From 3bb92fbffddccedec5f03b4ea31c025ef745c345 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 27 Jul 2020 21:09:16 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../boards/components/board_new_issue.vue     |   2 +-
 .../boards/components/modal/tabs.vue          |   2 +-
 .../boards/components/project_select.vue      |   2 +-
 .../clusters/components/application_row.vue   |   2 +-
 .../clusters/components/applications.vue      |   2 +-
 .../commit/pipelines/pipelines_table.vue      |   2 +-
 .../diffs/components/diff_line_note_form.vue  |   2 +-
 .../components/environments_table.vue         |   2 +-
 .../commit_sidebar/list_collapsed.vue         |   2 +-
 .../jobs/components/artifacts_block.vue       |   2 +-
 .../releases/components/app_edit_new.vue      |   2 +-
 .../javascripts/reports/components/modal.vue  |   2 +-
 .../viewers/download_viewer.vue               |   2 +-
 app/assets/stylesheets/framework/common.scss  |   1 -
 app/graphql/mutations/issues/update.rb        |   6 +
 app/models/packages/package_file.rb           |   2 +-
 .../_account_and_limit.html.haml              |   2 +-
 app/views/admin/groups/show.html.haml         |   2 +-
 app/views/admin/health_check/show.html.haml   |   2 +-
 .../ci/runner/_how_to_setup_runner.html.haml  |   2 +-
 .../groups/settings/_pages_settings.html.haml |   2 +-
 app/views/projects/branches/_panel.html.haml  |   2 +-
 app/views/projects/ci/lints/show.html.haml    |   4 +-
 .../_service_desk_info_content.html.haml      |   4 +-
 app/views/projects/labels/index.html.haml     |   4 +-
 .../projects/mirrors/_ssh_host_keys.html.haml |   2 +-
 .../projects/pages/_pages_settings.html.haml  |   2 +-
 .../pipeline_schedules/_form.html.haml        |   2 +-
 app/views/projects/pipelines/new.html.haml    |   2 +-
 .../settings/ci_cd/_autodevops_form.html.haml |   2 +-
 app/views/projects/starrers/index.html.haml   |   2 +-
 app/views/search/_results.html.haml           |   2 +-
 app/views/shared/_group_form.html.haml        |   2 +-
 app/views/shared/issuable/_form.html.haml     |   2 +-
 ...flare-cert-docs-from-gitlab-pages-docs.yml |   5 +
 changelogs/unreleased/36319-follow-up.yml     |   5 +
 .../dblessing-external-auth-gitlab-http.yml   |   5 +
 ...-email-unconfirmed-message-in-git-auth.yml |   5 +
 .../graphql/reference/gitlab_schema.graphql   |  41 ++++++
 doc/api/graphql/reference/gitlab_schema.json  | 139 ++++++++++++++++++
 doc/api/graphql/reference/index.md            |  10 ++
 doc/ci/large_repositories/index.md            |  12 ++
 doc/development/documentation/styleguide.md   |   1 +
 doc/user/clusters/applications.md             |   8 +-
 .../index.md                                  |  13 +-
 doc/user/project/pages/index.md               |   1 -
 lib/gitlab/auth/user_access_denied_reason.rb  |   6 +
 lib/gitlab/external_authorization/client.rb   |  11 +-
 lib/gitlab/external_authorization/response.rb |  10 +-
 locale/gitlab.pot                             |  15 ++
 package.json                                  |   2 +-
 spec/graphql/mutations/issues/update_spec.rb  |  13 +-
 .../auth/user_access_denied_reason_spec.rb    |   8 +
 .../external_authorization/client_spec.rb     |  24 ++-
 .../external_authorization/response_spec.rb   |  20 +--
 .../graphql/mutations/issues/update_spec.rb   |  41 ++++++
 yarn.lock                                     |   8 +-
 57 files changed, 399 insertions(+), 81 deletions(-)
 create mode 100644 changelogs/unreleased/231584-remove-link-to-cloudflare-cert-docs-from-gitlab-pages-docs.yml
 create mode 100644 changelogs/unreleased/36319-follow-up.yml
 create mode 100644 changelogs/unreleased/dblessing-external-auth-gitlab-http.yml
 create mode 100644 changelogs/unreleased/show-email-unconfirmed-message-in-git-auth.yml
 create mode 100644 spec/requests/api/graphql/mutations/issues/update_spec.rb

diff --git a/app/assets/javascripts/boards/components/board_new_issue.vue b/app/assets/javascripts/boards/components/board_new_issue.vue
index 02ac45f8ef9..34e8438ba4c 100644
--- a/app/assets/javascripts/boards/components/board_new_issue.vue
+++ b/app/assets/javascripts/boards/components/board_new_issue.vue
@@ -119,7 +119,7 @@ export default {
           autocomplete="off"
         />
         <project-select v-if="groupId" :group-id="groupId" :list="list" />
-        <div class="clearfix prepend-top-10">
+        <div class="clearfix gl-mt-3">
           <gl-button
             ref="submit-button"
             :disabled="disabled"
diff --git a/app/assets/javascripts/boards/components/modal/tabs.vue b/app/assets/javascripts/boards/components/modal/tabs.vue
index 3f4a944cfce..a71fda9d7c5 100644
--- a/app/assets/javascripts/boards/components/modal/tabs.vue
+++ b/app/assets/javascripts/boards/components/modal/tabs.vue
@@ -19,7 +19,7 @@ export default {
 };
 </script>
 <template>
-  <div class="top-area prepend-top-10 gl-mb-3">
+  <div class="top-area gl-mt-3 gl-mb-3">
     <ul class="nav-links issues-state-filters">
       <li :class="{ active: activeTab == 'all' }">
         <a href="#" role="button" @click.prevent="changeTab('all')">
diff --git a/app/assets/javascripts/boards/components/project_select.vue b/app/assets/javascripts/boards/components/project_select.vue
index 8fd377938b4..ef081f0f470 100644
--- a/app/assets/javascripts/boards/components/project_select.vue
+++ b/app/assets/javascripts/boards/components/project_select.vue
@@ -97,7 +97,7 @@ export default {
 
 <template>
   <div>
-    <label class="label-bold prepend-top-10">{{ __('Project') }}</label>
+    <label class="label-bold gl-mt-3">{{ __('Project') }}</label>
     <div ref="projectsDropdown" class="dropdown dropdown-projects">
       <button
         class="dropdown-menu-toggle wide"
diff --git a/app/assets/javascripts/clusters/components/application_row.vue b/app/assets/javascripts/clusters/components/application_row.vue
index ba6de41e025..5006301c6be 100644
--- a/app/assets/javascripts/clusters/components/application_row.vue
+++ b/app/assets/javascripts/clusters/components/application_row.vue
@@ -335,7 +335,7 @@ export default {
         <div>
           <slot name="description"></slot>
         </div>
-        <div v-if="hasError" class="cluster-application-error text-danger prepend-top-10">
+        <div v-if="hasError" class="cluster-application-error text-danger gl-mt-3">
           <p class="js-cluster-application-general-error-message gl-mb-0">
             {{ generalErrorDescription }}
           </p>
diff --git a/app/assets/javascripts/clusters/components/applications.vue b/app/assets/javascripts/clusters/components/applications.vue
index 214906021ad..6e3db2f6297 100644
--- a/app/assets/javascripts/clusters/components/applications.vue
+++ b/app/assets/javascripts/clusters/components/applications.vue
@@ -181,7 +181,7 @@ export default {
       <gl-link :href="helpPath">{{ __('More information') }}</gl-link>
     </p>
 
