From 2edc40d2d6bc45670e91f39537dea7dc9369f8d8 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Tue, 20 May 2025 15:09:54 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../admin_new_runner/admin_new_runner_app.vue |   5 +-
 .../components/runner_create_wizard.vue       |  25 +++
 .../runner_create_wizard_optional_fields.vue  | 169 ++++++++++++++++++
 .../runner_create_wizard_required_fields.vue  |  24 ++-
 .../javascripts/network/branch_graph.js       |   2 +-
 .../rapid_diffs/app_component.html.haml       |   7 +-
 app/components/rapid_diffs/app_component.rb   |  12 ++
 .../rapid_diffs/diff_file_component.html.haml |   2 +-
 .../rapid_diffs/diff_file_component.rb        |   5 +
 .../diff_file_header_component.html.haml      |   8 +-
 .../rapid_diffs/diff_file_header_component.rb |   9 +
 .../concerns/issues/sort_arguments.rb         |  13 +-
 .../non_stable_cursor_sort_options.rb         |  19 ++
 app/graphql/resolvers/work_items_resolver.rb  |  11 +-
 app/helpers/diff_helper.rb                    |   4 +
 .../backfill_lists_sharding_key.yml           |   2 +-
 db/docs/lists.yml                             |   6 +-
 ...23_finalize_backfill_lists_sharding_key.rb |  23 +++
 ...lidate_lists_parent_not_null_constraint.rb |  15 ++
 ...9_validate_lists_project_id_foreign_key.rb |  15 ++
 ...438_validate_lists_group_id_foreign_key.rb |  15 ++
 ..._drop_lists_ensure_sharding_key_trigger.rb |  35 ++++
 db/schema_migrations/20250519141223           |   1 +
 db/schema_migrations/20250519141731           |   1 +
 db/schema_migrations/20250519142209           |   1 +
 db/schema_migrations/20250519142438           |   1 +
 db/schema_migrations/20250519142617           |   1 +
 db/structure.sql                              |  27 +--
 doc/administration/instance_limits.md         |   6 +-
 doc/administration/redis/_index.md            |   4 +-
 .../redis/replication_and_failover.md         |   4 +-
 .../replication_and_failover_external.md      |   4 +-
 doc/administration/redis/standalone.md        |   4 +-
 doc/administration/redis/troubleshooting.md   |   4 +-
 doc/administration/sidekiq/_index.md          |   4 +-
 .../sidekiq/extra_sidekiq_processes.md        |   4 +-
 .../processing_specific_job_classes.md        |   4 +-
 .../sidekiq/sidekiq_health_check.md           |   4 +-
 .../sidekiq/sidekiq_memory_killer.md          |   4 +-
 .../sidekiq/sidekiq_troubleshooting.md        |   4 +-
 doc/api/graphql/reference/_index.md           |   4 +-
 doc/api/plan_limits.md                        |   3 +
 .../compromised_password_detection.md         |  20 +++
 .../compromised_password_detection.md         |  25 +++
 locale/gitlab.pot                             |  27 +++
 package.json                                  |   2 +-
 qa/Gemfile                                    |   2 +-
 qa/Gemfile.lock                               |   4 +-
 ...nner_create_wizard_optional_fields_spec.js |  50 ++++++
 ...nner_create_wizard_required_fields_spec.js |   2 +
 spec/helpers/diff_helper_spec.rb              |   6 +
 .../api/graphql/project/work_items_spec.rb    |  17 +-
 .../boards/lists/list_service_spec.rb         |   2 +
 yarn.lock                                     |   5 +
 54 files changed, 590 insertions(+), 87 deletions(-)
 create mode 100644 app/assets/javascripts/ci/runner/components/runner_create_wizard_optional_fields.vue
 create mode 100644 app/graphql/resolvers/concerns/work_items/non_stable_cursor_sort_options.rb
 create mode 100644 db/post_migrate/20250519141223_finalize_backfill_lists_sharding_key.rb
 create mode 100644 db/post_migrate/20250519141731_validate_lists_parent_not_null_constraint.rb
 create mode 100644 db/post_migrate/20250519142209_validate_lists_project_id_foreign_key.rb
 create mode 100644 db/post_migrate/20250519142438_validate_lists_group_id_foreign_key.rb
 create mode 100644 db/post_migrate/20250519142617_drop_lists_ensure_sharding_key_trigger.rb
 create mode 100644 db/schema_migrations/20250519141223
 create mode 100644 db/schema_migrations/20250519141731
 create mode 100644 db/schema_migrations/20250519142209
 create mode 100644 db/schema_migrations/20250519142438
 create mode 100644 db/schema_migrations/20250519142617
 create mode 100644 doc/development/compromised_password_detection.md
 create mode 100644 doc/security/compromised_password_detection.md
 create mode 100644 spec/frontend/ci/runner/components/runner_create_wizard_optional_fields_spec.js

diff --git a/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue b/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
index 326a5a629bf..6f6ba053d49 100644
--- a/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
+++ b/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
@@ -35,7 +35,10 @@ export default {
 </script>
 
 <template>
-  <runner-create-wizard v-if="glFeatures.runnerCreateWizardAdmin" />
+  <runner-create-wizard
+    v-if="glFeatures.runnerCreateWizardAdmin"
+    :runner-type="$options.INSTANCE_TYPE"
+  />
   <div v-else>
     <page-heading :heading="s__('Runners|Create instance runner')">
       <template #description>
diff --git a/app/assets/javascripts/ci/runner/components/runner_create_wizard.vue b/app/assets/javascripts/ci/runner/components/runner_create_wizard.vue
index 453d5df8992..7ad66f394fa 100644
--- a/app/assets/javascripts/ci/runner/components/runner_create_wizard.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_create_wizard.vue
@@ -1,10 +1,20 @@
 <script>
+import { RUNNER_TYPES } from '../constants';
 import RequiredFields from './runner_create_wizard_required_fields.vue';
+import OptionalFields from './runner_create_wizard_optional_fields.vue';
 
