844679b7c 100644
--- a/app/controllers/import/base_controller.rb
+++ b/app/controllers/import/base_controller.rb
@@ -112,7 +112,7 @@ class Import::BaseController < ApplicationController
 
     group = Groups::NestedCreateService.new(
       current_user,
-      organization_id: Current.organization&.id,
+      organization_id: Current.organization.id,
       group_path: names
     ).execute
 
diff --git a/app/controllers/import/bitbucket_server_controller.rb b/app/controllers/import/bitbucket_server_controller.rb
index 51e987a3aaa..f73191b4ac0 100644
--- a/app/controllers/import/bitbucket_server_controller.rb
+++ b/app/controllers/import/bitbucket_server_controller.rb
@@ -44,7 +44,7 @@ class Import::BitbucketServerController < Import::BaseController
     result = Import::BitbucketServerService.new(
       client,
       current_user,
-      params.merge({ organization_id: Current.organization&.id })
+      params.merge({ organization_id: Current.organization.id })
     ).execute(credentials)
 
     if result[:status] == :success
diff --git a/app/controllers/import/fogbugz_controller.rb b/app/controllers/import/fogbugz_controller.rb
index 87c221642c7..fbd741e2ef8 100644
--- a/app/controllers/import/fogbugz_controller.rb
+++ b/app/controllers/import/fogbugz_controller.rb
@@ -58,7 +58,7 @@ class Import::FogbugzController < Import::BaseController
 
     service_params = params.merge({
       umap: session[:fogbugz_user_map] || client.user_map,
-      organization_id: Current.organization&.id
+      organization_id: Current.organization.id
     })
 
     result = Import::FogbugzService.new(client, current_user, service_params).execute(credentials)
diff --git a/app/controllers/import/gitlab_groups_controller.rb b/app/controllers/import/gitlab_groups_controller.rb
index 6e7e95d3347..211fe9af42d 100644
--- a/app/controllers/import/gitlab_groups_controller.rb
+++ b/app/controllers/import/gitlab_groups_controller.rb
@@ -21,7 +21,7 @@ class Import::GitlabGroupsController < ApplicationController
         visibility_level: closest_allowed_visibility_level,
         import_export_upload: ImportExportUpload.new(import_file: group_params[:file], user: current_user)
       )
-      .with_defaults(organization_id: Current.organization&.id)
+      .with_defaults(organization_id: Current.organization.id)
 
     response = ::Groups::CreateService.new(current_user, group_data).execute
 
diff --git a/app/controllers/oauth/authorizations_controller.rb b/app/controllers/oauth/authorizations_controller.rb
index 066878b6952..4bf34197ec6 100644
--- a/app/controllers/oauth/authorizations_controller.rb
+++ b/app/controllers/oauth/authorizations_controller.rb
@@ -78,7 +78,7 @@ class Oauth::AuthorizationsController < Doorkeeper::AuthorizationsController
     # Cannot be achieved with a before_action hook, due to the execution order.
     downgrade_scopes! if action_name == 'new'
 
-    params[:organization_id] = ::Current.organization&.id
+    params[:organization_id] = ::Current.organization.id
 
     super
   end
diff --git a/app/controllers/user_settings/personal_access_tokens_controller.rb b/app/controllers/user_settings/personal_access_tokens_controller.rb
index d91517dda0b..3708383d260 100644
--- a/app/controllers/user_settings/personal_access_tokens_controller.rb
+++ b/app/controllers/user_settings/personal_access_tokens_controller.rb
@@ -53,7 +53,7 @@ module UserSettings
       result = ::PersonalAccessTokens::CreateService.new(
         current_user: current_user,
         target_user: current_user,
-        organization_id: Current.organization&.id,
+        organization_id: Current.organization.id,
         params: personal_access_token_params,
         concatenate_errors: false
       ).execute
diff --git a/app/finders/todos_finder.rb b/app/finders/todos_finder.rb
index 2b914b1709f..22ccb3bebdc 100644
--- a/app/finders/todos_finder.rb
+++ b/app/finders/todos_finder.rb
@@ -21,7 +21,6 @@ class TodosFinder
   include FinderMethods
   include Gitlab::Utils::StrongMemoize
   include SafeFormatHelper
-  include Gitlab::InternalEventsTracking
 
   requires_cross_project_access unless: -> { project? }
 
@@ -49,8 +48,6 @@ class TodosFinder
     return Todo.none if current_user.nil?
     raise ArgumentError, invalid_type_message unless valid_types?
 
-    track_bot_user if current_user.bot?
-
     items = current_user.todos
     items = without_hidden(items)
     items = by_action_id(items)
@@ -264,17 +261,6 @@ class TodosFinder
   def filter_done_only?
     Array.wrap(params[:state]).map(&:to_sym) == [:done]
   end
-
-  def track_bot_user
-    track_internal_event(
-      "request_todos_by_bot_user",
-      user: current_user,
-      additional_properties: {
-        label: 'user_type',
-        property: current_user.user_type
-      }
-    )
-  end
 end
 
 TodosFinder.prepend_mod_with('TodosFinder')
diff --git a/app/graphql/resolvers/todos_resolver.rb b/app/graphql/resolvers/todos_resolver.rb
index 071f4812f9e..1b2d8ff1a56 100644
--- a/app/graphql/resolvers/todos_resolver.rb
+++ b/app/graphql/resolvers/todos_resolver.rb
@@ -3,6 +3,7 @@
 module Resolvers
   class TodosResolver < BaseResolver
     type Types::TodoType.connection_type, null: true
+    include Gitlab::InternalEventsTracking
 
     alias_method :target, :object
 
@@ -49,6 +50,8 @@ module Resolvers
       return Todo.none unless current_user.present? && target.present?
       return Todo.none if target.is_a?(User) && target != current_user
 
+      track_bot_user if current_user.bot?
+
       TodosFinder.new(current_user, todo_finder_params(args)).execute.with_entity_associations
     end
 
@@ -75,5 +78,16 @@ module Resolvers
         target_id: target.id
       }
     end
+
+    def track_bot_user
+      track_internal_event(
+        "request_todos_by_bot_user",
+        user: current_user,
+        additional_properties: {
+          label: 'user_type',
+          property: current_user.user_type
+        }
+      )
+    end
   end
 end
diff --git a/app/graphql/types/work_items/widgets/award_emoji_type.rb b/app/graphql/types/work_items/widgets/award_emoji_type.rb
index 57985e2697b..d0ccc28d0db 100644
--- a/app/graphql/types/work_items/widgets/award_emoji_type.rb
+++ b/app/graphql/types/work_items/widgets/award_emoji_type.rb
@@ -40,9 +40,9 @@ module Types
         end
 
         def new_custom_emoji_path
-          return unless context[:current_user]&.can?(:create_custom_emoji, object.work_item.project.namespace)
+          return unless context[:current_user]
 
-          ::Gitlab::Routing.url_helpers.new_group_custom_emoji_path(object.work_item.project.namespace)
+          object.new_custom_emoji_path(context[:current_user])
         end
       end
       # rubocop:enable Graphql/AuthorizeTypes
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 0ba2f51e0aa..73b0a8e1b03 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -466,6 +466,7 @@ module ApplicationSettingsHelper
       :throttle_protected_paths_enabled,
       :throttle_protected_paths_period_in_seconds,
       :throttle_protected_paths_requests_per_period,
+      :top_level_group_creation_enabled,
       :protected_paths_raw,
       :protected_paths_for_get_request_raw,
       :time_tracking_limit_to_hours,
diff --git a/app/helpers/ci/jobs_helper.rb b/app/helpers/ci/jobs_helper.rb
index ff02505af10..113fb283c61 100644
--- a/app/helpers/ci/jobs_helper.rb
+++ b/app/helpers/ci/jobs_helper.rb
@@ -15,7 +15,7 @@ module Ci
         "retry_outdated_job_docs_url" => help_page_path('ci/pipelines/settings.md', anchor: 'prevent-outdated-deployment-jobs'),
         "pipeline_test_report_url" => test_report_project_pipeline_path(project, build.pipeline),
         "log_viewer_path" => viewer_project_job_path(project, build),
-        "user_role" => project.team.human_max_access(current_user&.id)
+        "can_set_pipeline_variables" => Ability.allowed?(current_user, :set_pipeline_variables, project).to_s
       }
     end
 
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 209d14e3454..98d49ef05cb 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -679,6 +679,12 @@ class ApplicationSetting < ApplicationRecord
   attribute :resource_usage_limits, ::Gitlab::Database::Type::IndifferentJsonb.new, default: -> { {} }
   validates :resource_usage_limits, json_schema: { filename: 'resource_usage_limits' }
 
+  jsonb_accessor :group_settings,
+    top_level_group_creation_enabled: [:boolean, { default: true }]
+
+  validates :group_settings,
+    json_schema: { filename: "application_setting_group_settings" }
+
   jsonb_accessor :clickhouse,
     use_clickhouse_for_analytics: [:boolean, { default: false }]
 
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index efcce6adbe4..adb29cffa91 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -324,6 +324,7 @@ module ApplicationSettingImplementation
         scan_execution_policies_schedule_limit: 0,
         seat_control: 0,
         show_migrate_from_jenkins_banner: true,
+        top_level_group_creation_enabled: true,
         ropc_without_client_credentials: true,
         vscode_extension_marketplace_enabled: false,
         reindexing_minimum_index_size: 1.gigabyte,
diff --git a/app/models/project_pages_metadatum.rb b/app/models/project_pages_metadatum.rb
index 2cadb5aa779..d40bfba23b0 100644
--- a/app/models/project_pages_metadatum.rb
+++ b/app/models/project_pages_metadatum.rb
@@ -5,9 +5,6 @@ class ProjectPagesMetadatum < ApplicationRecord
 
   include EachBatch
 
-  ignore_column :pages_deployment_id, remove_with: '17.11', remove_after: '2025-03-21'
-  ignore_column :deployed, remove_with: '17.11', remove_after: '2025-03-21'
-
   self.primary_key = :project_id
 
   belongs_to :project, inverse_of: :pages_metadatum
diff --git a/app/validators/json_schemas/application_setting_group_settings.json b/app/validators/json_schemas/application_setting_group_settings.json
new file mode 100644
index 00000000000..82dab5effd3
--- /dev/null
+++ b/app/validators/json_schemas/application_setting_group_settings.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "Application settings for the group_setting JsonB column",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "top_level_group_creation_enabled": {
+      "type": "boolean",
+      "description": "Allows a user to create top-level-groups"
+    }
+  }
+}
diff --git a/app/views/layouts/notify.html.haml b/app/views/layouts/notify.html.haml
index 549d0e8f5ff..071086f6359 100644
--- a/app/views/layouts/notify.html.haml
+++ b/app/views/layouts/notify.html.haml
@@ -44,9 +44,8 @@
             #{link_to _('View it on GitLab'), @target_url}.
           %br
           = notification_reason_text(reason: @reason, show_manage_notifications_link: !@labels_url, show_help_link: true, manage_label_subscriptions_url: @labels_url, unsubscribe_url: @unsubscribe_url, format: :html)
-          - if Feature.enabled?(:fix_gmail_footer_truncation, @project)
-            %span{ style: "color:transparent;font-size:0;display:none;overflow:hidden;opacity:0;width:0;height:0;max-width:0;max-height:0" }
-              = 'Notification message regarding ' + @target_url + " at #{Time.current.to_i}"
+          %span{ style: "color:transparent;font-size:0;display:none;overflow:hidden;opacity:0;width:0;height:0;max-width:0;max-height:0" }
+            = 'Notification message regarding ' + @target_url + " at #{Time.current.to_i}"
 