-    <div class="cluster-application-list prepend-top-10">
+    <div class="cluster-application-list gl-mt-3">
       <application-row
         v-if="!managedAppsLocalTillerEnabled"
         id="helm"
diff --git a/app/assets/javascripts/commit/pipelines/pipelines_table.vue b/app/assets/javascripts/commit/pipelines/pipelines_table.vue
index 0d80343831f..1526d994770 100644
--- a/app/assets/javascripts/commit/pipelines/pipelines_table.vue
+++ b/app/assets/javascripts/commit/pipelines/pipelines_table.vue
@@ -208,7 +208,7 @@ export default {
       <div v-if="canRenderPipelineButton" class="nav justify-content-end">
         <gl-button
           variant="success"
-          class="js-run-mr-pipeline prepend-top-10 btn-wide-on-xs"
+          class="js-run-mr-pipeline gl-mt-3 btn-wide-on-xs"
           :disabled="state.isRunningMergeRequestPipeline"
           @click="tryRunPipeline"
         >
diff --git a/app/assets/javascripts/diffs/components/diff_line_note_form.vue b/app/assets/javascripts/diffs/components/diff_line_note_form.vue
index d2f49bd0020..4989f4f3497 100644
--- a/app/assets/javascripts/diffs/components/diff_line_note_form.vue
+++ b/app/assets/javascripts/diffs/components/diff_line_note_form.vue
@@ -172,7 +172,7 @@ export default {
       :diff-file="diffFile"
       :show-suggest-popover="showSuggestPopover"
       save-button-title="Comment"
-      class="diff-comment-form prepend-top-10"
+      class="diff-comment-form gl-mt-3"
       @handleFormUpdateAddToReview="addToReview"
       @cancelForm="handleCancelCommentForm"
       @handleFormUpdate="handleSaveNote"
diff --git a/app/assets/javascripts/environments/components/environments_table.vue b/app/assets/javascripts/environments/components/environments_table.vue
index ab1818e61fa..1bf705dcda2 100644
--- a/app/assets/javascripts/environments/components/environments_table.vue
+++ b/app/assets/javascripts/environments/components/environments_table.vue
@@ -202,7 +202,7 @@ export default {
           />
 
           <div :key="`sub-div-${i}`">
-            <div class="text-center prepend-top-10">
+            <div class="text-center gl-mt-3">
               <a :href="folderUrl(model)" class="btn btn-default">
                 {{ s__('Environments|Show all') }}
               </a>
diff --git a/app/assets/javascripts/ide/components/commit_sidebar/list_collapsed.vue b/app/assets/javascripts/ide/components/commit_sidebar/list_collapsed.vue
index e758cc7b132..1b257ca11cc 100644
--- a/app/assets/javascripts/ide/components/commit_sidebar/list_collapsed.vue
+++ b/app/assets/javascripts/ide/components/commit_sidebar/list_collapsed.vue
@@ -94,7 +94,7 @@ export default {
       :title="modifiedTooltip"
       data-container="body"
       data-placement="left"
-      class="prepend-top-10 gl-mb-3"
+      class="gl-mt-3 gl-mb-3"
     >
       <icon :name="modifiedIconName" :size="18" :class="modifiedFilesClass" />
     </div>
diff --git a/app/assets/javascripts/jobs/components/artifacts_block.vue b/app/assets/javascripts/jobs/components/artifacts_block.vue
index b2f9bf2a348..6183779acd4 100644
--- a/app/assets/javascripts/jobs/components/artifacts_block.vue
+++ b/app/assets/javascripts/jobs/components/artifacts_block.vue
@@ -48,7 +48,7 @@ export default {
         )
       }}</span>
     </p>
-    <div class="btn-group d-flex prepend-top-10" role="group">
+    <div class="btn-group d-flex gl-mt-3" role="group">
       <gl-link
         v-if="artifact.keep_path"
         :href="artifact.keep_path"
diff --git a/app/assets/javascripts/releases/components/app_edit_new.vue b/app/assets/javascripts/releases/components/app_edit_new.vue
index 2985602cec3..fd3491a9c62 100644
--- a/app/assets/javascripts/releases/components/app_edit_new.vue
+++ b/app/assets/javascripts/releases/components/app_edit_new.vue
@@ -182,7 +182,7 @@ export default {
             :markdown-preview-path="markdownPreviewPath"
             :markdown-docs-path="markdownDocsPath"
             :add-spacing-classes="false"
-            class="prepend-top-10 gl-mb-3"
+            class="gl-mt-3 gl-mb-3"
           >
             <template #textarea>
               <textarea
diff --git a/app/assets/javascripts/reports/components/modal.vue b/app/assets/javascripts/reports/components/modal.vue
index 99c1c8f9af0..ca95db6c826 100644
--- a/app/assets/javascripts/reports/components/modal.vue
+++ b/app/assets/javascripts/reports/components/modal.vue
@@ -33,7 +33,7 @@ export default {
         v-for="(field, key, index) in modalData"
         v-if="field.value"
         :key="index"
-        class="row prepend-top-10 gl-mb-3"
+        class="row gl-mt-3 gl-mb-3"
       >
         <strong class="col-sm-3 text-right"> {{ field.text }}: </strong>
 
diff --git a/app/assets/javascripts/vue_shared/components/content_viewer/viewers/download_viewer.vue b/app/assets/javascripts/vue_shared/components/content_viewer/viewers/download_viewer.vue
index 47231c4ad39..3bf629d4acb 100644
--- a/app/assets/javascripts/vue_shared/components/content_viewer/viewers/download_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/content_viewer/viewers/download_viewer.vue
@@ -39,7 +39,7 @@ export default {
 <template>
   <div class="file-container">
     <div class="file-content">
-      <p class="prepend-top-10 file-info">
+      <p class="gl-mt-3 file-info">
         {{ fileName }}
         <template v-if="fileSize > 0">
           ({{ fileSizeReadable }})
diff --git a/app/assets/stylesheets/framework/common.scss b/app/assets/stylesheets/framework/common.scss
index ac3080f305d..f92db122209 100644
--- a/app/assets/stylesheets/framework/common.scss
+++ b/app/assets/stylesheets/framework/common.scss
@@ -396,7 +396,6 @@ img.emoji {
   🚨 Do not use these classes — they are deprecated and being removed. 🚨
   See https://gitlab.com/gitlab-org/gitlab/-/issues/217418 for more details.
 **/
-.prepend-top-10 { margin-top: 10px; }
 .prepend-top-15 { margin-top: 15px; }
 .prepend-top-20 { margin-top: 20px; }
 .prepend-left-15 { margin-left: 15px; }
diff --git a/app/graphql/mutations/issues/update.rb b/app/graphql/mutations/issues/update.rb
index 7f6d9b0f988..b99a9070466 100644
--- a/app/graphql/mutations/issues/update.rb
+++ b/app/graphql/mutations/issues/update.rb
@@ -25,6 +25,12 @@ module Mutations
                required: false,
                description: copy_field_description(Types::IssueType, :confidential)
 
+      argument :locked,
+               GraphQL::BOOLEAN_TYPE,
+               as: :discussion_locked,
+               required: false,
+               description: copy_field_description(Types::IssueType, :discussion_locked)
+
       def resolve(project_path:, iid:, **args)
         issue = authorized_find!(project_path: project_path, iid: iid)
         project = issue.project
diff --git a/app/models/packages/package_file.rb b/app/models/packages/package_file.rb
index 24933a3a42b..4ada9bc0b01 100644
--- a/app/models/packages/package_file.rb
+++ b/app/models/packages/package_file.rb
@@ -60,4 +60,4 @@ class Packages::PackageFile < ApplicationRecord
   end
 end
 