 export default {
   name: 'RunnerCreateWizard',
   components: {
     RequiredFields,
+    OptionalFields,
+  },
+  props: {
+    runnerType: {
+      type: String,
+      required: true,
+      validator: (t) => RUNNER_TYPES.includes(t),
+    },
   },
   data() {
     return {
@@ -17,6 +27,9 @@ export default {
     onNext() {
       this.currentStep += 1;
     },
+    onBack() {
+      this.currentStep -= 1;
+    },
     onRequiredFieldsUpdate(requiredFields) {
       this.tags = requiredFields.tags;
       this.runUntagged = requiredFields.runUntagged;
@@ -30,7 +43,19 @@ export default {
     v-if="currentStep === 1"
     :current-step="currentStep"
     :steps-total="$options.stepsTotal"
+    :is-run-untagged="runUntagged"
+    :tag-list="tags"
     @next="onNext"
     @onRequiredFieldsUpdate="onRequiredFieldsUpdate"
   />
+  <optional-fields
+    v-else-if="currentStep === 2"
+    :current-step="currentStep"
+    :steps-total="$options.stepsTotal"
+    :tags="tags"
+    :run-untagged="runUntagged"
+    :runner-type="runnerType"
+    @next="onNext"
+    @back="onBack"
+  />
 </template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_create_wizard_optional_fields.vue b/app/assets/javascripts/ci/runner/components/runner_create_wizard_optional_fields.vue
new file mode 100644
index 00000000000..dcc19771042
--- /dev/null
+++ b/app/assets/javascripts/ci/runner/components/runner_create_wizard_optional_fields.vue
@@ -0,0 +1,169 @@
+<script>
+import { GlForm, GlButton, GlFormGroup, GlFormInput, GlFormTextarea } from '@gitlab/ui';
+import MultiStepFormTemplate from '~/vue_shared/components/multi_step_form_template.vue';
+import MultipleChoiceSelector from '~/vue_shared/components/multiple_choice_selector.vue';
+import MultipleChoiceSelectorItem from '~/vue_shared/components/multiple_choice_selector_item.vue';
+import {
+  DEFAULT_ACCESS_LEVEL,
+  ACCESS_LEVEL_NOT_PROTECTED,
+  ACCESS_LEVEL_REF_PROTECTED,
+} from '../constants';
+
+export default {
+  components: {
+    GlForm,
+    GlButton,
+    GlFormGroup,
+    GlFormInput,
+    GlFormTextarea,
+    MultiStepFormTemplate,
+    MultipleChoiceSelector,
+    MultipleChoiceSelectorItem,
+  },
+  props: {
+    currentStep: {
+      type: Number,
+      required: true,
+    },
+    stepsTotal: {
+      type: Number,
+      required: true,
+    },
+    tags: {
+      type: String,
+      required: true,
+    },
+    runUntagged: {
+      type: Boolean,
+      required: true,
+    },
+    runnerType: {
+      type: String,
+      required: true,
+    },
+  },
+  data() {
+    return {
+      runner: {
+        runnerType: this.runnerType,
+        description: '',
+        maintenanceNote: '',
+        paused: false,
+        accessLevel: DEFAULT_ACCESS_LEVEL,
+        runUntagged: this.runUntagged,
+        locked: false,
+        tagList: this.tags,
+        maximumTimeout: '',
+      },
+    };
+  },
+  methods: {
+    onCheckboxesInput(checked) {
+      if (checked.includes(ACCESS_LEVEL_REF_PROTECTED))
+        this.runner.accessLevel = ACCESS_LEVEL_REF_PROTECTED;
+      else this.runner.accessLevel = ACCESS_LEVEL_NOT_PROTECTED;
+
+      this.runner.paused = checked.includes('paused');
+    },
+  },
+  ACCESS_LEVEL_REF_PROTECTED,
+};
+</script>
+<template>
+  <gl-form>
+    <multi-step-form-template
+      :title="s__('Runners|Optional configuration details')"
+      :current-step="currentStep"
+      :steps-total="stepsTotal"
+    >
+      <template #form>
+        <multiple-choice-selector class="gl-mb-5" @input="onCheckboxesInput">
+          <multiple-choice-selector-item
+            :value="ACCESS_LEVEL_REF_PROTECTED"
+            :title="s__('Runners|Protected')"
+            :description="s__('Runners|Use the runner on pipelines for protected branches only.')"
+          />
+          <multiple-choice-selector-item
+            value="paused"
+            :title="s__('Runners|Paused')"
+            :description="s__('Runners|Stop the runner from accepting new jobs.')"
+          />
+        </multiple-choice-selector>
+
+        <gl-form-group
+          label-for="runner-description"
+          :label="s__('Runners|Runner description')"
+          :optional="true"
+        >
+          <gl-form-input
+            id="runner-description"
+            v-model="runner.description"
+            name="description"
+            data-testid="runner-description-input"
+          />
+        </gl-form-group>
+
+        <gl-form-group
+          label-for="runner-maintenance-note"
+          :label="s__('Runners|Maintenance note')"
+          :label-description="
+            s__('Runners|Add notes such as the runner owner or what it should be used for.')
+          "
+          :optional="true"
+          :description="s__('Runners|Only administrators can view this.')"
+        >
+          <gl-form-textarea
+            id="runner-maintenance-note"
+            v-model="runner.maintenanceNote"
+            name="maintenance-note"
+            data-testid="runner-maintenance-note"
+          />
+        </gl-form-group>
+
+        <gl-form-group
+          label-for="max-timeout"
+          :label="s__('Runners|Maximum job timeout')"
+          :label-description="
+            s__(
+              'Runners|Maximum amount of time the runner can run before it terminates. If a project has a shorter job timeout period, the job timeout period of the instance runner is used instead.',
+            )
+          "
+          :optional="true"
+          :description="
+            s__('Runners|Enter the job timeout in seconds. Must be a minimum of 600 seconds.')
+          "
+        >
+          <gl-form-input
+            id="max-timeout"
+            v-model="runner.maximumTimeout"
+            name="max-timeout"
+            type="number"
+            data-testid="max-timeout-input"
+          />
+        </gl-form-group>
+      </template>
+      <template #next>
+        <!-- [Next step] button will be un-disabled in https://gitlab.com/gitlab-org/gitlab/-/issues/396544 -->
+        <gl-button
+          category="primary"
+          variant="confirm"
+          :disabled="true"
+          type="submit"
+          data-testid="next-button"
+        >
+          {{ __('Next step') }}
+        </gl-button>
+      </template>
+      <template #back>
+        <gl-button
+          category="primary"
+          variant="default"
+          data-testid="back-button"
+          @click="$emit('back')"
+        >
+          {{ __('Go back') }}
+        </gl-button>
+      </template>
+    </multi-step-form-template>
+  </gl-form>
+</template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_create_wizard_required_fields.vue b/app/assets/javascripts/ci/runner/components/runner_create_wizard_required_fields.vue
index c0ab8d4a660..6d3b0794c66 100644
--- a/app/assets/javascripts/ci/runner/components/runner_create_wizard_required_fields.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_create_wizard_required_fields.vue
@@ -26,15 +26,27 @@ export default {
       type: Number,
       required: true,
     },
+    isRunUntagged: {
+      type: Boolean,
+      required: true,
+    },
+    tagList: {
+      type: String,
+      required: true,
+    },
   },
   data() {
     return {
-      runUntagged: false,
-      tags: '',
+      runUntagged: this.isRunUntagged,
+      tags: this.tagList,
       isValidationAlertVisible: false,
     };
   },
-  computed: {},
+  computed: {
+    runUntaggedSelectorDefaultSelection() {
+      return this.runUntagged ? ['untagged'] : [];
+    },
+  },
   methods: {
     onNext() {
       if (this.runUntagged || this.tags !== '') {
@@ -106,7 +118,11 @@ export default {
         />
       </gl-form-group>
 
-      <multiple-choice-selector data-testid="runner-untagged-checkbox" @input="onUntaggedInput">
+      <multiple-choice-selector
+        data-testid="runner-untagged-checkbox"
+        :checked="runUntaggedSelectorDefaultSelection"
+        @input="onUntaggedInput"
+      >
         <multiple-choice-selector-item
           value="untagged"
           :title="__('Run untagged jobs')"
diff --git a/app/assets/javascripts/network/branch_graph.js b/app/assets/javascripts/network/branch_graph.js
index a9c57f9ac29..ae647a05e05 100644
--- a/app/assets/javascripts/network/branch_graph.js
+++ b/app/assets/javascripts/network/branch_graph.js
@@ -340,7 +340,7 @@ export default class BranchGraph {
       r.path(['M', x + 5, y, 'L', x + 15, y + 4, 'L', x + 15, y - 4, 'Z']).attr({
         fill: '#000',
         'fill-opacity': 0.5,
-        stroke: 'none',
+        stroke: '#FFF',
       });
       // Displayed in the center
       return this.element.scrollTop(y - this.graphHeight / 2);
diff --git a/app/components/rapid_diffs/app_component.html.haml b/app/components/rapid_diffs/app_component.html.haml
index 0325ef21119..cf2ca34816d 100644
--- a/app/components/rapid_diffs/app_component.html.haml
+++ b/app/components/rapid_diffs/app_component.html.haml
@@ -11,8 +11,8 @@
             streamRequest: fetch('#{Gitlab::UrlSanitizer.sanitize(@stream_url)}', { signal: controller.signal })
           }
 
