From 469adbda3d1611901e1e428b0bdbfd7b676e99cb Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 8 May 2024 21:12:23 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../components/details/ci_resource_header.vue |   2 +-
 .../diffs/components/diff_file_header.vue     |   2 +-
 .../javascripts/ide/init_gitlab_web_ide.js    |   9 +
 .../issues/show/components/header_actions.vue |   2 +-
 .../components/details/artifacts_list_row.vue |   2 +-
 .../components/tags/tags_header.vue           |   2 +-
 .../components/details/version_row.vue        |   2 +-
 .../components/list/package_list_row.vue      |   2 +-
 .../permissions/components/settings_panel.vue |   6 +-
 .../components/report_abuse_dropdown_item.vue |   2 +-
 .../releases/components/app_index.vue         |   8 +-
 .../releases/components/evidence_block.vue    |  18 +-
 .../releases/components/release_block.vue     |  62 ++++--
 .../components/release_block_assets.vue       |   5 +-
 .../components/release_block_footer.vue       |  25 +--
 .../components/release_block_header.vue       |  15 +-
 .../release_block_milestone_info.vue          |   8 +-
 .../repository/components/commit_info.vue     |   2 +-
 .../label_filter/label_dropdown_items.vue     |   2 +-
 .../components/user_menu_profile_item.vue     |   2 +-
 .../components/inbound_token_access.vue       | 165 ++++++++------
 .../components/outbound_token_access.vue      |  18 +-
 .../components/token_access_table.vue         |  67 ++++++
 .../components/token_projects_table.vue       |  64 ------
 ...roject_ci_job_token_scope.mutation.graphql |   5 +
 ...roject_ci_job_token_scope.mutation.graphql |   7 -
 ..._group_ci_job_token_scope.mutation.graphql |   7 +
 ...cts_with_ci_job_token_scope.query.graphql} |  13 +-
 .../actions/components/user_actions_app.vue   |   2 +-
 .../components/registry/details_row.vue       |   2 +-
 .../list/components/issuable_item.vue         |   8 +-
 .../notes/work_item_note_actions.vue          |   2 +-
 .../projects/branches_controller.rb           |  16 +-
 app/controllers/projects/notes_controller.rb  |   4 +-
 app/finders/issues/confidentiality_filter.rb  |  19 +-
 app/finders/issues_finder.rb                  |  10 -
 app/finders/work_items/work_items_finder.rb   |  77 +++++++
 .../mutations/ci/runner/cache/clear.rb        |  25 +++
 .../namespaces/work_items_resolver.rb         |  10 +
 .../ci/catalog/resources/version_type.rb      |   8 +-
 app/graphql/types/mutation_type.rb            |   1 +
 .../types/permission_types/merge_request.rb   |   2 +-
 app/helpers/markup_helper.rb                  |   5 +-
 app/models/ci/build.rb                        |  18 +-
 app/models/commit_collection.rb               |   4 +-
 app/models/issue.rb                           |   3 +
 app/policies/group_policy.rb                  |   1 +
 .../projects/blob/_header_content.html.haml   |   2 +-
 .../projects/diffs/_file_header.html.haml     |   6 +-
 .../user_settings/passwords/new.html.haml     |   2 +-
 .../stage/import_repository_worker.rb         |   6 +-
 .../skip_committer_email_check.yml            |   4 +-
 .../web_ui_commit_author_change.yml           |   4 +-
 ...ucket_server_convert_mentions_to_users.yml |   8 +
 .../development/issue_email_participants.yml  |   2 +-
 .../deprecate_unified_approval_rules.yml      |   9 -
 .../gitlab_com_derisk/remove_shared_jwts.yml  |   9 -
 .../16-6-maven-group-permissions.yml          |   4 +-
 ...-7-dependency-proxy-group-deploy-token.yml |   4 +-
 .../geo_hashed_storage_attachments_events.yml |   2 +
 .../geo_hashed_storage_migrated_events.yml    |   2 +
 .../geo_repository_created_events.yml         |   2 +
 .../geo_repository_deleted_events.yml         |   2 +
 .../geo_repository_renamed_events.yml         |   2 +
 .../geo_repository_updated_events.yml         |   2 +
 .../geo_reset_checksum_events.yml             |   2 +
 ..._key_geo_hashed_storage_migrated_events.rb |  31 +++
 ...able_geo_hashed_storage_migrated_events.rb |  24 +++
 ...y_geo_hashed_storage_attachments_events.rb |  31 +++
 ..._geo_hashed_storage_attachements_events.rb |  17 ++
 ...reign_key_geo_repository_updated_events.rb |  31 +++
 ...rop_table_geo_repository_updated_events.rb |  21 ++
 ...reign_key_geo_repository_renamed_events.rb |  31 +++
 ...rop_table_geo_repository_renamed_events.rb |  22 ++
 ...reign_key_geo_repository_created_events.rb |  31 +++
 ...rop_table_geo_repository_created_events.rb |  19 ++
 ...rop_table_geo_repository_deleted_events.rb |  19 ++
 ...e_foreign_key_geo_reset_checksum_events.rb |  31 +++
 ...17_drop_table_geo_reset_checksum_events.rb |  15 ++
 ...add_index_members_on_lower_invite_email.rb |  17 ++
 db/schema_migrations/20240503165628           |   1 +
 db/schema_migrations/20240503170147           |   1 +
 db/schema_migrations/20240503171707           |   1 +
 db/schema_migrations/20240503171904           |   1 +
 db/schema_migrations/20240503173034           |   1 +
 db/schema_migrations/20240503173210           |   1 +
 db/schema_migrations/20240503174054           |   1 +
 db/schema_migrations/20240503174241           |   1 +
 db/schema_migrations/20240503174832           |   1 +
 db/schema_migrations/20240503175120           |   1 +
 db/schema_migrations/20240503175735           |   1 +
 db/schema_migrations/20240503180347           |   1 +
 db/schema_migrations/20240503180517           |   1 +
 db/schema_migrations/20240507231644           |   1 +
 db/structure.sql                              | 201 +-----------------
 doc/api/graphql/reference/index.md            |  22 ++
 doc/update/deprecations.md                    |  76 +++----
 doc/user/ai_experiments.md                    | 176 +++++++++++++++
 doc/user/ai_features.md                       | 194 ++---------------
 doc/user/gitlab_duo_chat.md                   |   2 +-
 doc/user/gitlab_duo_examples.md               |   2 +-
 doc/user/project/service_desk/configure.md    |   7 +-
 .../service_desk/external_participants.md     |   8 +-
 doc/user/report_abuse.md                      |   4 +-
 .../importers/pull_request_importer.rb        |   6 +-
 .../importers/pull_request_notes_importer.rb  |   6 +-
 .../ci/templates/Jobs/SAST.gitlab-ci.yml      |   2 +-
 .../templates/Jobs/SAST.latest.gitlab-ci.yml  |   2 +-
 .../Security/Secure-Binaries.gitlab-ci.yml    |   4 +-
 lib/gitlab/xml_converter.rb                   |   8 +
 locale/gitlab.pot                             |  28 ++-
 package.json                                  |   2 +-
 .../repository/add_new_branch_rule_spec.rb    |   6 +-
 .../pipeline_with_image_pull_policy_spec.rb   |   2 +-
 .../projects/branches_controller_spec.rb      |  12 ++
 .../incidents/user_views_incident_spec.rb     |   2 +-
 spec/features/issues/issue_header_spec.rb     |   8 +-
 .../releases/user_views_release_spec.rb       |   2 +-
 .../releases/user_views_releases_spec.rb      |   4 +-
 spec/finders/issues_finder_spec.rb            |  63 ++++++
 .../work_items/work_items_finder_spec.rb      | 111 ++++++++--
 spec/frontend/ide/init_gitlab_web_ide_spec.js |  51 ++++-
 .../show/components/header_actions_spec.js    |  26 +--
 .../__snapshots__/file_sha_spec.js.snap       |   2 +-
 .../__snapshots__/file_sha_spec.js.snap       |   2 +-
 .../package_list_row_spec.js.snap             |   2 +-
 .../components/release_block_header_spec.js   |   6 +-
 .../token_access/inbound_token_access_spec.js | 134 ++++++++----
 spec/frontend/token_access/mock_data.js       |  57 ++++-
 .../token_access/token_access_table_spec.js   |  56 +++++
 .../token_access/token_projects_table_spec.js |  64 ------
 spec/helpers/markup_helper_spec.rb            |  21 +-
 .../importers/pull_request_importer_spec.rb   |  12 ++
 .../pull_request_notes_importer_spec.rb       |  24 +++
 spec/lib/gitlab/ci/parsers/test/junit_spec.rb |  14 ++
 spec/lib/gitlab/database/sharding_key_spec.rb |   1 -
 spec/lib/gitlab/xml_converter_spec.rb         |   8 +
 spec/models/ci/build_spec.rb                  |  31 +--
 .../api/graphql/ci/catalog/resource_spec.rb   |   4 +
 .../api/graphql/group/work_items_spec.rb      |  36 +++-
 .../mutations/ci/runner/cache/clear_spec.rb   |  40 ++++
 .../finders/issues_finder_shared_examples.rb  |  60 ------
 .../stage/import_repository_worker_spec.rb    |  13 ++
 vendor/gems/sidekiq-7.1.6/test/web_test.rb    |   7 +-
 yarn.lock                                     |   8 +-
 145 files changed, 1770 insertions(+), 1038 deletions(-)
 create mode 100644 app/assets/javascripts/token_access/components/token_access_table.vue
 delete mode 100644 app/assets/javascripts/token_access/components/token_projects_table.vue
 create mode 100644 app/assets/javascripts/token_access/graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql
 delete mode 100644 app/assets/javascripts/token_access/graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql
 create mode 100644 app/assets/javascripts/token_access/graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql
 rename app/assets/javascripts/token_access/graphql/queries/{inbound_get_projects_with_ci_job_token_scope.query.graphql => inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql} (50%)
 create mode 100644 app/graphql/mutations/ci/runner/cache/clear.rb
 rename config/feature_flags/{gitlab_com_derisk => beta}/skip_committer_email_check.yml (84%)
 rename config/feature_flags/{gitlab_com_derisk => beta}/web_ui_commit_author_change.yml (84%)
 create mode 100644 config/feature_flags/development/bitbucket_server_convert_mentions_to_users.yml
 delete mode 100644 config/feature_flags/gitlab_com_derisk/deprecate_unified_approval_rules.yml
 delete mode 100644 config/feature_flags/gitlab_com_derisk/remove_shared_jwts.yml
 rename db/docs/{ => deleted_tables}/geo_hashed_storage_attachments_events.yml (84%)
 rename db/docs/{ => deleted_tables}/geo_hashed_storage_migrated_events.yml (84%)
 rename db/docs/{ => deleted_tables}/geo_repository_created_events.yml (83%)
 rename db/docs/{ => deleted_tables}/geo_repository_deleted_events.yml (83%)
 rename db/docs/{ => deleted_tables}/geo_repository_renamed_events.yml (83%)
 rename db/docs/{ => deleted_tables}/geo_repository_updated_events.yml (84%)
 rename db/docs/{ => deleted_tables}/geo_reset_checksum_events.yml (83%)
 create mode 100644 db/post_migrate/20240503165628_remove_foreign_key_geo_hashed_storage_migrated_events.rb
 create mode 100644 db/post_migrate/20240503170147_drop_table_geo_hashed_storage_migrated_events.rb
 create mode 100644 db/post_migrate/20240503171707_remove_foreign_key_geo_hashed_storage_attachments_events.rb
 create mode 100644 db/post_migrate/20240503171904_drop_table_geo_hashed_storage_attachements_events.rb
 create mode 100644 db/post_migrate/20240503173034_remove_foreign_key_geo_repository_updated_events.rb
 create mode 100644 db/post_migrate/20240503173210_drop_table_geo_repository_updated_events.rb
 create mode 100644 db/post_migrate/20240503174054_remove_foreign_key_geo_repository_renamed_events.rb
 create mode 100644 db/post_migrate/20240503174241_drop_table_geo_repository_renamed_events.rb
 create mode 100644 db/post_migrate/20240503174832_remove_foreign_key_geo_repository_created_events.rb
 create mode 100644 db/post_migrate/20240503175120_drop_table_geo_repository_created_events.rb
 create mode 100644 db/post_migrate/20240503175735_drop_table_geo_repository_deleted_events.rb
 create mode 100644 db/post_migrate/20240503180347_remove_foreign_key_geo_reset_checksum_events.rb
 create mode 100644 db/post_migrate/20240503180517_drop_table_geo_reset_checksum_events.rb
 create mode 100644 db/post_migrate/20240507231644_add_index_members_on_lower_invite_email.rb
 create mode 100644 db/schema_migrations/20240503165628
 create mode 100644 db/schema_migrations/20240503170147
 create mode 100644 db/schema_migrations/20240503171707
 create mode 100644 db/schema_migrations/20240503171904
 create mode 100644 db/schema_migrations/20240503173034
 create mode 100644 db/schema_migrations/20240503173210
 create mode 100644 db/schema_migrations/20240503174054
 create mode 100644 db/schema_migrations/20240503174241
 create mode 100644 db/schema_migrations/20240503174832
 create mode 100644 db/schema_migrations/20240503175120
 create mode 100644 db/schema_migrations/20240503175735
 create mode 100644 db/schema_migrations/20240503180347
 create mode 100644 db/schema_migrations/20240503180517
 create mode 100644 db/schema_migrations/20240507231644
 create mode 100644 doc/user/ai_experiments.md
 create mode 100644 spec/frontend/token_access/token_access_table_spec.js
 delete mode 100644 spec/frontend/token_access/token_projects_table_spec.js
 create mode 100644 spec/requests/api/graphql/mutations/ci/runner/cache/clear_spec.rb