-Packages::PackageFile.prepend_if_ee('EE::Packages::PackageFileGeo')
+Packages::PackageFile.prepend_if_ee('EE::Packages::PackageFile')
diff --git a/app/views/admin/application_settings/_account_and_limit.html.haml b/app/views/admin/application_settings/_account_and_limit.html.haml
index 65a2f1d42e1..7305f2b0302 100644
--- a/app/views/admin/application_settings/_account_and_limit.html.haml
+++ b/app/views/admin/application_settings/_account_and_limit.html.haml
@@ -52,7 +52,7 @@
         = f.check_box :user_default_external, class: 'form-check-input'
         = f.label :user_default_external, class: 'form-check-label' do
           = _('Newly registered users will by default be external')
-      .prepend-top-10
+      .gl-mt-3
         = _('Internal users')
       = f.text_field :user_default_internal_regex, placeholder: _('Regex pattern'), class: 'form-control gl-mt-2'
       .help-block
diff --git a/app/views/admin/groups/show.html.haml b/app/views/admin/groups/show.html.haml
index cc480b2ba9e..6dd73698848 100644
--- a/app/views/admin/groups/show.html.haml
+++ b/app/views/admin/groups/show.html.haml
@@ -112,7 +112,7 @@
           = form_tag admin_group_members_update_path(@group), id: "new_project_member", class: "bulk_import", method: :put do
             %div
               = users_select_tag(:user_ids, multiple: true, email_user: true, skip_ldap: @group.ldap_synced?, scope: :all)
-            .prepend-top-10
+            .gl-mt-3
               = select_tag :access_level, options_for_select(GroupMember.access_level_roles), class: "project-access-select select2"
             %hr
             = button_tag _('Add users to group'), class: "btn btn-success"
diff --git a/app/views/admin/health_check/show.html.haml b/app/views/admin/health_check/show.html.haml
index 587bfba8d47..fbe37f6c509 100644
--- a/app/views/admin/health_check/show.html.haml
+++ b/app/views/admin/health_check/show.html.haml
@@ -7,7 +7,7 @@
     %p
   #{ s_('HealthCheck|Access token is') }
   %code#health-check-token= Gitlab::CurrentSettings.health_check_access_token
-  .prepend-top-10
+  .gl-mt-3
     = button_to _("Reset health check access token"), reset_health_check_token_admin_application_settings_path,
       method: :put, class: 'btn btn-default',
       data: { confirm: _('Are you sure you want to reset the health check token?') }
diff --git a/app/views/ci/runner/_how_to_setup_runner.html.haml b/app/views/ci/runner/_how_to_setup_runner.html.haml
index 6efe284da08..6c2bd2a5d2f 100644
--- a/app/views/ci/runner/_how_to_setup_runner.html.haml
+++ b/app/views/ci/runner/_how_to_setup_runner.html.haml
@@ -13,7 +13,7 @@
     = _("Use the following registration token during setup:")
     %code#registration_token= registration_token
     = clipboard_button(target: '#registration_token', title: _("Copy token"), class: "btn-transparent btn-clipboard")
-    .prepend-top-10.gl-mb-3
+    .gl-mt-3.gl-mb-3
       = button_to _("Reset runners registration token"), reset_token_url,
       method: :put, class: 'btn btn-default',
       data: { confirm: _("Are you sure you want to reset registration token?") }
diff --git a/app/views/groups/settings/_pages_settings.html.haml b/app/views/groups/settings/_pages_settings.html.haml
index 9e1932185da..b6cf05d96ab 100644
--- a/app/views/groups/settings/_pages_settings.html.haml
+++ b/app/views/groups/settings/_pages_settings.html.haml
@@ -1,5 +1,5 @@
 = form_for @group, html: { multipart: true, class: 'gl-show-field-errors' }, authenticity_token: true do |f|
   = render_if_exists 'shared/pages/max_pages_size_input', form: f
 
-  .prepend-top-10
+  .gl-mt-3
     = f.submit s_('GitLabPages|Save'), class: 'btn btn-success'
diff --git a/app/views/projects/branches/_panel.html.haml b/app/views/projects/branches/_panel.html.haml
index 828371e9656..f03b5cf2eff 100644
--- a/app/views/projects/branches/_panel.html.haml
+++ b/app/views/projects/branches/_panel.html.haml
@@ -7,7 +7,7 @@
 
 - return unless branches.any?
 
-.card.prepend-top-10
+.card.gl-mt-3
   .card-header
     = panel_title
   %ul.content-list.all-branches.qa-all-branches
diff --git a/app/views/projects/ci/lints/show.html.haml b/app/views/projects/ci/lints/show.html.haml
index 7b87664961e..33d9cd62aaf 100644
--- a/app/views/projects/ci/lints/show.html.haml
+++ b/app/views/projects/ci/lints/show.html.haml
@@ -15,9 +15,9 @@
           #ci-editor.ci-editor= @content
         = text_area_tag(:content, @content, class: 'hidden form-control span1', rows: 7, require: true)
       .col-sm-12
-        .float-left.prepend-top-10
+        .float-left.gl-mt-3
           = submit_tag(_('Validate'), class: 'btn btn-success submit-yml')
-        .float-right.prepend-top-10
+        .float-right.gl-mt-3
           = button_tag(_('Clear'), type: 'button', class: 'btn btn-default clear-yml')
 
   .row.prepend-top-20
diff --git a/app/views/projects/issues/_service_desk_info_content.html.haml b/app/views/projects/issues/_service_desk_info_content.html.haml
index ddd8e545043..7eff0277e83 100644
--- a/app/views/projects/issues/_service_desk_info_content.html.haml
+++ b/app/views/projects/issues/_service_desk_info_content.html.haml
@@ -11,7 +11,7 @@
     .svg-content
       = render svg_path
 
-    %div{ class: is_empty_state ? "text-content" : "prepend-top-10 gl-ml-3" }
+    %div{ class: is_empty_state ? "text-content" : "gl-mt-3 gl-ml-3" }
       - if is_empty_state
         %h4= title_text
       - else
@@ -26,7 +26,7 @@
       = link_to _('Read more'), help_page_path('user/project/service_desk')
 
       - if can_edit_project_settings && !service_desk_enabled
-        %div{ class: is_empty_state ? "text-center" : "prepend-top-10" }
+        %div{ class: is_empty_state ? "text-center" : "gl-mt-3" }
           = link_to _("Turn on Service Desk"), edit_project_path(@project), class: 'btn btn-success'
 - else
   .empty-state
diff --git a/app/views/projects/labels/index.html.haml b/app/views/projects/labels/index.html.haml
index ba47712211d..8d8270847a3 100644
--- a/app/views/projects/labels/index.html.haml
+++ b/app/views/projects/labels/index.html.haml
@@ -8,7 +8,7 @@
   #promote-label-modal
   = render 'shared/labels/nav', labels_or_filters: labels_or_filters, can_admin_label: can_admin_label
 