-.rd-app{ data: { rapid_diffs: true, app_data: app_data.to_json } }
-  .rd-app-header
+%article.rd-app{ aria: { label: root_label }, data: { rapid_diffs: true, app_data: app_data.to_json } }
+  %header.rd-app-header{ aria: { label: header_label } }
     .rd-app-file-browser-toggle
       %div{ data: { file_browser_toggle: true } }
     .rd-app-settings
@@ -21,7 +21,8 @@
     .rd-app-sidebar{ data: { file_browser: true }, style: sidebar_style }
       .rd-app-sidebar-loading{ data: { testid: 'rd-file-browser-loading' } }
         = helpers.gl_loading_icon(size: 'sm')
-    .rd-app-content
+    -# using label produces better results in VoiceOver than labelledby + hidden h2
+    %section.rd-app-content{ aria: { label: content_label } }
       .rd-app-content-header{ data: { hidden_files_warning: true } }
       - if empty_diff? && !@lazy
         = render RapidDiffs::EmptyStateComponent.new
diff --git a/app/components/rapid_diffs/app_component.rb b/app/components/rapid_diffs/app_component.rb
index 4509fb64312..e63e8d2d1b7 100644
--- a/app/components/rapid_diffs/app_component.rb
+++ b/app/components/rapid_diffs/app_component.rb
@@ -65,5 +65,17 @@ module RapidDiffs
       styles << "display: none;" unless browser_visible?
       styles.join(' ')
     end
+
+    def root_label
+      s_('RapidDiffs|Changes view')
+    end
+
+    def header_label
+      s_('RapidDiffs|View controls')
+    end
+
+    def content_label
+      s_('RapidDiffs|Diff files')
+    end
   end
 end
diff --git a/app/components/rapid_diffs/diff_file_component.html.haml b/app/components/rapid_diffs/diff_file_component.html.haml
index 0c8a5eb1325..ebdd43d7d38 100644
--- a/app/components/rapid_diffs/diff_file_component.html.haml
+++ b/app/components/rapid_diffs/diff_file_component.html.haml
@@ -1,7 +1,7 @@
 -# TODO: add fork suggestion (commits only)
 
 %diff-file.rd-diff-file-component{ id: id, data: {  testid: 'rd-diff-file', file_data: file_data.to_json } }
-  .rd-diff-file{ data: { virtual: virtual? }, style: ("--total-rows: #{total_rows}" if virtual?) }
+  %article.rd-diff-file{ data: { virtual: virtual? }, style: ("--total-rows: #{total_rows}" if virtual?), aria: { labelledby: heading_id } }
     = header || default_header
     -# extra wrapper needed so content-visibility: hidden doesn't require removing border or other styles
     %div{ data: { file_body: '' } }
diff --git a/app/components/rapid_diffs/diff_file_component.rb b/app/components/rapid_diffs/diff_file_component.rb
index 19679cb1c33..72c4ee913df 100644
--- a/app/components/rapid_diffs/diff_file_component.rb
+++ b/app/components/rapid_diffs/diff_file_component.rb
@@ -3,6 +3,7 @@
 module RapidDiffs
   class DiffFileComponent < ViewComponent::Base
     include TreeHelper
+    include DiffHelper
 
     renders_one :header
 
@@ -59,5 +60,9 @@ module RapidDiffs
     def virtual?
       total_rows > 0
     end
+
+    def heading_id
+      file_heading_id(@diff_file)
+    end
   end
 end
diff --git a/app/components/rapid_diffs/diff_file_header_component.html.haml b/app/components/rapid_diffs/diff_file_header_component.html.haml
index 775c938a612..7b6c351e55b 100644
--- a/app/components/rapid_diffs/diff_file_header_component.html.haml
+++ b/app/components/rapid_diffs/diff_file_header_component.html.haml
@@ -11,7 +11,7 @@
 -#  * toggle file comments
 -#  * submodule compare
 
-.rd-diff-file-header{ data: { testid: 'rd-diff-file-header' } }
+%header.rd-diff-file-header{ data: { testid: 'rd-diff-file-header' }, aria: { label: root_label } }
   .rd-diff-file-toggle<
     = render Pajamas::ButtonComponent.new(category: :tertiary, size: :small, icon: 'chevron-down', button_options: { class: 'rd-diff-file-toggle-button', data: { opened: '', click: 'toggleFile' }, aria: { label: _('Hide file contents'), expanded: 'true' } })
     = render Pajamas::ButtonComponent.new(category: :tertiary, size: :small, icon: 'chevron-right', button_options: { class: 'rd-diff-file-toggle-button', data: { closed: '', click: 'toggleFile' }, aria: { label: _('Show file contents'), expanded: 'false' } })
@@ -19,19 +19,19 @@
     - if @diff_file.submodule?
       %span{ data: { testid: 'rd-diff-file-header-submodule' } }
         = helpers.sprite_icon('folder-git', file_icon: true)
-        %h2.rd-diff-file-title
+        %h2.rd-diff-file-title{ id: heading_id }
           = helpers.submodule_link(@diff_file.blob, @diff_file.content_sha, @diff_file.repository)
       = copy_path_button
     - else
       -# TODO: add icons for file types
       - if @diff_file.renamed_file?
         - old_path, new_path = helpers.mark_inline_diffs(@diff_file.old_path, @diff_file.new_path)
-        %h2.rd-diff-file-title{ aria: { label: moved_title_label } }
+        %h2.rd-diff-file-title{ id: heading_id, aria: { label: moved_title_label } }
           = old_path
           %span.rd-diff-file-moved →
           = new_path
       - else
-        %h2.rd-diff-file-title
+        %h2.rd-diff-file-title{ id: heading_id }
           = @diff_file.file_path
         - if @diff_file.deleted_file?
           = _("deleted")
diff --git a/app/components/rapid_diffs/diff_file_header_component.rb b/app/components/rapid_diffs/diff_file_header_component.rb
index e9c12b50d2b..c45ec1da5d7 100644
--- a/app/components/rapid_diffs/diff_file_header_component.rb
+++ b/app/components/rapid_diffs/diff_file_header_component.rb
@@ -3,6 +3,7 @@
 module RapidDiffs
   class DiffFileHeaderComponent < ViewComponent::Base
     include ButtonHelper
+    include DiffHelper
 
     def initialize(diff_file:, additional_menu_items: [])
       @diff_file = diff_file
@@ -38,6 +39,14 @@ module RapidDiffs
       [*base_items, *@additional_menu_items].sort_by { |item| item[:position] || Float::INFINITY }
     end
 