diff --git a/app/assets/javascripts/ci/catalog/components/details/ci_resource_header.vue b/app/assets/javascripts/ci/catalog/components/details/ci_resource_header.vue
index c6bffbc2033..5467adb9af6 100644
--- a/app/assets/javascripts/ci/catalog/components/details/ci_resource_header.vue
+++ b/app/assets/javascripts/ci/catalog/components/details/ci_resource_header.vue
@@ -21,7 +21,7 @@ import CiResourceHeaderSkeletonLoader from './ci_resource_header_skeleton_loader
 export default {
   i18n: {
     moreActionsLabel: __('More actions'),
-    reportAbuse: __('Report abuse to administrator'),
+    reportAbuse: __('Report abuse'),
     lastRelease: s__('CiCatalog|Released %{date}'),
     lastReleaseMissing: s__('CiCatalog|No release available'),
   },
diff --git a/app/assets/javascripts/diffs/components/diff_file_header.vue b/app/assets/javascripts/diffs/components/diff_file_header.vue
index 91465c2f5b6..fb175b7e519 100644
--- a/app/assets/javascripts/diffs/components/diff_file_header.vue
+++ b/app/assets/javascripts/diffs/components/diff_file_header.vue
@@ -319,7 +319,7 @@ export default {
       />
       <a
         :v-once="!viewDiffsFileByFile"
-        class="gl-mr-2 gl-text-decoration-none! gl-word-break-all"
+        class="gl-mr-2 gl-text-decoration-none! gl-break-all"
         :href="titleLink"
         data-testid="file-title"
         @click="handleFileNameClick"
diff --git a/app/assets/javascripts/ide/init_gitlab_web_ide.js b/app/assets/javascripts/ide/init_gitlab_web_ide.js
index beb79d027c4..74fc00432d1 100644
--- a/app/assets/javascripts/ide/init_gitlab_web_ide.js
+++ b/app/assets/javascripts/ide/init_gitlab_web_ide.js
@@ -34,6 +34,14 @@ const getMRTargetProject = () => {
   return url.searchParams.get('target_project') || '';
 };
 
+const getCrossOriginExtensionHostFlagValue = (extensionsGallerySettings) => {
+  return (
+    extensionsGallerySettings?.enabled ||
+    extensionsGallerySettings?.reason === 'opt_in_unset' ||
+    extensionsGallerySettings?.reason === 'opt_in_disabled'
+  );
+};
+
 export const initGitlabWebIDE = async (el) => {
   // what: Pull what we need from the element. We will replace it soon.
   const {
@@ -87,6 +95,7 @@ export const initGitlabWebIDE = async (el) => {
     },
     featureFlags: {
       settingsSync: true,
+      crossOriginExtensionHost: getCrossOriginExtensionHostFlagValue(extensionsGallerySettings),
     },
     editorFont,
     extensionsGallerySettings,
diff --git a/app/assets/javascripts/issues/show/components/header_actions.vue b/app/assets/javascripts/issues/show/components/header_actions.vue
index 6f601eeedf6..7aa14264314 100644
--- a/app/assets/javascripts/issues/show/components/header_actions.vue
+++ b/app/assets/javascripts/issues/show/components/header_actions.vue
@@ -55,7 +55,7 @@ export default {
     promoteSuccessMessage: __(
       'The issue was successfully promoted to an epic. Redirecting to epic...',
     ),
-    reportAbuse: __('Report abuse to administrator'),
+    reportAbuse: __('Report abuse'),
     referenceFetchError: __('An error occurred while fetching reference'),
     copyReferenceText: __('Copy reference'),
   },
diff --git a/app/assets/javascripts/packages_and_registries/harbor_registry/components/details/artifacts_list_row.vue b/app/assets/javascripts/packages_and_registries/harbor_registry/components/details/artifacts_list_row.vue
index b489f126f75..95813353d60 100644
--- a/app/assets/javascripts/packages_and_registries/harbor_registry/components/details/artifacts_list_row.vue
+++ b/app/assets/javascripts/packages_and_registries/harbor_registry/components/details/artifacts_list_row.vue
@@ -83,7 +83,7 @@ export default {
     <template #left-primary>
       <div class="gl-display-flex gl-align-items-center">
         <router-link
-          class="gl-text-body gl-font-weight-bold gl-word-break-all"
+          class="gl-text-body gl-font-weight-bold gl-break-all"
           data-testid="name"
           :to="linkTo"
         >
diff --git a/app/assets/javascripts/packages_and_registries/harbor_registry/components/tags/tags_header.vue b/app/assets/javascripts/packages_and_registries/harbor_registry/components/tags/tags_header.vue
index e7f6989c49f..c61d5df8733 100644
--- a/app/assets/javascripts/packages_and_registries/harbor_registry/components/tags/tags_header.vue
+++ b/app/assets/javascripts/packages_and_registries/harbor_registry/components/tags/tags_header.vue
@@ -43,7 +43,7 @@ export default {
 <template>
   <title-area :metadata-loading="tagsLoading">
     <template #title>
-      <span class="gl-word-break-all" data-testid="title">
+      <span class="gl-break-all" data-testid="title">
         {{ artifactDetail.digest }}
       </span>
     </template>
diff --git a/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue b/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
index c72866435c0..8eeb4ea576a 100644
--- a/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
+++ b/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
@@ -104,7 +104,7 @@ export default {
       >
         <gl-link
           v-if="containsWebPathLink"
-          class="gl-text-body gl-min-w-0 gl-word-break-all"
+          class="gl-text-body gl-min-w-0 gl-break-all"
           :class="errorPackageStyle"
           :href="packageLink"
         >
diff --git a/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue b/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
index 542e0b6d0e3..6370e77d8f1 100644
--- a/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
+++ b/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
@@ -151,7 +151,7 @@ export default {
         <router-link
           v-if="containsWebPathLink"
           :class="errorPackageStyle"
-          class="gl-text-body gl-min-w-0 gl-word-break-all"
+          class="gl-text-body gl-min-w-0 gl-break-all"
           data-testid="details-link"
           :to="{ name: 'details', params: { id: packageId } }"
         >
diff --git a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
index a811741d2a1..b2ca725c8f0 100644
--- a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
+++ b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
@@ -789,7 +789,11 @@ export default {
         <project-setting-row
           ref="pipeline-settings"
           :label="$options.i18n.ciCdLabel"
-          :help-text="s__('ProjectSettings|Build, test, and deploy your changes.')"
+          :help-text="
+            s__(
+              'ProjectSettings|Build, test, and deploy your changes. Does not apply to project integrations.',
+            )
+          "
         >
           <project-feature-setting
             v-model="buildsAccessLevel"
diff --git a/app/assets/javascripts/projects/report_abuse/components/report_abuse_dropdown_item.vue b/app/assets/javascripts/projects/report_abuse/components/report_abuse_dropdown_item.vue
index ff76ca7c862..afceef76d80 100644
--- a/app/assets/javascripts/projects/report_abuse/components/report_abuse_dropdown_item.vue
+++ b/app/assets/javascripts/projects/report_abuse/components/report_abuse_dropdown_item.vue
@@ -14,7 +14,7 @@ export default {
   },
   inject: ['reportedUserId', 'reportedFromUrl'],
   i18n: {
-    reportAbuse: s__('ReportAbuse|Report abuse to administrator'),
+    reportAbuse: s__('ReportAbuse|Report abuse'),
   },
   data() {
     return {
diff --git a/app/assets/javascripts/releases/components/app_index.vue b/app/assets/javascripts/releases/components/app_index.vue
index e02a082a1b3..70477405240 100644
--- a/app/assets/javascripts/releases/components/app_index.vue
+++ b/app/assets/javascripts/releases/components/app_index.vue
@@ -286,8 +286,8 @@ export default {
       </gl-link>
     </gl-alert>
     <releases-empty-state v-if="shouldRenderEmptyState" />
-    <div v-else class="gl-align-self-end gl-mb-3 gl-display-flex">
-      <releases-sort :value="sort" class="gl-mr-2" @input="onSortChanged" />
+    <div v-else class="gl-align-self-end gl-display-flex gl-gap-3">
+      <releases-sort :value="sort" @input="onSortChanged" />
 
       <div
         v-if="newReleasePath"
@@ -313,7 +313,7 @@ export default {
       :class="{ 'linked-card': releases.length > 1 && index !== releases.length - 1 }"
     />
 
-    <release-skeleton-loader v-if="shouldRenderLoadingIndicator" />
+    <release-skeleton-loader v-if="shouldRenderLoadingIndicator" class="gl-mt-5" />
 
     <releases-pagination
       v-if="shouldRenderPagination"
@@ -331,6 +331,6 @@ export default {
   height: 17px;
   top: 100%;
   position: absolute;
-  left: 32px;
+  left: 23px;
 }
 </style>
diff --git a/app/assets/javascripts/releases/components/evidence_block.vue b/app/assets/javascripts/releases/components/evidence_block.vue
index b9231bec13c..51f62a7ced5 100644
--- a/app/assets/javascripts/releases/components/evidence_block.vue
+++ b/app/assets/javascripts/releases/components/evidence_block.vue
@@ -59,14 +59,12 @@ export default {
 
 <template>
   <div>
-    <div class="card-text gl-mt-3">
-      <b>{{ __('Evidence collection') }}</b>
-    </div>
-    <div v-for="(evidence, index) in evidences" :key="evidenceTitle(index)" class="mb-2">
-      <div class="d-flex gl-align-items-center">
+    <h3 class="gl-heading-5 gl-mb-2!">{{ __('Evidence collection') }}</h3>
+    <div v-for="(evidence, index) in evidences" :key="evidenceTitle(index)">
+      <div class="gl-display-flex gl-align-items-center">
         <gl-link
           v-gl-tooltip
-          class="d-flex gl-align-items-center monospace"
+          class="gl-display-flex gl-align-items-center gl-font-monospace"
           target="_blank"
           :title="__('Open evidence JSON in new tab')"
           :href="evidenceUrl(index)"
@@ -76,18 +74,18 @@ export default {
           <gl-icon name="external-link" class="gl-ml-2 gl-flex-shrink-0 gl-flex-grow-0" />
         </gl-link>
 
-        <expand-button class="gl-ml-4">
+        <expand-button class="gl-display-flex gl-align-items-center gl-gap-2 gl-ml-4">
           <template #short>
-            <span class="js-short monospace">{{ shortSha(index) }}</span>
+            <span class="js-short gl-font-monospace gl-text-secondary">{{ shortSha(index) }}</span>
           </template>
           <template #expanded>
-            <span class="js-expanded monospace gl-pl-2">{{ sha(index) }}</span>
+            <span class="js-expanded gl-font-monospace gl-pl-2">{{ sha(index) }}</span>
           </template>
         </expand-button>
         <clipboard-button :title="__('Copy evidence SHA')" :text="sha(index)" category="tertiary" />
       </div>
 
-      <div class="d-flex gl-align-items-center text-muted">
+      <div class="gl-display-flex gl-align-items-center gl-text-secondary">
         <gl-icon
           v-gl-tooltip
           name="clock"
diff --git a/app/assets/javascripts/releases/components/release_block.vue b/app/assets/javascripts/releases/components/release_block.vue
index 49c349e7a7b..9486b9b7033 100644
--- a/app/assets/javascripts/releases/components/release_block.vue
+++ b/app/assets/javascripts/releases/components/release_block.vue
@@ -1,4 +1,5 @@
 <script>
+import { GlCard } from '@gitlab/ui';
 import { isEmpty } from 'lodash';
 import SafeHtml from '~/vue_shared/directives/safe_html';
 import { scrollToElement } from '~/lib/utils/common_utils';
@@ -16,6 +17,7 @@ import ReleaseBlockMilestoneInfo from './release_block_milestone_info.vue';
 export default {
   name: 'ReleaseBlock',
   components: {
+    GlCard,
     EvidenceBlock,
     ReleaseBlockAssets,
     ReleaseBlockFooter,
@@ -92,10 +94,24 @@ export default {
 };
 </script>
 <template>
-  <div :id="htmlId" :class="{ 'bg-line-target-blue': isHighlighted }" class="card release-block">
-    <release-block-header :release="release" />
-    <div class="card-body">
-      <div v-if="shouldRenderMilestoneInfo">
+  <gl-card
+    :id="htmlId"
+    :class="{ 'bg-line-target-blue': isHighlighted }"
+    class="gl-new-card"
+    header-class="gl-new-card-header"
+    body-class="gl-new-card-body gl-px-5 gl-py-4"
+    footer-class="gl-bg-white"
+    data-testid="release-block"
+  >
+    <template #header>
+      <release-block-header :release="release" />
+    </template>
+
+    <div class="gl-display-flex gl-flex-direction-column gl-gap-5">
+      <div
+        v-if="shouldRenderMilestoneInfo"
+        class="gl-border-b-solid gl-border-b-1 gl-border-gray-100"
+      >
         <!-- TODO: Switch open* links to opened* once fields have been updated in GraphQL -->
         <release-block-milestone-info
           :milestones="milestones"
@@ -105,27 +121,35 @@ export default {
           :merged-merge-requests-path="release._links.mergedMergeRequestsUrl"
           :closed-merge-requests-path="release._links.closedMergeRequestsUrl"
         />
-        <hr class="mb-3 mt-0" />
       </div>
 