-  .labels-container.prepend-top-10
+  .labels-container.gl-mt-3
     - if can_admin_label && search.blank?
       %p.text-muted
         = _('Labels can be applied to issues and merge requests.')
@@ -18,7 +18,7 @@
     -# Only show it in the first page
     - hide = @available_labels.empty? || (params[:page].present? && params[:page] != '1')
     .prioritized-labels{ class: [('hide' if hide), ('is-not-draggable' unless can_admin_label)] }
-      %h5.prepend-top-10= _('Prioritized Labels')
+      %h5.gl-mt-3= _('Prioritized Labels')
       .content-list.manage-labels-list.js-prioritized-labels{ data: { url: set_priorities_project_labels_path(@project), sortable: can_admin_label } }
         #js-priority-labels-empty-state.priority-labels-empty-state{ class: "#{'hidden' unless @prioritized_labels.empty? && search.blank?}" }
           = render 'shared/empty_states/priority_labels'
diff --git a/app/views/projects/mirrors/_ssh_host_keys.html.haml b/app/views/projects/mirrors/_ssh_host_keys.html.haml
index 7d4c7a182c9..786918c4970 100644
--- a/app/views/projects/mirrors/_ssh_host_keys.html.haml
+++ b/app/views/projects/mirrors/_ssh_host_keys.html.haml
@@ -6,7 +6,7 @@
   %button.btn.btn-inverted.btn-secondary.inline.js-detect-host-keys.gl-mr-3{ type: 'button', data: { qa_selector: 'detect_host_keys' } }
     .js-spinner.d-none.spinner.mr-1
     = _('Detect host keys')
-  .fingerprint-ssh-info.js-fingerprint-ssh-info.prepend-top-10.gl-mb-3{ class: ('collapse' unless mirror.ssh_mirror_url?) }
+  .fingerprint-ssh-info.js-fingerprint-ssh-info.gl-mt-3.gl-mb-3{ class: ('collapse' unless mirror.ssh_mirror_url?) }
     %label.label-bold
       = _('Fingerprints')
     .fingerprints-list.js-fingerprints-list{ data: { qa_selector: 'fingerprints_list' } }
diff --git a/app/views/projects/pages/_pages_settings.html.haml b/app/views/projects/pages/_pages_settings.html.haml
index 0049ce1b873..8aa02074205 100644
--- a/app/views/projects/pages/_pages_settings.html.haml
+++ b/app/views/projects/pages/_pages_settings.html.haml
@@ -9,5 +9,5 @@
           %strong
             = s_('GitLabPages|Force HTTPS (requires valid certificates)')
 
-    .prepend-top-10
+    .gl-mt-3
       = f.submit s_('GitLabPages|Save'), class: 'btn btn-success'
diff --git a/app/views/projects/pipeline_schedules/_form.html.haml b/app/views/projects/pipeline_schedules/_form.html.haml
index dd2955f564f..1a8229350d9 100644
--- a/app/views/projects/pipeline_schedules/_form.html.haml
+++ b/app/views/projects/pipeline_schedules/_form.html.haml
@@ -27,7 +27,7 @@
           = render 'ci/variables/variable_row', form_field: 'schedule', variable: variable, only_key_value: true
         = render 'ci/variables/variable_row', form_field: 'schedule', only_key_value: true
       - if @schedule.variables.size > 0
-        %button.btn.btn-info.btn-inverted.prepend-top-10.js-secret-value-reveal-button{ type: 'button', data: { secret_reveal_status: "#{@schedule.variables.size == 0}" } }
+        %button.btn.btn-info.btn-inverted.gl-mt-3.js-secret-value-reveal-button{ type: 'button', data: { secret_reveal_status: "#{@schedule.variables.size == 0}" } }
           - if @schedule.variables.size == 0
             = n_('Hide value', 'Hide values', @schedule.variables.size)
           - else
diff --git a/app/views/projects/pipelines/new.html.haml b/app/views/projects/pipelines/new.html.haml
index 02a6f3b0b29..0b1393f7392 100644
--- a/app/views/projects/pipelines/new.html.haml
+++ b/app/views/projects/pipelines/new.html.haml
@@ -23,7 +23,7 @@
         .form-text.text-muted
           = s_("Pipeline|Existing branch name or tag")
 
-      .col-sm-12.prepend-top-10.js-ci-variable-list-section
+      .col-sm-12.gl-mt-3.js-ci-variable-list-section
         %label
           = s_('Pipeline|Variables')
         %ul.ci-variable-list
diff --git a/app/views/projects/settings/ci_cd/_autodevops_form.html.haml b/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
index 7284b4bb55d..2786621352f 100644
--- a/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
+++ b/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
@@ -34,7 +34,7 @@
                 - elsif !has_base_domain
                   %p.settings-message.text-center
                     = s_('CICD|You must add a %{base_domain_link_start}base domain%{link_end} to your %{kubernetes_cluster_link_start}Kubernetes cluster%{link_end} in order for your deployment strategy to work.').html_safe % { base_domain_link_start: base_domain_link_start, kubernetes_cluster_link_start: kubernetes_cluster_link_start, link_end: link_end }
-                %label.prepend-top-10
+                %label.gl-mt-3
                   %strong= s_('CICD|Deployment strategy')
                 .form-check
                   = form.radio_button :deploy_strategy, 'continuous', class: 'form-check-input'
diff --git a/app/views/projects/starrers/index.html.haml b/app/views/projects/starrers/index.html.haml
index e55ed99f643..97996562e2c 100644
--- a/app/views/projects/starrers/index.html.haml
+++ b/app/views/projects/starrers/index.html.haml
@@ -22,7 +22,7 @@
                   = link_to filter_starrer_path(sort: value), class: ("is-active" if @sort == value) do
                     = title
 - if @starrers.size > 0
-  .row.prepend-top-10
+  .row.gl-mt-3
     = render partial: 'starrer', collection: @starrers, as: :starrer
   = paginate @starrers, theme: 'gitlab'
 - else
diff --git a/app/views/search/_results.html.haml b/app/views/search/_results.html.haml
index 1f995ffe482..79f01c61833 100644
--- a/app/views/search/_results.html.haml
+++ b/app/views/search/_results.html.haml
@@ -22,7 +22,7 @@
         = _("in group %{link_to_group}").html_safe % { link_to_group: link_to_group }
   = render_if_exists 'shared/promotions/promote_advanced_search'
 
-  .results.prepend-top-10
+  .results.gl-mt-3
     - if @scope == 'commits'
       %ul.content-list.commit-list
         = render partial: "search/results/commit", collection: @search_objects
diff --git a/app/views/shared/_group_form.html.haml b/app/views/shared/_group_form.html.haml
index 09b9cd448bb..eb4ca76acb3 100644
--- a/app/views/shared/_group_form.html.haml
+++ b/app/views/shared/_group_form.html.haml
@@ -34,7 +34,7 @@
     %p.validation-pending.gl-field-error-ignore.field-validation.hide= _('Checking group path availability...')
 
     - if @group.persisted?
-      .alert.alert-warning.prepend-top-10
+      .alert.alert-warning.gl-mt-3
         = _('Changing group path can have unintended side effects.')
         = succeed '.' do
           = link_to _('Learn more'), help_page_path('user/group/index', anchor: 'changing-a-groups-path'), target: '_blank'
diff --git a/app/views/shared/issuable/_form.html.haml b/app/views/shared/issuable/_form.html.haml
index 083b4759dc4..2e66ed318a0 100644
--- a/app/views/shared/issuable/_form.html.haml
+++ b/app/views/shared/issuable/_form.html.haml
@@ -76,7 +76,7 @@
       = form.submit 'Save changes', class: 'btn btn-success'
 