+    def heading_id
+      file_heading_id(@diff_file)
+    end
+
+    def root_label
+      s_('RapidDiffs|Diff file controls')
+    end
+
     def moved_title_label
       helpers.safe_format(
         s_('RapidDiffs|File moved from %{old} to %{new}'),
diff --git a/app/graphql/resolvers/concerns/issues/sort_arguments.rb b/app/graphql/resolvers/concerns/issues/sort_arguments.rb
index 525a070bc12..34fcebd5334 100644
--- a/app/graphql/resolvers/concerns/issues/sort_arguments.rb
+++ b/app/graphql/resolvers/concerns/issues/sort_arguments.rb
@@ -3,12 +3,7 @@
 module Issues
   module SortArguments
     extend ActiveSupport::Concern
-
-    NON_STABLE_CURSOR_SORTS = %i[priority_asc priority_desc
-      popularity_asc popularity_desc
-      label_priority_asc label_priority_desc
-      milestone_due_asc milestone_due_desc
-      escalation_status_asc escalation_status_desc].freeze
+    include ::WorkItems::NonStableCursorSortOptions
 
     included do
       argument :sort, Types::IssueSortEnum,
@@ -16,11 +11,5 @@ module Issues
         required: false,
         default_value: :created_desc
     end
-
-    private
-
-    def non_stable_cursor_sort?(sort)
-      NON_STABLE_CURSOR_SORTS.include?(sort)
-    end
   end
 end
diff --git a/app/graphql/resolvers/concerns/work_items/non_stable_cursor_sort_options.rb b/app/graphql/resolvers/concerns/work_items/non_stable_cursor_sort_options.rb
new file mode 100644
index 00000000000..d5234e4679f
--- /dev/null
+++ b/app/graphql/resolvers/concerns/work_items/non_stable_cursor_sort_options.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module WorkItems
+  module NonStableCursorSortOptions
+    extend ActiveSupport::Concern
+
+    NON_STABLE_CURSOR_SORTS = %i[priority_asc priority_desc
+      popularity_asc popularity_desc
+      label_priority_asc label_priority_desc
+      milestone_due_asc milestone_due_desc
+      escalation_status_asc escalation_status_desc].freeze
+
+    private
+
+    def non_stable_cursor_sort?(sort)
+      NON_STABLE_CURSOR_SORTS.include?(sort)
+    end
+  end
+end
diff --git a/app/graphql/resolvers/work_items_resolver.rb b/app/graphql/resolvers/work_items_resolver.rb
index 7cc7c49e836..5139b71dcb3 100644
--- a/app/graphql/resolvers/work_items_resolver.rb
+++ b/app/graphql/resolvers/work_items_resolver.rb
@@ -5,6 +5,7 @@ module Resolvers
     prepend ::WorkItems::LookAheadPreloads
     include SearchArguments
     include ::WorkItems::SharedFilterArguments
+    include ::WorkItems::NonStableCursorSortOptions
 
     argument :iid,
       GraphQL::Types::String,
@@ -23,9 +24,17 @@ module Resolvers
 
       finder = choose_finder(args)
 
-      Gitlab::Graphql::Loaders::IssuableLoader
+      items = Gitlab::Graphql::Loaders::IssuableLoader
         .new(resource_parent, finder)
         .batching_find_all { |q| apply_lookahead(q) }
+
+      if non_stable_cursor_sort?(args[:sort])
+        # Certain complex sorts are not supported by the stable cursor pagination yet.
+        # In these cases, we use offset pagination, so we return the correct connection.
+        offset_pagination(items)
+      else
+        items
+      end
     end
 
     private
diff --git a/app/helpers/diff_helper.rb b/app/helpers/diff_helper.rb
index d0979b75d2d..668e37a28ee 100644
--- a/app/helpers/diff_helper.rb
+++ b/app/helpers/diff_helper.rb
@@ -301,6 +301,10 @@ module DiffHelper
     hide_whitespace? ? safe_params.except(:w) : safe_params.merge(w: 1)
   end
 
+  def file_heading_id(diff_file)
+    "#{diff_file.file_hash}-heading"
+  end
+
   private
 