-      <release-block-assets v-if="shouldRenderAssets" :assets="assets" />
+      <release-block-assets
+        v-if="shouldRenderAssets"
+        :assets="assets"
+        :class="{
+          'gl-pb-5 gl-border-b-solid gl-border-b-1 gl-border-gray-100':
+            hasEvidence || release.descriptionHtml,
+        }"
+      />
       <evidence-block v-if="hasEvidence" :release="release" />
 
-      <div ref="gfm-content" class="card-text gl-mt-3">
+      <div v-if="release.descriptionHtml" ref="gfm-content">
+        <h3 class="gl-heading-5 gl-mb-2!">{{ __('Release notes') }}</h3>
         <div v-safe-html:[$options.safeHtmlConfig]="release.descriptionHtml" class="md"></div>
       </div>
     </div>
 
-    <release-block-footer
-      class="card-footer"
-      :commit="release.commit"
-      :commit-path="release.commitPath"
-      :tag-name="release.tagName"
-      :tag-path="release.tagPath"
-      :author="release.author"
-      :released-at="release.releasedAt"
-      :created-at="release.createdAt"
-      :sort="sort"
-    />
-  </div>
+    <template #footer>
+      <release-block-footer
+        :commit="release.commit"
+        :commit-path="release.commitPath"
+        :tag-name="release.tagName"
+        :tag-path="release.tagPath"
+        :author="release.author"
+        :released-at="release.releasedAt"
+        :created-at="release.createdAt"
+        :sort="sort"
+      />
+    </template>
+  </gl-card>
 </template>
diff --git a/app/assets/javascripts/releases/components/release_block_assets.vue b/app/assets/javascripts/releases/components/release_block_assets.vue
index 3d7d61b7908..57a59dafa03 100644
--- a/app/assets/javascripts/releases/components/release_block_assets.vue
+++ b/app/assets/javascripts/releases/components/release_block_assets.vue
@@ -98,11 +98,12 @@ export default {
 </script>
 
 <template>
-  <div class="card-text gl-mt-3">
+  <div>
     <gl-button
       data-testid="accordion-button"
       variant="link"
-      class="gl-font-weight-bold gl-text-black-normal!"
+      class="gl-text-black-normal!"
+      button-text-classes="gl-heading-5"
       @click="toggleAssetsExpansion"
     >
       <gl-icon
diff --git a/app/assets/javascripts/releases/components/release_block_footer.vue b/app/assets/javascripts/releases/components/release_block_footer.vue
index 2a931aa602c..76739a7de44 100644
--- a/app/assets/javascripts/releases/components/release_block_footer.vue
+++ b/app/assets/javascripts/releases/components/release_block_footer.vue
@@ -85,14 +85,14 @@ export default {
 };
 </script>
 <template>
-  <div class="gl-display-flex gl-gap-5">
-    <div v-if="commit" class="gl-display-flex gl-align-items-center js-commit-info">
-      <gl-icon ref="commitIcon" name="commit" class="gl-mr-2 gl-text-gray-700" />
+  <div class="gl-display-flex gl-gap-5 gl-align-items-center gl-font-sm">
+    <div v-if="commit" class="gl-display-flex gl-align-items-center gl-gap-2 js-commit-info">
+      <gl-icon ref="commitIcon" name="commit" class="gl-text-secondary" />
       <div v-gl-tooltip.bottom :title="commit.title">
         <gl-link
           v-if="commitPath"
           :href="commitPath"
-          class="gl-font-sm gl-font-monospace gl-mr-0 gl-text-gray-700"
+          class="gl-font-monospace gl-text-secondary gl-mr-0"
         >
           {{ commit.shortId }}
         </gl-link>
@@ -100,23 +100,16 @@ export default {
       </div>
     </div>
 
-    <div v-if="tagName" class="gl-display-flex gl-align-items-center js-tag-info">
-      <gl-icon name="tag" class="gl-mr-2 gl-text-gray-700" />
+    <div v-if="tagName" class="gl-display-flex gl-align-items-center gl-gap-2 js-tag-info">
+      <gl-icon name="tag" class="gl-text-secondary" />
       <div v-gl-tooltip.bottom :title="__('Tag')">
-        <gl-link
-          v-if="tagPath"
-          :href="tagPath"
-          class="gl-font-sm gl-font-monospace gl-mr-0 gl-text-gray-700"
-        >
+        <gl-link v-if="tagPath" :href="tagPath" class="gl-font-monospace gl-mr-0 gl-text-secondary">
           {{ tagName }}
         </gl-link>
         <span v-else>{{ tagName }}</span>
       </div>
     </div>
-    <div
-      v-if="timeAt || author"
-      class="gl-display-flex gl-align-items-center js-author-date-info gl-font-sm"
-    >
+    <div v-if="timeAt || author" class="gl-display-flex gl-align-items-center js-author-date-info">
       <span class="gl-text-secondary">{{ createdTime }}&nbsp;</span>
       <template v-if="timeAt">
         <span
@@ -128,7 +121,7 @@ export default {
         </span>
       </template>
 
-      <div v-if="author" class="gl-display-flex">
+      <div v-if="author" class="gl-display-flex gl-align-items-center gl-gap-1">
         <span class="gl-text-secondary">{{ __('by') }}&nbsp;</span>
         <user-avatar-link
           :link-href="author.webUrl"
diff --git a/app/assets/javascripts/releases/components/release_block_header.vue b/app/assets/javascripts/releases/components/release_block_header.vue
index b896b8589c3..a4dd4705c4b 100644
--- a/app/assets/javascripts/releases/components/release_block_header.vue
+++ b/app/assets/javascripts/releases/components/release_block_header.vue
@@ -48,8 +48,11 @@ export default {
 </script>
 
 <template>
-  <div class="card-header d-flex gl-align-items-center bg-white pr-0">
-    <h2 class="card-title gl-my-2 mr-auto gl-font-size-h2">
+  <div class="gl-display-flex gl-align-items-center gl-justify-content-space-between gl-w-full">
+    <h2
+      class="gl-new-card-title gl-heading-3 gl-m-0! gl-display-flex gl-gap-3"
+      data-testid="release-block-title"
+    >
       <gl-link v-if="selfLink" class="gl-text-black-normal" :href="selfLink">
         {{ release.name }}
       </gl-link>
@@ -63,17 +66,17 @@ export default {
               'Private - Guest users are not allowed to view detailed release information like title and source code.',
             )
           "
-          class="text-secondary gl-mb-2"
+          class="gl-text-secondary"
         />
       </template>
-      <gl-badge v-if="release.upcomingRelease" variant="warning" class="align-middle">{{
+      <gl-badge v-if="release.upcomingRelease" variant="warning" class="gl-align-self-center">{{
         __('Upcoming Release')
       }}</gl-badge>
       <gl-badge
         v-else-if="release.historicalRelease"
         v-gl-tooltip
         :title="$options.i18n.historicalTooltip"
-        class="gl-align-middle"
+        class="gl-align-self-center"
       >
         {{ $options.i18n.historical }}
       </gl-badge>
@@ -83,7 +86,7 @@ export default {
       category="primary"
       size="small"
       variant="default"
-      class="gl-mr-3 js-edit-button gl-ml-3 gl-pb-3"
+      class="js-edit-button"
       :href="editLink"
     >
       {{ $options.i18n.editButton }}
diff --git a/app/assets/javascripts/releases/components/release_block_milestone_info.vue b/app/assets/javascripts/releases/components/release_block_milestone_info.vue
index 4792f02ab91..6159c74d0d2 100644
--- a/app/assets/javascripts/releases/components/release_block_milestone_info.vue
+++ b/app/assets/javascripts/releases/components/release_block_milestone_info.vue
@@ -132,10 +132,10 @@ export default {
 };
 </script>
 <template>
-  <div class="release-block-milestone-info gl-display-flex gl-flex-wrap">
+  <div class="release-block-milestone-info gl-display-flex gl-flex-wrap gl-gap-6">
     <div
       v-gl-tooltip
-      class="milestone-progress-bar-container js-milestone-progress-bar-container gl-display-flex gl-flex-direction-column gl-mr-6 gl-mb-5"
+      class="milestone-progress-bar-container js-milestone-progress-bar-container gl-display-flex gl-flex-direction-column"
       :title="__('Closed issues')"
     >
       <span class="gl-mb-3">{{ percentCompleteText }}</span>
@@ -143,9 +143,7 @@ export default {
         <gl-progress-bar :value="issueCounts.closed" :max="issueCounts.total" />
       </span>
     </div>
-    <div
-      class="gl-display-flex gl-flex-direction-column gl-mr-6 gl-mb-5 js-milestone-list-container"
-    >
+    <div class="gl-display-flex gl-flex-direction-column js-milestone-list-container">
       <span class="gl-mb-2">{{ milestoneLabelText }}</span>
       <div class="gl-display-flex gl-flex-wrap gl-align-items-flex-end">
         <template v-for="(milestone, index) in milestonesToDisplay">
diff --git a/app/assets/javascripts/repository/components/commit_info.vue b/app/assets/javascripts/repository/components/commit_info.vue
index 29d71f3e117..660eb887779 100644
--- a/app/assets/javascripts/repository/components/commit_info.vue
+++ b/app/assets/javascripts/repository/components/commit_info.vue
@@ -96,7 +96,7 @@ export default {
             v-safe-html:[$options.safeHtmlConfig]="commit.titleHtml"
             :href="commit.webPath"
             :class="{ 'gl-italic': !commit.message }"
-            class="commit-row-message item-title gl-line-clamp-1 gl-word-break-all!"
+            class="commit-row-message item-title gl-line-clamp-1 !gl-break-all"
           />
           <gl-button
             v-if="commit.descriptionHtml"
diff --git a/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue b/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
index ac9e8de1a7a..3419ecd9253 100644
--- a/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
+++ b/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
@@ -34,7 +34,7 @@ export default {
           class="gl-rounded-base gl-min-w-5 gl-h-5 gl-display-inline-block gl-align-bottom gl-mr-3"
           :style="{ 'background-color': label.color }"
         ></span>
-        <span class="gl-reset-text-align gl-m-0 gl-p-0 label-title gl-word-break-all">{{
+        <span class="gl-reset-text-align gl-m-0 gl-p-0 label-title gl-break-all">{{
           label.title
         }}</span></gl-form-checkbox
       >
diff --git a/app/assets/javascripts/super_sidebar/components/user_menu_profile_item.vue b/app/assets/javascripts/super_sidebar/components/user_menu_profile_item.vue
index fe166687b87..734c90b53bc 100644
--- a/app/assets/javascripts/super_sidebar/components/user_menu_profile_item.vue
+++ b/app/assets/javascripts/super_sidebar/components/user_menu_profile_item.vue
@@ -58,7 +58,7 @@ export default {
           </gl-badge>
         </span>
 
-        <span class="gl-text-gray-500 gl-word-break-all">@{{ user.username }}</span>
+        <span class="gl-text-gray-500 gl-break-all">@{{ user.username }}</span>
 
         <span
           v-if="user.status.customized"
diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index 02605dfb4fb..31575cd36b7 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -13,42 +13,43 @@ import {
 import { createAlert } from '~/alert';
 import { __, s__ } from '~/locale';
 import { helpPagePath } from '~/helpers/help_page_helper';
-import inboundAddProjectCIJobTokenScopeMutation from '../graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql';
+import { TYPENAME_GROUP } from '~/graphql_shared/constants';
+import inboundAddGroupOrProjectCIJobTokenScope from '../graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql';
 import inboundRemoveProjectCIJobTokenScopeMutation from '../graphql/mutations/inbound_remove_project_ci_job_token_scope.mutation.graphql';
+import inboundRemoveGroupCIJobTokenScopeMutation from '../graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql';
 import inboundUpdateCIJobTokenScopeMutation from '../graphql/mutations/inbound_update_ci_job_token_scope.mutation.graphql';
 import inboundGetCIJobTokenScopeQuery from '../graphql/queries/inbound_get_ci_job_token_scope.query.graphql';
-import inboundGetProjectsWithCIJobTokenScopeQuery from '../graphql/queries/inbound_get_projects_with_ci_job_token_scope.query.graphql';
-import TokenProjectsTable from './token_projects_table.vue';
+import inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery from '../graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql';
+import TokenAccessTable from './token_access_table.vue';
 