   - if !issuable.persisted? && !issuable.project.empty_repo? && (guide_url = issuable.project.present.contribution_guide_path)
-    .inline.prepend-top-10
+    .inline.gl-mt-3
       Please review the
       %strong= link_to('contribution guidelines', guide_url)
       for this project.
diff --git a/changelogs/unreleased/231584-remove-link-to-cloudflare-cert-docs-from-gitlab-pages-docs.yml b/changelogs/unreleased/231584-remove-link-to-cloudflare-cert-docs-from-gitlab-pages-docs.yml
new file mode 100644
index 00000000000..9aff1efdb0f
--- /dev/null
+++ b/changelogs/unreleased/231584-remove-link-to-cloudflare-cert-docs-from-gitlab-pages-docs.yml
@@ -0,0 +1,5 @@
+---
+title: Remove link to Cloudflare cert for Pages
+merge_request: 37876
+author: Takuya Noguchi
+type: other
diff --git a/changelogs/unreleased/36319-follow-up.yml b/changelogs/unreleased/36319-follow-up.yml
new file mode 100644
index 00000000000..615d316ca10
--- /dev/null
+++ b/changelogs/unreleased/36319-follow-up.yml
@@ -0,0 +1,5 @@
+---
+title: Add locked as an argument to updateIssue
+merge_request: 37105
+author:
+type: added
diff --git a/changelogs/unreleased/dblessing-external-auth-gitlab-http.yml b/changelogs/unreleased/dblessing-external-auth-gitlab-http.yml
new file mode 100644
index 00000000000..b132b2a6c3b
--- /dev/null
+++ b/changelogs/unreleased/dblessing-external-auth-gitlab-http.yml
@@ -0,0 +1,5 @@
+---
+title: External auth adheres to local request setting
+merge_request: 37622
+author:
+type: changed
diff --git a/changelogs/unreleased/show-email-unconfirmed-message-in-git-auth.yml b/changelogs/unreleased/show-email-unconfirmed-message-in-git-auth.yml
new file mode 100644
index 00000000000..a6f4ed725e7
--- /dev/null
+++ b/changelogs/unreleased/show-email-unconfirmed-message-in-git-auth.yml
@@ -0,0 +1,5 @@
+---
+title: Provide better git error message when the user is unconfirmed
+merge_request: 37944
+author:
+type: fixed
diff --git a/doc/api/graphql/reference/gitlab_schema.graphql b/doc/api/graphql/reference/gitlab_schema.graphql
index e3fb9ae48a9..cd0f32b728d 100644
--- a/doc/api/graphql/reference/gitlab_schema.graphql
+++ b/doc/api/graphql/reference/gitlab_schema.graphql
@@ -8311,6 +8311,7 @@ type Mutation {
   Update attributes of a merge request
   """
   mergeRequestUpdate(input: MergeRequestUpdateInput!): MergeRequestUpdatePayload
+  namespaceIncreaseStorageTemporarily(input: NamespaceIncreaseStorageTemporarilyInput!): NamespaceIncreaseStorageTemporarilyPayload
   removeAwardEmoji(input: RemoveAwardEmojiInput!): RemoveAwardEmojiPayload @deprecated(reason: "Use awardEmojiRemove. Deprecated in 13.2")
   removeProjectFromSecurityDashboard(input: RemoveProjectFromSecurityDashboardInput!): RemoveProjectFromSecurityDashboardPayload
   runDastScan(input: RunDASTScanInput!): RunDASTScanPayload
@@ -8503,6 +8504,41 @@ type NamespaceEdge {
   node: Namespace
 }
 
+"""
+Autogenerated input type of NamespaceIncreaseStorageTemporarily
+"""
+input NamespaceIncreaseStorageTemporarilyInput {
+  """
+  A unique identifier for the client performing the mutation.
+  """
+  clientMutationId: String
+
+  """
+  The global id of the namespace to mutate
+  """
+  id: ID!
+}
+
+"""
+Autogenerated return type of NamespaceIncreaseStorageTemporarily
+"""
+type NamespaceIncreaseStorageTemporarilyPayload {
+  """
+  A unique identifier for the client performing the mutation.
+  """
+  clientMutationId: String
+
+  """
+  Errors encountered during execution of the mutation.
+  """
+  errors: [String!]!
+
+  """
+  The namespace after mutation
+  """
+  namespace: Namespace
+}
+
 type Note implements ResolvableInterface {
   """
   User who wrote this note
@@ -14122,6 +14158,11 @@ input UpdateIssueInput {
   """
   iid: String!
 
+  """
+  Indicates discussion is locked on the issue
+  """
+  locked: Boolean
+
   """
   The project the issue to mutate is in
   """
diff --git a/doc/api/graphql/reference/gitlab_schema.json b/doc/api/graphql/reference/gitlab_schema.json
index 9c2e04e34c0..b5fff06982d 100644
--- a/doc/api/graphql/reference/gitlab_schema.json
+++ b/doc/api/graphql/reference/gitlab_schema.json
@@ -24468,6 +24468,33 @@
               "isDeprecated": false,
               "deprecationReason": null
             },
+            {
+              "name": "namespaceIncreaseStorageTemporarily",
+              "description": null,
+              "args": [
+                {
+                  "name": "input",
+                  "description": null,
+                  "type": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "INPUT_OBJECT",
+                      "name": "NamespaceIncreaseStorageTemporarilyInput",
+                      "ofType": null
+                    }
+                  },
+                  "defaultValue": null
+                }
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "NamespaceIncreaseStorageTemporarilyPayload",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
             {
               "name": "removeAwardEmoji",
               "description": null,
@@ -25386,6 +25413,108 @@
           "enumValues": null,
           "possibleTypes": null
         },
+        {
+          "kind": "INPUT_OBJECT",
+          "name": "NamespaceIncreaseStorageTemporarilyInput",
+          "description": "Autogenerated input type of NamespaceIncreaseStorageTemporarily",
+          "fields": null,
+          "inputFields": [
+            {
+              "name": "id",
+              "description": "The global id of the namespace to mutate",
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "ID",
+                  "ofType": null
+                }
+              },
+              "defaultValue": null
+            },
+            {
+              "name": "clientMutationId",
+              "description": "A unique identifier for the client performing the mutation.",
+              "type": {
+                "kind": "SCALAR",
+                "name": "String",
+                "ofType": null
+              },
+              "defaultValue": null
+            }
+          ],
+          "interfaces": null,
+          "enumValues": null,
+          "possibleTypes": null
+        },
+        {
+          "kind": "OBJECT",
+          "name": "NamespaceIncreaseStorageTemporarilyPayload",
+          "description": "Autogenerated return type of NamespaceIncreaseStorageTemporarily",
+          "fields": [
+            {
+              "name": "clientMutationId",
+              "description": "A unique identifier for the client performing the mutation.",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "SCALAR",
+                "name": "String",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "errors",
+              "description": "Errors encountered during execution of the mutation.",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "LIST",
+                  "name": null,
+                  "ofType": {
+                    "kind": "NON_NULL",
+                    "name": null,
+                    "ofType": {
+                      "kind": "SCALAR",
+                      "name": "String",
+                      "ofType": null
+                    }
+                  }
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "namespace",
+              "description": "The namespace after mutation",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "Namespace",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [
+
+          ],
+          "enumValues": null,
+          "possibleTypes": null
+        },
         {
           "kind": "OBJECT",
           "name": "Note",
@@ -41716,6 +41845,16 @@
               },
               "defaultValue": null
             },
+            {
+              "name": "locked",
+              "description": "Indicates discussion is locked on the issue",
+              "type": {
+                "kind": "SCALAR",
+                "name": "Boolean",
+                "ofType": null
+              },
+              "defaultValue": null
+            },
             {
               "name": "healthStatus",
               "description": "The desired health status",
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index e15d0fea8ca..708c2c578e9 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1302,6 +1302,16 @@ Contains statistics about a milestone
 | `temporaryStorageIncreaseEndsOn` | Time | Date until the temporary storage increase is active |
 | `visibility` | String | Visibility of the namespace |
 
+## NamespaceIncreaseStorageTemporarilyPayload
+
+Autogenerated return type of NamespaceIncreaseStorageTemporarily
+
+| Name  | Type  | Description |
+| ---   |  ---- | ----------  |
+| `clientMutationId` | String | A unique identifier for the client performing the mutation. |
+| `errors` | String! => Array | Errors encountered during execution of the mutation. |
+| `namespace` | Namespace | The namespace after mutation |
+
 ## Note
 
 | Name  | Type  | Description |
diff --git a/doc/ci/large_repositories/index.md b/doc/ci/large_repositories/index.md
index b4652050654..00e912d47dc 100644
--- a/doc/ci/large_repositories/index.md
+++ b/doc/ci/large_repositories/index.md
@@ -124,6 +124,10 @@ are dependent on Git version.
 [`GIT_FETCH_EXTRA_FLAGS`](../yaml/README.md#git-fetch-extra-flags) allows you
 to modify `git fetch` behavior by passing extra flags.
 