           = email_action @target_url
 
diff --git a/config/application_setting_columns/group_settings.yml b/config/application_setting_columns/group_settings.yml
new file mode 100644
index 00000000000..88f09ae9bc6
--- /dev/null
+++ b/config/application_setting_columns/group_settings.yml
@@ -0,0 +1,12 @@
+---
+api_type:
+attr: group_settings
+clusterwide: false
+column: group_settings
+db_type: jsonb
+default: "'{}'::jsonb"
+description: "A jsonb column that stores a hash of related group_settings on the application_settings table"
+encrypted: false
+gitlab_com_different_than_default: true
+jihu: false
+not_null: true
diff --git a/config/feature_flags/wip/fix_gmail_footer_truncation.patch b/config/feature_flags/wip/fix_gmail_footer_truncation.patch
deleted file mode 100644
index fcca8878da0..00000000000
--- a/config/feature_flags/wip/fix_gmail_footer_truncation.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/app/views/layouts/notify.html.haml b/app/views/layouts/notify.html.haml
-index 826d822354b6..b713cee3266f 100644
---- a/app/views/layouts/notify.html.haml
-+++ b/app/views/layouts/notify.html.haml
-@@ -44,9 +44,8 @@
-             #{link_to _('View it on GitLab'), @target_url}.
-           %br
-           = notification_reason_text(reason: @reason, show_manage_notifications_link: !@labels_url, show_help_link: true, manage_label_subscriptions_url: @labels_url, unsubscribe_url: @unsubscribe_url, format: :html)
--          - if Feature.enabled?(:fix_gmail_footer_truncation, @project)
--            %span{ style: "color:transparent;font-size:0;display:none;overflow:hidden;opacity:0;width:0;height:0;max-width:0;max-height:0" }
--              = 'Notification message regarding ' + @target_url + " at #{Time.current.to_i}"
-+          %span{ style: "color:transparent;font-size:0;display:none;overflow:hidden;opacity:0;width:0;height:0;max-width:0;max-height:0" }
-+            = 'Notification message regarding ' + @target_url + " at #{Time.current.to_i}"
- 
-           = email_action @target_url
- 
-diff --git a/config/feature_flags/wip/fix_gmail_footer_truncation.yml b/config/feature_flags/wip/fix_gmail_footer_truncation.yml
-deleted file mode 100644
-index e092a0d092b6..000000000000
---- a/config/feature_flags/wip/fix_gmail_footer_truncation.yml
-+++ /dev/null
-@@ -1,9 +0,0 @@
-----
--name: fix_gmail_footer_truncation
--feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/14072
--introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177913
--rollout_issue_url:
--milestone: '17.11'
--group: group::ux paper cuts
--type: wip
--default_enabled: false
diff --git a/config/feature_flags/wip/fix_gmail_footer_truncation.yml b/config/feature_flags/wip/fix_gmail_footer_truncation.yml
deleted file mode 100644
index e092a0d092b..00000000000
--- a/config/feature_flags/wip/fix_gmail_footer_truncation.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: fix_gmail_footer_truncation
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/14072
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177913
-rollout_issue_url:
-milestone: '17.11'
-group: group::ux paper cuts
-type: wip
-default_enabled: false
diff --git a/db/docs/batched_background_migrations/backfill_amazon_group_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_amazon_group_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..b406d8b5c70
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_amazon_group_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillAmazonGroupAuditEventDestinationsFixed
+description: Fixed version of BackfillAmazonGroupAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155730
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_amazon_instance_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_amazon_instance_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..c59cabf0a64
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_amazon_instance_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillAmazonInstanceAuditEventDestinationsFixed
+description: Fixed version of BackfillAmazonInstanceAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155743
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_external_group_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_external_group_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..2edde5f7709
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_external_group_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillExternalGroupAuditEventDestinationsFixed
+description: Fixed version of BackfillExternalGroupAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155636
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_external_instance_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_external_instance_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..de5e1094b84
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_external_instance_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillExternalInstanceAuditEventDestinationsFixed
+description: Fixed version of BackfillExternalInstanceAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155703
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_google_group_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_google_group_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..928c4fa5c3c
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_google_group_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillGoogleGroupAuditEventDestinationsFixed
+description: Fixed version of BackfillGoogleGroupAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155756
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/backfill_google_instance_audit_event_destinations_fixed.yml b/db/docs/batched_background_migrations/backfill_google_instance_audit_event_destinations_fixed.yml
new file mode 100644
index 00000000000..9f0985cb120
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_google_instance_audit_event_destinations_fixed.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: BackfillGoogleInstanceAuditEventDestinationsFixed
+description: Fixed version of BackfillGoogleInstanceAuditEventDestinations BBM
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186866
+milestone: '18.0'
+queued_migration_version: 20250403155815
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/migrate/20250410032730_add_group_settings_to_application_settings.rb b/db/migrate/20250410032730_add_group_settings_to_application_settings.rb
new file mode 100644
index 00000000000..dd16cc246f9
--- /dev/null
+++ b/db/migrate/20250410032730_add_group_settings_to_application_settings.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class AddGroupSettingsToApplicationSettings < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+
+  CONSTRAINT_NAME = 'check_application_settings_group_settings_is_hash'
+
+  def up
+    with_lock_retries do
+      add_column :application_settings, :group_settings, :jsonb, default: {}, null: false
+    end
+
+    add_check_constraint :application_settings, "(jsonb_typeof(group_settings) = 'object')", CONSTRAINT_NAME
+  end
+
+  def down
+    remove_check_constraint :application_settings, CONSTRAINT_NAME
+
+    with_lock_retries do
+      remove_column :application_settings, :group_settings
+    end
+  end
+end
diff --git a/db/migrate/20250416184314_remove_index_watermark_changed_event_worker.rb b/db/migrate/20250416184314_remove_index_watermark_changed_event_worker.rb
new file mode 100644
index 00000000000..bae95db5136
--- /dev/null
+++ b/db/migrate/20250416184314_remove_index_watermark_changed_event_worker.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class RemoveIndexWatermarkChangedEventWorker < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+  DEPRECATED_JOB_CLASSES = %w[Search::Zoekt::IndexWatermarkChangedEventWorker]
+
+  def up
+    sidekiq_remove_jobs(job_klasses: DEPRECATED_JOB_CLASSES)
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250310144538_queue_backfill_external_group_audit_event_destinations.rb b/db/post_migrate/20250310144538_queue_backfill_external_group_audit_event_destinations.rb
index f2791339920..80af6d0c83e 100644
--- a/db/post_migrate/20250310144538_queue_backfill_external_group_audit_event_destinations.rb
+++ b/db/post_migrate/20250310144538_queue_backfill_external_group_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillExternalGroupAuditEventDestinations < Gitlab::Database::Migra
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_external_audit_event_destinations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by QueueBackfillExternalGroupAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_external_audit_event_destinations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250310150446_queue_backfill_amazon_group_audit_event_destinations.rb b/db/post_migrate/20250310150446_queue_backfill_amazon_group_audit_event_destinations.rb
index b93cb3e6e3f..2bce0c82d2f 100644
--- a/db/post_migrate/20250310150446_queue_backfill_amazon_group_audit_event_destinations.rb
+++ b/db/post_migrate/20250310150446_queue_backfill_amazon_group_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillAmazonGroupAuditEventDestinations < Gitlab::Database::Migrati
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_amazon_s3_configurations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by QueueBackfillAmazonGroupAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_amazon_s3_configurations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250310151216_queue_backfill_amazon_instance_audit_event_destinations.rb b/db/post_migrate/20250310151216_queue_backfill_amazon_instance_audit_event_destinations.rb
index b0c7a1e55a3..bc3cd582b85 100644
--- a/db/post_migrate/20250310151216_queue_backfill_amazon_instance_audit_event_destinations.rb
+++ b/db/post_migrate/20250310151216_queue_backfill_amazon_instance_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillAmazonInstanceAuditEventDestinations < Gitlab::Database::Migr
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_instance_amazon_s3_configurations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by QueueBackfillAmazonInstanceAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_instance_amazon_s3_configurations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250310155742_queue_backfill_google_instance_audit_event_destinations.rb b/db/post_migrate/20250310155742_queue_backfill_google_instance_audit_event_destinations.rb
index e0f5bea8828..b616fb439f1 100644
--- a/db/post_migrate/20250310155742_queue_backfill_google_instance_audit_event_destinations.rb
+++ b/db/post_migrate/20250310155742_queue_backfill_google_instance_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillGoogleInstanceAuditEventDestinations < Gitlab::Database::Migr
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_instance_google_cloud_logging_configurations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by BackfillGoogleInstanceAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_instance_google_cloud_logging_configurations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250310161242_queue_backfill_external_instance_audit_event_destinations.rb b/db/post_migrate/20250310161242_queue_backfill_external_instance_audit_event_destinations.rb
index 7db5c40177f..a4eabe2fad2 100644
--- a/db/post_migrate/20250310161242_queue_backfill_external_instance_audit_event_destinations.rb
+++ b/db/post_migrate/20250310161242_queue_backfill_external_instance_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillExternalInstanceAuditEventDestinations < Gitlab::Database::Mi
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_instance_external_audit_event_destinations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by BackfillExternalInstanceAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_instance_external_audit_event_destinations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250310162554_queue_backfill_google_group_audit_event_destinations.rb b/db/post_migrate/20250310162554_queue_backfill_google_group_audit_event_destinations.rb
index a7a53fc3650..6a2660cb7f4 100644
--- a/db/post_migrate/20250310162554_queue_backfill_google_group_audit_event_destinations.rb
+++ b/db/post_migrate/20250310162554_queue_backfill_google_group_audit_event_destinations.rb
@@ -11,17 +11,9 @@ class QueueBackfillGoogleGroupAuditEventDestinations < Gitlab::Database::Migrati
   SUB_BATCH_SIZE = 100
 
   def up
-    queue_batched_background_migration(
-      MIGRATION,
-      :audit_events_google_cloud_logging_configurations,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration (double JSON encoding),
+    # which has been fixed by BackfillGoogleGroupAuditEventDestinationsFixed
   end
 
-  def down
-    delete_batched_background_migration(MIGRATION, :audit_events_google_cloud_logging_configurations, :id, [])
-  end
+  def down; end
 end
diff --git a/db/post_migrate/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..d0f794d7b49
--- /dev/null
+++ b/db/post_migrate/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+class QueueBackfillExternalGroupAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillExternalGroupAuditEventDestinations"
+  MIGRATION = "BackfillExternalGroupAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_external_audit_event_destinations, :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_external_audit_event_destinations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_external_audit_event_destinations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..d67dee46798
--- /dev/null
+++ b/db/post_migrate/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueBackfillExternalInstanceAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillExternalInstanceAuditEventDestinations"
+  MIGRATION = "BackfillExternalInstanceAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_instance_external_audit_event_destinations,
+      :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_instance_external_audit_event_destinations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_instance_external_audit_event_destinations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..b31f5022f49
--- /dev/null
+++ b/db/post_migrate/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueBackfillAmazonGroupAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillAmazonGroupAuditEventDestinations"
+  MIGRATION = "BackfillAmazonGroupAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_amazon_s3_configurations,
+      :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_amazon_s3_configurations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_amazon_s3_configurations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..23b91d2ae00
--- /dev/null
+++ b/db/post_migrate/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueBackfillAmazonInstanceAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillAmazonInstanceAuditEventDestinations"
+  MIGRATION = "BackfillAmazonInstanceAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_instance_amazon_s3_configurations,
+      :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_instance_amazon_s3_configurations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_instance_amazon_s3_configurations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..1f758cc8767
--- /dev/null
+++ b/db/post_migrate/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueBackfillGoogleGroupAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillGoogleGroupAuditEventDestinations"
+  MIGRATION = "BackfillGoogleGroupAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_google_cloud_logging_configurations,
+      :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_google_cloud_logging_configurations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_google_cloud_logging_configurations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed.rb b/db/post_migrate/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..e67f79de8bb
--- /dev/null
+++ b/db/post_migrate/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueBackfillGoogleInstanceAuditEventDestinationsFixed < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  ORIGINAL_MIGRATION = "BackfillGoogleInstanceAuditEventDestinations"
+  MIGRATION = "BackfillGoogleInstanceAuditEventDestinationsFixed"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    delete_batched_background_migration(ORIGINAL_MIGRATION, :audit_events_instance_google_cloud_logging_configurations,
+      :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_instance_google_cloud_logging_configurations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_instance_google_cloud_logging_configurations, :id, [])
+  end
+end
diff --git a/db/schema_migrations/20250403155636 b/db/schema_migrations/20250403155636
new file mode 100644
index 00000000000..b771991d407
--- /dev/null
+++ b/db/schema_migrations/20250403155636
@@ -0,0 +1 @@
+d8f12561559be060a125b7dd9571fe58f648cbb6dd9a7762867a634f900cfb87
\ No newline at end of file
diff --git a/db/schema_migrations/20250403155703 b/db/schema_migrations/20250403155703
new file mode 100644
index 00000000000..22ce005b983
--- /dev/null
+++ b/db/schema_migrations/20250403155703
@@ -0,0 +1 @@
+737a0cca0456a39337177ac0edd90f15572ff3a96653c42f6540e06c60d1a0b7
\ No newline at end of file
diff --git a/db/schema_migrations/20250403155730 b/db/schema_migrations/20250403155730
new file mode 100644
index 00000000000..d3d596e0ecb
--- /dev/null
+++ b/db/schema_migrations/20250403155730
@@ -0,0 +1 @@
+e7d2c3264b4054cbd3f84dd9033fbddde33a6739878d956324c9a47debdb232d
\ No newline at end of file
diff --git a/db/schema_migrations/20250403155743 b/db/schema_migrations/20250403155743
new file mode 100644
index 00000000000..a0968591b5d
--- /dev/null
+++ b/db/schema_migrations/20250403155743
@@ -0,0 +1 @@
+b6645fd33972bc8e90d414fe57f64c00bec5be3b17bbb897ab46bc924ce4b0e5
\ No newline at end of file
diff --git a/db/schema_migrations/20250403155756 b/db/schema_migrations/20250403155756
new file mode 100644
index 00000000000..4e7950f4f6c
--- /dev/null
+++ b/db/schema_migrations/20250403155756
@@ -0,0 +1 @@
+3cd21442de47941d55da39188bc0fa29bde9ea36dce1efdf4963827b632bd166
\ No newline at end of file
diff --git a/db/schema_migrations/20250403155815 b/db/schema_migrations/20250403155815
new file mode 100644
index 00000000000..d3353a0322e
--- /dev/null
+++ b/db/schema_migrations/20250403155815
@@ -0,0 +1 @@
+a52b95ce6dd19c9249a06e1c60c04c13d9c10a31de8b2a3cd289f6a0cfce1473
\ No newline at end of file
diff --git a/db/schema_migrations/20250410032730 b/db/schema_migrations/20250410032730
new file mode 100644
index 00000000000..43b499da30e
--- /dev/null
+++ b/db/schema_migrations/20250410032730
@@ -0,0 +1 @@
+175f392feadd6f457d887086267f7ac5c0cdbf3c934c76ef2eb5df37d64a5735
\ No newline at end of file
diff --git a/db/schema_migrations/20250416184314 b/db/schema_migrations/20250416184314
new file mode 100644
index 00000000000..6d4d72237ca
--- /dev/null
+++ b/db/schema_migrations/20250416184314
@@ -0,0 +1 @@
+c037a0cbc72686ff14b2035651ad90f7188bafc100f113f5930a8795671b2b95
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 1c923f2fa85..cc589f635e3 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -9185,6 +9185,7 @@ CREATE TABLE application_settings (
     duo_nano_features_enabled boolean,
     database_reindexing jsonb DEFAULT '{}'::jsonb NOT NULL,
     duo_chat jsonb DEFAULT '{}'::jsonb NOT NULL,
+    group_settings jsonb DEFAULT '{}'::jsonb NOT NULL,
     CONSTRAINT app_settings_container_reg_cleanup_tags_max_list_size_positive CHECK ((container_registry_cleanup_tags_service_max_list_size >= 0)),
     CONSTRAINT app_settings_dep_proxy_ttl_policies_worker_capacity_positive CHECK ((dependency_proxy_ttl_group_policy_worker_capacity >= 0)),
     CONSTRAINT app_settings_ext_pipeline_validation_service_url_text_limit CHECK ((char_length(external_pipeline_validation_service_url) <= 255)),
@@ -9241,6 +9242,7 @@ CREATE TABLE application_settings (
     CONSTRAINT check_application_settings_duo_chat_is_hash CHECK ((jsonb_typeof(duo_chat) = 'object'::text)),
     CONSTRAINT check_application_settings_duo_workflow_is_hash CHECK ((jsonb_typeof(duo_workflow) = 'object'::text)),
     CONSTRAINT check_application_settings_elasticsearch_is_hash CHECK ((jsonb_typeof(elasticsearch) = 'object'::text)),
+    CONSTRAINT check_application_settings_group_settings_is_hash CHECK ((jsonb_typeof(group_settings) = 'object'::text)),
     CONSTRAINT check_application_settings_importers_is_hash CHECK ((jsonb_typeof(importers) = 'object'::text)),
     CONSTRAINT check_application_settings_integrations_is_hash CHECK ((jsonb_typeof(integrations) = 'object'::text)),
     CONSTRAINT check_application_settings_o11y_settings_is_hash CHECK ((jsonb_typeof(observability_settings) = 'object'::text)),
diff --git a/doc/api/dependencies.md b/doc/api/dependencies.md
index 1ca50804ab5..18a9c42d8e7 100644
--- a/doc/api/dependencies.md
+++ b/doc/api/dependencies.md
@@ -36,7 +36,8 @@ GET /projects/:id/dependencies?package_manager=yarn,bundler
 | `package_manager` | string array   | no       | Returns dependencies belonging to specified package manager. Valid values: `bundler`, `composer`, `conan`, `go`, `gradle`, `maven`, `npm`, `nuget`, `pip`, `pipenv`, `pnpm`, `yarn`, `sbt`, or `setuptools`. |
 
 ```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/4/dependencies"
+curl --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/projects/4/dependencies"
 ```
 
 Example response:
diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md
index 075807e7cda..9a8d024e821 100644
--- a/doc/api/graphql/reference/_index.md
+++ b/doc/api/graphql/reference/_index.md
@@ -20979,7 +20979,6 @@ Requires ClickHouse. Premium and Ultimate with GitLab Duo Pro and Enterprise onl
 | <a id="aimetricscodesuggestionsshowncount"></a>`codeSuggestionsShownCount` | [`Int`](#int) | Total count of code suggestions shown to code contributors. |
 | <a id="aimetricsduoassigneduserscount"></a>`duoAssignedUsersCount` | [`Int`](#int) | Total assigned Duo Pro and Enterprise seats. Ignores time period filter. Returns current data. |
 | <a id="aimetricsduochatcontributorscount"></a>`duoChatContributorsCount` | [`Int`](#int) | Number of contributors who used GitLab Duo Chat features. |
-| <a id="aimetricsduoproassigneduserscount"></a>`duoProAssignedUsersCount` {{< icon name="warning-solid" >}} | [`Int`](#int) | **Deprecated** in GitLab 17.6. use duoAssignedUsersCount for the same behavior. |
 | <a id="aimetricsduousedcount"></a>`duoUsedCount` | [`Int`](#int) | Number of contributors who used any GitLab Duo feature. |
 | <a id="aimetricsrootcauseanalysisuserscount"></a>`rootCauseAnalysisUsersCount` | [`Int`](#int) | Number of users using troubleshoot within a failed pipeline. |
 