 export default {
   i18n: {
     toggleLabelTitle: s__('CICD|Limit access %{italicStart}to%{italicEnd} this project'),
-    toggleHelpText: s__(
-      `CICD|Prevent access to this project from other project CI/CD job tokens, unless the other project is added to the allowlist. It is a security risk to disable this feature, because unauthorized projects might attempt to retrieve an active token and access the API. %{linkStart}Learn more%{linkEnd}.`,
-    ),
-    cardHeaderTitle: s__(
-      'CICD|Allow CI job tokens from the following projects to access this project',
+    toggleDescription: s__(
+      `CICD|Allow access to this project from authorized groups or projects by adding them to the allowlist. It is a security risk to disable this feature, because unauthorized projects might attempt to retrieve an active token and access the API. %{linkStart}Learn more%{linkEnd}.`,
     ),
+    cardHeaderTitle: s__('CICD|Groups and projects with access'),
     settingDisabledMessage: s__(
-      'CICD|Enable feature to limit job token access, so only the projects in this list can access this project with a CI/CD job token.',
+      'CICD|No access is currently allowed to this project. Enable feature to authorize access from groups or projects in the allowlist below.',
     ),
-    addProject: __('Add project'),
+    addGroupOrProject: __('Add group or project'),
+    add: __('Add'),
     cancel: __('Cancel'),
-    addProjectPlaceholder: __('Paste project path (i.e. gitlab-org/gitlab)'),
+    addProjectPlaceholder: __(
+      'Paste group path (i.e. gitlab-org) or project path (i.e. gitlab-org/gitlab)',
+    ),
     projectsFetchError: __('There was a problem fetching the projects'),
     scopeFetchError: __('There was a problem fetching the job token scope value'),
   },
   fields: [
     {
-      key: 'project',
-      label: __('Project with access'),
-      thClass: 'gl-border-t-none!',
+      key: 'fullPath',
+      label: '',
     },
     {
       key: 'actions',
       label: '',
       tdClass: 'gl-text-right',
-      thClass: 'gl-border-t-none!',
     },
   ],
   components: {
@@ -61,7 +62,7 @@ export default {
     GlLoadingIcon,
     GlSprintf,
     GlToggle,
-    TokenProjectsTable,
+    TokenAccessTable,
   },
   inject: {
     fullPath: {
@@ -83,15 +84,16 @@ export default {
         createAlert({ message: this.$options.i18n.scopeFetchError });
       },
     },
-    projects: {
-      query: inboundGetProjectsWithCIJobTokenScopeQuery,
+    groupsAndProjectsWithAccess: {
+      query: inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
       variables() {
         return {
           fullPath: this.fullPath,
         };
       },
       update({ project }) {
-        return project?.ciJobTokenScope?.inboundAllowlist?.nodes ?? [];
+        this.projects = project?.ciJobTokenScope?.inboundAllowlist?.nodes ?? [];
+        this.groups = project?.ciJobTokenScope?.groupsAllowlist?.nodes ?? [];
       },
       error() {
         createAlert({ message: this.$options.i18n.projectsFetchError });
@@ -101,14 +103,15 @@ export default {
   data() {
     return {
       inboundJobTokenScopeEnabled: null,
-      targetProjectPath: '',
+      targetPath: '',
       projects: [],
+      groups: [],
       isAddFormVisible: false,
     };
   },
   computed: {
-    isProjectPathEmpty() {
-      return this.targetProjectPath === '';
+    isTargetPathEmpty() {
+      return this.targetPath === '';
     },
     ciJobTokenHelpPage() {
       return helpPagePath('ci/jobs/ci_job_token#allow-access-to-your-project-with-a-job-token');
@@ -139,17 +142,17 @@ export default {
         createAlert({ message: error.message });
       }
     },
-    async addProject() {
+    async addGroupOrProject() {
       try {
         const {
           data: {
-            ciJobTokenScopeAddProject: { errors },
+            ciJobTokenScopeAddGroupOrProject: { errors },
           },
         } = await this.$apollo.mutate({
-          mutation: inboundAddProjectCIJobTokenScopeMutation,
+          mutation: inboundAddGroupOrProjectCIJobTokenScope,
           variables: {
             projectPath: this.fullPath,
-            targetProjectPath: this.targetProjectPath,
+            targetPath: this.targetPath,
           },
         });
 
@@ -159,23 +162,38 @@ export default {
       } catch (error) {
         createAlert({ message: error.message });
       } finally {
-        this.clearTargetProjectPath();
-        this.getProjects();
+        this.clearTargetPath();
+        this.getGroupsAndProjects();
       }
     },
-    async removeProject(removeTargetPath) {
+    async removeItem(item) {
       try {
-        const {
-          data: {
-            ciJobTokenScopeRemoveProject: { errors },
-          },
-        } = await this.$apollo.mutate({
-          mutation: inboundRemoveProjectCIJobTokenScopeMutation,
-          variables: {
-            projectPath: this.fullPath,
-            targetProjectPath: removeTargetPath,
-          },
-        });
+        let errors;
+
+        // eslint-disable-next-line no-underscore-dangle
+        if (item.__typename === TYPENAME_GROUP) {
+          const {
+            data: { ciJobTokenScopeRemoveGroup },
+          } = await this.$apollo.mutate({
+            mutation: inboundRemoveGroupCIJobTokenScopeMutation,
+            variables: {
+              projectPath: this.fullPath,
+              targetGroupPath: item.fullPath,
+            },
+          });
+          errors = ciJobTokenScopeRemoveGroup.errors;
+        } else {
+          const {
+            data: { ciJobTokenScopeRemoveProject },
+          } = await this.$apollo.mutate({
+            mutation: inboundRemoveProjectCIJobTokenScopeMutation,
+            variables: {
+              projectPath: this.fullPath,
+              targetProjectPath: item.fullPath,
+            },
+          });
+          errors = ciJobTokenScopeRemoveProject.errors;
+        }
 
         if (errors.length) {
           throw new Error(errors[0]);
@@ -183,15 +201,15 @@ export default {
       } catch (error) {
         createAlert({ message: error.message });
       } finally {
-        this.getProjects();
+        this.getGroupsAndProjects();
       }
     },
-    clearTargetProjectPath() {
-      this.targetProjectPath = '';
+    clearTargetPath() {
+      this.targetPath = '';
       this.isAddFormVisible = false;
     },
-    getProjects() {
-      this.$apollo.queries.projects.refetch();
+    getGroupsAndProjects() {
+      this.$apollo.queries.groupsAndProjectsWithAccess.refetch();
     },
     showAddForm() {
       this.isAddFormVisible = true;
@@ -206,6 +224,7 @@ export default {
       <gl-toggle
         v-model="inboundJobTokenScopeEnabled"
         :label="$options.i18n.toggleLabelTitle"
+        class="gl-mt-5"
         @change="updateCIJobTokenScope"
       >
         <template #label>
@@ -215,8 +234,8 @@ export default {
             </template>
           </gl-sprintf>
         </template>
-        <template #help>
-          <gl-sprintf :message="$options.i18n.toggleHelpText">
+        <template #description>
+          <gl-sprintf :message="$options.i18n.toggleDescription" class="gl-text-secondary">
             <template #link="{ content }">
               <gl-link :href="ciJobTokenHelpPage" class="inline-link" target="_blank">{{
                 content
@@ -226,15 +245,29 @@ export default {
         </template>
       </gl-toggle>
 
+      <gl-alert
+        v-if="!inboundJobTokenScopeEnabled"
+        variant="warning"
+        class="gl-mt-6"
+        :dismissible="false"
+        :show-icon="false"
+      >
+        {{ $options.i18n.settingDisabledMessage }}
+      </gl-alert>
+
       <div>
         <gl-card
           class="gl-new-card"
-          header-class="gl-new-card-header"
+          header-class="gl-new-card-header gl-border-bottom-0"
           body-class="gl-new-card-body gl-px-0"
         >
           <template #header>
             <div class="gl-new-card-title-wrapper">
               <h5 class="gl-new-card-title">{{ $options.i18n.cardHeaderTitle }}</h5>
+              <span class="gl-new-card-count">
+                <gl-icon name="group" class="gl-mr-2" />
+                {{ groups.length }}
+              </span>
               <span class="gl-new-card-count">
                 <gl-icon name="project" class="gl-mr-2" />
                 {{ projects.length }}
@@ -246,46 +279,44 @@ export default {
                 size="small"
                 data-testid="toggle-form-btn"
                 @click="showAddForm"
-                >{{ $options.i18n.addProject }}</gl-button
+                >{{ $options.i18n.addGroupOrProject }}</gl-button
               >
             </div>
           </template>
 
           <div v-if="isAddFormVisible" class="gl-new-card-add-form gl-m-3">
-            <h4 class="gl-mt-0">{{ $options.i18n.addProject }}</h4>
+            <h4 class="gl-mt-0">{{ $options.i18n.addGroupOrProject }}</h4>
             <gl-form-input
-              v-model="targetProjectPath"
+              v-model="targetPath"
               :placeholder="$options.i18n.addProjectPlaceholder"
             />
             <div class="gl-display-flex gl-mt-5">
               <gl-button
                 variant="confirm"
-                :disabled="isProjectPathEmpty"
+                :disabled="isTargetPathEmpty"
                 class="gl-mr-3"
                 data-testid="add-project-btn"
-                @click="addProject"
+                @click="addGroupOrProject"
               >
-                {{ $options.i18n.addProject }}
+                {{ $options.i18n.add }}
               </gl-button>
-              <gl-button @click="clearTargetProjectPath">{{ $options.i18n.cancel }}</gl-button>
+              <gl-button @click="clearTargetPath">{{ $options.i18n.cancel }}</gl-button>
             </div>
           </div>
 
-          <token-projects-table
-            :projects="projects"
+          <token-access-table
+            :is-group="true"
+            :items="groups"
             :table-fields="$options.fields"
-            @removeProject="removeProject"
+            @removeItem="removeItem"
+          />
+
+          <token-access-table
+            :items="projects"
+            :table-fields="$options.fields"
+            @removeItem="removeItem"
           />
         </gl-card>
-        <gl-alert
-          v-if="!inboundJobTokenScopeEnabled"
-          class="gl-mb-3"
-          variant="warning"
-          :dismissible="false"
-          :show-icon="false"
-        >
-          {{ $options.i18n.settingDisabledMessage }}
-        </gl-alert>
       </div>
     </template>
   </div>
diff --git a/app/assets/javascripts/token_access/components/outbound_token_access.vue b/app/assets/javascripts/token_access/components/outbound_token_access.vue
index a819ab45f55..aad46e730d8 100644
--- a/app/assets/javascripts/token_access/components/outbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/outbound_token_access.vue
@@ -18,7 +18,7 @@ import removeProjectCIJobTokenScopeMutation from '../graphql/mutations/remove_pr
 import updateCIJobTokenScopeMutation from '../graphql/mutations/update_ci_job_token_scope.mutation.graphql';
 import getCIJobTokenScopeQuery from '../graphql/queries/get_ci_job_token_scope.query.graphql';
 import getProjectsWithCIJobTokenScopeQuery from '../graphql/queries/get_projects_with_ci_job_token_scope.query.graphql';
-import TokenProjectsTable from './token_projects_table.vue';
+import TokenAccessTable from './token_access_table.vue';
 