+For example, if your project contains a large number of tags that your CI jobs don't rely on,
+you could add [`--no-tags`](https://git-scm.com/docs/git-fetch#Documentation/git-fetch.txt---no-tags)
+to the extra flags to make your fetches faster and more compact.
+
 See the [`GIT_FETCH_EXTRA_FLAGS` documentation](../yaml/README.md#git-fetch-extra-flags)
 for more information.
 
@@ -253,3 +257,11 @@ concurrent = 4
 
 This makes the cloning configuration to be part of given Runner
 and does not require us to update each `.gitlab-ci.yml`.
+
+## Pre-clone step
+
+For very active repositories with a large number of references and files, you can also
+optimize your CI jobs by seeding repository data with GitLab Runner's [`pre_clone_script`](https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runners-section).
+
+See [our development documentation](../../development/pipelines.md#pre-clone-step) for
+an overview of how we implemented this approach on GitLab.com for the main GitLab repository.
diff --git a/doc/development/documentation/styleguide.md b/doc/development/documentation/styleguide.md
index 02fe53a7b56..8ca038562a0 100644
--- a/doc/development/documentation/styleguide.md
+++ b/doc/development/documentation/styleguide.md
@@ -431,6 +431,7 @@ tenses, words, and phrases:
 
 Check the general punctuation rules for the GitLab documentation on the table below.
 Check specific punctuation rules for [lists](#lists) below.
+Additional examples are available in the [Pajamas guide for punctuation](https://design.gitlab.com/content/punctuation/).
 
 | Rule | Example |
 | ---- | ------- |
diff --git a/doc/user/clusters/applications.md b/doc/user/clusters/applications.md
index d2e0d88490d..ba62cbc4e21 100644
--- a/doc/user/clusters/applications.md
+++ b/doc/user/clusters/applications.md
@@ -547,7 +547,7 @@ file.
 
 NOTE: **Note:**
 The chart deploys 3 identical Elasticsearch pods which can't be colocated, and each
-require 1 CPU and 2 GB of RAM, making them incompatible with clusters containing
+requires 1 CPU and 2 GB of RAM, making them incompatible with clusters containing
 fewer than 3 nodes or consisting of `f1-micro`, `g1-small`, `n1-standard-1`, or
 `*-highcpu-2` instance types.
 
@@ -1184,7 +1184,7 @@ below are examples and should be replaced with settings specific to your environ
 ui:
   enabled: true
 server:
-  # Disable the built in data storage volume as it's not safe for Hight Availability mode
+  # Disable the built in data storage volume as it's not safe for High Availability mode
   dataStorage:
     enabled: false
   # Enable High Availability Mode
@@ -1213,7 +1213,7 @@ server:
 
 Once you have successfully installed Vault, you will need to [initialize the Vault](https://learn.hashicorp.com/vault/getting-started/deploy#initializing-the-vault)
 and obtain the initial root token. You will need access to your Kubernetes cluster that Vault has been deployed into in order to do this.
-To initialise the Vault, get a shell to one of the Vault pods running inside Kubernetes (typically this is done by using the `kubectl` command line tool).
+To initialize the Vault, get a shell to one of the Vault pods running inside Kubernetes (typically this is done by using the `kubectl` command line tool).
 Once you have a shell into the pod, run the `vault operator init` command:
 
 ```shell
@@ -1588,7 +1588,7 @@ To avoid installation errors:
 If you're using a managed cluster on AWS EKS, and you are not able to install some of the managed
 apps, consider checking the logs.
 
-You can check the logs by running following commands:
+You can check the logs by running the following commands:
 
 ```shell
 kubectl get pods --all-namespaces
diff --git a/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md b/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
index e5ec530f11f..8e8f75be82d 100644
--- a/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
+++ b/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
@@ -1,5 +1,5 @@
 ---
-last_updated: 2019-07-04
+last_updated: 2020-07-25
 type: reference, howto
 disqus_identifier: 'https://docs.gitlab.com/ee/user/project/pages/getting_started_part_three.html'
 stage: Release
@@ -129,7 +129,7 @@ They require:
 | ------------------------------------------------- | ---------- | ---------------------- |
 | `example.com`                                     | A          | `35.185.44.232`        |
 | `_gitlab-pages-verification-code.example.com`     | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
-|--------------------------------------------+--------------------------------------------|
+|---------------------------------------------------+------------+------------------------|
 | `www.example.com`                                 | CNAME      | `namespace.gitlab.io`  |
 | `_gitlab-pages-verification-code.www.example.com` | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
@@ -236,7 +236,9 @@ To secure your custom domain with GitLab Pages you can opt by:
 - Manually adding SSL/TLS certificates to GitLab Pages websites
   by following the steps below.
 
-### Requirements
+### Manual addition of SSL/TLS certificates
+
+You can use any certificate satisfying the following requirements:
 
 - A GitLab Pages website up and running accessible via a custom domain.
 - **A PEM certificate**: it is the certificate generated by the CA,
@@ -250,7 +252,10 @@ To secure your custom domain with GitLab Pages you can opt by:
 - **A private key**, it's an encrypted key which validates
   your PEM against your domain.
 
-### Steps
+NOTE: **Note:**
+[Cloudflare certificates](https://about.gitlab.com/blog/2017/02/07/setting-up-gitlab-pages-with-cloudflare-certificates/), for example, meet these requirements.
+
+#### Steps
 
 - To add the certificate at the time you add a new domain, go to your
   project's **Settings > Pages > New Domain**, add the domain name and the certificate.
diff --git a/doc/user/project/pages/index.md b/doc/user/project/pages/index.md
index d22c9a6a6b6..eff80a4c9bd 100644
--- a/doc/user/project/pages/index.md
+++ b/doc/user/project/pages/index.md
@@ -59,7 +59,6 @@ To update a GitLab Pages website:
 | [Explore GitLab Pages](introduction.md) | Requirements, technical aspects, specific GitLab CI/CD configuration options, Access Control, custom 404 pages, limitations, FAQ. |
 | [Custom domains and SSL/TLS Certificates](custom_domains_ssl_tls_certification/index.md) | Custom domains and subdomains, DNS records, and SSL/TLS certificates. |
 | [Let's Encrypt integration](custom_domains_ssl_tls_certification/lets_encrypt_integration.md) | Secure your Pages sites with Let's Encrypt certificates, which are automatically obtained and renewed by GitLab. |
-| [Cloudflare certificates](https://about.gitlab.com/blog/2017/02/07/setting-up-gitlab-pages-with-cloudflare-certificates/) | Secure your Pages site with Cloudflare certificates. |
 