   def cached_conflicts_with_types
diff --git a/db/docs/batched_background_migrations/backfill_lists_sharding_key.yml b/db/docs/batched_background_migrations/backfill_lists_sharding_key.yml
index e4c2214cd98..8e4ddc049d1 100644
--- a/db/docs/batched_background_migrations/backfill_lists_sharding_key.yml
+++ b/db/docs/batched_background_migrations/backfill_lists_sharding_key.yml
@@ -5,4 +5,4 @@ feature_category: team_planning
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186991
 milestone: '17.11'
 queued_migration_version: 20250404130722
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250519141223
diff --git a/db/docs/lists.yml b/db/docs/lists.yml
index 659ba761011..d1953bdf797 100644
--- a/db/docs/lists.yml
+++ b/db/docs/lists.yml
@@ -7,6 +7,8 @@ feature_categories:
 description: Configuration of a single list on an issue board
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/611dab2e522e5e59cf09cd459a31686e65616863
 milestone: '8.11'
-gitlab_schema: gitlab_main
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/514597
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  group_id: namespaces
+  project_id: projects
 table_size: small
diff --git a/db/post_migrate/20250519141223_finalize_backfill_lists_sharding_key.rb b/db/post_migrate/20250519141223_finalize_backfill_lists_sharding_key.rb
new file mode 100644
index 00000000000..8dd87f1f5f1
--- /dev/null
+++ b/db/post_migrate/20250519141223_finalize_backfill_lists_sharding_key.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillListsShardingKey < Gitlab::Database::Migration[2.3]
+  MIGRATION = 'BackfillListsShardingKey'
+
+  disable_ddl_transaction!
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+  milestone '18.1'
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: MIGRATION,
+      table_name: :lists,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250519141731_validate_lists_parent_not_null_constraint.rb b/db/post_migrate/20250519141731_validate_lists_parent_not_null_constraint.rb
new file mode 100644
index 00000000000..b3e6a3b9a50
--- /dev/null
+++ b/db/post_migrate/20250519141731_validate_lists_parent_not_null_constraint.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ValidateListsParentNotNullConstraint < Gitlab::Database::Migration[2.3]
+  CONSTRAINT_NAME = 'check_6dadb82d36'
+
+  milestone '18.1'
+
+  def up
+    validate_multi_column_not_null_constraint :lists, :group_id, :project_id, constraint_name: CONSTRAINT_NAME
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250519142209_validate_lists_project_id_foreign_key.rb b/db/post_migrate/20250519142209_validate_lists_project_id_foreign_key.rb
new file mode 100644
index 00000000000..5f7fcfbefdf
--- /dev/null
+++ b/db/post_migrate/20250519142209_validate_lists_project_id_foreign_key.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ValidateListsProjectIdForeignKey < Gitlab::Database::Migration[2.3]
+  FK_NAME = 'fk_67f2498cc9'
+
+  milestone '18.1'
+
+  def up
+    validate_foreign_key :lists, :project_id, name: FK_NAME
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250519142438_validate_lists_group_id_foreign_key.rb b/db/post_migrate/20250519142438_validate_lists_group_id_foreign_key.rb
new file mode 100644
index 00000000000..7ddc8d421c6
--- /dev/null
+++ b/db/post_migrate/20250519142438_validate_lists_group_id_foreign_key.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ValidateListsGroupIdForeignKey < Gitlab::Database::Migration[2.3]
+  FK_NAME = 'fk_f8b2e8680c'
+
+  milestone '18.1'
+
+  def up
+    validate_foreign_key :lists, :group_id, name: FK_NAME
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250519142617_drop_lists_ensure_sharding_key_trigger.rb b/db/post_migrate/20250519142617_drop_lists_ensure_sharding_key_trigger.rb
new file mode 100644
index 00000000000..f52d5c87573
--- /dev/null
+++ b/db/post_migrate/20250519142617_drop_lists_ensure_sharding_key_trigger.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+class DropListsEnsureShardingKeyTrigger < Gitlab::Database::Migration[2.3]
+  include Gitlab::Database::SchemaHelpers
+
+  milestone '18.1'
+
+  LISTS_TABLE = 'lists'
+
+  TRIGGER_FUNCTION_NAME = 'ensure_lists_sharding_key'
+  TRIGGER_NAME = 'trigger_ensure_lists_sharding_key'
+
+  def up
+    drop_trigger(LISTS_TABLE, TRIGGER_NAME)
+    drop_function(TRIGGER_FUNCTION_NAME)
+  end
+
+  def down
+    create_trigger_function(TRIGGER_FUNCTION_NAME, replace: true) do
+      <<~SQL
+        IF NEW."project_id" IS NULL AND NEW."group_id" IS NULL THEN
+          SELECT "boards"."project_id", "boards"."group_id"
+          INTO NEW."project_id", NEW."group_id"
+          FROM "boards"
+          WHERE "boards"."id" = NEW."board_id";
+        END IF;
+        RETURN NEW;
+      SQL
+    end
+
+    create_trigger(
+      LISTS_TABLE, TRIGGER_NAME, TRIGGER_FUNCTION_NAME, fires: 'BEFORE INSERT OR UPDATE'
+    )
+  end
+end
diff --git a/db/schema_migrations/20250519141223 b/db/schema_migrations/20250519141223
new file mode 100644
index 00000000000..49f01d49824
--- /dev/null
+++ b/db/schema_migrations/20250519141223
@@ -0,0 +1 @@
+b631b97071ce6a20b3b51b7b2a3917bc1e22e6e768025896c695be125b401250
\ No newline at end of file
diff --git a/db/schema_migrations/20250519141731 b/db/schema_migrations/20250519141731
new file mode 100644
index 00000000000..3f5ee24a916
--- /dev/null
+++ b/db/schema_migrations/20250519141731
@@ -0,0 +1 @@
+5e65acab713ea3ce6032b8e444c83159186b36a8ee51bd64ed626381227eb3c7
\ No newline at end of file
diff --git a/db/schema_migrations/20250519142209 b/db/schema_migrations/20250519142209
new file mode 100644
index 00000000000..47e3954d86b
--- /dev/null
+++ b/db/schema_migrations/20250519142209
@@ -0,0 +1 @@
+ee521a41eb30252c23f8109c112a97826ed99d537f6eea01246290a0aaaa46b5
\ No newline at end of file
diff --git a/db/schema_migrations/20250519142438 b/db/schema_migrations/20250519142438
new file mode 100644
index 00000000000..33c9c202559
--- /dev/null
+++ b/db/schema_migrations/20250519142438
@@ -0,0 +1 @@
+765360a35cec817296e118c8bc1427f01a0ac9df81039a9b3e7af3fa4dc17c2c
\ No newline at end of file
diff --git a/db/schema_migrations/20250519142617 b/db/schema_migrations/20250519142617
new file mode 100644
index 00000000000..41d447e158f
--- /dev/null
+++ b/db/schema_migrations/20250519142617
@@ -0,0 +1 @@
+b93c25418e368f1db76cec0035e52a3b893de132f4b5a090db8cf8c0503ff13f
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 09cafced461..bb4f3278545 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -178,21 +178,6 @@ RETURN NULL;
 END
 $$;
 
-CREATE FUNCTION ensure_lists_sharding_key() RETURNS trigger
-    LANGUAGE plpgsql
-    AS $$
-BEGIN
-IF NEW."project_id" IS NULL AND NEW."group_id" IS NULL THEN
-  SELECT "boards"."project_id", "boards"."group_id"
-  INTO NEW."project_id", NEW."group_id"
-  FROM "boards"
-  WHERE "boards"."id" = NEW."board_id";
-END IF;
-RETURN NEW;
-
-END
-$$;
-
 CREATE TABLE namespaces (
     id bigint NOT NULL,
     name character varying NOT NULL,
@@ -16686,7 +16671,8 @@ CREATE TABLE lists (
     limit_metric character varying(20),
     iteration_id bigint,
     group_id bigint,
-    project_id bigint
+    project_id bigint,
+    CONSTRAINT check_6dadb82d36 CHECK ((num_nonnulls(group_id, project_id) = 1))
 );
 
 CREATE SEQUENCE lists_id_seq
@@ -29107,9 +29093,6 @@ ALTER TABLE ONLY instance_type_ci_runners
 ALTER TABLE ONLY project_type_ci_runners
     ADD CONSTRAINT check_619c71f3a2 UNIQUE (id);
 
-ALTER TABLE lists
-    ADD CONSTRAINT check_6dadb82d36 CHECK ((num_nonnulls(group_id, project_id) = 1)) NOT VALID;
-
 ALTER TABLE ONLY group_type_ci_runners
     ADD CONSTRAINT check_81b90172a6 UNIQUE (id);
 
@@ -41599,8 +41582,6 @@ CREATE TRIGGER trigger_efb9d354f05a BEFORE INSERT OR UPDATE ON incident_manageme
 
 CREATE TRIGGER trigger_eff80ead42ac BEFORE INSERT OR UPDATE ON ci_unit_test_failures FOR EACH ROW EXECUTE FUNCTION trigger_eff80ead42ac();
 
-CREATE TRIGGER trigger_ensure_lists_sharding_key BEFORE INSERT OR UPDATE ON lists FOR EACH ROW EXECUTE FUNCTION ensure_lists_sharding_key();
-
 CREATE TRIGGER trigger_f6c61cdddf31 BEFORE INSERT OR UPDATE ON ml_model_metadata FOR EACH ROW EXECUTE FUNCTION trigger_f6c61cdddf31();
 
 CREATE TRIGGER trigger_f6f59d8216b3 BEFORE INSERT OR UPDATE ON protected_environment_deploy_access_levels FOR EACH ROW EXECUTE FUNCTION trigger_f6f59d8216b3();
@@ -42595,7 +42576,7 @@ ALTER TABLE ONLY routes
     ADD CONSTRAINT fk_679ff8213d FOREIGN KEY (namespace_id) REFERENCES namespaces(id) ON DELETE CASCADE NOT VALID;
 
 ALTER TABLE ONLY lists
-    ADD CONSTRAINT fk_67f2498cc9 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE NOT VALID;
+    ADD CONSTRAINT fk_67f2498cc9 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY merge_requests_approval_rules_approver_groups
     ADD CONSTRAINT fk_67fa93ad4b FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
@@ -43870,7 +43851,7 @@ ALTER TABLE ONLY protected_tag_create_access_levels
     ADD CONSTRAINT fk_f7dfda8c51 FOREIGN KEY (protected_tag_id) REFERENCES protected_tags(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY lists
-    ADD CONSTRAINT fk_f8b2e8680c FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE NOT VALID;
+    ADD CONSTRAINT fk_f8b2e8680c FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY project_requirement_compliance_statuses
     ADD CONSTRAINT fk_f9109a4712 FOREIGN KEY (compliance_framework_id) REFERENCES compliance_management_frameworks(id) ON DELETE CASCADE;
diff --git a/doc/administration/instance_limits.md b/doc/administration/instance_limits.md
index 5ef4300cc71..932978060a6 100644
--- a/doc/administration/instance_limits.md
+++ b/doc/administration/instance_limits.md
@@ -560,14 +560,14 @@ Instead of increasing the limit, restructure your CI/CD configuration by splitti
 
 {{< /alert >}}
 
-To modify this limit on your instance, run the following command in the GitLab Rails console:
+To modify this limit on your instance use the GitLab UI in the [Admin area](settings/continuous_integration.md#set-cicd-limits) or the [Plan Limits API](../api/plan_limits.md).
+
+You can also run the following command in the GitLab Rails console:
 
 ```ruby
 Plan.default.actual_limits.update!(pipeline_hierarchy_size: 500)
 ```
 
-You can also set this limit by using the GitLab UI in the [Admin area](settings/continuous_integration.md#set-cicd-limits).
-
 This limit is enabled on GitLab.com and cannot be changed.
 