 // Note: This component will be removed in 17.0, as the outbound access token is getting deprecated
 export default {
@@ -48,15 +48,13 @@ export default {
   }),
   fields: [
     {
-      key: 'project',
+      key: 'fullPath',
       label: __('Project that can be accessed'),
-      thClass: 'gl-border-t-none!',
     },
     {
       key: 'actions',
       label: '',
       tdClass: 'gl-text-right',
-      thClass: 'gl-border-t-none!',
     },
   ],
   components: {
@@ -68,7 +66,7 @@ export default {
     GlLoadingIcon,
     GlSprintf,
     GlToggle,
-    TokenProjectsTable,
+    TokenAccessTable,
   },
   mixins: [glFeatureFlagMixin()],
   inject: {
@@ -174,7 +172,7 @@ export default {
         this.getProjects();
       }
     },
-    async removeProject(removeTargetPath) {
+    async removeProject(project) {
       try {
         const {
           data: {
@@ -185,7 +183,7 @@ export default {
           variables: {
             input: {
               projectPath: this.fullPath,
-              targetProjectPath: removeTargetPath,
+              targetProjectPath: project.fullPath,
             },
           },
         });
@@ -282,10 +280,10 @@ export default {
               <gl-button size="small" disabled>{{ $options.i18n.addProject }}</gl-button>
             </div>
           </template>
-          <token-projects-table
-            :projects="projects"
+          <token-access-table
+            :items="projects"
             :table-fields="$options.fields"
-            @removeProject="removeProject"
+            @removeItem="removeProject"
           />
         </gl-card>
       </div>
diff --git a/app/assets/javascripts/token_access/components/token_access_table.vue b/app/assets/javascripts/token_access/components/token_access_table.vue
new file mode 100644
index 00000000000..700c6b9ef39
--- /dev/null
+++ b/app/assets/javascripts/token_access/components/token_access_table.vue
@@ -0,0 +1,67 @@
+<script>
+import { GlButton, GlTableLite } from '@gitlab/ui';
+import { sprintf, s__ } from '~/locale';
+
+export default {
+  components: {
+    GlButton,
+    GlTableLite,
+  },
+  inject: {
+    fullPath: {
+      default: '',
+    },
+  },
+  props: {
+    isGroup: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    items: {
+      type: Array,
+      required: true,
+    },
+    tableFields: {
+      type: Array,
+      required: true,
+    },
+  },
+  computed: {
+    emptyText() {
+      return sprintf(s__('CI/CD|No %{itemType}s have been added to the scope'), {
+        itemType: this.itemType,
+      });
+    },
+    itemType() {
+      return this.isGroup ? 'group' : 'project';
+    },
+  },
+};
+</script>
+<template>
+  <gl-table-lite
+    :items="items"
+    :fields="tableFields"
+    :tbody-tr-attr="{ 'data-testid': `${itemType}s-token-table-row` }"
+    :empty-text="emptyText"
+    show-empty
+    stacked="sm"
+    thead-class="gl-display-none"
+    fixed
+  >
+    <template #cell(fullPath)="{ item }">
+      <span :data-testid="`token-access-${itemType}-name`">{{ item.fullPath }}</span>
+    </template>
+
+    <template #cell(actions)="{ item }">
+      <gl-button
+        v-if="item.fullPath !== fullPath"
+        category="primary"
+        icon="remove"
+        :aria-label="__('Remove access')"
+        @click="$emit('removeItem', item)"
+      />
+    </template>
+  </gl-table-lite>
+</template>
diff --git a/app/assets/javascripts/token_access/components/token_projects_table.vue b/app/assets/javascripts/token_access/components/token_projects_table.vue
deleted file mode 100644
index 4245b39dec1..00000000000
--- a/app/assets/javascripts/token_access/components/token_projects_table.vue
+++ /dev/null
@@ -1,64 +0,0 @@
-<script>
-import { GlButton, GlTable } from '@gitlab/ui';
-import { s__ } from '~/locale';
-
-export default {
-  i18n: {
-    emptyText: s__('CI/CD|No projects have been added to the scope'),
-  },
-  components: {
-    GlButton,
-    GlTable,
-  },
-  inject: {
-    fullPath: {
-      default: '',
-    },
-  },
-  props: {
-    projects: {
-      type: Array,
-      required: true,
-    },
-    tableFields: {
-      type: Array,
-      required: true,
-    },
-  },
-  methods: {
-    removeProject(project) {
-      this.$emit('removeProject', project);
-    },
-  },
-};
-</script>
-<template>
-  <gl-table
-    :items="projects"
-    :fields="tableFields"
-    :tbody-tr-attr="{ 'data-testid': 'projects-token-table-row' }"
-    :empty-text="$options.i18n.emptyText"
-    show-empty
-    stacked="sm"
-    fixed
-  >
-    <template #table-colgroup="{ fields }">
-      <col v-for="field in fields" :key="field.key" :class="field.columnClass" />
-    </template>
-
-    <template #cell(project)="{ item }">
-      <span data-testid="token-access-project-name">{{ item.fullPath }}</span>
-    </template>
-
-    <template #cell(actions)="{ item }">
-      <gl-button
-        v-if="item.fullPath !== fullPath"
-        category="primary"
-        variant="danger"
-        icon="remove"
-        :aria-label="__('Remove access')"
-        @click="removeProject(item.fullPath)"
-      />
-    </template>
-  </gl-table>
-</template>
diff --git a/app/assets/javascripts/token_access/graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql b/app/assets/javascripts/token_access/graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql
new file mode 100644
index 00000000000..94b34a6c1eb
--- /dev/null
+++ b/app/assets/javascripts/token_access/graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql
@@ -0,0 +1,5 @@
+mutation inboundAddGroupOrProjectCIJobTokenScope($projectPath: ID!, $targetPath: ID!) {
+  ciJobTokenScopeAddGroupOrProject(input: { projectPath: $projectPath, targetPath: $targetPath }) {
+    errors
+  }
+}
diff --git a/app/assets/javascripts/token_access/graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql b/app/assets/javascripts/token_access/graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql
deleted file mode 100644
index f030a892af2..00000000000
--- a/app/assets/javascripts/token_access/graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql
+++ /dev/null
@@ -1,7 +0,0 @@
-mutation inboundAddProjectCIJobTokenScope($projectPath: ID!, $targetProjectPath: ID!) {
-  ciJobTokenScopeAddProject(
-    input: { projectPath: $projectPath, targetProjectPath: $targetProjectPath, direction: INBOUND }
-  ) {
-    errors
-  }
-}
diff --git a/app/assets/javascripts/token_access/graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql b/app/assets/javascripts/token_access/graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql
new file mode 100644
index 00000000000..5681c5967ad
--- /dev/null
+++ b/app/assets/javascripts/token_access/graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql
@@ -0,0 +1,7 @@
+mutation inboundRemoveGroupCIJobTokenScope($projectPath: ID!, $targetGroupPath: ID!) {
+  ciJobTokenScopeRemoveGroup(
+    input: { projectPath: $projectPath, targetGroupPath: $targetGroupPath }
+  ) {
+    errors
+  }
+}
diff --git a/app/assets/javascripts/token_access/graphql/queries/inbound_get_projects_with_ci_job_token_scope.query.graphql b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
similarity index 50%
rename from app/assets/javascripts/token_access/graphql/queries/inbound_get_projects_with_ci_job_token_scope.query.graphql
rename to app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
index c51bdcbf7d2..641642ffc76 100644
--- a/app/assets/javascripts/token_access/graphql/queries/inbound_get_projects_with_ci_job_token_scope.query.graphql
+++ b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
@@ -1,15 +1,18 @@
-query inboundGetProjectsWithCIJobTokenScope($fullPath: ID!) {
+query inboundGetGroupsAndProjectsWithCIJobTokenScope($fullPath: ID!) {
   project(fullPath: $fullPath) {
     id
     ciJobTokenScope {
+      groupsAllowlist {
+        nodes {
+          id
+          name
+          fullPath
+        }
+      }
       inboundAllowlist {
         nodes {
           id
           name
-          namespace {
-            id
-            fullPath
-          }
           fullPath
         }
       }
diff --git a/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue b/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
index f994cad6881..6bf3d240b31 100644
--- a/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
+++ b/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
@@ -76,7 +76,7 @@ export default {
     userId: s__('UserProfile|Copy user ID: %{id}'),
     userIdCopied: s__('UserProfile|User ID copied to clipboard'),
     rssSubscribe: s__('UserProfile|Subscribe'),
-    reportToAdmin: s__('ReportAbuse|Report abuse to administrator'),
+    reportToAdmin: s__('ReportAbuse|Report abuse'),
   },
 };
 </script>
diff --git a/app/assets/javascripts/vue_shared/components/registry/details_row.vue b/app/assets/javascripts/vue_shared/components/registry/details_row.vue
index 85b4ea241ef..8e0c8408d5c 100644
--- a/app/assets/javascripts/vue_shared/components/registry/details_row.vue
+++ b/app/assets/javascripts/vue_shared/components/registry/details_row.vue
@@ -32,7 +32,7 @@ export default {
 
 <template>
   <div
-    class="gl-display-flex gl-align-items-top gl-font-monospace gl-font-sm gl-word-break-all"
+    class="gl-display-flex gl-align-items-top gl-font-monospace gl-font-sm gl-break-all"
     :class="[padding, borderClass]"
   >
     <div v-if="icon" class="gl-w-5 gl-mr-4">
diff --git a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
index eb2f35ac5c7..efbaede01e6 100644
--- a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
+++ b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
@@ -265,10 +265,7 @@ export default {
       <span class="gl-sr-only">{{ issuable.title }}</span>
     </gl-form-checkbox>
     <div class="issuable-main-info">
-      <div
-        data-testid="issuable-title"
-        class="issue-title title gl-display-flex gl-align-items-center"
-      >
+      <div data-testid="issuable-title" class="issue-title title gl-font-size-0">
         <work-item-type-icon
           v-if="showWorkItemTypeIcon"
           class="gl-mr-2"
@@ -281,6 +278,7 @@ export default {
           name="eye-slash"
           :title="__('Confidential')"
           :aria-label="__('Confidential')"
+          class="gl-mr-2"
         />
         <gl-icon
           v-if="issuable.hidden"
@@ -290,7 +288,7 @@ export default {
           :aria-label="__('Hidden')"
         />
         <gl-link
-          class="issue-title-text"
+          class="issue-title-text gl-font-base"
           dir="auto"
           :href="issuableLinkHref"
           data-testid="issuable-title-link"
diff --git a/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue b/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
index e16d8fe8047..c6ac550b706 100644
--- a/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
+++ b/app/assets/javascripts/work_items/components/notes/work_item_note_actions.vue
@@ -20,7 +20,7 @@ export default {
     copyLinkText: __('Copy link'),
     assignUserText: __('Assign to commenting user'),
     unassignUserText: __('Unassign from commenting user'),
-    reportAbuseText: __('Report abuse to administrator'),
+    reportAbuseText: __('Report abuse'),
   },
   components: {
     EmojiPicker: () => import('~/emoji/components/picker.vue'),
diff --git a/app/controllers/projects/branches_controller.rb b/app/controllers/projects/branches_controller.rb
index 571fa38be22..34ff7be80a3 100644
--- a/app/controllers/projects/branches_controller.rb
+++ b/app/controllers/projects/branches_controller.rb
@@ -42,8 +42,8 @@ class Projects::BranchesController < Projects::ApplicationController
         render status: :service_unavailable
       end
       format.json do
-        branches = BranchesFinder.new(@repository, params).execute
-        branches = Kaminari.paginate_array(branches).page(params[:page])
+        branches = BranchesFinder.new(@repository, branches_params).execute
+        branches = Kaminari.paginate_array(branches).page(branches_params[:page])
         render json: branches.map(&:name)
       end
     end
@@ -135,7 +135,7 @@ class Projects::BranchesController < Projects::ApplicationController
   private
 
   def sort_param
-    sort = params[:sort].presence
+    sort = branches_params[:sort].presence
 
     unless sort.in?(supported_sort_options)
       flash.now[:alert] = _("Unsupported sort value.")
@@ -191,7 +191,7 @@ class Projects::BranchesController < Projects::ApplicationController
 
   def redirect_for_legacy_index_sort_or_search
     # Normalize a legacy URL with redirect
-    if request.format != :json && !params[:state].presence && [:sort, :search, :page].any? { |key| params[key].presence }
+    if request.format != :json && !branches_params[:state].presence && [:sort, :search, :page].any? { |key| branches_params[key].presence }
       redirect_to project_branches_filtered_path(@project, state: 'all'), notice: _('Update your bookmarked URLs as filtered/sorted branches URL has been changed.')
     end
   end
@@ -200,7 +200,7 @@ class Projects::BranchesController < Projects::ApplicationController
     return fetch_branches_for_overview if @mode == 'overview'
 
     @branches, @prev_path, @next_path =
-      Projects::BranchesByModeService.new(@project, params.merge(sort: @sort, mode: @mode)).execute
+      Projects::BranchesByModeService.new(@project, branches_params.merge(sort: @sort, mode: @mode)).execute
   end
 
   def fetch_merge_requests_for_branches
@@ -227,7 +227,7 @@ class Projects::BranchesController < Projects::ApplicationController
   end
 
   def fetch_mode
-    state = params[:state].presence
+    state = branches_params[:state].presence
 
     return 'overview' unless state
 
@@ -243,4 +243,8 @@ class Projects::BranchesController < Projects::ApplicationController
 
     confidential_issue_project
   end
+
+  def branches_params
+    params.permit(:page, :state, :sort, :search, :page_token, :offset)
+  end
 end
diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index 3d8a787afcb..a93bd52298f 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -7,7 +7,7 @@ class Projects::NotesController < Projects::ApplicationController
   include NotesHelper
   include ToggleAwardEmoji
 
-  before_action :disable_query_limiting, only: [:create, :update]
+  before_action :disable_query_limiting, only: [:create, :update, :index]
   before_action :authorize_read_note!
   before_action :authorize_create_note!, only: [:create]
   before_action :authorize_resolve_note!, only: [:resolve, :unresolve]
@@ -118,6 +118,8 @@ class Projects::NotesController < Projects::ApplicationController
   end
 
   def disable_query_limiting
+    # Using a single disable! Call to not repeat this code, but there are different issues created for each action
+    # index: https://gitlab.com/gitlab-org/gitlab/-/issues/460923
     Gitlab::QueryLimiting.disable!('https://gitlab.com/gitlab-org/gitlab/-/issues/20800')
   end
 end
diff --git a/app/finders/issues/confidentiality_filter.rb b/app/finders/issues/confidentiality_filter.rb
index 4bec9ac1b38..282e56637fa 100644
--- a/app/finders/issues/confidentiality_filter.rb
+++ b/app/finders/issues/confidentiality_filter.rb
@@ -4,10 +4,11 @@ module Issues
   class ConfidentialityFilter < Issuables::BaseFilter
     CONFIDENTIAL_ACCESS_LEVEL = Gitlab::Access::REPORTER
 
-    def initialize(current_user:, parent:, assignee_filter:, **kwargs)
+    def initialize(current_user:, parent:, assignee_filter:, related_groups: nil, **kwargs)
       @current_user = current_user
       @parent = parent
       @assignee_filter = assignee_filter
+      @related_groups = related_groups
 
       super(**kwargs)
     end
@@ -24,7 +25,7 @@ module Issues
         issues.confidential_only.merge(
           issues.authored(@current_user)
             .or(issues.assigned_to(@current_user))
-            .or(access_to_project_exists(issues))
+            .or(access_to_parent_exists(issues))
         )
       ).allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/422045')
     end
@@ -41,13 +42,23 @@ module Issues
         @assignee_filter.includes_user?(@current_user)
     end
 