diff --git a/doc/api/openapi/openapi_v2.yaml b/doc/api/openapi/openapi_v2.yaml
index eab0bfaf80c..571ce33f617 100644
--- a/doc/api/openapi/openapi_v2.yaml
+++ b/doc/api/openapi/openapi_v2.yaml
@@ -43671,10 +43671,10 @@ definitions:
         type: string
       repository_storage:
         type: string
-      duo_base_features_enabled:
+      duo_core_features_enabled:
         type: boolean
-        description: "[Experimental] Indicates whether GitLab Duo features are enabled
-          for the group"
+        description: "[Experimental] Indicates whether GitLab Duo Core features are
+          enabled for the group"
       duo_features_enabled:
         type: string
       lock_duo_features_enabled:
@@ -44201,10 +44201,10 @@ definitions:
       service_access_tokens_expiration_enforced:
         type: boolean
         description: To enforce token expiration for Service accounts users for group
-      duo_base_features_enabled:
+      duo_core_features_enabled:
         type: boolean
-        description: "[Experimental] Indicates whether GitLab Duo features are enabled
-          for the group"
+        description: "[Experimental] Indicates whether GitLab Duo Core features are
+          enabled for the group"
       duo_features_enabled:
         type: boolean
         description: Indicates whether GitLab Duo features are enabled for the group
@@ -44320,10 +44320,10 @@ definitions:
         type: string
       repository_storage:
         type: string
-      duo_base_features_enabled:
+      duo_core_features_enabled:
         type: boolean
-        description: "[Experimental] Indicates whether GitLab Duo features are enabled
-          for the group"
+        description: "[Experimental] Indicates whether GitLab Duo Core features are
+          enabled for the group"
       duo_features_enabled:
         type: string
       lock_duo_features_enabled:
diff --git a/doc/api/settings.md b/doc/api/settings.md
index f2888a4a73d..857e19c5b17 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -164,7 +164,8 @@ Example response:
   "concurrent_github_import_jobs_limit": 1000,
   "concurrent_bitbucket_import_jobs_limit": 100,
   "concurrent_bitbucket_server_import_jobs_limit": 100,
-  "silent_admin_exports_enabled": false
+  "silent_admin_exports_enabled": false,
+  "top_level_group_creation_enabled": true
 }
 ```
 
@@ -755,6 +756,7 @@ to configure other related settings. These requirements are
 | `throttle_unauthenticated_web_period_in_seconds`          | integer | required by:<br>`throttle_unauthenticated_web_enabled`          | Rate limit period in seconds. |
 | `throttle_unauthenticated_web_requests_per_period`        | integer | required by:<br>`throttle_unauthenticated_web_enabled`          | Max requests per period per IP. |
 | `time_tracking_limit_to_hours`           | boolean          | no                                   | Limit display of time tracking units to hours. Default is `false`. |
+| `top_level_group_creation_enabled`           | boolean          | no                                   | Allows a user to create top-level-groups. Default is `true`. |
 | `two_factor_grace_period`                | integer          | required by: `require_two_factor_authentication` | Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication. |
 | `unconfirmed_users_delete_after_days`    | integer          | no                                   | Specifies how many days after sign-up to delete users who have not confirmed their email. Only applicable if `delete_unconfirmed_users` is set to `true`. Must be `1` or greater. Default is `7`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352514) in GitLab 16.1. GitLab Self-Managed, Premium and Ultimate only. |
 | `unique_ips_limit_enabled`               | boolean          | no                                   | (**If enabled, requires:** `unique_ips_limit_per_user` and `unique_ips_limit_time_window`) Limit sign in from multiple IPs. |
diff --git a/doc/ci/runners/new_creation_workflow.md b/doc/ci/runners/new_creation_workflow.md
index 260440a566d..2d99fe9dfe0 100644
--- a/doc/ci/runners/new_creation_workflow.md
+++ b/doc/ci/runners/new_creation_workflow.md
@@ -179,9 +179,10 @@ runUntagged: true
 protected: true
 ```
 
-The `runnerRegistrationToken` field replaces the `runnerToken` field. For GitLab Runner on Kubernetes, Helm deploy passes the runner `authentication token` to the runner worker pod and creates the runner configuration. In GitLab 17.0, if Kubernetes hosted runners attached to GitLab.com use `runnerRegistrationToken`, the runner worker pod uses an unsupported Registration API method at creation.
+For GitLab Runner on Kubernetes, Helm deploy passes the runner authentication token to the runner worker pod and creates the runner configuration.
+In GitLab 17.0 and later, if you use the `runnerRegistrationToken` token field on Kubernetes hosted runners attached to GitLab.com, the runner worker pod tries to use the unsupported Registration API method during creation.
 
-If you store the runner authentication token in `secrets`, you must also modify them.
+Replace the invalid `runnerRegistrationToken` field with the `runnerToken` field. You must also modify the runner authentication token stored in `secrets`.
 
 In the legacy runner registration workflow, fields were specified with:
 
diff --git a/doc/development/cells/application_settings_analysis.md b/doc/development/cells/application_settings_analysis.md
index ac11a0d8b8e..48ea50ef034 100644
--- a/doc/development/cells/application_settings_analysis.md
+++ b/doc/development/cells/application_settings_analysis.md
@@ -14,12 +14,12 @@ title: Application Settings analysis
 
 ## Statistics
 
-- Number of attributes: 495
+- Number of attributes: 497
 - Number of encrypted attributes: 41 (8.0%)
 - Number of attributes documented: 298 (60.0%)
 - Number of attributes on GitLab.com different from the defaults: 222 (45.0%)
-- Number of attributes with `clusterwide` set: 495 (100.0%)
-- Number of attributes with `clusterwide: true` set: 126 (25.0%)
+- Number of attributes with `clusterwide` set: 497 (100.0%)
+- Number of attributes with `clusterwide: true` set: 128 (26.0%)
 
 ## Individual columns
 
@@ -66,7 +66,7 @@ title: Application Settings analysis
 | `can_create_group` | `false` | `boolean` | `boolean` | `true` | `true` | `false` | `false`| `true` |
 | `can_create_organization` | `false` | `boolean` | `` | `true` | `true` | `false` | `false`| `false` |
 | `check_namespace_plan` | `false` | `boolean` | `boolean` | `true` | `false` | `true` | `true`| `true` |
-| `ci_cd_settings` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `false` | `true`| `false` |
+| `ci_cd_settings` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `false` | `false`| `false` |
 | `ci_job_token_signing_key` | `true` | `bytea` | `` | `false` | `null` | `true` | `true`| `false` |
 | `ci_jwt_signing_key` | `true` | `text` | `` | `false` | `null` | `true` | `true`| `false` |
 | `ci_max_includes` | `false` | `integer` | `integer` | `true` | `150` | `false` | `false`| `true` |
@@ -147,8 +147,9 @@ title: Application Settings analysis
 | `domain_denylist` | `false` | `text` | `array of strings` | `false` | `null` | `true` | `true`| `true` |
 | `domain_denylist_enabled` | `false` | `boolean` | `boolean` | `false` | `false` | `true` | `true`| `true` |
 | `dsa_key_restriction` | `false` | `integer` | `integer` | `true` | `'-1'::integer` | `false` | `false`| `true` |
-| `duo_chat` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `true` | `true`| `false` |
+| `duo_chat` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `false` | `true`| `false` |
 | `duo_features_enabled` | `false` | `boolean` | `boolean` | `true` | `true` | `false` | `false`| `true` |
+| `duo_nano_features_enabled` | `false` | `boolean` | `` | `false` | `null` | `false` | `true`| `false` |
 | `duo_workflow` | `false` | `jsonb` | `` | `false` | `'{}'::jsonb` | `true` | `true`| `false` |
 | `ecdsa_key_restriction` | `false` | `integer` | `integer` | `true` | `0` | `false` | `false`| `true` |
 | `ecdsa_sk_key_restriction` | `false` | `integer` | `integer` | `true` | `0` | `false` | `false`| `true` |
@@ -216,6 +217,7 @@ title: Application Settings analysis
 | `group_import_limit` | `false` | `integer` | `` | `true` | `6` | `false` | `false`| `false` |
 | `group_owners_can_manage_default_branch_protection` | `false` | `boolean` | `boolean` | `true` | `true` | `false` | `false`| `true` |
 | `group_runner_token_expiration_interval` | `false` | `integer` | `integer` | `false` | `null` | `false` | `false`| `true` |
+| `group_settings` | `false` | `jsonb` | `` | `true` | `'{}'::jsonb` | `false` | `true`| `false` |
 | `hashed_storage_enabled` | `false` | `boolean` | `boolean` | `true` | `true` | `false` | `false`| `true` |
 | `health_check_access_token` | `false` | `character` | `` | `false` | `null` | `true` | `true`| `false` |
 | `help_page_documentation_base_url` | `false` | `text` | `` | `false` | `null` | `true` | `true`| `false` |
diff --git a/doc/install/install_ai_gateway.md b/doc/install/install_ai_gateway.md
index 0168d286557..bba7603d9ee 100644
--- a/doc/install/install_ai_gateway.md
+++ b/doc/install/install_ai_gateway.md
@@ -71,6 +71,167 @@ To fix this, set the appropriate certificate bundle path in the Docker container
 
 Replace `/path/to/ca-bundle.pem` with the actual path to your certificate bundle.
 
+## Docker-NGINX-SSL Setup
+
+{{< alert type="note" >}}
+
+This method of deploying NGINX or Caddy as a reverse proxy is a temporary workaround to support SSL
+until [issue 455854](https://gitlab.com/gitlab-org/gitlab/-/issues/455854)
+is implemented.
+
+{{< /alert >}}
+
+You can set up SSL for an AI gateway instance by using Docker,
+NGINX as a reverse proxy, and Let's Encrypt for SSL certificates.
+
+NGINX manages the secure connection with external clients, decrypting incoming HTTPS requests before
+passing them to the AI Gateway.
+
+Prerequisites:
+
+- Docker and Docker Compose installed
+- Registered and configured domain name
+
+### Step 1: Create Configuration Files
+
+Create the following files in your working directory:
+
+1. `nginx.conf`:
+
+   ```nginx
+   user  nginx;
+   worker_processes  auto;
+   error_log  /var/log/nginx/error.log warn;
+   pid        /var/run/nginx.pid;
+   events {
+       worker_connections  1024;
+   }
+   http {
+       include       /etc/nginx/mime.types;
+       default_type  application/octet-stream;
+       log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                         '$status $body_bytes_sent "$http_referer" '
+                         '"$http_user_agent" "$http_x_forwarded_for"';
+       access_log  /var/log/nginx/access.log  main;
+       sendfile        on;
+       keepalive_timeout  65;
+       include /etc/nginx/conf.d/*.conf;
+   }
+   ```
+
+1. `default.conf`:
+
+   ```nginx
+   # nginx/conf.d/default.conf
+   server {
+       listen 80;
+       server_name _;
+
+       # Forward all requests to the AI Gateway
+       location / {
+           proxy_pass http://gitlab-ai-gateway:5052;
+           proxy_read_timeout 300s;
+           proxy_connect_timeout 75s;
+           proxy_buffering off;
+       }
+   }
+
+   server {
+       listen 443 ssl;
+       server_name _;
+
+       # SSL configuration
+       ssl_certificate /etc/nginx/ssl/server.crt;
+       ssl_certificate_key /etc/nginx/ssl/server.key;
+
+       # Configuration for self-signed certificates
+       ssl_verify_client off;
+       ssl_protocols TLSv1.2 TLSv1.3;
+       ssl_ciphers HIGH:!aNULL:!MD5;
+       ssl_prefer_server_ciphers on;
+       ssl_session_cache shared:SSL:10m;
+       ssl_session_timeout 10m;
+
+       # Proxy headers
+       proxy_set_header Host $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+
+       # WebSocket support (if needed)
+       proxy_http_version 1.1;
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "upgrade";
+
+       # Forward all requests to the AI Gateway
+       location / {
+           proxy_pass http://gitlab-ai-gateway:5052;
+           proxy_read_timeout 300s;
+           proxy_connect_timeout 75s;
+           proxy_buffering off;
+       }
+   }
+   ```
+
+### Step 2: SSL Certificate setup using Let's Encrypt
+
+- For Docker-based NGINX servers, Certbot provides an automated way to implement Let's Encrypt certificates -
+  see the [guide here](https://phoenixnap.com/kb/letsencrypt-docker).
+- Alternatively, you can use [Certbot's manual installation](https://eff-certbot.readthedocs.io/en/stable/using.html#manual)
+  process if you prefer that approach.
+
+### Step 3: Create Docker-compose file
+
+1. `docker-compose.yaml`:
+
+   ```yaml
+   version: '3.8'
+
+   services:
+     nginx-proxy:
+       image: nginx:alpine
+       ports:
+         - "80:80"
+         - "443:443"
+       volumes:
+         - /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
+         - /path/to/default.conf:/etc/nginx/conf.d/default.conf:ro
+         - /path/to/fullchain.pem:/etc/nginx/ssl/server.crt:ro
+         - /path/to/privkey.pem:/etc/nginx/ssl/server.key:ro
+       networks:
+         - proxy-network
+       depends_on:
+         - gitlab-ai-gateway
+
+     gitlab-ai-gateway:
+       image: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:<ai-gateway-tag>
+       expose:
+         - "5052"
+       environment:
+         - AIGW_GITLAB_URL=<your_gitlab_instance>
+         - AIGW_GITLAB_API_URL=https://<your_gitlab_domain>/api/v4/
+       networks:
+         - proxy-network
+       restart: always
+
+   networks:
+     proxy-network:
+       driver: bridge
+   ```
+
+### Step 4: Deployment and validation
+
+1. Start the `nginx` and `AIGW` containers and verify if they're running:
+
+   ```shell
+   docker-compose up
+   docker ps
+   ```
+
+1. Configure your [GitLab instance to access the AI gateway](../administration/gitlab_duo_self_hosted/configure_duo_features.md#configure-your-gitlab-instance-to-access-the-ai-gateway).
+
+1. Perform the health check and confirm that the AI gateway is accessible.
+
 ## Install using the AI gateway Helm chart
 
 Prerequisites:
diff --git a/doc/integration/saml.md b/doc/integration/saml.md
index 7f9ef5ae90a..39d28796988 100644
--- a/doc/integration/saml.md
+++ b/doc/integration/saml.md
@@ -12,6 +12,12 @@ title: SAML SSO for GitLab Self-Managed
 
 {{< /details >}}
 
+{{< alert type="note" >}}
+
+For GitLab.com, see [SAML SSO for GitLab.com groups](../user/group/saml_sso/_index.md).
+
+{{< /alert >}}
+
 This page describes how to set up instance-wide SAML single sign on (SSO) for
 GitLab Self-Managed.
 
@@ -19,8 +25,6 @@ You can configure GitLab to act as a SAML service provider (SP). This allows
 GitLab to consume assertions from a SAML identity provider (IdP), such as
 Okta, to authenticate users.
 
-To set up SAML on GitLab.com, see [SAML SSO for GitLab.com groups](../user/group/saml_sso/_index.md).
-
 For more information on:
 
 - OmniAuth provider settings, see the [OmniAuth documentation](omniauth.md).
diff --git a/doc/user/application_security/api_security/api_discovery/_index.md b/doc/user/application_security/api_security/api_discovery/_index.md
index f687ce8ef23..17201bb8003 100644
--- a/doc/user/application_security/api_security/api_discovery/_index.md
+++ b/doc/user/application_security/api_security/api_discovery/_index.md
@@ -88,7 +88,7 @@ When running in this method, you provide a container image that has the required
    ```yaml
    api_discovery:
        extends: .api_discovery_java_spring_boot
-       image: openjdk:11-jre-slim
+       image: eclipse-temurin:17-jre-alpine
    ```
 
 1. Provide the Java class path needed by your application. This includes your compatible build
@@ -99,24 +99,24 @@ When running in this method, you provide a container image that has the required
    ```yaml
    api_discovery:
        extends: .api_discovery_java_spring_boot
-       image: openjdk:11-jre-slim
+       image: eclipse-temurin:17-jre-alpine
        variables:
            API_DISCOVERY_JAVA_CLASSPATH: build/libs/spring-boot-app-0.0.0.jar
    ```
 
 1. Optional. If the image provided is missing a dependency needed by API Discovery, it can be added
-   using a `before_script`. In this example, the `openjdk:11-jre-slim` container doesn't include
+   using a `before_script`. In this example, the `eclipse-temurin:17-jre-alpine` container doesn't include
    `curl` which is required by API Discovery. The dependency can be installed using the Debian
    package manager `apt`:
 
    ```yaml
    api_discovery:
        extends: .api_discovery_java_spring_boot
-       image: openjdk:11-jre-slim
+       image: eclipse-temurin:17-jre-alpine
        variables:
            API_DISCOVERY_JAVA_CLASSPATH: build/libs/spring-boot-app-0.0.0.jar
        before_script:
-           - apt-get update && apt-get install -y curl
+           - apk add --no-cache curl
    ```
 
 1. Optional. If the image provided doesn't automatically set the `JAVA_HOME` environment variable,
@@ -125,7 +125,7 @@ When running in this method, you provide a container image that has the required
    ```yaml
    api_discovery:
        extends: .api_discovery_java_spring_boot
-       image: openjdk:11-jre-slim
+       image: eclipse-temurin:17-jre-alpine
        variables:
            API_DISCOVERY_JAVA_CLASSPATH: build/libs/spring-boot-app-0.0.0.jar
            API_DISCOVERY_JAVA_HOME: /opt/java
@@ -141,7 +141,7 @@ When running in this method, you provide a container image that has the required
    ```yaml
    api_discovery:
        extends: .api_discovery_java_spring_boot
-       image: openjdk:8-jre-alpine
+       image: eclipse-temurin:17-jre-alpine
        variables:
            API_DISCOVERY_JAVA_CLASSPATH: build/libs/spring-boot-app-0.0.0.jar
            API_DISCOVERY_PACKAGE_TOKEN: $GITLAB_READ_TOKEN
@@ -182,8 +182,8 @@ When experiencing a behavior not working as expected, consider providing context
 - GitLab version if using a GitLab Self-Managed instance.
 - `.gitlab-ci.yml` job definition.
 - Full job console output.
-- Framework in use with version (for example Spring Boot v2.3.2).
-- Language runtime with version (for example OpenJDK v17.0.1).
+- Framework in use with version (for example "Spring Boot v2.3.2").
+- Language runtime with version (for example "Eclipse Temurin v17.0.1").
 <!-- - Scanner log file is available as a job artifact named `gl-api-discovery.log`. -->
 
 {{< alert type="warning" >}}
diff --git a/doc/user/duo_workflow/troubleshooting.md b/doc/user/duo_workflow/troubleshooting.md
index e35199de5b5..e717ea4a3aa 100644
--- a/doc/user/duo_workflow/troubleshooting.md
+++ b/doc/user/duo_workflow/troubleshooting.md
@@ -57,7 +57,13 @@ To confirm that you can connect to the Workflow service:
 1. In the address bar, enter `https://duo-workflow.runway.gitlab.net/DuoWorkflow/ExecuteWorkflow`.
 1. Ensure the request was successful and the **Protocol** column includes `h2` in Chrome or `HTTP/2` in Firefox.
 