 ### Number of CI/CD subscriptions to a project
diff --git a/doc/administration/redis/_index.md b/doc/administration/redis/_index.md
index fadb7cf547f..101fb04116a 100644
--- a/doc/administration/redis/_index.md
+++ b/doc/administration/redis/_index.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Configuring Redis for scaling
 ---
diff --git a/doc/administration/redis/replication_and_failover.md b/doc/administration/redis/replication_and_failover.md
index 111a17f7c8b..934368ce39d 100644
--- a/doc/administration/redis/replication_and_failover.md
+++ b/doc/administration/redis/replication_and_failover.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Redis replication and failover with the Linux package
 ---
diff --git a/doc/administration/redis/replication_and_failover_external.md b/doc/administration/redis/replication_and_failover_external.md
index de7ac1e7869..17c4e25e187 100644
--- a/doc/administration/redis/replication_and_failover_external.md
+++ b/doc/administration/redis/replication_and_failover_external.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Redis replication and failover providing your own instance
 ---
diff --git a/doc/administration/redis/standalone.md b/doc/administration/redis/standalone.md
index 975e3c6384d..30ce24a7e5c 100644
--- a/doc/administration/redis/standalone.md
+++ b/doc/administration/redis/standalone.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Standalone Redis using the Linux package
 ---
diff --git a/doc/administration/redis/troubleshooting.md b/doc/administration/redis/troubleshooting.md
index 40b4106d5d9..86ffbaba1bf 100644
--- a/doc/administration/redis/troubleshooting.md
+++ b/doc/administration/redis/troubleshooting.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Troubleshooting Redis
 ---
diff --git a/doc/administration/sidekiq/_index.md b/doc/administration/sidekiq/_index.md
index b7b68c7b998..cbea52100d9 100644
--- a/doc/administration/sidekiq/_index.md
+++ b/doc/administration/sidekiq/_index.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Configure an external Sidekiq instance
 ---
diff --git a/doc/administration/sidekiq/extra_sidekiq_processes.md b/doc/administration/sidekiq/extra_sidekiq_processes.md
index bc09e34e77e..2550c1a388c 100644
--- a/doc/administration/sidekiq/extra_sidekiq_processes.md
+++ b/doc/administration/sidekiq/extra_sidekiq_processes.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Run multiple Sidekiq processes
 ---
diff --git a/doc/administration/sidekiq/processing_specific_job_classes.md b/doc/administration/sidekiq/processing_specific_job_classes.md
index 9f847838daf..a5444f0e6a8 100644
--- a/doc/administration/sidekiq/processing_specific_job_classes.md
+++ b/doc/administration/sidekiq/processing_specific_job_classes.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Processing specific job classes
 ---
diff --git a/doc/administration/sidekiq/sidekiq_health_check.md b/doc/administration/sidekiq/sidekiq_health_check.md
index 50174c60578..5a7d61583a2 100644
--- a/doc/administration/sidekiq/sidekiq_health_check.md
+++ b/doc/administration/sidekiq/sidekiq_health_check.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Sidekiq health check
 ---
diff --git a/doc/administration/sidekiq/sidekiq_memory_killer.md b/doc/administration/sidekiq/sidekiq_memory_killer.md
index 6c93b440953..50d3aa9a704 100644
--- a/doc/administration/sidekiq/sidekiq_memory_killer.md
+++ b/doc/administration/sidekiq/sidekiq_memory_killer.md
@@ -1,6 +1,6 @@
 ---
-stage: Systems
-group: Cloud Connector
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Reducing memory use
 ---
diff --git a/doc/administration/sidekiq/sidekiq_troubleshooting.md b/doc/administration/sidekiq/sidekiq_troubleshooting.md
index 67bbd00d813..7e2b67342ab 100644
--- a/doc/administration/sidekiq/sidekiq_troubleshooting.md
+++ b/doc/administration/sidekiq/sidekiq_troubleshooting.md
@@ -1,6 +1,6 @@
 ---
-stage: GitLab Delivery
-group: Self Managed
+stage: Data access
+group: Durability
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Troubleshooting Sidekiq
 ---
diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md
index b7120aeb7de..808cb8ffdf3 100644
--- a/doc/api/graphql/reference/_index.md
+++ b/doc/api/graphql/reference/_index.md
@@ -46623,8 +46623,8 @@ Values for sorting work items.
 