-    def access_to_project_exists(issues)
-      issues.where_exists(
+    def access_to_parent_exists(issues)
+      access_to_project_level_issue_exists = issues.where_exists(
         @current_user.authorizations_for_projects(
           min_access_level: CONFIDENTIAL_ACCESS_LEVEL,
           related_project_column: 'issues.project_id'
         )
       )
+
+      return access_to_project_level_issue_exists if @related_groups.nil?
+
+      access_to_project_level_issue_exists.project_level.or(
+        issues.group_level.in_namespaces(
+          Group.id_in(
+            Group.groups_user_can(@related_groups, @current_user, :read_confidential_issues, same_root: true)
+          )
+        )
+      )
     end
   end
 end
diff --git a/app/finders/issues_finder.rb b/app/finders/issues_finder.rb
index cf7fe3e3f91..c593d8cdd71 100644
--- a/app/finders/issues_finder.rb
+++ b/app/finders/issues_finder.rb
@@ -67,16 +67,6 @@ class IssuesFinder < IssuableFinder
     super.with_projects_matching_search_data
   end
 
-  def group_namespaces
-    return if params[:project_id] || params[:projects]
-
-    Group.id_in(params.group).select(:id)
-  end
-
-  def project_namespaces
-    params.projects.select(:project_namespace_id)
-  end
-
   def by_confidential(items)
     Issues::ConfidentialityFilter.new(
       current_user: current_user,
diff --git a/app/finders/work_items/work_items_finder.rb b/app/finders/work_items/work_items_finder.rb
index 407af0f4904..e7021a77377 100644
--- a/app/finders/work_items/work_items_finder.rb
+++ b/app/finders/work_items/work_items_finder.rb
@@ -6,6 +6,8 @@
 # WorkItems instead of Issues
 module WorkItems
   class WorkItemsFinder < IssuesFinder
+    include Gitlab::Utils::StrongMemoize
+
     def klass
       WorkItem
     end
@@ -47,12 +49,27 @@ module WorkItems
       super
     end
 
+    override :by_confidential
+    def by_confidential(items)
+      return super unless include_namespace_level_work_items?
+
+      Issues::ConfidentialityFilter.new(
+        current_user: current_user,
+        params: original_params,
+        parent: root_ancestor_group,
+        assignee_filter: assignee_filter,
+        related_groups: related_groups
+      ).filter(items)
+    end
+
     override :by_parent
     def by_parent(items)
       return super unless include_namespace_level_work_items?
 
       relations = [group_namespaces, project_namespaces].compact
 
+      return items.none if relations.empty?
+
       namespaces = if relations.one?
                      relations.first
                    else
@@ -62,8 +79,68 @@ module WorkItems
       items.in_namespaces(namespaces)
     end
 
+    def group_namespaces
+      return if params[:project_id] || params[:projects]
+
+      related_groups_with_access.select(:id)
+    end
+
+    def related_groups_with_access
+      # If the user is not signed in, we just return public groups
+      return related_groups.public_to_user unless current_user
+
+      # If the user is an admin or a member of the root group, they will have read access to all
+      # work items in the subgroups so we can skip the expensive permissions check
+      if Ability.allowed?(current_user, :read_all_resources) || root_ancestor_group.member?(current_user)
+        return related_groups
+      end
+
+      Group.id_in(
+        Group.groups_user_can(related_groups, current_user, :read_work_item, same_root: true)
+      )
+    end
+
+    def related_groups
+      if include_ancestors? && include_descendants?
+        params.group.self_and_hierarchy
+      elsif include_ancestors?
+        params.group.self_and_ancestors
+      elsif include_descendants?
+        params.group.self_and_descendants
+      else
+        Group.id_in(params.group.id)
+      end
+    end
+    strong_memoize_attr :related_groups
+
+    def root_ancestor_group
+      include_ancestors? ? params.group.root_ancestor : params.group
+    end
+
+    def project_namespaces
+      return unless include_descendants?
+
+      projects = Project.in_namespace(params.group.self_and_descendant_ids)
+      projects = projects.id_in(params[:projects]) if params[:projects]
+
+      projects
+        .public_or_visible_to_user(current_user, ProjectFeature.required_minimum_access_level(klass.base_class))
+        .with_feature_available_for_user(klass.base_class, current_user)
+        .select(:project_namespace_id)
+    end
+
     def include_namespace_level_work_items?
       params.group? && Feature.enabled?(:namespace_level_work_items, params.group)
     end
+
+    def include_descendants?
+      params.fetch(:include_descendants, false)
+    end
+    strong_memoize_attr :include_descendants?
+
+    def include_ancestors?
+      params.fetch(:include_ancestors, false)
+    end
+    strong_memoize_attr :include_ancestors?
   end
 end
diff --git a/app/graphql/mutations/ci/runner/cache/clear.rb b/app/graphql/mutations/ci/runner/cache/clear.rb
new file mode 100644
index 00000000000..0a0b9f0bb14
--- /dev/null
+++ b/app/graphql/mutations/ci/runner/cache/clear.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Ci
+    module Runner
+      module Cache
+        class Clear < BaseMutation
+          graphql_name 'RunnerCacheClear'
+
+          authorize :admin_pipeline
+
+          argument :project_id, ::Types::GlobalIDType[Project],
+            required: true,
+            description: 'Global ID of the project that will have its runner cache cleared.'
+
+          def resolve(project_id:)
+            project = authorized_find!(id: project_id)
+
+            ResetProjectCacheService.new(project, current_user).execute
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/app/graphql/resolvers/namespaces/work_items_resolver.rb b/app/graphql/resolvers/namespaces/work_items_resolver.rb
index 5df2b87222e..6f64fa49e4e 100644
--- a/app/graphql/resolvers/namespaces/work_items_resolver.rb
+++ b/app/graphql/resolvers/namespaces/work_items_resolver.rb
@@ -4,6 +4,16 @@ module Resolvers
   module Namespaces
     # rubocop:disable Graphql/ResolverType -- inherited from Resolvers::WorkItemsResolver
     class WorkItemsResolver < ::Resolvers::WorkItemsResolver
+      argument :include_ancestors, GraphQL::Types::Boolean,
+        required: false,
+        default_value: false,
+        description: 'Include work items from ancestor groups.'
+
+      argument :include_descendants, GraphQL::Types::Boolean,
+        required: false,
+        default_value: false,
+        description: 'Include work items from descendant groups and projects.'
+
       def ready?(**args)
         return false if Feature.disabled?(:namespace_level_work_items, resource_parent)
 
diff --git a/app/graphql/types/ci/catalog/resources/version_type.rb b/app/graphql/types/ci/catalog/resources/version_type.rb
index b52a1c6b13d..0c76ef5fa5a 100644
--- a/app/graphql/types/ci/catalog/resources/version_type.rb
+++ b/app/graphql/types/ci/catalog/resources/version_type.rb
@@ -39,6 +39,8 @@ module Types
             description: 'Components belonging to the catalog resource.',
             alpha: { milestone: '16.7' }
 
+          # TODO: Turn this into a proper markup_field, which will require some refactoring.
+          # https://gitlab.com/gitlab-org/gitlab/-/issues/460462
           field :readme_html, GraphQL::Types::String, null: true, calls_gitaly: true,
             description: 'GitLab Flavored Markdown rendering of README.md. This field ' \
                          'can only be resolved for one version in any single request.',
@@ -51,10 +53,8 @@ module Types
           end
 
           def readme_html
-            return unless Ability.allowed?(current_user, :read_code, object.project)
-
-            markdown_context = context.to_h.dup.merge(project: object.project)
-            ::MarkupHelper.markdown(object.readme&.data, markdown_context)
+            ctx = context.to_h.dup.merge(project: object.project)
+            ::MarkupHelper.markdown(object.readme.data, ctx, { requested_path: object.readme.path })
           end
         end
         # rubocop: enable Graphql/AuthorizeTypes
diff --git a/app/graphql/types/mutation_type.rb b/app/graphql/types/mutation_type.rb
index c821e4ad6ab..45b2a233186 100644
--- a/app/graphql/types/mutation_type.rb
+++ b/app/graphql/types/mutation_type.rb
@@ -171,6 +171,7 @@ module Types
     mount_mutation Mutations::Ci::PipelineTrigger::Update, alpha: { milestone: '16.3' }
     mount_mutation Mutations::Ci::ProjectCiCdSettingsUpdate
     mount_mutation Mutations::Ci::Runner::BulkDelete, alpha: { milestone: '15.3' }
+    mount_mutation Mutations::Ci::Runner::Cache::Clear
     mount_mutation Mutations::Ci::Runner::Create, alpha: { milestone: '15.10' }
     mount_mutation Mutations::Ci::Runner::Delete
     mount_mutation Mutations::Ci::Runner::Update
diff --git a/app/graphql/types/permission_types/merge_request.rb b/app/graphql/types/permission_types/merge_request.rb
index 82592aa6f5f..a5fa63b20b0 100644
--- a/app/graphql/types/permission_types/merge_request.rb
+++ b/app/graphql/types/permission_types/merge_request.rb
@@ -21,7 +21,7 @@ module Types
       end
 
       permission_field :can_merge, calls_gitaly: true
-      permission_field :can_approve
+      permission_field :can_approve, calls_gitaly: true
 
       def can_merge
         object.can_be_merged_by?(context[:current_user])
diff --git a/app/helpers/markup_helper.rb b/app/helpers/markup_helper.rb
index 92d11385c1e..29b170394c6 100644
--- a/app/helpers/markup_helper.rb
+++ b/app/helpers/markup_helper.rb
@@ -83,13 +83,14 @@ module MarkupHelper
     render_links(text)
   end
 
-  def markdown(text, context = {})
+  def markdown(text, context = {}, postprocess = {})
     return '' unless text.present?
 
     context[:project] ||= @project
     context[:group] ||= @group
 
-    html = Markup::RenderingService.new(text, context: context, postprocess_context: postprocess_context).execute
+    html = Markup::RenderingService.new(text, context: context,
+      postprocess_context: postprocess_context.merge!(postprocess)).execute
 
     Hamlit::RailsHelpers.preserve(html)
   end
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 048ea35b266..03f10c1f817 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -1160,23 +1160,7 @@ module Ci
     end
 
     def job_jwt_variables
-      if Feature.enabled?(:remove_shared_jwts) || id_tokens?
-        id_tokens_variables
-      else
-        predefined_jwt_variables
-      end
-    end
-
-    def predefined_jwt_variables
-      Gitlab::Ci::Variables::Collection.new.tap do |variables|
-        jwt = Gitlab::Ci::Jwt.for_build(self)
-        jwt_v2 = Gitlab::Ci::JwtV2.for_build(self)
-        variables.append(key: 'CI_JOB_JWT', value: jwt, public: false, masked: true)
-        variables.append(key: 'CI_JOB_JWT_V1', value: jwt, public: false, masked: true)
-        variables.append(key: 'CI_JOB_JWT_V2', value: jwt_v2, public: false, masked: true)
-      rescue OpenSSL::PKey::RSAError, Gitlab::Ci::Jwt::NoSigningKeyError => e
-        Gitlab::ErrorTracking.track_exception(e)
-      end
+      id_tokens_variables
     end
 
     def id_tokens_variables
diff --git a/app/models/commit_collection.rb b/app/models/commit_collection.rb
index 14a6573d624..dfacbd86015 100644
--- a/app/models/commit_collection.rb
+++ b/app/models/commit_collection.rb
@@ -177,12 +177,12 @@ class CommitCollection
   def committer_emails_for(commits, include_author_when_signed: false)
     commit_author_change_enabled = ::Feature.enabled?(:web_ui_commit_author_change, project)
 
-    if commit_author_change_enabled
+    if include_author_when_signed && commit_author_change_enabled
       commits.each(&:signature) # preload signatures
     end
 
     commits.filter_map do |commit|
-      if commit_author_change_enabled && commit.signature&.verified_system? && include_author_when_signed
+      if include_author_when_signed && commit_author_change_enabled && commit.signature&.verified_system?
         commit.author_email
       else
         commit.committer_email
diff --git a/app/models/issue.rb b/app/models/issue.rb
index 994563dbfcc..308cf901abf 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -124,6 +124,9 @@ class Issue < ApplicationRecord
 
   pg_full_text_searchable columns: [{ name: 'title', weight: 'A' }, { name: 'description', weight: 'B' }]
 
+  scope :project_level, -> { where.not(project_id: nil) }
+  scope :group_level, -> { where(project_id: nil) }
+
   scope :in_namespaces, ->(namespaces) { where(namespace: namespaces) }
   scope :in_projects, ->(project_ids) { where(project_id: project_ids) }
   scope :not_in_projects, ->(project_ids) { where.not(project_id: project_ids) }
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index 2229c1473c9..c56fd8ca8e3 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -176,6 +176,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     enable :read_custom_emoji
     enable :read_counts
     enable :read_issue
+    enable :read_work_item
     enable :read_namespace
   end
 
diff --git a/app/views/projects/blob/_header_content.html.haml b/app/views/projects/blob/_header_content.html.haml
index 8c132a16797..5c810ff67ef 100644
--- a/app/views/projects/blob/_header_content.html.haml
+++ b/app/views/projects/blob/_header_content.html.haml
@@ -3,7 +3,7 @@
     .js-table-contents
   = blob_icon blob.mode, blob.name
 
-  %strong.file-title-name.gl-word-break-all{ data: { testid: 'file-name-content' } }
+  %strong.file-title-name.gl-break-all{ data: { testid: 'file-name-content' } }
     = blob.name
 