-If the request fails, your network might be blocking the connection.
+If the request fails or does not show the HTTP/2 protocol:
+
+- A security system like Netskope or Zscaler might be configured to block or inspect traffic.
+- The HTTP/2 protocol downgrades to HTTP/1.1, which prevents Duo Workflow from working correctly.
+ 
+To correct this issue, ask your network administrator to put `https://duo-workflow.runway.gitlab.net/DuoWorkflow/ExecuteWorkflow`
+on the correct allowlist, or to exempt it from traffic inspection.
 
 ## Docker setup
 
diff --git a/doc/user/gitlab_com/_index.md b/doc/user/gitlab_com/_index.md
index 8b35a28db00..6822c0c0542 100644
--- a/doc/user/gitlab_com/_index.md
+++ b/doc/user/gitlab_com/_index.md
@@ -386,6 +386,10 @@ GitLab.com sets these requirements for passwords on new accounts and password ch
 - All characters are accepted. For example, `~`, `!`, `@`, `#`, `$`, `%`, `^`, `&`, `*`, `()`,
   `[]`, `_`, `+`,  `=`, and `-`.
 
+## Group creation
+
+On GitLab.com, [top-level group creation](../../api/groups.md#create-a-group) is not available through the API. It must be performed through the UI.
+
 ## Project and group deletion
 
 Settings related to the deletion of projects and groups.
diff --git a/doc/user/group/saml_sso/_index.md b/doc/user/group/saml_sso/_index.md
index 1f776e74b7f..29c81a4fcea 100644
--- a/doc/user/group/saml_sso/_index.md
+++ b/doc/user/group/saml_sso/_index.md
@@ -12,6 +12,12 @@ title: SAML SSO for GitLab.com groups
 
 {{< /details >}}
 
+{{< alert type="note" >}}
+
+For GitLab Self-Managed, see [SAML SSO for GitLab Self-Managed](../../../integration/saml.md).
+
+{{< /alert >}}
+
 Users can sign in to GitLab through their SAML identity provider.
 
 [SCIM](scim_setup.md) synchronizes users with the group on GitLab.com.
diff --git a/lib/api/todos.rb b/lib/api/todos.rb
index ad59429faa2..01843cdc4d1 100644
--- a/lib/api/todos.rb
+++ b/lib/api/todos.rb
@@ -79,6 +79,17 @@ module API
             options[type] = { issuable_metadata: Gitlab::IssuableMetadata.new(current_user, targets).data, include_subscribed: false }
           end
         end
+
+        def track_bot_user
+          track_event(
+            "request_todos_by_bot_user",
+            user: current_user,
+            additional_properties: {
+              label: 'user_type',
+              property: current_user.user_type
+            }
+          )
+        end
       end
 
       desc 'Get a list of to-do items' do
@@ -90,6 +101,7 @@ module API
       get do
         Gitlab::QueryLimiting.disable!('https://gitlab.com/gitlab-org/gitlab/-/issues/408576')
 
+        track_bot_user if current_user.bot?
         todos = paginate(find_todos.with_entity_associations)
         todos = ::Todos::AllowedTargetFilterService.new(todos, current_user).execute
         options = { with: Entities::Todo, current_user: current_user }
diff --git a/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations.rb b/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations.rb
index 261ec6530e4..2a8f6095c0c 100644
--- a/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations.rb
+++ b/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations.rb
@@ -5,9 +5,7 @@ module Gitlab
     class BackfillAmazonGroupAuditEventDestinations < BatchedMigrationJob
       feature_category :audit_events
 
-      def perform
-        # CE implementation is a no-op
-      end
+      def perform; end
     end
   end
 end
diff --git a/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..65442600d2f
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillAmazonGroupAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_amazon_group_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillAmazonGroupAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations.rb b/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations.rb
index 4f5b1d004c6..ba7a42928a3 100644
--- a/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations.rb
+++ b/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations.rb
@@ -5,9 +5,7 @@ module Gitlab
     class BackfillAmazonInstanceAuditEventDestinations < BatchedMigrationJob
       feature_category :audit_events
 
-      def perform
-        # CE implementation is a no-op
-      end
+      def perform; end
     end
   end
 end
diff --git a/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..128a35a050e
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillAmazonInstanceAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_amazon_instance_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillAmazonInstanceAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_external_group_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_external_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..1dfc04b5496
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_external_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillExternalGroupAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_external_group_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillExternalGroupAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations.rb b/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations.rb
index bba7ad5476c..9decb3124ba 100644
--- a/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations.rb
+++ b/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations.rb
@@ -5,9 +5,7 @@ module Gitlab
     class BackfillExternalInstanceAuditEventDestinations < BatchedMigrationJob
       feature_category :audit_events
 
-      def perform
-        # no-op, EE only migration
-      end
+      def perform; end
     end
   end
 end
diff --git a/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..03d74049ccf
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillExternalInstanceAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_external_instance_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillExternalInstanceAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations.rb b/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations.rb
index d1edc29b301..96fcab09518 100644
--- a/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations.rb
+++ b/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations.rb
@@ -5,9 +5,7 @@ module Gitlab
     class BackfillGoogleGroupAuditEventDestinations < BatchedMigrationJob
       feature_category :audit_events
 
-      def perform
-        # no-op, EE only migration
-      end
+      def perform; end
     end
   end
 end
diff --git a/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..1687607a8ce
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillGoogleGroupAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_google_group_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillGoogleGroupAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations.rb b/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations.rb
index 8cc972c3430..36c54dcd1be 100644
--- a/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations.rb
+++ b/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations.rb
@@ -5,9 +5,7 @@ module Gitlab
     class BackfillGoogleInstanceAuditEventDestinations < BatchedMigrationJob
       feature_category :audit_events
 
-      def perform
-        # no-op, EE only migration
-      end
+      def perform; end
     end
   end
 end
diff --git a/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations_fixed.rb b/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations_fixed.rb
new file mode 100644
index 00000000000..acf9176ccd3
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations_fixed.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillGoogleInstanceAuditEventDestinationsFixed < BatchedMigrationJob
+      feature_category :audit_events
+
+      def perform
+        # This batched background migration is EE-only,
+        # see ee/lib/gitlab/background_migration/backfill_google_instance_audit_event_destinations_fixed.rb for
+        # the actual migration code.
+      end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::BackfillGoogleInstanceAuditEventDestinationsFixed.prepend_mod
diff --git a/lib/gitlab/ci/status/build/manual.rb b/lib/gitlab/ci/status/build/manual.rb
index 16782c94e34..44782f7d704 100644
--- a/lib/gitlab/ci/status/build/manual.rb
+++ b/lib/gitlab/ci/status/build/manual.rb
@@ -31,8 +31,10 @@ module Gitlab
           def manual_job_action_message
             if subject.retryable?
               _("You can modify this job's CI/CD variables before running it again.")
+            elsif can?(user, :set_pipeline_variables, subject.project)
+              _('This job does not start automatically and must be started manually. You can add CI/CD variables below for last-minute configuration changes before starting the job.')
             else
-              _('This job does not start automatically and must be started manually.')
+              _("This job does not start automatically and must be started manually.")
             end
           end
 
diff --git a/lib/gitlab/ci/templates/Security/API-Discovery.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/API-Discovery.gitlab-ci.yml
index b7ac4aa15e5..a1e75b599c1 100644
--- a/lib/gitlab/ci/templates/Security/API-Discovery.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/API-Discovery.gitlab-ci.yml
@@ -51,17 +51,25 @@ variables:
       - gl-api-discovery-openapi.json
       - gl-*.log
   rules:
-    - if: $API_DISCOVERY_DISABLED
+    - if: $API_DISCOVERY_DISABLED == 'true' || $API_DISCOVERY_DISABLED == '1'
       when: never
-    - if: $API_DISCOVERY_DISABLED_FOR_DEFAULT_BRANCH &&
+    - if: $API_DISCOVERY_DISABLED_FOR_DEFAULT_BRANCH == 'true' &&
           $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
       when: never
-    # Add the job to merge request pipelines if there's an open merge request.
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-
-    # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
-    - if: $CI_OPEN_MERGE_REQUESTS
+    - if: $API_DISCOVERY_DISABLED_FOR_DEFAULT_BRANCH == '1' &&
+          $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
       when: never
 
-    # Add the job to branch pipelines.
+    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
+    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
+    # to cover both the *MR pipeline* and the *branch pipeline* workflows.
+
+    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
+    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
+          $CI_PIPELINE_SOURCE == "merge_request_event"
+    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
+    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
+          $CI_OPEN_MERGE_REQUESTS
+      when: never
+    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
     - if: $CI_COMMIT_BRANCH
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e86d5dd094b..00b26e1ce5b 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -13017,9 +13017,6 @@ msgstr ""
 msgid "CiVariables|What are pipeline variables?"
 msgstr ""
 
-msgid "CiVariables|You can add CI/CD variables below for last-minute configuration changes before starting the job."
-msgstr ""
-
 msgid "CiVariables|You can use CI/CD variables with the same name in different places, but the variables might overwrite each other. %{linkStart}What is the order of precedence for variables?%{linkEnd}"
 msgstr ""
 
@@ -54997,6 +54994,9 @@ msgstr ""
 msgid "SecurityOrchestration|Security policy projects store your organization's security policies. They are identified when policies are created, or when a project is linked as a security policy project. %{linkStart}Learn more%{linkEnd}."
 msgstr ""
 
+msgid "SecurityOrchestration|Select a cadence"
+msgstr ""
+
 msgid "SecurityOrchestration|Select a project to store your security policies in. %{linkStart}More information.%{linkEnd}"
 msgstr ""
 
@@ -61796,6 +61796,9 @@ msgstr ""
 msgid "This job does not start automatically and must be started manually."
 msgstr ""
 
+msgid "This job does not start automatically and must be started manually. You can add CI/CD variables below for last-minute configuration changes before starting the job."
+msgstr ""
+
 msgid "This job has been canceled"
 msgstr ""
 
@@ -64716,18 +64719,9 @@ msgstr ""
 msgid "UsageQuota|Excess storage usage"
 msgstr ""
 
-msgid "UsageQuota|Filter by runner"
-msgstr ""
-
-msgid "UsageQuota|Filter chart by year"
-msgstr ""
-
 msgid "UsageQuota|Filter charts by year"
 msgstr ""
 
-msgid "UsageQuota|Filter list by month"
-msgstr ""
-
 msgid "UsageQuota|Filter projects data by month"
 msgstr ""
 
@@ -68791,9 +68785,6 @@ msgstr ""
 msgid "WorkItem|Options:"
 msgstr ""
 
-msgid "WorkItem|Parent"
-msgstr ""
-
 msgid "WorkItem|Parent item type %{parentWorkItemType} is not supported on %{workItemType}. Remove the parent item to change type."
 msgstr ""
 
diff --git a/package.json b/package.json
index e865bba46f4..46f54e9b451 100644
--- a/package.json
+++ b/package.json
@@ -275,7 +275,7 @@
     "crypto": "^1.0.1",
     "custom-jquery-matchers": "^2.1.0",
     "dependency-cruiser": "^16.9.0",
-    "eslint": "9.24.0",
+    "eslint": "9.25.1",
     "eslint-formatter-gitlab": "^5.1.0",
     "eslint-import-resolver-jest": "3.0.2",
     "eslint-import-resolver-webpack": "0.13.10",
diff --git a/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_request_set_to_auto_merge_spec.rb b/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_request_set_to_auto_merge_spec.rb
index 311ee123d5b..aefc9b9364c 100644
--- a/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_request_set_to_auto_merge_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_request_set_to_auto_merge_spec.rb
@@ -15,7 +15,7 @@ module QA
             content: <<~YAML
               test:
                 tags: ["#{runner_name}"]
-                script: sleep 25
+                script: sleep 45
                 only:
                   - merge_requests
             YAML
diff --git a/spec/features/user_settings/personal_access_tokens_spec.rb b/spec/features/user_settings/personal_access_tokens_spec.rb
index f216a22f2e9..14e278e3c86 100644
--- a/spec/features/user_settings/personal_access_tokens_spec.rb
+++ b/spec/features/user_settings/personal_access_tokens_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'User Settings > Personal access tokens', :js, feature_category: :system_access do
+RSpec.describe 'User Settings > Personal access tokens', :with_current_organization, :js, feature_category: :system_access do
   include Spec::Support::Helpers::ModalHelpers
   include Features::AccessTokenHelpers
 
diff --git a/spec/finders/todos_finder_spec.rb b/spec/finders/todos_finder_spec.rb
index a3a1771ccba..6e419749066 100644
--- a/spec/finders/todos_finder_spec.rb
+++ b/spec/finders/todos_finder_spec.rb
@@ -22,17 +22,6 @@ RSpec.describe TodosFinder, feature_category: :notifications do
         expect(described_class.new(nil, {}).execute).to be_empty
       end
 
-      context 'when user is a bot' do
-        it_behaves_like 'internal event tracking' do
-          let(:event) { 'request_todos_by_bot_user' }
-          let(:category) { described_class.name }
-          let(:user) { create(:user, :bot) }
-          let(:additional_properties) { { label: 'user_type', property: user.user_type } }
-          let(:event_attribute_overrides) { { project: nil, namespace: nil } }
-          subject(:finder_service) { finder.new(user).execute }
-        end
-      end
-
       context 'filtering' do
         let!(:todo1) { create(:todo, user: user, project: project, target: issue) }
         let!(:todo2) { create(:todo, user: user, group: group, target: merge_request) }
diff --git a/spec/frontend/ci/job_details/components/empty_state_spec.js b/spec/frontend/ci/job_details/components/empty_state_spec.js
index 2cb724095c0..8b34b7954b4 100644
--- a/spec/frontend/ci/job_details/components/empty_state_spec.js
+++ b/spec/frontend/ci/job_details/components/empty_state_spec.js
@@ -1,7 +1,7 @@
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import EmptyState from '~/ci/job_details/components/empty_state.vue';
 import ManualJobForm from '~/ci/job_details/components/manual_job_form.vue';
-import { mockFullPath, mockId, mockPipelineVariablesPermissions } from '../mock_data';
+import { mockId } from '../mock_data';
 
 describe('Empty State', () => {
   let wrapper;
@@ -16,24 +16,12 @@ describe('Empty State', () => {
     isRetryable: true,
   };
 