 | Value | Description |
 | ----- | ----------- |
-| <a id="workitemsortblocking_items_asc"></a>`BLOCKING_ITEMS_ASC` | Blocking items count by ascending order. |
-| <a id="workitemsortblocking_items_desc"></a>`BLOCKING_ITEMS_DESC` | Blocking items count by descending order. |
+| <a id="workitemsortblocking_issues_asc"></a>`BLOCKING_ISSUES_ASC` | Blocking items count by ascending order. |
+| <a id="workitemsortblocking_issues_desc"></a>`BLOCKING_ISSUES_DESC` | Blocking items count by descending order. |
 | <a id="workitemsortclosed_at_asc"></a>`CLOSED_AT_ASC` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.10. **Status**: Experiment. Closed time by ascending order. |
 | <a id="workitemsortclosed_at_desc"></a>`CLOSED_AT_DESC` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.10. **Status**: Experiment. Closed time by descending order. |
 | <a id="workitemsortcreated_asc"></a>`CREATED_ASC` | Created at ascending order. |
diff --git a/doc/api/plan_limits.md b/doc/api/plan_limits.md
index 225ab3564bc..18a2c991f6b 100644
--- a/doc/api/plan_limits.md
+++ b/doc/api/plan_limits.md
@@ -59,6 +59,7 @@ Example response:
   "maven_max_file_size": 3221225472,
   "npm_max_file_size": 524288000,
   "nuget_max_file_size": 524288000,
+  "pipeline_hierarchy_size": 1000,
   "pypi_max_file_size": 3221225472,
   "terraform_module_max_file_size": 1073741824,
   "storage_size_limit": 15000
@@ -94,6 +95,7 @@ PUT /application/plan_limits
 | `notification_limit`              | integer | no       | Maximum storage size for root namespace limit notifications in MiB. |
 | `npm_max_file_size`               | integer | no       | Maximum NPM package file size in bytes. |
 | `nuget_max_file_size`             | integer | no       | Maximum NuGet package file size in bytes. |
+| `pipeline_hierarchy_size`         | integer | no       | Maximum number of downstream pipelines in a pipeline's hierarchy tree. Default value: `1000`. Values greater than 1000 are [not recommended](../administration/instance_limits.md#limit-pipeline-hierarchy-size). |
 | `pypi_max_file_size`              | integer | no       | Maximum PyPI package file size in bytes. |
 | `terraform_module_max_file_size`  | integer | no       | Maximum Terraform Module package file size in bytes. |
 | `storage_size_limit`              | integer | no       | Maximum storage size for the root namespace in MiB. |
@@ -122,6 +124,7 @@ Example response:
   "maven_max_file_size": 3221225472,
   "npm_max_file_size": 524288000,
   "nuget_max_file_size": 524288000,
+  "pipeline_hierarchy_size": 1000,
   "pypi_max_file_size": 3221225472,
   "terraform_module_max_file_size": 1073741824
 }
diff --git a/doc/development/compromised_password_detection.md b/doc/development/compromised_password_detection.md
new file mode 100644
index 00000000000..72a50c2de12
--- /dev/null
+++ b/doc/development/compromised_password_detection.md
@@ -0,0 +1,20 @@
+---
+stage: Software Supply Chain Security
+group: Authentication
+info: Any user with at least the Maintainer role can merge updates to this content. For details, see https://docs.gitlab.com/ee/development/development_processes.html#development-guidelines-review.
+title: Compromised password detection development
+---
+
+For information on this feature that are not development-specific, see the [feature documentation](../security/compromised_password_detection.md).
+
+## CloudFlare
+
+The CloudFlare [leaked credentials detection](https://developers.cloudflare.com/waf/detections/leaked-credentials/) feature can detect when a request contains compromised credentials, and passes information to the application in the `Exposed-Credential-Check` header through a [managed transform](https://developers.cloudflare.com/rules/transform/managed-transforms/reference/#add-leaked-credentials-checks-header).
+
+GitLab team members can find the CloudFlare Terraform configuration in the GitLab.com infrastructure configuration management repository: `https://ops.gitlab.net/gitlab-com/gl-infra/config-mgmt`
+
+## Additional resources
+
+<!-- markdownlint-disable MD044 -->
+The [Authentication group](https://handbook.gitlab.com/handbook/engineering/development/sec/software-supply-chain-security/authentication/) owns the compromised password detection feature. GitLab team members can join their channel on Slack: [#g_sscs_authentication](https://gitlab.slack.com/archives/CLM1D8QR0).
+<!-- markdownlint-enable MD044 -->
diff --git a/doc/security/compromised_password_detection.md b/doc/security/compromised_password_detection.md
new file mode 100644
index 00000000000..f65eccd82e6
--- /dev/null
+++ b/doc/security/compromised_password_detection.md
@@ -0,0 +1,25 @@
+---
+stage: Software Supply Chain Security
+group: Authentication
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+title: Compromised password detection
+---
+
+{{< details >}}
+
+- Tier: Free, Premium, Ultimate
+- Offering: GitLab.com
+
+{{< /details >}}
+
+{{< history >}}
+
+- [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/188723) in GitLab 18.0 [with a flag](../administration/feature_flags.md) named `notify_compromised_passwords`. Disabled by default.
+
+{{< /history >}}
+
+GitLab can notify you if your GitLab.com credentials are compromised as part of a data breach on another service or platform. GitLab credentials are encrypted and GitLab itself does not have direct access to them.
+
+When a compromised credential is detected, GitLab displays a security banner and sends an email alert that includes instructions on how to change your password and strengthen your account security.
+
+Compromised password detection is unavailable when authenticating [with an external provider](../administration/auth/_index.md), or if your account is already [locked](unlock_user.md).
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 023bd026ab7..e4828d0de5b 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -50090,6 +50090,15 @@ msgstr[1] ""
 msgid "RapidDiffs|Added line %d"
 msgstr ""
 
+msgid "RapidDiffs|Changes view"
+msgstr ""
+
+msgid "RapidDiffs|Diff file controls"
+msgstr ""
+
+msgid "RapidDiffs|Diff files"
+msgstr ""
+
 msgid "RapidDiffs|Diff line"
 msgstr ""
 
@@ -50131,6 +50140,9 @@ msgstr ""
 msgid "RapidDiffs|Show options"
 msgstr ""
 
+msgid "RapidDiffs|View controls"
+msgstr ""
+
 msgid "Rate Limits"
 msgstr ""
 
@@ -52545,6 +52557,9 @@ msgstr ""
 msgid "Runners|Operating systems"
 msgstr ""
 
+msgid "Runners|Optional configuration details"
+msgstr ""
+
 msgid "Runners|Other projects"
 msgstr ""
 
@@ -55549,6 +55564,9 @@ msgstr ""
 msgid "SecurityOrchestration|Project cannot be deleted because it is linked as a security policy project"
 msgstr ""
 
+msgid "SecurityOrchestration|Reason for snoozing policy (optional)"
+msgstr ""
+
 msgid "SecurityOrchestration|Require %{approvals} %{plural} from %{approvers}"
 msgstr ""
 
@@ -55657,6 +55675,9 @@ msgstr ""
 msgid "SecurityOrchestration|Select a variable"
 msgstr ""
 
+msgid "SecurityOrchestration|Select date"
+msgstr ""
+
 msgid "SecurityOrchestration|Select days"
 msgstr ""
 
@@ -55705,6 +55726,12 @@ msgstr ""
 msgid "SecurityOrchestration|Show only linked security policy projects"
 msgstr ""
 
+msgid "SecurityOrchestration|Snooze policy"
+msgstr ""
+
+msgid "SecurityOrchestration|Snooze the policy until %{until} because %{reason}"
+msgstr ""
+
 msgid "SecurityOrchestration|Some settings may be affected by policy %{policyName} based on its rules."
 msgstr ""
 
diff --git a/package.json b/package.json
index da41c3d6031..cf5b7afae18 100644
--- a/package.json
+++ b/package.json
@@ -131,7 +131,7 @@
     "canvas-confetti": "^1.4.0",
     "clipboard": "^2.0.8",
     "colord": "^2.9.3",
-    "commander": "^13.1.0",
+    "commander": "^14.0.0",
     "compression-webpack-plugin": "^5.0.2",
     "copy-webpack-plugin": "^6.4.1",
     "core-js": "^3.41.0",
diff --git a/qa/Gemfile b/qa/Gemfile
index 54ee8c182ee..22772fe25a0 100644
--- a/qa/Gemfile
+++ b/qa/Gemfile
@@ -23,7 +23,7 @@ gem 'rainbow', '~> 3.1.1'
 gem 'rspec-parameterized', '~> 1.0.2'
 gem 'octokit', '~> 9.2.0', require: false
 gem "faraday-retry", "~> 2.3", ">= 2.3.1"
-gem 'zeitwerk', '~> 2.7', '>= 2.7.2'
+gem 'zeitwerk', '~> 2.7', '>= 2.7.3'
 gem 'influxdb-client', '~> 3.2'
 gem 'terminal-table', '~> 4.0.0', require: false
 gem 'slack-notifier', '~> 2.4', require: false
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index b94de42ff39..1aefa91b053 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -363,7 +363,7 @@ GEM
     wisper (2.0.1)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.7.2)
+    zeitwerk (2.7.3)
 