   = copy_file_path_button(blob.path)
diff --git a/app/views/projects/diffs/_file_header.html.haml b/app/views/projects/diffs/_file_header.html.haml
index 17e55699615..cf2275e6cc7 100644
--- a/app/views/projects/diffs/_file_header.html.haml
+++ b/app/views/projects/diffs/_file_header.html.haml
@@ -17,13 +17,13 @@
 
     - if diff_file.renamed_file?
       - old_path, new_path = mark_inline_diffs(diff_file.old_path, diff_file.new_path)
-      %strong.file-title-name.has-tooltip.gl-word-break-all{ data: { title: diff_file.old_path, container: 'body' } }
+      %strong.file-title-name.has-tooltip.gl-break-all{ data: { title: diff_file.old_path, container: 'body' } }
         = old_path
       &rarr;
-      %strong.file-title-name.has-tooltip.gl-word-break-all{ data: { title: diff_file.new_path, container: 'body' } }
+      %strong.file-title-name.has-tooltip.gl-break-all{ data: { title: diff_file.new_path, container: 'body' } }
         = new_path
     - else
-      %strong.file-title-name.has-tooltip.gl-word-break-all{ data: { title: diff_file.file_path, container: 'body', testid: 'file-name-content' } }
+      %strong.file-title-name.has-tooltip.gl-break-all{ data: { title: diff_file.file_path, container: 'body', testid: 'file-name-content' } }
         = diff_file.file_path
 
       - if diff_file.deleted_file?
diff --git a/app/views/user_settings/passwords/new.html.haml b/app/views/user_settings/passwords/new.html.haml
index 4190e0b642e..a804f9c583d 100644
--- a/app/views/user_settings/passwords/new.html.haml
+++ b/app/views/user_settings/passwords/new.html.haml
@@ -9,7 +9,7 @@
     .well-segment
       .gl-justify-content-left.gl-display-flex.gl-align-items-center
         = render Pajamas::AvatarComponent.new(current_user, size: 24, avatar_options: { data: { qa_selector: 'user_avatar_content' }, title: current_user.username })
-        .gl-pl-4.gl-word-break-all
+        .gl-pl-4.gl-break-all
           %span= _('Signed in as %{username}') % { username: '@' + current_user.username }
   = gitlab_ui_form_for @user, url: user_settings_password_path, method: :post do |f|
 
diff --git a/app/workers/gitlab/bitbucket_server_import/stage/import_repository_worker.rb b/app/workers/gitlab/bitbucket_server_import/stage/import_repository_worker.rb
index efc1d454b70..573c73cd7df 100644
--- a/app/workers/gitlab/bitbucket_server_import/stage/import_repository_worker.rb
+++ b/app/workers/gitlab/bitbucket_server_import/stage/import_repository_worker.rb
@@ -14,7 +14,11 @@ module Gitlab
 
           importer.execute
 
-          ImportUsersWorker.perform_async(project.id)
+          if Feature.enabled?(:bitbucket_server_convert_mentions_to_users, project.creator)
+            ImportUsersWorker.perform_async(project.id)
+          else
+            ImportPullRequestsWorker.perform_async(project.id)
+          end
         end
 
         def importer_class
diff --git a/config/feature_flags/gitlab_com_derisk/skip_committer_email_check.yml b/config/feature_flags/beta/skip_committer_email_check.yml
similarity index 84%
rename from config/feature_flags/gitlab_com_derisk/skip_committer_email_check.yml
rename to config/feature_flags/beta/skip_committer_email_check.yml
index d7d69d6e3af..d46e9c8a64f 100644
--- a/config/feature_flags/gitlab_com_derisk/skip_committer_email_check.yml
+++ b/config/feature_flags/beta/skip_committer_email_check.yml
@@ -5,5 +5,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/146878
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/448342
 milestone: '16.10'
 group: group::source code
-type: gitlab_com_derisk
-default_enabled: false
+type: beta
+default_enabled: true
diff --git a/config/feature_flags/gitlab_com_derisk/web_ui_commit_author_change.yml b/config/feature_flags/beta/web_ui_commit_author_change.yml
similarity index 84%
rename from config/feature_flags/gitlab_com_derisk/web_ui_commit_author_change.yml
rename to config/feature_flags/beta/web_ui_commit_author_change.yml
index 793d7a27a79..741d410e09e 100644
--- a/config/feature_flags/gitlab_com_derisk/web_ui_commit_author_change.yml
+++ b/config/feature_flags/beta/web_ui_commit_author_change.yml
@@ -5,5 +5,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/148889
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/455288
 milestone: '16.11'
 group: group::source code
-type: gitlab_com_derisk
-default_enabled: false
+type: beta
+default_enabled: true
diff --git a/config/feature_flags/development/bitbucket_server_convert_mentions_to_users.yml b/config/feature_flags/development/bitbucket_server_convert_mentions_to_users.yml
new file mode 100644
index 00000000000..90ea8d56c0a
--- /dev/null
+++ b/config/feature_flags/development/bitbucket_server_convert_mentions_to_users.yml
@@ -0,0 +1,8 @@
+---
+name: bitbucket_server_convert_mentions_to_users
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/139097
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/434453
+milestone: '16.7'
+type: development
+group: group::import and integrate
+default_enabled: false
diff --git a/config/feature_flags/development/issue_email_participants.yml b/config/feature_flags/development/issue_email_participants.yml
index 97b8e97116b..d78767a366a 100644
--- a/config/feature_flags/development/issue_email_participants.yml
+++ b/config/feature_flags/development/issue_email_participants.yml
@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/350460
 milestone: '13.8'
 type: development
 group: group::respond
-default_enabled: false
+default_enabled: true
diff --git a/config/feature_flags/gitlab_com_derisk/deprecate_unified_approval_rules.yml b/config/feature_flags/gitlab_com_derisk/deprecate_unified_approval_rules.yml
deleted file mode 100644
index 198b7ee316b..00000000000
--- a/config/feature_flags/gitlab_com_derisk/deprecate_unified_approval_rules.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: deprecate_unified_approval_rules
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/388191
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150182
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/457258
-milestone: '17.0'
-group: group::environments
-type: gitlab_com_derisk
-default_enabled: false
diff --git a/config/feature_flags/gitlab_com_derisk/remove_shared_jwts.yml b/config/feature_flags/gitlab_com_derisk/remove_shared_jwts.yml
deleted file mode 100644
index 8b2d44c764c..00000000000
--- a/config/feature_flags/gitlab_com_derisk/remove_shared_jwts.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: remove_shared_jwts
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/423106
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/148106
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/452294
-milestone: '16.11'
-group: group::pipeline security
-type: gitlab_com_derisk
-default_enabled: false
diff --git a/data/deprecations/16-6-maven-group-permissions.yml b/data/deprecations/16-6-maven-group-permissions.yml
index f22aff107f9..1749c632e79 100644
--- a/data/deprecations/16-6-maven-group-permissions.yml
+++ b/data/deprecations/16-6-maven-group-permissions.yml
@@ -1,6 +1,6 @@
 - title: "Breaking change to the Maven repository group permissions"
   announcement_milestone: "16.6"
-  removal_milestone: "17.0"
+  removal_milestone: "18.0"
   breaking_change: true
   reporter: trizzi
   stage: Package
@@ -9,7 +9,7 @@
     The Maven repository exposes an API endpoint at the group level that allows Maven clients to download files from a specific package. The package finder first locates the package within the group, and then finds the file within the package.
     However, there is a limitation that affects duplicate package names hosted in different projects. The Maven package finder always returns the most recent package, but the "most recent" filter depends on user permissions. It is possible for a user with different permissions in different projects to download the wrong Maven package.
 
-    In GitLab 17.0, the package finder logic will be fixed so that the "most recent" package is the last updated name and version of a package in a group. User permissions will be checked after the most recent package is found.
+    In GitLab 18.0, the package finder logic will be fixed so that the "most recent" package is the last updated name and version of a package in a group. User permissions will be checked after the most recent package is found.
     After the change, download requests for users without correct permissions will be rejected. If your workflow depends on the current bugged behavior, this fix will introduce a breaking change.
 
     The change will be introduced in GitLab 16.6 behind a feature flag. If you are interested in enabling the feature flag for your group, leave a comment in [issue 393933](https://gitlab.com/gitlab-org/gitlab/-/issues/393933).
diff --git a/data/deprecations/16-7-dependency-proxy-group-deploy-token.yml b/data/deprecations/16-7-dependency-proxy-group-deploy-token.yml
index bb86a53e382..759a41d1b5e 100644
--- a/data/deprecations/16-7-dependency-proxy-group-deploy-token.yml
+++ b/data/deprecations/16-7-dependency-proxy-group-deploy-token.yml
@@ -1,6 +1,6 @@
 - title: "Dependency Proxy: Access tokens to have additional scope checks"
   announcement_milestone: "16.7"
-  removal_milestone: "17.0"
+  removal_milestone: "18.0"
   breaking_change: true
   reporter: trizzi
   stage: Package
@@ -8,6 +8,6 @@
   body: |
     When using the Dependency Proxy for containers with a group access token or personal access token, `docker login` and `docker pull` requests with insufficient scopes for Dependency Proxy are not rejected.
 
-    GitLab 17.0 adds checks for group or personal access tokens authenticating with the dependency proxy for containers. This is a breaking change, because tokens without the required scopes will fail.
+    GitLab 18.0 adds checks for group or personal access tokens authenticating with the dependency proxy for containers. This is a breaking change, because tokens without the required scopes will fail.
 