-  const defaultProvide = {
-    projectPath: mockFullPath,
-    userRole: 'maintainer',
-  };
-
-  const createWrapper = ({
-    props,
-    pipelineVariablesPermissionsMixin = mockPipelineVariablesPermissions(true),
-  } = {}) => {
+  const createWrapper = ({ props = {} } = {}) => {
     wrapper = shallowMountExtended(EmptyState, {
       propsData: {
         ...defaultProps,
         ...props,
       },
-      provide: {
-        ...defaultProvide,
-      },
-      mixins: [pipelineVariablesPermissionsMixin],
     });
   };
 
@@ -160,43 +148,6 @@ describe('Empty State', () => {
     });
   });
 
-  describe('when user is allowed to see the pipeline variables', () => {
-    beforeEach(() => {
-      createWrapper({
-        props: { content, isRetryable: false, playable: true, scheduled: false },
-      });
-    });
-
-    it('provides `canViewPipelineVariables` as `true` to manual variables form', () => {
-      expect(findManualVarsForm().props('canViewPipelineVariables')).toBe(true);
-    });
-
-    it('renders additional text for pipeline variables when it is not a retryable job', () => {
-      expect(findContent().text()).toContain(
-        'You can add CI/CD variables below for last-minute configuration changes before starting the job.',
-      );
-    });
-  });
-
-  describe('when user is not allowed to see the pipeline variables', () => {
-    beforeEach(() => {
-      createWrapper({
-        props: { content, isRetryable: false, playable: true, scheduled: false },
-        pipelineVariablesPermissionsMixin: mockPipelineVariablesPermissions(false),
-      });
-    });
-
-    it('provides `canViewPipelineVariables` as `false` to manual variables form', () => {
-      expect(findManualVarsForm().props('canViewPipelineVariables')).toBe(false);
-    });
-
-    it('does not render additional text for pipeline variables when it is not a retryable job', () => {
-      expect(findContent().text()).not.toContain(
-        'You can add CI/CD variables below for last-minute configuration changes before starting the job.',
-      );
-    });
-  });
-
   describe('when user is not allowed to retry the pipeline', () => {
     beforeEach(() => {
       createWrapper({
diff --git a/spec/frontend/ci/job_details/components/manual_job_form_spec.js b/spec/frontend/ci/job_details/components/manual_job_form_spec.js
index 84e280a5d14..6085bcba498 100644
--- a/spec/frontend/ci/job_details/components/manual_job_form_spec.js
+++ b/spec/frontend/ci/job_details/components/manual_job_form_spec.js
@@ -34,11 +34,11 @@ const defaultProps = {
   jobId: mockId,
   jobName: 'job-name',
   isRetryable: false,
-  canViewPipelineVariables: true,
 };
 
 const defaultProvide = {
   projectPath: mockFullPath,
+  canSetPipelineVariables: true,
 };
 
 describe('Manual Variables Form', () => {
@@ -54,7 +54,7 @@ describe('Manual Variables Form', () => {
     retryJobMutationHandler,
   };
 
-  const createComponent = ({ props = {}, handlers = defaultHandlers } = {}) => {
+  const createComponent = ({ props = {}, provide = {}, handlers = defaultHandlers } = {}) => {
     requestHandlers = handlers;
 
     mockApollo = createMockApollo([
@@ -73,6 +73,7 @@ describe('Manual Variables Form', () => {
       },
       provide: {
         ...defaultProvide,
+        ...provide,
       },
       ...options,
     });
@@ -262,7 +263,7 @@ describe('Manual Variables Form', () => {
   describe('when the user is not allowed to see the pipeline variables', () => {
     beforeEach(() => {
       createComponent({
-        props: { canViewPipelineVariables: false },
+        provide: { canSetPipelineVariables: false },
       });
     });
 
diff --git a/spec/frontend/ci/job_details/components/sidebar/job_sidebar_retry_button_spec.js b/spec/frontend/ci/job_details/components/sidebar/job_sidebar_retry_button_spec.js
index 7d4a282a8bd..29c0826b654 100644
--- a/spec/frontend/ci/job_details/components/sidebar/job_sidebar_retry_button_spec.js
+++ b/spec/frontend/ci/job_details/components/sidebar/job_sidebar_retry_button_spec.js
@@ -6,13 +6,11 @@ import job from 'jest/ci/jobs_mock_data';
 import { confirmAction } from '~/lib/utils/confirm_via_gl_modal/confirm_via_gl_modal';
 import axios from '~/lib/utils/axios_utils';
 import waitForPromises from 'helpers/wait_for_promises';
-import { mockFullPath, mockPipelineVariablesPermissions } from '../../mock_data';
 
 jest.mock('~/lib/utils/confirm_via_gl_modal/confirm_action');
 
 const defaultProvide = {
-  projectPath: mockFullPath,
-  userRole: 'maintainer',
+  canSetPipelineVariables: true,
 };
 
 describe('Job Sidebar Retry Button', () => {
@@ -25,11 +23,7 @@ describe('Job Sidebar Retry Button', () => {
   const findManualRetryButton = () => wrapper.findByTestId('manual-run-again-btn');
   const findManualRunEditButton = () => wrapper.findByTestId('manual-run-edit-btn');
 
-  const createWrapper = ({
-    mountFn = shallowMountExtended,
-    props = {},
-    pipelineVariablesPermissionsMixin = mockPipelineVariablesPermissions(true),
-  } = {}) => {
+  const createWrapper = ({ mountFn = shallowMountExtended, props = {}, provide = {} } = {}) => {
     store = createStore();
     wrapper = mountFn(JobsSidebarRetryButton, {
       propsData: {
@@ -42,8 +36,8 @@ describe('Job Sidebar Retry Button', () => {
       },
       provide: {
         ...defaultProvide,
+        ...provide,
       },
-      mixins: [pipelineVariablesPermissionsMixin],
       store,
     });
   };
@@ -149,7 +143,7 @@ describe('Job Sidebar Retry Button', () => {
     it('is not rendered if user is not allowed to view pipeline variables', async () => {
       createWrapper({
         props: { isManualJob: true },
-        pipelineVariablesPermissionsMixin: mockPipelineVariablesPermissions(false),
+        provide: { canSetPipelineVariables: false },
       });
       await waitForPromises();
       expect(findManualRunEditButton().exists()).toBe(false);
diff --git a/spec/frontend/emoji/components/picker_spec.js b/spec/frontend/emoji/components/picker_spec.js
index 59db394de72..31bb0aac156 100644
--- a/spec/frontend/emoji/components/picker_spec.js
+++ b/spec/frontend/emoji/components/picker_spec.js
@@ -6,15 +6,27 @@ import EmojiPicker from '~/emoji/components/picker.vue';
 describe('Emoji Picker component', () => {
   let wrapper;
 
-  const createComponent = () => {
+  const createComponent = ({ newCustomEmojiPath = '', customEmojiPath = '' } = {}) => {
     wrapper = shallowMount(EmojiPicker, {
       stubs: { GlDisclosureDropdown },
+      provide: {
+        newCustomEmojiPath,
+      },
+      propsData: {
+        customEmojiPath,
+      },
     });
   };
 
   const findDropdown = () => wrapper.findComponent(GlDisclosureDropdown);
   const findSearchBox = () => wrapper.findComponent(GlSearchBoxByType);
   const findCategoryButtons = () => wrapper.find('[data-testid="category-buttons"]');
+  const findCreateNewEmojiLink = () => wrapper.find('[data-testid="create-new-emoji"]');
+
+  const showDropdown = async () => {
+    await findDropdown().vm.$emit('shown');
+    await nextTick();
+  };
 
   beforeEach(() => {
     createComponent();
@@ -27,16 +39,14 @@ describe('Emoji Picker component', () => {
     });
 
     it('renders search box and category buttons when dropdown is shown', async () => {
-      await findDropdown().vm.$emit('shown');
-      await nextTick();
+      await showDropdown();
 
       expect(findSearchBox().exists()).toBe(true);
       expect(findCategoryButtons().exists()).toBe(true);
     });
 
     it('hides search box and category buttons when dropdown is hidden', async () => {
-      await findDropdown().vm.$emit('shown');
-      await nextTick();
+      await showDropdown();
       await findDropdown().vm.$emit('hidden');
       await nextTick();
 
@@ -44,4 +54,35 @@ describe('Emoji Picker component', () => {
       expect(findCategoryButtons().exists()).toBe(false);
     });
   });
+
+  describe('create new emoji link', () => {
+    const mockCustomEmojiPath = '/groups/gitlab-org/-/custom_emoji/new';
+
+    it('shown when newCustomEmojiPath is provided', async () => {
+      createComponent({ newCustomEmojiPath: mockCustomEmojiPath });
+
+      await showDropdown();
+
+      expect(findCreateNewEmojiLink().exists()).toBe(true);
+      expect(findCreateNewEmojiLink().attributes('href')).toBe(mockCustomEmojiPath);
+    });
+
+    it('shown when customEmojiPath prop is set', async () => {
+      createComponent({ customEmojiPath: mockCustomEmojiPath });
+
+      await showDropdown();
+
+      expect(findCreateNewEmojiLink().exists()).toBe(true);
+      expect(findCreateNewEmojiLink().attributes('href')).toBe(mockCustomEmojiPath);
+    });
+
+    it('Injected newCustomEmojiPath is prioritized over customEmojiPath prop', async () => {
+      createComponent({ newCustomEmojiPath: mockCustomEmojiPath, customEmojiPath: 'foo' });
+
+      await showDropdown();
+
+      expect(findCreateNewEmojiLink().exists()).toBe(true);
+      expect(findCreateNewEmojiLink().attributes('href')).toBe(mockCustomEmojiPath);
+    });
+  });
 });
diff --git a/spec/frontend/issuable/popover/components/issue_popover_spec.js b/spec/frontend/issuable/popover/components/issue_popover_spec.js
index f815c31bd99..a5a351bdf81 100644
--- a/spec/frontend/issuable/popover/components/issue_popover_spec.js
+++ b/spec/frontend/issuable/popover/components/issue_popover_spec.js
@@ -62,7 +62,7 @@ describe('IssuePopover component', () => {
     });
 
     it('shows title', () => {
-      expect(wrapper.find('.gl-heading-5').text()).toBe(workItem.title);
+      expect(wrapper.find('[data-testid="popover-title"]').text()).toBe(workItem.title);
     });
 
     it('shows the work type icon', () => {
diff --git a/spec/frontend/vue_shared/components/awards_list_spec.js b/spec/frontend/vue_shared/components/awards_list_spec.js
index 539903d8334..cd0e868b974 100644
--- a/spec/frontend/vue_shared/components/awards_list_spec.js
+++ b/spec/frontend/vue_shared/components/awards_list_spec.js
@@ -92,8 +92,13 @@ const REACTION_CONTROL_CLASSES = [
 
 describe('vue_shared/components/awards_list', () => {
   let wrapper;
+  const mockCustomEmojiPath = '/groups/gitlab-org/-/custom_emoji/new';
 
-  const createComponent = (props = {}) => {
+  const createComponent = (
+    props = {
+      customEmojiPath: mockCustomEmojiPath,
+    },
+  ) => {
     wrapper = mount(AwardsList, { propsData: props });
   };
   const matchingEmojiTag = (name) => expect.stringMatching(`gl-emoji data-name="${name}"`);
@@ -113,6 +118,7 @@ describe('vue_shared/components/awards_list', () => {
   describe('default', () => {
     beforeEach(() => {
       createComponent({
+        customEmojiPath: mockCustomEmojiPath,
         awards: TEST_AWARDS,
         canAwardEmoji: true,
         currentUserId: USERS.root.id,
@@ -207,12 +213,14 @@ describe('vue_shared/components/awards_list', () => {
       const btn = findAddAwardButton();
 
       expect(btn.exists()).toBe(true);
+      expect(btn.props('customEmojiPath')).toBe(mockCustomEmojiPath);
     });
   });
 
   describe('with no awards', () => {
     beforeEach(() => {
       createComponent({
+        customEmojiPath: mockCustomEmojiPath,
         awards: [],
         canAwardEmoji: true,
       });
@@ -226,6 +234,7 @@ describe('vue_shared/components/awards_list', () => {
   describe('when cannot award emoji', () => {
     beforeEach(() => {
       createComponent({
+        customEmojiPath: mockCustomEmojiPath,
         awards: [createAward(EMOJI_CACTUS, USERS.root.id)],
         canAwardEmoji: false,
         currentUserId: USERS.marie.id,
@@ -240,6 +249,7 @@ describe('vue_shared/components/awards_list', () => {
   describe('with no user', () => {
     beforeEach(() => {
       createComponent({
+        customEmojiPath: mockCustomEmojiPath,
         awards: TEST_AWARDS,
         canAwardEmoji: false,
       });
@@ -256,6 +266,7 @@ describe('vue_shared/components/awards_list', () => {
   describe('with default awards', () => {
     beforeEach(() => {
       createComponent({
+        customEmojiPath: mockCustomEmojiPath,
         awards: [createAward(EMOJI_SMILE, USERS.marie), createAward(EMOJI_100, USERS.marie)],
         canAwardEmoji: true,
         currentUserId: USERS.root.id,
diff --git a/spec/frontend/work_items/components/notes/work_item_note_actions_spec.js b/spec/frontend/work_items/components/notes/work_item_note_actions_spec.js
index b98e7803828..74b73a472e7 100644
--- a/spec/frontend/work_items/components/notes/work_item_note_actions_spec.js
+++ b/spec/frontend/work_items/components/notes/work_item_note_actions_spec.js
@@ -5,10 +5,16 @@ import createMockApollo from 'helpers/mock_apollo_helper';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import { createMockDirective } from 'helpers/vue_mock_directive';
 import { stubComponent } from 'helpers/stub_component';
+import EmojiPicker from '~/emoji/components/picker.vue';
 import ReplyButton from '~/notes/components/note_actions/reply_button.vue';
 import WorkItemNoteActions from '~/work_items/components/notes/work_item_note_actions.vue';
 import addAwardEmojiMutation from '~/work_items/graphql/notes/work_item_note_add_award_emoji.mutation.graphql';
 
+jest.mock('~/work_items/notes/award_utils', () => ({
+  ...jest.requireActual('~/work_items/notes/award_utils'),
+  getNewCustomEmojiPath: jest.fn().mockReturnValue('/groups/gitlab-org/-/custom_emoji/new'),
+}));
+
 Vue.use(VueApollo);
 
 describe('Work Item Note Actions', () => {
@@ -68,6 +74,7 @@ describe('Work Item Note Actions', () => {
         },
       },
       stubs: {
+        EmojiPicker,
         GlDisclosureDropdown: stubComponent(GlDisclosureDropdown, {
           methods: { close: showSpy },
         }),
@@ -159,6 +166,9 @@ describe('Work Item Note Actions', () => {
       createComponent();
 
       expect(findEmojiButton().exists()).toBe(true);
+      expect(findEmojiButton().props('customEmojiPath')).toBe(
+        '/groups/gitlab-org/-/custom_emoji/new',
+      );
     });
 
     it('is hidden when `showAwardEmoji` prop is false', () => {
diff --git a/spec/frontend/work_items/components/notes/work_item_note_awards_list_spec.js b/spec/frontend/work_items/components/notes/work_item_note_awards_list_spec.js
index 19ff81b0bcc..a4d917a7c70 100644
--- a/spec/frontend/work_items/components/notes/work_item_note_awards_list_spec.js
+++ b/spec/frontend/work_items/components/notes/work_item_note_awards_list_spec.js
@@ -15,6 +15,11 @@ import {
 } from 'jest/work_items/mock_data';
 import { EMOJI_THUMBS_UP, EMOJI_THUMBS_DOWN } from '~/emoji/constants';
 