 Learn more and see examples:
 
diff --git a/lib/gitlab/auth/user_access_denied_reason.rb b/lib/gitlab/auth/user_access_denied_reason.rb
index e73f6ca808c..cc4b8d887ff 100644
--- a/lib/gitlab/auth/user_access_denied_reason.rb
+++ b/lib/gitlab/auth/user_access_denied_reason.rb
@@ -17,6 +17,10 @@ module Gitlab
         when :deactivated
           "Your account has been deactivated by your administrator. "\
           "Please log back in from a web browser to reactivate your account at #{Gitlab.config.gitlab.url}"
+        when :unconfirmed
+          "Your primary email address is not confirmed. "\
+          "Please check your inbox for the confirmation instructions. "\
+          "In case the link is expired, you can request a new confirmation email at #{Rails.application.routes.url_helpers.new_user_confirmation_url}"
         else
           "Your account has been blocked."
         end
@@ -31,6 +35,8 @@ module Gitlab
           :terms_not_accepted
         elsif @user.deactivated?
           :deactivated
+        elsif !@user.confirmed?
+          :unconfirmed
         else
           :blocked
         end
diff --git a/lib/gitlab/external_authorization/client.rb b/lib/gitlab/external_authorization/client.rb
index 7985e6dcf7b..fc859304eab 100644
--- a/lib/gitlab/external_authorization/client.rb
+++ b/lib/gitlab/external_authorization/client.rb
@@ -17,23 +17,28 @@ module Gitlab
       end
 
       def request_access
-        response = Excon.post(
+        response = Gitlab::HTTP.post(
           service_url,
           post_params
         )
         ::Gitlab::ExternalAuthorization::Response.new(response)
-      rescue Excon::Error => e
+      rescue *Gitlab::HTTP::HTTP_ERRORS => e
         raise ::Gitlab::ExternalAuthorization::RequestFailed.new(e)
       end
 
       private
 
+      def allow_local_requests?
+        Gitlab::CurrentSettings.allow_local_requests_from_system_hooks?
+      end
+
       def post_params
         params = { headers: REQUEST_HEADERS,
                    body: body.to_json,
                    connect_timeout: timeout,
                    read_timeout: timeout,
-                   write_timeout: timeout }
+                   write_timeout: timeout,
+                   allow_local_requests: allow_local_requests? }
 
         if has_tls?
           params[:client_cert_data] = client_cert
diff --git a/lib/gitlab/external_authorization/response.rb b/lib/gitlab/external_authorization/response.rb
index 04f9688fad0..8656065303d 100644
--- a/lib/gitlab/external_authorization/response.rb
+++ b/lib/gitlab/external_authorization/response.rb
@@ -5,16 +5,16 @@ module Gitlab
     class Response
       include ::Gitlab::Utils::StrongMemoize
 
-      def initialize(excon_response)
-        @excon_response = excon_response
+      def initialize(response)
+        @response = response
       end
 
       def valid?
-        @excon_response && [200, 401, 403].include?(@excon_response.status)
+        @response && [200, 401, 403].include?(@response.code)
       end
 
       def successful?
-        valid? && @excon_response.status == 200
+        valid? && @response.code == 200
       end
 
       def reason
@@ -28,7 +28,7 @@ module Gitlab
       end
 
       def parse_response!
-        Gitlab::Json.parse(@excon_response.body)
+        Gitlab::Json.parse(@response.body)
       rescue JSON::JSONError
         # The JSON response is optional, so don't fail when it's missing
         nil
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index fb84eeab17b..9a552cad295 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -14672,6 +14672,9 @@ msgstr ""
 msgid "Merge Request"
 msgstr ""
 
+msgid "Merge Request Analytics"
+msgstr ""
+
 msgid "Merge Request Approvals"
 msgstr ""
 
@@ -16388,6 +16391,9 @@ msgstr ""
 msgid "OnDemandScans|Could not run the scan. Please try again."
 msgstr ""
 
+msgid "OnDemandScans|Could not run the scan: %{backendErrorMessage}"
+msgstr ""
+
 msgid "OnDemandScans|Create new DAST scan"
 msgstr ""
 
@@ -23368,6 +23374,12 @@ msgstr ""
 msgid "Templates"
 msgstr ""
 
+msgid "TemporaryStorageIncrease|can only be set once"
+msgstr ""
+
+msgid "TemporaryStorageIncrease|can only be set with more than %{percentage}%% usage"
+msgstr ""
+
 msgid "TemporaryStorage|GitLab allows you a %{strongStart}free, one-time storage increase%{strongEnd}. For 30 days your storage will be unlimited. This gives you time to reduce your storage usage. After 30 days, your original storage limit of %{limit} applies. If you are at maximum storage capacity, your account will be read-only. To continue using GitLab you'll have to purchase additional storage or decrease storage usage."
 msgstr ""
 
@@ -28826,6 +28838,9 @@ msgstr ""
 msgid "mrWidget|to start a merge train when the pipeline succeeds"
 msgstr ""
 
+msgid "must be a root namespace"
+msgstr ""
+
 msgid "must be greater than start date"
 msgstr ""
 
diff --git a/package.json b/package.json
index 99fec1c2dd6..93f02e81d05 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "@babel/plugin-syntax-import-meta": "^7.10.1",
     "@babel/preset-env": "^7.10.1",
     "@gitlab/at.js": "1.5.5",
-    "@gitlab/svgs": "1.153.0",
+    "@gitlab/svgs": "1.154.0",
     "@gitlab/ui": "17.37.0",
     "@gitlab/visual-review-tools": "1.6.1",
     "@rails/actioncable": "^6.0.3-1",
diff --git a/spec/graphql/mutations/issues/update_spec.rb b/spec/graphql/mutations/issues/update_spec.rb
index 9a847476e2e..4d3ee79d0b0 100644
--- a/spec/graphql/mutations/issues/update_spec.rb
+++ b/spec/graphql/mutations/issues/update_spec.rb
@@ -3,14 +3,15 @@
 require 'spec_helper'
 
 RSpec.describe Mutations::Issues::Update do
-  let(:issue) { create(:issue) }
-  let(:user) { create(:user) }
+  let_it_be(:issue) { create(:issue) }
+  let_it_be(:user) { create(:user) }
   let(:expected_attributes) do
     {
       title: 'new title',
       description: 'new description',
       confidential: true,
-      due_date: Date.tomorrow
+      due_date: Date.tomorrow,
+      discussion_locked: true
     }
   end
   let(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
@@ -28,8 +29,10 @@ RSpec.describe Mutations::Issues::Update do
 
     subject { mutation.resolve(mutation_params) }
 
-    it 'raises an error if the resource is not accessible to the user' do
-      expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+    context 'when the user cannot access the issue' do
+      it 'raises an error' do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+      end
     end
 
     context 'when the user can update the issue' do
diff --git a/spec/lib/gitlab/auth/user_access_denied_reason_spec.rb b/spec/lib/gitlab/auth/user_access_denied_reason_spec.rb
index a2a0eb5428a..5cbd22827c9 100644
--- a/spec/lib/gitlab/auth/user_access_denied_reason_spec.rb
+++ b/spec/lib/gitlab/auth/user_access_denied_reason_spec.rb
@@ -41,5 +41,13 @@ RSpec.describe Gitlab::Auth::UserAccessDeniedReason do
 
       it { is_expected.to eq "Your account has been deactivated by your administrator. Please log back in from a web browser to reactivate your account at #{Gitlab.config.gitlab.url}" }
     end
+
+    context 'when the user is unconfirmed' do
+      before do
+        user.update!(confirmed_at: nil)
+      end
+
+      it { is_expected.to match /Your primary email address is not confirmed/ }
+    end
   end
 end
diff --git a/spec/lib/gitlab/external_authorization/client_spec.rb b/spec/lib/gitlab/external_authorization/client_spec.rb
index 473b57441fa..c08da382486 100644
--- a/spec/lib/gitlab/external_authorization/client_spec.rb
+++ b/spec/lib/gitlab/external_authorization/client_spec.rb
@@ -14,7 +14,7 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
 
   describe '#request_access' do
     it 'performs requests to the configured endpoint' do
-      expect(Excon).to receive(:post).with(dummy_url, any_args)
+      expect(Gitlab::HTTP).to receive(:post).with(dummy_url, any_args)
 
       client.request_access
     end
@@ -25,7 +25,7 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
         project_classification_label: 'dummy_label',
         identities: []
       }.to_json
-      expect(Excon).to receive(:post)
+      expect(Gitlab::HTTP).to receive(:post)
                          .with(dummy_url, hash_including(body: expected_body))
 
       client.request_access
@@ -36,7 +36,7 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
         external_authorization_service_timeout: 3
       )
 