 PLATFORMS
   ruby
@@ -404,7 +404,7 @@ DEPENDENCIES
   slack-notifier (~> 2.4)
   terminal-table (~> 4.0.0)
   warning (~> 1.5)
-  zeitwerk (~> 2.7, >= 2.7.2)
+  zeitwerk (~> 2.7, >= 2.7.3)
 
 BUNDLED WITH
    2.6.5
diff --git a/spec/frontend/ci/runner/components/runner_create_wizard_optional_fields_spec.js b/spec/frontend/ci/runner/components/runner_create_wizard_optional_fields_spec.js
new file mode 100644
index 00000000000..66a5f231233
--- /dev/null
+++ b/spec/frontend/ci/runner/components/runner_create_wizard_optional_fields_spec.js
@@ -0,0 +1,50 @@
+import MultiStepFormTemplate from '~/vue_shared/components/multi_step_form_template.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import RunnerCreateWizardOptionalFields from '~/ci/runner/components/runner_create_wizard_optional_fields.vue';
+
+describe('Create Runner Optional Fields', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(RunnerCreateWizardOptionalFields, {
+      propsData: {
+        currentStep: 2,
+        stepsTotal: 3,
+      },
+    });
+  };
+
+  beforeEach(() => {
+    createComponent();
+  });
+
+  const findMultiStepFormTemplate = () => wrapper.findComponent(MultiStepFormTemplate);
+  const findNextButton = () => wrapper.findByTestId('next-button');
+  const findBackButton = () => wrapper.findByTestId('back-button');
+
+  describe('form', () => {
+    it('passes the correct props to MultiStepFormTemplate', () => {
+      expect(findMultiStepFormTemplate().props()).toMatchObject({
+        title: 'Optional configuration details',
+        currentStep: 2,
+        stepsTotal: 3,
+      });
+    });
+  });
+
+  it('renders the Next step button', () => {
+    expect(findNextButton().text()).toBe('Next step');
+    expect(findNextButton().props('disabled')).toBe(true);
+  });
+
+  describe('back button', () => {
+    it('renders the Go back button', () => {
+      expect(findBackButton().text()).toBe('Go back');
+    });
+
+    it(`emits the "back" event when the back button is clicked`, () => {
+      findBackButton().vm.$emit('click');
+      expect(wrapper.emitted('back')).toHaveLength(1);
+    });
+  });
+});
diff --git a/spec/frontend/ci/runner/components/runner_create_wizard_required_fields_spec.js b/spec/frontend/ci/runner/components/runner_create_wizard_required_fields_spec.js
index 43498eba2db..481c282696e 100644
--- a/spec/frontend/ci/runner/components/runner_create_wizard_required_fields_spec.js
+++ b/spec/frontend/ci/runner/components/runner_create_wizard_required_fields_spec.js
@@ -12,6 +12,8 @@ describe('Create Runner Required Fields', () => {
       propsData: {
         currentStep: 1,
         stepsTotal: 3,
+        isRunUntagged: false,
+        tagList: '',
       },
       stubs: {
         GlFormInput,
diff --git a/spec/helpers/diff_helper_spec.rb b/spec/helpers/diff_helper_spec.rb
index 5d00318afc0..5565d99b166 100644
--- a/spec/helpers/diff_helper_spec.rb
+++ b/spec/helpers/diff_helper_spec.rb
@@ -858,4 +858,10 @@ RSpec.describe DiffHelper, feature_category: :code_review_workflow do
       end
     end
   end
+
+  describe "#file_heading_id" do
+    subject { helper.file_heading_id(diff_file) }
+
+    it { is_expected.to eq("#{diff_file.file_hash}-heading") }
+  end
 end
diff --git a/spec/requests/api/graphql/project/work_items_spec.rb b/spec/requests/api/graphql/project/work_items_spec.rb
index fe24485c51b..84a0183340e 100644
--- a/spec/requests/api/graphql/project/work_items_spec.rb
+++ b/spec/requests/api/graphql/project/work_items_spec.rb
@@ -7,11 +7,14 @@ RSpec.describe 'getting a work item list for a project', feature_category: :team
 
   let_it_be(:label1) { create(:label, project: project) }
   let_it_be(:label2) { create(:label, project: project) }
-  let_it_be(:milestone1) { create(:milestone, project: project) }
-  let_it_be(:milestone2) { create(:milestone, project: project) }
+  let_it_be(:milestone1) { create(:milestone, project: project, due_date: 5.days.ago) }
+  let_it_be(:milestone2) { create(:milestone, project: project, due_date: 3.days.from_now) }
 
   let_it_be_with_reload(:item1) do
-    create(:work_item, project: project, discussion_locked: true, title: 'item1', labels: [label1])
+    create(
+      :work_item, project: project, discussion_locked: true,
+      title: 'item1', milestone: milestone2, labels: [label1]
+    )
   end
 
   let_it_be_with_reload(:item2) do
@@ -376,6 +379,14 @@ RSpec.describe 'getting a work item list for a project', feature_category: :team
         let(:all_records) { [confidential_item, item2, item1].map { |item| item.to_global_id.to_s } }
       end
     end
+
+    context 'when sorting by MILESTONE_DUE_ASC' do
+      it_behaves_like 'sorted paginated query' do
+        let(:sort_param) { :MILESTONE_DUE_ASC }
+        let(:first_param) { 2 }
+        let(:all_records) { [item2, item1, confidential_item].map { |item| item.to_global_id.to_s } }
+      end
+    end
   end
 
   context 'when fetching work item notifications widget' do
diff --git a/spec/services/boards/lists/list_service_spec.rb b/spec/services/boards/lists/list_service_spec.rb
index 40ef4b64603..1b8ae63b9ac 100644
--- a/spec/services/boards/lists/list_service_spec.rb
+++ b/spec/services/boards/lists/list_service_spec.rb
@@ -13,6 +13,7 @@ RSpec.describe Boards::Lists::ListService, feature_category: :portfolio_manageme
       let_it_be(:milestone) { create(:milestone, group: group) }
       let_it_be(:assignee_list) do
         list = build(:list, board: board, user_id: user.id, list_type: List.list_types[:assignee], position: 0)
+        list.send(:ensure_group_or_project) # Necessary as this is called on a before_validation callback
         list.save!(validate: false)
         list
       end
@@ -20,6 +21,7 @@ RSpec.describe Boards::Lists::ListService, feature_category: :portfolio_manageme
       let_it_be(:milestone_list) do
         list = build(:list, board: board, milestone_id: milestone.id, list_type: List.list_types[:milestone],
           position: 1)
+        list.send(:ensure_group_or_project) # Necessary as this is called on a before_validation callback
         list.save!(validate: false)
         list
       end
diff --git a/yarn.lock b/yarn.lock
index cb828e6896e..158dae98fc7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5452,6 +5452,11 @@ commander@^13.1.0:
   resolved "https://registry.yarnpkg.com/commander/-/commander-13.1.0.tgz#776167db68c78f38dcce1f9b8d7b8b9a488abf46"
   integrity sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==
 
+commander@^14.0.0:
+  version "14.0.0"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-14.0.0.tgz#f244fc74a92343514e56229f16ef5c5e22ced5e9"
+  integrity sha512-2uM9rYjPvyq39NwLRqaiLtWHyDC1FvryJDa2ATTVims5YAS4PupsEQsDvP14FqhFr0P49CYDugi59xaxJlTXRA==
+
 commander@^4.0.0:
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/commander/-/commander-4.1.1.tgz#9fd602bd936294e9e9ef46a3f4d6964044b18068"