+jest.mock('~/work_items/notes/award_utils', () => ({
+  ...jest.requireActual('~/work_items/notes/award_utils'),
+  getNewCustomEmojiPath: jest.fn().mockReturnValue('/groups/gitlab-org/-/custom_emoji/new'),
+}));
+
 Vue.use(VueApollo);
 
 describe('Work Item Note Awards List', () => {
@@ -76,6 +81,16 @@ describe('Work Item Note Awards List', () => {
   });
 
   describe('when not editing', () => {
+    it('renders the awards list', async () => {
+      createComponent();
+      await waitForPromises();
+
+      expect(findAwardsList().exists()).toBe(true);
+      expect(findAwardsList().props('customEmojiPath')).toBe(
+        '/groups/gitlab-org/-/custom_emoji/new',
+      );
+    });
+
     it.each([true, false])('passes emoji permission to awards-list', (hasAwardEmojiPermission) => {
       const note = {
         ...firstNote,
diff --git a/spec/frontend/work_items/components/shared/work_item_token_input_spec.js b/spec/frontend/work_items/components/shared/work_item_token_input_spec.js
index 7860ec86ea4..2c801845211 100644
--- a/spec/frontend/work_items/components/shared/work_item_token_input_spec.js
+++ b/spec/frontend/work_items/components/shared/work_item_token_input_spec.js
@@ -11,7 +11,7 @@ import groupWorkItemsQuery from '~/work_items/graphql/group_work_items.query.gra
 import projectWorkItemsQuery from '~/work_items/graphql/project_work_items.query.graphql';
 import workItemsByReferencesQuery from '~/work_items/graphql/work_items_by_references.query.graphql';
 import workItemAncestorsQuery from '~/work_items/graphql/work_item_ancestors.query.graphql';
-import { searchWorkItemsResponse, mockworkItemReferenceQueryResponse } from '../../mock_data';
+import { searchWorkItemsResponse, mockWorkItemReferenceQueryResponse } from '../../mock_data';
 
 Vue.use(VueApollo);
 
@@ -48,6 +48,11 @@ describe('WorkItemTokenInput', () => {
           iid: '2',
           title: 'Task 1',
           confidential: false,
+          namespace: {
+            id: 'gid://gitlab/Group/1',
+            fullPath: 'test-project-path',
+            __typename: 'Namespace',
+          },
           workItemType: {
             id: 'gid://gitlab/WorkItems::Type/5',
             name: 'Task',
@@ -61,6 +66,11 @@ describe('WorkItemTokenInput', () => {
           iid: '3',
           title: 'Task 2',
           confidential: false,
+          namespace: {
+            id: 'gid://gitlab/Group/1',
+            fullPath: 'test-project-path',
+            __typename: 'Namespace',
+          },
           workItemType: {
             id: 'gid://gitlab/WorkItems::Type/5',
             name: 'Task',
@@ -74,6 +84,11 @@ describe('WorkItemTokenInput', () => {
           iid: '4',
           title: 'Task 3',
           confidential: false,
+          namespace: {
+            id: 'gid://gitlab/Group/1',
+            fullPath: 'test-project-path',
+            __typename: 'Namespace',
+          },
           workItemType: {
             id: 'gid://gitlab/WorkItems::Type/5',
             name: 'Task',
@@ -175,6 +190,11 @@ describe('WorkItemTokenInput', () => {
     iid: '3',
     title: 'Task 2',
     confidential: false,
+    namespace: {
+      id: 'gid://gitlab/Group/1',
+      fullPath: 'test-project-path',
+      __typename: 'Namespace',
+    },
     workItemType: {
       id: 'gid://gitlab/WorkItems::Type/5',
       name: 'Task',
@@ -189,6 +209,11 @@ describe('WorkItemTokenInput', () => {
     iid: 'Task 2 <svg><use href=#/></svg>',
     title: 'Task 2 <svg><use href=#/></svg>',
     confidential: false,
+    namespace: {
+      id: 'gid://gitlab/Group/1',
+      fullPath: 'test-project-path',
+      __typename: 'Namespace',
+    },
     workItemType: {
       id: 'gid://gitlab/WorkItems::Type/5',
       name: 'Task',
@@ -211,7 +236,7 @@ describe('WorkItemTokenInput', () => {
 
   const workItemReferencesQueryResolver = jest
     .fn()
-    .mockResolvedValue(mockworkItemReferenceQueryResponse);
+    .mockResolvedValue(mockWorkItemReferenceQueryResponse);
 
   const workItemAncestorsQueryHandler = jest.fn().mockResolvedValue(workItemAncestorsQueryResponse);
 
@@ -328,6 +353,11 @@ describe('WorkItemTokenInput', () => {
       iid: '101',
       title: 'Task 3',
       confidential: false,
+      namespace: {
+        id: 'gid://gitlab/Group/1',
+        fullPath: 'test-project-path',
+        __typename: 'Namespace',
+      },
       workItemType: {
         id: 'gid://gitlab/WorkItems::Type/5',
         name: 'Task',
@@ -341,6 +371,11 @@ describe('WorkItemTokenInput', () => {
       iid: '3',
       title: 'Task 123',
       confidential: false,
+      namespace: {
+        id: 'gid://gitlab/Group/1',
+        fullPath: 'test-project-path',
+        __typename: 'Namespace',
+      },
       workItemType: {
         id: 'gid://gitlab/WorkItems::Type/5',
         name: 'Task',
@@ -354,6 +389,11 @@ describe('WorkItemTokenInput', () => {
       iid: '123',
       title: 'Task 2',
       confidential: false,
+      namespace: {
+        id: 'gid://gitlab/Group/1',
+        fullPath: 'test-project-path',
+        __typename: 'Namespace',
+      },
       workItemType: {
         id: 'gid://gitlab/WorkItems::Type/5',
         name: 'Task',
diff --git a/spec/frontend/work_items/components/work_item_ancestors/mock_data.js b/spec/frontend/work_items/components/work_item_ancestors/mock_data.js
index b2db5b75d64..a9d7cf62735 100644
--- a/spec/frontend/work_items/components/work_item_ancestors/mock_data.js
+++ b/spec/frontend/work_items/components/work_item_ancestors/mock_data.js
@@ -75,6 +75,11 @@ export const workItemAncestorsQueryResponse = {
             iid: '5',
             title: 'Test parent',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: '/gitlab-org/gitlab-test/-/work_items/5',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/2',
@@ -153,6 +158,11 @@ export const workItemMultipleInaccessibleAncestorsQueryResponse = {
             iid: '5',
             title: 'Test parent',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: '/gitlab-org/gitlab-test/-/work_items/5',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/2',
@@ -242,6 +252,11 @@ export const workItemThreeAncestorsQueryResponse = {
             iid: '5',
             title: 'Test parent',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: '/gitlab-org/gitlab-test/-/work_items/5',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/2',
diff --git a/spec/frontend/work_items/components/work_item_award_emoji_spec.js b/spec/frontend/work_items/components/work_item_award_emoji_spec.js
index 6e579857400..d5de1b06277 100644
--- a/spec/frontend/work_items/components/work_item_award_emoji_spec.js
+++ b/spec/frontend/work_items/components/work_item_award_emoji_spec.js
@@ -34,13 +34,15 @@ describe('WorkItemAwardEmoji component', () => {
   let mockApolloProvider;
 
   const mutationErrorMessage = 'Failed to update the award';
+  const newCustomEmojiPath = '/groups/gitlab-org/-/custom_emoji/new';
 
-  const workItemQueryResponse = workItemByIidResponseFactory();
+  const workItemQueryResponse = workItemByIidResponseFactory({ newCustomEmojiPath });
   const mockWorkItem = workItemQueryResponse.data.workspace.workItem;
 
   const awardEmojiQuerySuccessHandler = jest.fn().mockResolvedValue(workItemQueryResponse);
   const awardEmojiQueryEmptyHandler = jest.fn().mockResolvedValue(
     workItemByIidResponseFactory({
+      newCustomEmojiPath,
       awardEmoji: {
         ...mockAwardsWidget,
         nodes: [],
@@ -49,6 +51,7 @@ describe('WorkItemAwardEmoji component', () => {
   );
   const awardEmojiQueryThumbsUpHandler = jest.fn().mockResolvedValue(
     workItemByIidResponseFactory({
+      newCustomEmojiPath,
       awardEmoji: {
         ...mockAwardsWidget,
         nodes: [mockAwardEmojiThumbsUp],
@@ -135,6 +138,7 @@ describe('WorkItemAwardEmoji component', () => {
 
     expect(findAwardsList().exists()).toBe(true);
     expect(findAwardsList().props()).toEqual({
+      customEmojiPath: newCustomEmojiPath,
       canAwardEmoji: true,
       currentUserId: 5,
       defaultAwards: [EMOJI_THUMBS_UP, EMOJI_THUMBS_DOWN],
@@ -176,6 +180,7 @@ describe('WorkItemAwardEmoji component', () => {
 
   it('renders awards list given by multiple users', async () => {
     const mockWorkItemAwardEmojiDifferentUser = workItemByIidResponseFactory({
+      newCustomEmojiPath,
       awardEmoji: {
         ...mockAwardsWidget,
         nodes: [mockAwardEmojiThumbsUp, mockAwardEmojiDifferentUser],
@@ -291,6 +296,7 @@ describe('WorkItemAwardEmoji component', () => {
     describe('when there is no next page', () => {
       const awardEmojiQuerySingleItemHandler = jest.fn().mockResolvedValue(
         workItemByIidResponseFactory({
+          newCustomEmojiPath,
           awardEmoji: {
             ...mockAwardsWidget,
             nodes: [mockAwardEmojiThumbsUp],
@@ -315,6 +321,7 @@ describe('WorkItemAwardEmoji component', () => {
     describe('when there is next page', () => {
       const awardEmojisQueryMoreThanDefaultHandler = jest.fn().mockResolvedValueOnce(
         workItemByIidResponseFactory({
+          newCustomEmojiPath,
           awardEmoji: mockMoreThanDefaultAwardEmojisWidget,
         }),
       );
diff --git a/spec/frontend/work_items/components/work_item_parent_spec.js b/spec/frontend/work_items/components/work_item_parent_spec.js
index 24a224b0efc..6881ba0f830 100644
--- a/spec/frontend/work_items/components/work_item_parent_spec.js
+++ b/spec/frontend/work_items/components/work_item_parent_spec.js
@@ -1,9 +1,10 @@
-import { GlPopover } from '@gitlab/ui';
+import { GlLink, GlPopover } from '@gitlab/ui';
 import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import waitForPromises from 'helpers/wait_for_promises';
 import createMockApollo from 'helpers/mock_apollo_helper';
-import { mountExtended } from 'helpers/vue_test_utils_helper';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import IssuePopover from '~/issuable/popover/components/issue_popover.vue';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import WorkItemParent from '~/work_items/components/work_item_parent.vue';
 import WorkItemSidebarDropdownWidget from '~/work_items/components/shared/work_item_sidebar_dropdown_widget.vue';
@@ -14,7 +15,6 @@ import projectWorkItemsQuery from '~/work_items/graphql/project_work_items.query
 import workItemsByReferencesQuery from '~/work_items/graphql/work_items_by_references.query.graphql';
 import getAllowedWorkItemParentTypes from '~/work_items/graphql/work_item_allowed_parent_types.query.graphql';
 import { WORK_ITEM_TYPE_ENUM_EPIC } from '~/work_items/constants';
-
 import {
   availableObjectivesResponse,
   mockParentWidgetResponse,
@@ -22,7 +22,7 @@ import {
   mockEmptyAncestorWidgetResponse,
   searchedObjectiveResponse,
   updateWorkItemMutationErrorResponse,
-  mockworkItemReferenceQueryResponse,
+  mockWorkItemReferenceQueryResponse,
   allowedParentTypesResponse,
 } from '../mock_data';
 
@@ -47,11 +47,13 @@ describe('WorkItemParent component', () => {
 
   const workItemReferencesSuccessHandler = jest
     .fn()
-    .mockResolvedValue(mockworkItemReferenceQueryResponse);
+    .mockResolvedValue(mockWorkItemReferenceQueryResponse);
 
   const findSidebarDropdownWidget = () => wrapper.findComponent(WorkItemSidebarDropdownWidget);
   const findAncestorUnavailable = () => wrapper.findByTestId('ancestor-not-available');
+  const findLink = () => wrapper.findComponent(GlLink);
   const findPopover = () => wrapper.findComponent(GlPopover);
+  const findIssuePopover = () => wrapper.findComponent(IssuePopover);
 
   const successUpdateWorkItemMutationHandler = jest
     .fn()
@@ -68,7 +70,7 @@ describe('WorkItemParent component', () => {
     mutationHandler = successUpdateWorkItemMutationHandler,
     hasParent = true,
   } = {}) => {
-    wrapper = mountExtended(WorkItemParent, {
+    wrapper = shallowMountExtended(WorkItemParent, {
       apolloProvider: createMockApollo([
         [projectWorkItemsQuery, searchQueryHandler],
         [groupWorkItemsQuery, groupWorkItemsSuccessHandler],
@@ -86,17 +88,15 @@ describe('WorkItemParent component', () => {
         workItemType,
         hasParent,
       },
+      stubs: {
+        IssuePopover: true,
+      },
     });
   };
 
-  beforeEach(() => {
-    createComponent();
-  });
-
   describe('when loaded', () => {
-    it('fetches allowed parent types for the current work item', async () => {
+    it('fetches allowed parent types for the current work item', () => {
       createComponent();
-      await waitForPromises();
 
       expect(allowedParentTypesHandler).toHaveBeenCalled();
     });
@@ -127,11 +127,8 @@ describe('WorkItemParent component', () => {
       createComponent();
 
       showDropdown();
-
       await nextTick();
 
-      expect(findSidebarDropdownWidget().props('loading')).toBe(true);
-      await waitForPromises();
       expect(availableWorkItemsSuccessHandler).toHaveBeenCalled();
     });
   });
@@ -143,15 +140,13 @@ describe('WorkItemParent component', () => {
 
     it('shows loading icon while update is in progress', async () => {
       createComponent();
+
       showDropdown();
-
-      await waitForPromises();
-
       selectWorkItem('gid://gitlab/WorkItem/716');
-
       await nextTick();
 
       expect(findSidebarDropdownWidget().props('updateInProgress')).toBe(true);
+
       await waitForPromises();
 
       expect(findSidebarDropdownWidget().props('updateInProgress')).toBe(false);
@@ -159,15 +154,13 @@ describe('WorkItemParent component', () => {
 
     it('shows loading icon when unassign is clicked', async () => {
       createComponent({ parent: mockEmptyAncestorWidgetResponse });
+
       showDropdown();
-
-      await waitForPromises();
-
       findSidebarDropdownWidget().vm.$emit('reset');
-
       await nextTick();
 
       expect(findSidebarDropdownWidget().props('updateInProgress')).toBe(true);
+
       await waitForPromises();
 
       expect(findSidebarDropdownWidget().props('updateInProgress')).toBe(false);
@@ -175,35 +168,44 @@ describe('WorkItemParent component', () => {
   });
 
   describe('value', () => {
-    beforeEach(() => {
-      createComponent({ parent: mockParentWidgetResponse });
-    });
-
     it('shows None when no parent is set', () => {
       createComponent({ hasParent: false });
 
-      expect(wrapper.text()).toContain('None');
+      expect(findSidebarDropdownWidget().props('toggleDropdownText')).toBe('None');
     });
 
     it('shows parent when parent is set', () => {
-      expect(wrapper.text()).not.toContain('None');
-      expect(wrapper.text()).toContain(mockParentWidgetResponse.title);
+      createComponent({ parent: mockParentWidgetResponse });
+
+      expect(findSidebarDropdownWidget().props('toggleDropdownText')).toBe(
+        mockParentWidgetResponse.title,
+      );
+      expect(findLink().attributes('href')).toBe(mockParentWidgetResponse.webUrl);
+    });
+
+    it('renders IssuePopover for parent link', () => {
+      createComponent({ parent: mockParentWidgetResponse });
+
+      expect(findIssuePopover().exists()).toBe(true);
     });
 
     it('does not show ancestor not available message', () => {
+      createComponent({ parent: mockParentWidgetResponse });
+
       expect(findAncestorUnavailable().exists()).toBe(false);
     });
 
     it('does not render inaccessible parent popover', () => {
+      createComponent({ parent: mockParentWidgetResponse });
+
       expect(findPopover().exists()).toBe(false);
     });
   });
 
   describe('Parent dropdown', () => {
-    it('renders the sidebar dropdwon widget with required props by default', () => {
+    it('renders the sidebar dropdown widget with required props by default', () => {
       createComponent();
 