-      expect(Excon).to receive(:post).with(dummy_url,
+      expect(Gitlab::HTTP).to receive(:post).with(dummy_url,
                                            hash_including(
                                              connect_timeout: 3,
                                              read_timeout: 3,
@@ -58,25 +58,33 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
         client_key_pass: 'open sesame'
       }
 
-      expect(Excon).to receive(:post).with(dummy_url, hash_including(expected_params))
+      expect(Gitlab::HTTP).to receive(:post).with(dummy_url, hash_including(expected_params))
 
       client.request_access
     end
 
     it 'returns an expected response' do
-      expect(Excon).to receive(:post)
+      expect(Gitlab::HTTP).to receive(:post)
 
       expect(client.request_access)
         .to be_kind_of(::Gitlab::ExternalAuthorization::Response)
     end
 
     it 'wraps exceptions if the request fails' do
-      expect(Excon).to receive(:post) { raise Excon::Error.new('the request broke') }
+      expect(Gitlab::HTTP).to receive(:post) { raise Gitlab::HTTP::BlockedUrlError.new('the request broke') }
 
       expect { client.request_access }
         .to raise_error(::Gitlab::ExternalAuthorization::RequestFailed)
     end
 
+    it 'passes local request setting to Gitlab::HTTP' do
+      stub_application_setting(allow_local_requests_from_system_hooks: false)
+
+      expect(Gitlab::HTTP).to receive(:post).with(dummy_url, hash_including(allow_local_requests: false))
+
+      client.request_access
+    end
+
     describe 'for ldap users' do
       let(:user) do
         create(:omniauth_user,
@@ -92,7 +100,7 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
           identities: [{ provider: 'ldapprovider', extern_uid: 'external id' }],
           user_ldap_dn: 'external id'
         }.to_json
-        expect(Excon).to receive(:post)
+        expect(Gitlab::HTTP).to receive(:post)
                            .with(dummy_url, hash_including(body: expected_body))
 
         client.request_access
@@ -115,7 +123,7 @@ RSpec.describe Gitlab::ExternalAuthorization::Client do
             { provider: 'facebook', extern_uid: 'facebook_external_id' }
           ]
         }.to_json
-        expect(Excon).to receive(:post)
+        expect(Gitlab::HTTP).to receive(:post)
                            .with(dummy_url, hash_including(body: expected_body))
 
         client.request_access
diff --git a/spec/lib/gitlab/external_authorization/response_spec.rb b/spec/lib/gitlab/external_authorization/response_spec.rb
index 11f83feb76f..716196e0aa2 100644
--- a/spec/lib/gitlab/external_authorization/response_spec.rb
+++ b/spec/lib/gitlab/external_authorization/response_spec.rb
@@ -3,21 +3,21 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::ExternalAuthorization::Response do
-  let(:excon_response) { double }
+  let(:http_response) { double }
 
-  subject(:response) { described_class.new(excon_response) }
+  subject(:response) { described_class.new(http_response) }
 
   describe '#valid?' do
     it 'is valid for 200, 401, and 403 responses' do
-      [200, 401, 403].each do |status|
-        allow(excon_response).to receive(:status).and_return(status)
+      [200, 401, 403].each do |code|
+        allow(http_response).to receive(:code).and_return(code)
 
         expect(response).to be_valid
       end
     end
 
     it "is invalid for other statuses" do
-      expect(excon_response).to receive(:status).and_return(500)
+      expect(http_response).to receive(:code).and_return(500)
 
       expect(response).not_to be_valid
     end
@@ -25,13 +25,13 @@ RSpec.describe Gitlab::ExternalAuthorization::Response do
 
   describe '#reason' do
     it 'returns a reason if it was included in the response body' do
-      expect(excon_response).to receive(:body).and_return({ reason: 'Not authorized' }.to_json)
+      expect(http_response).to receive(:body).and_return({ reason: 'Not authorized' }.to_json)
 
       expect(response.reason).to eq('Not authorized')
     end
 
     it 'returns nil when there was no body' do
-      expect(excon_response).to receive(:body).and_return('')
+      expect(http_response).to receive(:body).and_return('')
 
       expect(response.reason).to eq(nil)
     end
@@ -39,14 +39,14 @@ RSpec.describe Gitlab::ExternalAuthorization::Response do
 
   describe '#successful?' do
     it 'is `true` if the status is 200' do
-      allow(excon_response).to receive(:status).and_return(200)
+      allow(http_response).to receive(:code).and_return(200)
 
       expect(response).to be_successful
     end
 
     it 'is `false` if the status is 401 or 403' do
-      [401, 403].each do |status|
-        allow(excon_response).to receive(:status).and_return(status)
+      [401, 403].each do |code|
+        allow(http_response).to receive(:code).and_return(code)
 
         expect(response).not_to be_successful
       end
diff --git a/spec/requests/api/graphql/mutations/issues/update_spec.rb b/spec/requests/api/graphql/mutations/issues/update_spec.rb
new file mode 100644
index 00000000000..fd983c683be
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/issues/update_spec.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Update of an existing issue' do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:project) { create(:project, :public) }
+  let_it_be(:issue) { create(:issue, project: project) }
+  let(:input) do
+    {
+      project_path: project.full_path,
+      iid: issue.iid.to_s,
+      locked: true
+    }
+  end
+
+  let(:mutation) { graphql_mutation(:update_issue, input) }
+  let(:mutation_response) { graphql_mutation_response(:update_issue) }
+
+  context 'the user is not allowed to update issue' do
+    it_behaves_like 'a mutation that returns top-level errors',
+      errors: ['The resource that you are attempting to access does not exist or you don\'t have permission to perform this action']
+  end
+
+  context 'when user has permissions to update issue' do
+    before do
+      project.add_developer(current_user)
+    end
+
+    it 'updates the issue' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(mutation_response['issue']).to include(
+        'discussionLocked' => true
+      )
+    end
+  end
+end
diff --git a/yarn.lock b/yarn.lock
index 94c7c322c01..2cbde5f42df 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -843,10 +843,10 @@
     eslint-plugin-vue "^6.2.1"
     vue-eslint-parser "^7.0.0"
 
-"@gitlab/svgs@1.153.0":
-  version "1.153.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.153.0.tgz#79db0598382e6990d242f2e8dc0911903b1f558c"
-  integrity sha512-9letemutba300jT8BgxmYjUjMGDJifFFulPBNT4bxT+U2Ki+X+xs57Il3o/FNv5feJOPAlYS8Z/aEII8145g1g==
+"@gitlab/svgs@1.154.0":
+  version "1.154.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.154.0.tgz#519edc2d1a798b0ff36b89a790291fbdaf500223"
+  integrity sha512-Pi/WvKjYZCfqcGp19S/NLkn8zwAdDqHrxztgjulBanDISE2GbJzNSpmPH4hIzdXWljxMCnWYQCw56A7OCN9dKQ==
 
 "@gitlab/ui@17.37.0":
   version "17.37.0"