-      expect(findSidebarDropdownWidget().exists()).toBe(true);
       expect(findSidebarDropdownWidget().props()).toMatchObject({
         listItems: [],
         headerText: 'Select parent',
@@ -218,8 +220,8 @@ describe('WorkItemParent component', () => {
       createComponent();
 
       showDropdown();
-
       await nextTick();
+
       expect(findSidebarDropdownWidget().props('loading')).toBe(true);
     });
   });
@@ -231,8 +233,8 @@ describe('WorkItemParent component', () => {
 
     it('loads work items in the listbox', async () => {
       createComponent();
-      showDropdown();
 
+      showDropdown();
       await waitForPromises();
 
       expect(findSidebarDropdownWidget().props('loading')).toBe(false);
@@ -245,12 +247,9 @@ describe('WorkItemParent component', () => {
     });
 
     it('emits error when the query fails', async () => {
-      createComponent({
-        searchQueryHandler: failedQueryHandler,
-      });
+      createComponent({ searchQueryHandler: failedQueryHandler });
 
       showDropdown();
-
       await waitForPromises();
 
       expect(wrapper.emitted('error')).toEqual([
@@ -258,23 +257,17 @@ describe('WorkItemParent component', () => {
       ]);
     });
 
-    it('skips the work item query when the getAllowedWorkItemParentTypes query fails', async () => {
-      createComponent({
-        allowedParentTypesHandler: failedQueryHandler,
-      });
-      await waitForPromises();
+    it('skips the work item query when the getAllowedWorkItemParentTypes query fails', () => {
+      createComponent({ allowedParentTypesHandler: failedQueryHandler });
 
       expect(availableWorkItemsSuccessHandler).not.toHaveBeenCalled();
     });
 
     it('searches item when input data is entered', async () => {
       const searchedItemQueryHandler = jest.fn().mockResolvedValue(searchedObjectiveResponse);
-      createComponent({
-        searchQueryHandler: searchedItemQueryHandler,
-      });
+      createComponent({ searchQueryHandler: searchedItemQueryHandler });
 
       showDropdown();
-
       await waitForPromises();
 
       expect(searchedItemQueryHandler).toHaveBeenCalledWith({
@@ -290,7 +283,6 @@ describe('WorkItemParent component', () => {
       });
 
       findSidebarDropdownWidget().vm.$emit('searchStarted', mockText);
-
       await waitForPromises();
 
       expect(searchedItemQueryHandler).toHaveBeenCalledWith({
@@ -305,9 +297,6 @@ describe('WorkItemParent component', () => {
         includeAncestors: true,
       });
       expect(workItemReferencesSuccessHandler).not.toHaveBeenCalled();
-
-      await nextTick();
-
       expect(findSidebarDropdownWidget().props('listItems')).toStrictEqual([
         { text: mockText, value: 'gid://gitlab/WorkItem/716' },
       ]);
@@ -321,7 +310,6 @@ describe('WorkItemParent component', () => {
       createComponent();
 
       showDropdown();
-
       await waitForPromises();
 
       expect(availableWorkItemsSuccessHandler).toHaveBeenCalledWith({
@@ -337,16 +325,12 @@ describe('WorkItemParent component', () => {
       });
 
       findSidebarDropdownWidget().vm.$emit('searchStarted', input);
-
       await waitForPromises();
 
       expect(workItemReferencesSuccessHandler).toHaveBeenCalledWith({
         contextNamespacePath: mockFullPath,
         refs,
       });
-
-      await nextTick();
-
       expect(findSidebarDropdownWidget().props('listItems')).toStrictEqual([
         { text: 'Objective linked items 104', value: 'gid://gitlab/WorkItem/705' },
       ]);
@@ -362,10 +346,7 @@ describe('WorkItemParent component', () => {
       createComponent();
 
       showDropdown();
-      await waitForPromises();
-
       selectWorkItem('gid://gitlab/WorkItem/716');
-
       await waitForPromises();
 
       expect(successUpdateWorkItemMutationHandler).toHaveBeenCalledWith({
@@ -376,7 +357,6 @@ describe('WorkItemParent component', () => {
           },
         },
       });
-
       expect(updateParent).toHaveBeenCalledWith({
         cache: expect.anything(Object),
         fullPath: mockFullPath,
@@ -397,10 +377,7 @@ describe('WorkItemParent component', () => {
       });
 
       showDropdown();
-      await waitForPromises();
-
       findSidebarDropdownWidget().vm.$emit('reset');
-
       await waitForPromises();
 
       expect(unAssignParentWorkItemMutationHandler).toHaveBeenCalledWith({
@@ -425,10 +402,7 @@ describe('WorkItemParent component', () => {
       });
 
       showDropdown();
-      await waitForPromises();
-
       selectWorkItem('gid://gitlab/WorkItem/716');
-
       await waitForPromises();
 
       expect(wrapper.emitted('error')).toEqual([['Error!']]);
@@ -436,15 +410,10 @@ describe('WorkItemParent component', () => {
 
     it('emits error and captures exception in sentry when network request fails', async () => {
       const error = new Error('error');
-      createComponent({
-        mutationHandler: jest.fn().mockRejectedValue(error),
-      });
+      createComponent({ mutationHandler: jest.fn().mockRejectedValue(error) });
 
       showDropdown();
-      await waitForPromises();
-
       selectWorkItem('gid://gitlab/WorkItem/716');
-
       await waitForPromises();
 
       expect(wrapper.emitted('error')).toEqual([
@@ -460,12 +429,10 @@ describe('WorkItemParent component', () => {
     });
 
     it('shows ancestor not available message', () => {
-      expect(findAncestorUnavailable().exists()).toBe(true);
       expect(findAncestorUnavailable().text()).toBe('Ancestor not available');
     });
 
     it('displays appropriate message in popover on hover and focus', () => {
-      expect(findPopover().exists()).toBe(true);
       expect(findPopover().props('triggers')).toBe('hover focus');
       expect(findPopover().text()).toEqual(
         `You don't have the necessary permission to view the ancestor.`,
diff --git a/spec/frontend/work_items/graphql/resolvers_spec.js b/spec/frontend/work_items/graphql/resolvers_spec.js
index 5bfa81c3186..9819c882f2a 100644
--- a/spec/frontend/work_items/graphql/resolvers_spec.js
+++ b/spec/frontend/work_items/graphql/resolvers_spec.js
@@ -152,6 +152,11 @@ describe('work items graphql resolvers', () => {
             id: 'gid://gitlab/WorkItem/1259',
             iid: '56',
             title: 'PARENT',
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: 'http://127.0.0.1:3000/groups/flightjs/-/epics/56',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/8',
@@ -170,6 +175,11 @@ describe('work items graphql resolvers', () => {
             id: 'gid://gitlab/WorkItem/1259',
             iid: '56',
             title: 'PARENT',
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: 'http://127.0.0.1:3000/groups/flightjs/-/epics/56',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/8',
diff --git a/spec/frontend/work_items/mock_data.js b/spec/frontend/work_items/mock_data.js
index 461ae2061d7..45e4e0779a8 100644
--- a/spec/frontend/work_items/mock_data.js
+++ b/spec/frontend/work_items/mock_data.js
@@ -262,6 +262,11 @@ export const workItemQueryResponse = {
             iid: '5',
             title: 'Parent title',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             webUrl: 'http://gdk.test/gitlab-org/gitlab/-/issues/1',
             workItemType: {
               id: 'gid://gitlab/WorkItems::Type/1',
@@ -423,7 +428,7 @@ export const updateWorkItemMutationErrorResponse = {
   },
 };
 
-export const mockworkItemReferenceQueryResponse = {
+export const mockWorkItemReferenceQueryResponse = {
   data: {
     workItemsByReference: {
       nodes: [
@@ -432,6 +437,11 @@ export const mockworkItemReferenceQueryResponse = {
           iid: '111',
           title: 'Objective linked items 104',
           confidential: false,
+          namespace: {
+            id: 'gid://gitlab/Group/1',
+            fullPath: 'test-project-path',
+            __typename: 'Namespace',
+          },
           workItemType: {
             iconName: 'issue-type-objective',
             id: 'gid://gitlab/WorkItems::Type/6',
@@ -568,6 +578,11 @@ export const mockParent = {
     iid: '5',
     title: 'Parent title',
     confidential: false,
+    namespace: {
+      id: 'gid://gitlab/Group/1',
+      fullPath: 'test-project-path',
+      __typename: 'Namespace',
+    },
     webUrl: 'http://gdk.test/gitlab-org/gitlab/-/issues/1',
     workItemType: {
       id: 'gid://gitlab/WorkItems::Type/1',
@@ -1429,6 +1444,7 @@ export const workItemResponseFactory = ({
   notificationsWidgetPresent = true,
   currentUserTodosWidgetPresent = true,
   awardEmojiWidgetPresent = true,
+  newCustomEmojiPath = '',
   subscribed = true,
   allowsMultipleAssignees = true,
   assigneesWidgetPresent = true,
@@ -1782,6 +1798,7 @@ export const workItemResponseFactory = ({
               __typename: 'WorkItemWidgetAwardEmoji',
               type: 'AWARD_EMOJI',
               awardEmoji,
+              ...(newCustomEmojiPath ? { newCustomEmojiPath } : {}),
             }
           : { type: 'MOCK TYPE' },
         linkedItemsWidgetPresent ? linkedItems : { type: 'MOCK TYPE' },
@@ -3295,6 +3312,11 @@ export const availableObjectivesResponse = {
             iid: '122',
             title: 'Objective 101',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             workItemType: {
               iconName: 'issue-type-objective',
               id: 'gid://gitlab/WorkItems::Type/6',
@@ -3308,6 +3330,11 @@ export const availableObjectivesResponse = {
             iid: '118',
             title: 'Objective 103',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             workItemType: {
               iconName: 'issue-type-objective',
               id: 'gid://gitlab/WorkItems::Type/6',
@@ -3321,6 +3348,11 @@ export const availableObjectivesResponse = {
             iid: '117',
             title: 'Objective 102',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             workItemType: {
               iconName: 'issue-type-objective',
               id: 'gid://gitlab/WorkItems::Type/6',
@@ -3347,6 +3379,11 @@ export const searchedObjectiveResponse = {
             iid: '122',
             title: 'Objective 101',
             confidential: false,
+            namespace: {
+              id: 'gid://gitlab/Group/1',
+              fullPath: 'test-project-path',
+              __typename: 'Namespace',
+            },
             workItemType: {
               iconName: 'issue-type-objective',
               id: 'gid://gitlab/WorkItems::Type/6',
@@ -3611,6 +3648,11 @@ export const mockParentWidgetResponse = {
   iid: '122',
   title: 'Objective 101',
   confidential: false,
+  namespace: {
+    id: 'gid://gitlab/Group/1',
+    fullPath: 'test-project-path',
+    __typename: 'Namespace',
+  },
   webUrl: 'http://127.0.0.1:3000/gitlab-org/gitlab-test/-/work_items/122',
   workItemType: {
     id: 'gid://gitlab/WorkItems::Type/6',
@@ -3636,6 +3678,11 @@ export const mockAncestorWidgetResponse = {
               iid: '149',
               title: 'Objective 333',
               confidential: false,
+              namespace: {
+                id: 'gid://gitlab/Group/1',
+                fullPath: 'test-project-path',
+                __typename: 'Namespace',
+              },
               webUrl: 'http://gdk.test:3000/gitlab-org/gitlab-test/-/work_items/149',
               workItemType: {
                 id: 'gid://gitlab/WorkItems::Type/6',
diff --git a/spec/frontend/work_items/notes/award_utils_spec.js b/spec/frontend/work_items/notes/award_utils_spec.js
index 33aff80cc0c..2985c955e85 100644
--- a/spec/frontend/work_items/notes/award_utils_spec.js
+++ b/spec/frontend/work_items/notes/award_utils_spec.js
@@ -1,13 +1,19 @@
-import { getMutation, optimisticAwardUpdate } from '~/work_items/notes/award_utils';
+import {
+  getMutation,
+  optimisticAwardUpdate,
+  getNewCustomEmojiPath,
+} from '~/work_items/notes/award_utils';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import mockApollo from 'helpers/mock_apollo_helper';
 import workItemNotesByIidQuery from '~/work_items/graphql/notes/work_item_notes_by_iid.query.graphql';
+import workItemAwardEmojiQuery from '~/work_items/graphql/award_emoji.query.graphql';
 import addAwardEmojiMutation from '~/work_items/graphql/notes/work_item_note_add_award_emoji.mutation.graphql';
 import removeAwardEmojiMutation from '~/work_items/graphql/notes/work_item_note_remove_award_emoji.mutation.graphql';
 import {
   mockAwardEmojiThumbsUp,
   mockAwardEmojiThumbsDown,
   mockWorkItemNotesResponseWithComments,
+  workItemResponseFactory,
 } from '../mock_data';
 
 function getWorkItem(data) {
@@ -142,4 +148,30 @@ describe('Work item note award utils', () => {
       );
     });
   });
+
+  describe('getNewCustomEmojiPath', () => {
+    const newCustomEmojiPath = '/groups/gitlab-org/-/custom_emoji/new';
+    const cacheData = workItemResponseFactory({ newCustomEmojiPath });
+    const mockCache = {
+      readQuery: jest.fn().mockReturnValue({
+        workspace: {
+          workItem: cacheData.data.workItem,
+        },
+      }),
+    };
+
+    it('returns newCustomEmojiPath when it exists', () => {
+      const result = getNewCustomEmojiPath({
+        cache: mockCache,
+        fullPath,
+        workItemIid,
+      });
+
+      expect(mockCache.readQuery).toHaveBeenCalledWith({
+        query: workItemAwardEmojiQuery,
+        variables: { fullPath, iid: workItemIid, pageSize: 1 },
+      });
+      expect(result).toBe(newCustomEmojiPath);
+    });
+  });
 });
diff --git a/spec/graphql/resolvers/todos_resolver_spec.rb b/spec/graphql/resolvers/todos_resolver_spec.rb
index d61cecb3b3a..fa8c2d8b173 100644
--- a/spec/graphql/resolvers/todos_resolver_spec.rb
+++ b/spec/graphql/resolvers/todos_resolver_spec.rb
@@ -183,6 +183,35 @@ RSpec.describe Resolvers::TodosResolver, feature_category: :notifications do
         expect(todos).to contain_exactly(issue_todo_pending)
       end
     end
+
+    context 'when user is a human' do
+      it 'does not trigger the tracking events' do
+        expect do
+          resolve_todos
+        end
+          .not_to trigger_internal_events('request_todos_by_bot_user')
+      end
+    end
+
+    context 'when user is a bot' do
+      let(:current_user) { create(:user, :service_account) }
+
+      it 'triggers the tracking events' do
+        expect do
+          resolve_todos
+        end
+          .to trigger_internal_events('request_todos_by_bot_user')
+                .with(
+                  user: current_user,
+                  additional_properties: {
+                    label: 'user_type', property: current_user.user_type
+                  }
+                ).exactly(:once)
+                .and increment_usage_metrics(
+                  'redis_hll_counters.count_distinct_user_id_from_request_todos_by_bot_user_weekly'
+                ).by(1)
+      end
+    end
   end
 
   def resolve_todos(args: {}, context: { current_user: current_user })
diff --git a/spec/helpers/application_settings_helper_spec.rb b/spec/helpers/application_settings_helper_spec.rb
index 28b36e42e42..99f64e23cf6 100644
--- a/spec/helpers/application_settings_helper_spec.rb
+++ b/spec/helpers/application_settings_helper_spec.rb
@@ -89,6 +89,7 @@ RSpec.describe ApplicationSettingsHelper, feature_category: :shared do
           group_invited_groups_api_limit
           project_invited_groups_api_limit
           create_organization_api_limit
+          top_level_group_creation_enabled
         ])
     end
 
diff --git a/spec/helpers/ci/jobs_helper_spec.rb b/spec/helpers/ci/jobs_helper_spec.rb
index 2f82b28cdc0..30c017fb82d 100644
--- a/spec/helpers/ci/jobs_helper_spec.rb
+++ b/spec/helpers/ci/jobs_helper_spec.rb
@@ -35,7 +35,7 @@ RSpec.describe Ci::JobsHelper, feature_category: :continuous_integration do
         "retry_outdated_job_docs_url" => "/help/ci/pipelines/settings.md#prevent-outdated-deployment-jobs",
         "pipeline_test_report_url" => "/#{project.full_path}/-/pipelines/#{job.pipeline.id}/test_report",
         "log_viewer_path" => "/#{project.full_path}/-/jobs/#{job.id}/viewer",
-        "user_role" => "Maintainer"
+        "can_set_pipeline_variables" => Ability.allowed?(user, :set_pipeline_variables, project).to_s
       })
     end
 
diff --git a/spec/lib/gitlab/ci/status/build/manual_spec.rb b/spec/lib/gitlab/ci/status/build/manual_spec.rb
index ac9da81f368..2cc5bce60e8 100644
--- a/spec/lib/gitlab/ci/status/build/manual_spec.rb
+++ b/spec/lib/gitlab/ci/status/build/manual_spec.rb
@@ -19,6 +19,20 @@ RSpec.describe Gitlab::Ci::Status::Build::Manual, feature_category: :continuous_
       end
 
       context 'when the job has not been played' do
+        it 'instructs the user about possible actions' do
+          expect(subject.illustration[:content]).to eq(
+            _("This job does not start automatically and must be started manually. You can add CI/CD variables below for last-minute configuration changes before starting the job.")
+          )
+        end
+      end
+
+      context 'when the job has not been played and user cannot see pipeline variables' do
+        before do
+          job.project.update!(
+            ci_cd_settings_attributes: { pipeline_variables_minimum_override_role: :owner }
+          )
+        end
+
         it 'instructs the user about possible actions' do
           expect(subject.illustration[:content]).to eq(
             _('This job does not start automatically and must be started manually.')
diff --git a/spec/migrations/20250224155021_queue_backfill_external_group_audit_event_destinations_spec.rb b/spec/migrations/20250224155021_queue_backfill_external_group_audit_event_destinations_spec.rb
index 0667b9aa6e7..9214d154bdf 100644
--- a/spec/migrations/20250224155021_queue_backfill_external_group_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224155021_queue_backfill_external_group_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillExternalGroupAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillExternalGroupAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_external_audit_event_destinations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250224205632_queue_backfill_external_instance_audit_event_destinations_spec.rb b/spec/migrations/20250224205632_queue_backfill_external_instance_audit_event_destinations_spec.rb
index 8883717e754..01cd70f48c7 100644
--- a/spec/migrations/20250224205632_queue_backfill_external_instance_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224205632_queue_backfill_external_instance_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillExternalInstanceAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillExternalInstanceAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_instance_external_audit_event_destinations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250224211819_queue_backfill_google_group_audit_event_destinations_spec.rb b/spec/migrations/20250224211819_queue_backfill_google_group_audit_event_destinations_spec.rb
index 18c8cc8dd88..2c54d9b2d45 100644
--- a/spec/migrations/20250224211819_queue_backfill_google_group_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224211819_queue_backfill_google_group_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillGoogleGroupAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillGoogleGroupAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_google_cloud_logging_configurations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250224214021_queue_backfill_google_instance_audit_event_destinations_spec.rb b/spec/migrations/20250224214021_queue_backfill_google_instance_audit_event_destinations_spec.rb
index 28e8eebbed0..996b86212c9 100644
--- a/spec/migrations/20250224214021_queue_backfill_google_instance_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224214021_queue_backfill_google_instance_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillGoogleInstanceAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillGoogleInstanceAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_instance_google_cloud_logging_configurations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250224214935_queue_backfill_amazon_group_audit_event_destinations_spec.rb b/spec/migrations/20250224214935_queue_backfill_amazon_group_audit_event_destinations_spec.rb
index 96a454e9ce9..5e39122a101 100644
--- a/spec/migrations/20250224214935_queue_backfill_amazon_group_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224214935_queue_backfill_amazon_group_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillAmazonGroupAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillAmazonGroupAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_amazon_s3_configurations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250224215131_queue_backfill_amazon_instance_audit_event_destinations_spec.rb b/spec/migrations/20250224215131_queue_backfill_amazon_instance_audit_event_destinations_spec.rb
index 521ddc6a0ea..50455059799 100644
--- a/spec/migrations/20250224215131_queue_backfill_amazon_instance_audit_event_destinations_spec.rb
+++ b/spec/migrations/20250224215131_queue_backfill_amazon_instance_audit_event_destinations_spec.rb
@@ -3,36 +3,13 @@
 require 'spec_helper'
 require_migration!
 
-RSpec.describe QueueBackfillAmazonInstanceAuditEventDestinations,
-  migration: :gitlab_main,
-  feature_category: :audit_events do
+RSpec.describe QueueBackfillAmazonInstanceAuditEventDestinations, migration: :gitlab_main, feature_category: :audit_events do
   let(:batched_migration) { described_class::MIGRATION }
 
-  it 'schedules a new batched migration' do
-    reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
+  it 'is a no-op migration' do
+    # Simply verify that up and down do nothing
+    expect { migrate! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
 
-      migration.after -> {
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :audit_events_instance_amazon_s3_configurations,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE,
-          gitlab_schema: :gitlab_main
-        )
-      }
-    end
-  end
-
-  it 'removes scheduled migration when rolling back' do
-    disable_migrations_output do
-      migrate!
-      schema_migrate_down!
-    end
-
-    expect(batched_migration).not_to have_scheduled_batched_migration
+    expect { schema_migrate_down! }.not_to change { Gitlab::Database::BackgroundMigration::BatchedMigration.count }
   end
 end
diff --git a/spec/migrations/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..930ac48daf0
--- /dev/null
+++ b/spec/migrations/20250403155636_queue_backfill_external_group_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillExternalGroupAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_external_audit_event_destinations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/migrations/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..b9eb0f8016c
--- /dev/null
+++ b/spec/migrations/20250403155703_queue_backfill_external_instance_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillExternalInstanceAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_instance_external_audit_event_destinations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/migrations/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..b06c0deb0da
--- /dev/null
+++ b/spec/migrations/20250403155730_queue_backfill_amazon_group_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillAmazonGroupAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_amazon_s3_configurations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/migrations/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..f558a017701
--- /dev/null
+++ b/spec/migrations/20250403155743_queue_backfill_amazon_instance_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillAmazonInstanceAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_instance_amazon_s3_configurations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/migrations/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..e3b368d81d5
--- /dev/null
+++ b/spec/migrations/20250403155756_queue_backfill_google_group_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillGoogleGroupAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_google_cloud_logging_configurations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/migrations/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed_spec.rb b/spec/migrations/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed_spec.rb
new file mode 100644
index 00000000000..2c5a04a8f7b
--- /dev/null
+++ b/spec/migrations/20250403155815_queue_backfill_google_instance_audit_event_destinations_fixed_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillGoogleInstanceAuditEventDestinationsFixed,
+  migration: :gitlab_main,
+  feature_category: :audit_events do
+  let(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :audit_events_instance_google_cloud_logging_configurations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main
+        )
+      }
+    end
+  end
+
+  it 'removes scheduled migration when rolling back' do
+    disable_migrations_output do
+      migrate!
+      schema_migrate_down!
+    end
+
+    expect(batched_migration).not_to have_scheduled_batched_migration
+  end
+end
diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb
index c885657961e..17a76357580 100644
--- a/spec/models/application_setting_spec.rb
+++ b/spec/models/application_setting_spec.rb
@@ -94,7 +94,8 @@ RSpec.describe ApplicationSetting, feature_category: :shared, type: :model do
           'session_expire_from_init' => false
         },
         reindexing_minimum_index_size: 1.gigabyte,
-        reindexing_minimum_relative_bloat_size: 0.2
+        reindexing_minimum_relative_bloat_size: 0.2,
+        top_level_group_creation_enabled: true
       )
     end
   end
@@ -295,6 +296,10 @@ RSpec.describe ApplicationSetting, feature_category: :shared, type: :model do
     it { is_expected.not_to allow_value(nil).for(:pypi_package_requests_forwarding) }
     it { is_expected.not_to allow_value(nil).for(:lock_pypi_package_requests_forwarding) }
 
+    context 'for validating the group_settings jsonb_column`s atrributes' do
+      it { is_expected.to allow_values([true, false]).for(:top_level_group_creation_enabled) }
+    end
+
     context 'for non-null integer attributes starting from 0' do
       where(:attribute) do
         %i[
diff --git a/spec/requests/api/todos_spec.rb b/spec/requests/api/todos_spec.rb
index e4439557ef7..875cd6399e1 100644
--- a/spec/requests/api/todos_spec.rb
+++ b/spec/requests/api/todos_spec.rb
@@ -244,6 +244,16 @@ RSpec.describe API::Todos, feature_category: :source_code_management do
       end
     end
 
+    context 'when user is a bot' do
+      it_behaves_like 'internal event tracking' do
+        let(:event) { 'request_todos_by_bot_user' }
+        let(:user) { create(:user, :service_account) }
+        let(:additional_properties) { { label: 'user_type', property: user.user_type } }
+        let(:event_attribute_overrides) { { project: nil, namespace: nil } }
+        subject(:api_request) { get api('/todos', user) }
+      end
+    end
+
     it 'avoids N+1 queries', :request_store do
       create_issue_todo_for(john_doe)
       create(:todo, project: project_1, author: author_2, user: john_doe, target: merge_request)
diff --git a/yarn.lock b/yarn.lock
index b553602a048..151a1e6822f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1273,15 +1273,15 @@
     debug "^4.3.1"
     minimatch "^3.1.2"
 
-"@eslint/config-helpers@^0.2.0":
-  version "0.2.0"
-  resolved "https://registry.yarnpkg.com/@eslint/config-helpers/-/config-helpers-0.2.0.tgz#12dc8d65c31c4b6c3ebf0758db6601eb7692ce59"
-  integrity sha512-yJLLmLexii32mGrhW29qvU3QBVTu0GUmEf/J4XsBtVhp4JkIUFN/BjWqTF63yRvGApIDpZm5fa97LtYtINmfeQ==
+"@eslint/config-helpers@^0.2.1":
+  version "0.2.1"
+  resolved "https://registry.yarnpkg.com/@eslint/config-helpers/-/config-helpers-0.2.1.tgz#26042c028d1beee5ce2235a7929b91c52651646d"
+  integrity sha512-RI17tsD2frtDu/3dmI7QRrD4bedNKPM08ziRYaC5AhkGrzIAJelm9kJU1TznK+apx6V+cqRz8tfpEeG3oIyjxw==
 
-"@eslint/core@^0.12.0":
-  version "0.12.0"
-  resolved "https://registry.yarnpkg.com/@eslint/core/-/core-0.12.0.tgz#5f960c3d57728be9f6c65bd84aa6aa613078798e"
-  integrity sha512-cmrR6pytBuSMTaBweKoGMwu3EiHiEC+DoyupPmlZ0HxBJBtIxwe+j/E4XPIKNx+Q74c8lXKPwYawBf5glsTkHg==
+"@eslint/core@^0.13.0":
+  version "0.13.0"
+  resolved "https://registry.yarnpkg.com/@eslint/core/-/core-0.13.0.tgz#bf02f209846d3bf996f9e8009db62df2739b458c"
+  integrity sha512-yfkgDw1KR66rkT5A8ci4irzDysN7FRpq3ttJolR88OqQikAWqwA8j5VZyas+vjyBNFIJ7MfybJ9plMILI2UrCw==
   dependencies:
     "@types/json-schema" "^7.0.15"
 
@@ -1300,22 +1300,22 @@
     minimatch "^3.1.2"
     strip-json-comments "^3.1.1"
 
-"@eslint/js@9.24.0", "@eslint/js@^9.15.0":
-  version "9.24.0"
-  resolved "https://registry.yarnpkg.com/@eslint/js/-/js-9.24.0.tgz#685277980bb7bf84ecc8e4e133ccdda7545a691e"
-  integrity sha512-uIY/y3z0uvOGX8cp1C2fiC4+ZmBhp6yZWkojtHL1YEMnRt1Y63HB9TM17proGEmeG7HeUY+UP36F0aknKYTpYA==
+"@eslint/js@9.25.1", "@eslint/js@^9.15.0":
+  version "9.25.1"
+  resolved "https://registry.yarnpkg.com/@eslint/js/-/js-9.25.1.tgz#25f5c930c2b68b5ebe7ac857f754cbd61ef6d117"
+  integrity sha512-dEIwmjntEx8u3Uvv+kr3PDeeArL8Hw07H9kyYxCjnM9pBjfEhk6uLXSchxxzgiwtRhhzVzqmUSDFBOi1TuZ7qg==
 
 "@eslint/object-schema@^2.1.6":
   version "2.1.6"
   resolved "https://registry.yarnpkg.com/@eslint/object-schema/-/object-schema-2.1.6.tgz#58369ab5b5b3ca117880c0f6c0b0f32f6950f24f"
   integrity sha512-RBMg5FRL0I0gs51M/guSAj5/e14VQ4tpZnQNWwuDT66P14I43ItmPfIZRhO9fUVIPOAQXU47atlywZ/czoqFPA==
 
-"@eslint/plugin-kit@^0.2.7":
-  version "0.2.7"
-  resolved "https://registry.yarnpkg.com/@eslint/plugin-kit/-/plugin-kit-0.2.7.tgz#9901d52c136fb8f375906a73dcc382646c3b6a27"
-  integrity sha512-JubJ5B2pJ4k4yGxaNLdbjrnk9d/iDz6/q8wOilpIowd6PJPgaxCuHBnBszq7Ce2TyMrywm5r4PnKm6V3iiZF+g==
+"@eslint/plugin-kit@^0.2.8":
+  version "0.2.8"
+  resolved "https://registry.yarnpkg.com/@eslint/plugin-kit/-/plugin-kit-0.2.8.tgz#47488d8f8171b5d4613e833313f3ce708e3525f8"
+  integrity sha512-ZAoA40rNMPwSm+AeHpCq8STiNAwzWLJuP8Xv4CHIc9wv/PSuExjMrmjfYNj682vW0OOiZ1HKxzvjQr9XZIisQA==
   dependencies:
-    "@eslint/core" "^0.12.0"
+    "@eslint/core" "^0.13.0"
     levn "^0.4.1"
 
 "@fastify/busboy@^2.0.0":
@@ -7516,19 +7516,19 @@ eslint-visitor-keys@^4.2.0:
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz#687bacb2af884fcdda8a6e7d65c606f46a14cd45"
   integrity sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==
 
-eslint@9.24.0:
-  version "9.24.0"
-  resolved "https://registry.yarnpkg.com/eslint/-/eslint-9.24.0.tgz#9a7f2e6cb2de81c405ab244b02f4584c79dc6bee"
-  integrity sha512-eh/jxIEJyZrvbWRe4XuVclLPDYSYYYgLy5zXGGxD6j8zjSAxFEzI2fL/8xNq6O2yKqVt+eF2YhV+hxjV6UKXwQ==
+eslint@9.25.1:
+  version "9.25.1"
+  resolved "https://registry.yarnpkg.com/eslint/-/eslint-9.25.1.tgz#8a7cf8dd0e6acb858f86029720adb1785ee57580"
+  integrity sha512-E6Mtz9oGQWDCpV12319d59n4tx9zOTXSTmc8BLVxBx+G/0RdM5MvEEJLU9c0+aleoePYYgVTOsRblx433qmhWQ==
   dependencies:
     "@eslint-community/eslint-utils" "^4.2.0"
     "@eslint-community/regexpp" "^4.12.1"
     "@eslint/config-array" "^0.20.0"
-    "@eslint/config-helpers" "^0.2.0"
-    "@eslint/core" "^0.12.0"
+    "@eslint/config-helpers" "^0.2.1"
+    "@eslint/core" "^0.13.0"
     "@eslint/eslintrc" "^3.3.1"
-    "@eslint/js" "9.24.0"
-    "@eslint/plugin-kit" "^0.2.7"
+    "@eslint/js" "9.25.1"
+    "@eslint/plugin-kit" "^0.2.8"
     "@humanfs/node" "^0.16.6"
     "@humanwhocodes/module-importer" "^1.0.1"
     "@humanwhocodes/retry" "^0.4.2"