     To help avoid being impacted by this breaking change, create new access tokens with the [required scopes](https://docs.gitlab.com/ee/user/packages/dependency_proxy/#authenticate-with-the-dependency-proxy), and update your workflow variables and scripts with those new tokens.
diff --git a/db/docs/geo_hashed_storage_attachments_events.yml b/db/docs/deleted_tables/geo_hashed_storage_attachments_events.yml
similarity index 84%
rename from db/docs/geo_hashed_storage_attachments_events.yml
rename to db/docs/deleted_tables/geo_hashed_storage_attachments_events.yml
index b1daf7d1459..6773c079a27 100644
--- a/db/docs/geo_hashed_storage_attachments_events.yml
+++ b/db/docs/deleted_tables/geo_hashed_storage_attachments_events.yml
@@ -8,6 +8,8 @@ description: Used to replicate storage attachments migration paths on Geo second
   from regular to hashed storage.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/3544
 milestone: '10.3'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_hashed_storage_migrated_events.yml b/db/docs/deleted_tables/geo_hashed_storage_migrated_events.yml
similarity index 84%
rename from db/docs/geo_hashed_storage_migrated_events.yml
rename to db/docs/deleted_tables/geo_hashed_storage_migrated_events.yml
index 4ef7a7607db..df556bb2dd2 100644
--- a/db/docs/geo_hashed_storage_migrated_events.yml
+++ b/db/docs/deleted_tables/geo_hashed_storage_migrated_events.yml
@@ -8,6 +8,8 @@ description: Used to replicate repository migration paths on Geo secondaries fro
   regular to hashed storage.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/3066
 milestone: '10.2'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_repository_created_events.yml b/db/docs/deleted_tables/geo_repository_created_events.yml
similarity index 83%
rename from db/docs/geo_repository_created_events.yml
rename to db/docs/deleted_tables/geo_repository_created_events.yml
index 99ffbe0bd0f..34b358b5201 100644
--- a/db/docs/geo_repository_created_events.yml
+++ b/db/docs/deleted_tables/geo_repository_created_events.yml
@@ -7,6 +7,8 @@ feature_categories:
 description: Geo event for when a repository gets created, belongs to geo_event_log.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/f3eacf881659b7af97b7c7ba3289237ec6cdc1cb
 milestone: '10.0'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_repository_deleted_events.yml b/db/docs/deleted_tables/geo_repository_deleted_events.yml
similarity index 83%
rename from db/docs/geo_repository_deleted_events.yml
rename to db/docs/deleted_tables/geo_repository_deleted_events.yml
index d0ee74ae405..e8bd73ba804 100644
--- a/db/docs/geo_repository_deleted_events.yml
+++ b/db/docs/deleted_tables/geo_repository_deleted_events.yml
@@ -7,6 +7,8 @@ feature_categories:
 description: Geo event for when a repository gets deleted, belongs to geo_event_log.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/04c3da24ac5975b140cf2e6a7e33414543f148f5
 milestone: '9.4'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_repository_renamed_events.yml b/db/docs/deleted_tables/geo_repository_renamed_events.yml
similarity index 83%
rename from db/docs/geo_repository_renamed_events.yml
rename to db/docs/deleted_tables/geo_repository_renamed_events.yml
index 3cfbc2c695f..c3a25369d1d 100644
--- a/db/docs/geo_repository_renamed_events.yml
+++ b/db/docs/deleted_tables/geo_repository_renamed_events.yml
@@ -7,6 +7,8 @@ feature_categories:
 description: Geo event for when a repository gets renamed, belongs to geo_event_log.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/6e5fa040d1c689fad4e110dd10be8ddba61ea7ef
 milestone: '9.4'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_repository_updated_events.yml b/db/docs/deleted_tables/geo_repository_updated_events.yml
similarity index 84%
rename from db/docs/geo_repository_updated_events.yml
rename to db/docs/deleted_tables/geo_repository_updated_events.yml
index 37c278e046c..1ba9075a468 100644
--- a/db/docs/geo_repository_updated_events.yml
+++ b/db/docs/deleted_tables/geo_repository_updated_events.yml
@@ -8,6 +8,8 @@ description: Geo event for when a repository gets updated (content changed), bel
   to geo_event_log.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/71cc57b1e4b7721c93107357517235a18f7ba8e2
 milestone: '9.3'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/docs/geo_reset_checksum_events.yml b/db/docs/deleted_tables/geo_reset_checksum_events.yml
similarity index 83%
rename from db/docs/geo_reset_checksum_events.yml
rename to db/docs/deleted_tables/geo_reset_checksum_events.yml
index 1f333cc61c9..459b0f7b5ef 100644
--- a/db/docs/geo_reset_checksum_events.yml
+++ b/db/docs/deleted_tables/geo_reset_checksum_events.yml
@@ -8,6 +8,8 @@ description: Geo event for when a project gets reverified on the primary, belong
   to geo_event_log.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/7394
 milestone: '11.4'
+removed_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151938
+removed_in_milestone: '17.0'
 gitlab_schema: gitlab_main_cell
 allow_cross_joins:
 - gitlab_main_clusterwide
diff --git a/db/post_migrate/20240503165628_remove_foreign_key_geo_hashed_storage_migrated_events.rb b/db/post_migrate/20240503165628_remove_foreign_key_geo_hashed_storage_migrated_events.rb
new file mode 100644
index 00000000000..3b54ba83bff
--- /dev/null
+++ b/db/post_migrate/20240503165628_remove_foreign_key_geo_hashed_storage_migrated_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoHashedStorageMigratedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_hashed_storage_migrated_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_687ed7d7c5,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503170147_drop_table_geo_hashed_storage_migrated_events.rb b/db/post_migrate/20240503170147_drop_table_geo_hashed_storage_migrated_events.rb
new file mode 100644
index 00000000000..89a0728699e
--- /dev/null
+++ b/db/post_migrate/20240503170147_drop_table_geo_hashed_storage_migrated_events.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class DropTableGeoHashedStorageMigratedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_hashed_storage_migrated_events
+  end
+
+  def down
+    create_table :geo_hashed_storage_migrated_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_hashed_storage_migrated_events_on_project_id' }, null: false
+      t.text :repository_storage_name, null: false
+      t.text :old_disk_path, null: false
+      t.text :new_disk_path, null: false
+      t.text :old_wiki_disk_path, null: false
+      t.text :new_wiki_disk_path, null: false
+      t.integer :old_storage_version, limit: 2
+      t.integer :new_storage_version, limit: 2, null: false
+      t.text :old_design_disk_path
+      t.text :new_design_disk_path
+    end
+  end
+end
diff --git a/db/post_migrate/20240503171707_remove_foreign_key_geo_hashed_storage_attachments_events.rb b/db/post_migrate/20240503171707_remove_foreign_key_geo_hashed_storage_attachments_events.rb
new file mode 100644
index 00000000000..b31d813eb3c
--- /dev/null
+++ b/db/post_migrate/20240503171707_remove_foreign_key_geo_hashed_storage_attachments_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoHashedStorageAttachmentsEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_hashed_storage_attachments_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_d496b088e9,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503171904_drop_table_geo_hashed_storage_attachements_events.rb b/db/post_migrate/20240503171904_drop_table_geo_hashed_storage_attachements_events.rb
new file mode 100644
index 00000000000..f53296f7c14
--- /dev/null
+++ b/db/post_migrate/20240503171904_drop_table_geo_hashed_storage_attachements_events.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class DropTableGeoHashedStorageAttachementsEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_hashed_storage_attachments_events
+  end
+
+  def down
+    create_table :geo_hashed_storage_attachments_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_hashed_storage_attachments_events_on_project_id' }, null: false
+      t.text :old_attachments_path, null: false
+      t.text :new_attachments_path, null: false
+    end
+  end
+end
diff --git a/db/post_migrate/20240503173034_remove_foreign_key_geo_repository_updated_events.rb b/db/post_migrate/20240503173034_remove_foreign_key_geo_repository_updated_events.rb
new file mode 100644
index 00000000000..9f69e6d4208
--- /dev/null
+++ b/db/post_migrate/20240503173034_remove_foreign_key_geo_repository_updated_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoRepositoryUpdatedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_repository_updated_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_2b70854c08,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503173210_drop_table_geo_repository_updated_events.rb b/db/post_migrate/20240503173210_drop_table_geo_repository_updated_events.rb
new file mode 100644
index 00000000000..c37a9894730
--- /dev/null
+++ b/db/post_migrate/20240503173210_drop_table_geo_repository_updated_events.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class DropTableGeoRepositoryUpdatedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_repository_updated_events
+  end
+
+  def down
+    create_table :geo_repository_updated_events do |t|
+      t.integer :branches_affected, null: false
+      t.integer :tags_affected, null: false
+      t.integer :project_id, index: { name: 'index_geo_repository_updated_events_on_project_id' }, null: false
+      t.integer :source, limit: 2, index: { name: 'index_geo_repository_updated_events_on_source' }, null: false
+      t.boolean :new_branch, default: false, null: false
+      t.boolean :remove_branch, default: false, null: false
+      t.text :ref
+    end
+  end
+end
diff --git a/db/post_migrate/20240503174054_remove_foreign_key_geo_repository_renamed_events.rb b/db/post_migrate/20240503174054_remove_foreign_key_geo_repository_renamed_events.rb
new file mode 100644
index 00000000000..59aec7ac2e1
--- /dev/null
+++ b/db/post_migrate/20240503174054_remove_foreign_key_geo_repository_renamed_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoRepositoryRenamedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_repository_renamed_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_4e6524febb,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503174241_drop_table_geo_repository_renamed_events.rb b/db/post_migrate/20240503174241_drop_table_geo_repository_renamed_events.rb
new file mode 100644
index 00000000000..80912b1a205
--- /dev/null
+++ b/db/post_migrate/20240503174241_drop_table_geo_repository_renamed_events.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class DropTableGeoRepositoryRenamedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_repository_renamed_events
+  end
+
+  def down
+    create_table :geo_repository_renamed_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_repository_renamed_events_on_project_id' }, null: false
+      t.text :repository_storage_name, null: false
+      t.text :old_path_with_namespace, null: false
+      t.text :new_path_with_namespace, null: false
+      t.text :old_wiki_path_with_namespace, null: false
+      t.text :new_wiki_path_with_namespace, null: false
+      t.text :old_path, null: false
+      t.text :new_path, null: false
+    end
+  end
+end
diff --git a/db/post_migrate/20240503174832_remove_foreign_key_geo_repository_created_events.rb b/db/post_migrate/20240503174832_remove_foreign_key_geo_repository_created_events.rb
new file mode 100644
index 00000000000..e25925a010c
--- /dev/null
+++ b/db/post_migrate/20240503174832_remove_foreign_key_geo_repository_created_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoRepositoryCreatedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_repository_created_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_1f49e46a61,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503175120_drop_table_geo_repository_created_events.rb b/db/post_migrate/20240503175120_drop_table_geo_repository_created_events.rb
new file mode 100644
index 00000000000..7062b1f5266
--- /dev/null
+++ b/db/post_migrate/20240503175120_drop_table_geo_repository_created_events.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class DropTableGeoRepositoryCreatedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_repository_created_events
+  end
+
+  def down
+    create_table :geo_repository_created_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_repository_created_events_on_project_id' }, null: false
+      t.text :repository_storage_name, null: false
+      t.text :repo_path, null: false
+      t.text :wiki_path
+      t.text :project_name, null: false
+    end
+  end
+end
diff --git a/db/post_migrate/20240503175735_drop_table_geo_repository_deleted_events.rb b/db/post_migrate/20240503175735_drop_table_geo_repository_deleted_events.rb
new file mode 100644
index 00000000000..a52569eb773
--- /dev/null
+++ b/db/post_migrate/20240503175735_drop_table_geo_repository_deleted_events.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class DropTableGeoRepositoryDeletedEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_repository_deleted_events
+  end
+
+  def down
+    create_table :geo_repository_deleted_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_repository_deleted_events_on_project_id' }, null: false
+      t.text :repository_storage_name, null: false
+      t.text :deleted_path, null: false
+      t.text :deleted_wiki_path
+      t.text :deleted_project_name, null: false
+    end
+  end
+end
diff --git a/db/post_migrate/20240503180347_remove_foreign_key_geo_reset_checksum_events.rb b/db/post_migrate/20240503180347_remove_foreign_key_geo_reset_checksum_events.rb
new file mode 100644
index 00000000000..1ebf551f507
--- /dev/null
+++ b/db/post_migrate/20240503180347_remove_foreign_key_geo_reset_checksum_events.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class RemoveForeignKeyGeoResetChecksumEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  disable_ddl_transaction!
+
+  FROM_TABLE = :geo_reset_checksum_events
+  TO_TABLE = :projects
+
+  def up
+    with_lock_retries do
+      remove_foreign_key(
+        FROM_TABLE,
+        TO_TABLE,
+        column: :project_id,
+        if_exists: true
+      )
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(
+      FROM_TABLE,
+      TO_TABLE,
+      name: :fk_rails_910a06f12b,
+      column: :project_id,
+      on_delete: :cascade
+    )
+  end
+end
diff --git a/db/post_migrate/20240503180517_drop_table_geo_reset_checksum_events.rb b/db/post_migrate/20240503180517_drop_table_geo_reset_checksum_events.rb
new file mode 100644
index 00000000000..64b53e1dbf7
--- /dev/null
+++ b/db/post_migrate/20240503180517_drop_table_geo_reset_checksum_events.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class DropTableGeoResetChecksumEvents < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  def up
+    drop_table :geo_reset_checksum_events
+  end
+
+  def down
+    create_table :geo_reset_checksum_events do |t|
+      t.integer :project_id, index: { name: 'index_geo_reset_checksum_events_on_project_id' }, null: false
+    end
+  end
+end
diff --git a/db/post_migrate/20240507231644_add_index_members_on_lower_invite_email.rb b/db/post_migrate/20240507231644_add_index_members_on_lower_invite_email.rb
new file mode 100644
index 00000000000..5b594c59d6c
--- /dev/null
+++ b/db/post_migrate/20240507231644_add_index_members_on_lower_invite_email.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddIndexMembersOnLowerInviteEmail < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  INDEX_NAME = 'index_members_on_lower_invite_email'
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :members, '(lower(invite_email))', name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :members, INDEX_NAME
+  end
+end
diff --git a/db/schema_migrations/20240503165628 b/db/schema_migrations/20240503165628
new file mode 100644
index 00000000000..487893a6dc9
--- /dev/null
+++ b/db/schema_migrations/20240503165628
@@ -0,0 +1 @@
+58549bf920eb048c92b8faeeb1c09aabb99bfc6000366eef283bc3f04d15a1a4
\ No newline at end of file
diff --git a/db/schema_migrations/20240503170147 b/db/schema_migrations/20240503170147
new file mode 100644
index 00000000000..5b2fb772e73
--- /dev/null
+++ b/db/schema_migrations/20240503170147
@@ -0,0 +1 @@
+d3e1f2dfccc5d329d677a2163d5a44df5c5bd575ee8c2ae678609de6d5eef942
\ No newline at end of file
diff --git a/db/schema_migrations/20240503171707 b/db/schema_migrations/20240503171707
new file mode 100644
index 00000000000..9921bb21b90
--- /dev/null
+++ b/db/schema_migrations/20240503171707
@@ -0,0 +1 @@
+7674c725ec40ca8f35f3fa34d2c0004d93e60d082143c7d95648d727ba1c1633
\ No newline at end of file
diff --git a/db/schema_migrations/20240503171904 b/db/schema_migrations/20240503171904
new file mode 100644
index 00000000000..a59023348cb
--- /dev/null
+++ b/db/schema_migrations/20240503171904
@@ -0,0 +1 @@
+4438ab576df6ec912cf25576c52a096a0a625e8b5aee5a087f5d7db59504d164
\ No newline at end of file
diff --git a/db/schema_migrations/20240503173034 b/db/schema_migrations/20240503173034
new file mode 100644
index 00000000000..c44e1bb4128
--- /dev/null
+++ b/db/schema_migrations/20240503173034
@@ -0,0 +1 @@
+9aa10a6889d0d25a080895406fd4a1d0182fe0ce258b435970fc48cfc3cd98cb
\ No newline at end of file
diff --git a/db/schema_migrations/20240503173210 b/db/schema_migrations/20240503173210
new file mode 100644
index 00000000000..9280fa81a7c
--- /dev/null
+++ b/db/schema_migrations/20240503173210
@@ -0,0 +1 @@
+60e54814c34eaff5a4a002152be76b9c5fad5db0058d2fd1eb1ce8f80bcbac68
\ No newline at end of file
diff --git a/db/schema_migrations/20240503174054 b/db/schema_migrations/20240503174054
new file mode 100644
index 00000000000..134f56c0036
--- /dev/null
+++ b/db/schema_migrations/20240503174054
@@ -0,0 +1 @@
+e8da0d1411165e4c37380cf6f5b3f1e6814889b4c5c7236235ea40ef198cafda
\ No newline at end of file
diff --git a/db/schema_migrations/20240503174241 b/db/schema_migrations/20240503174241
new file mode 100644
index 00000000000..abb451fbe3b
--- /dev/null
+++ b/db/schema_migrations/20240503174241
@@ -0,0 +1 @@
+312533b34332d08f8bbf10430224996a7a33e16303b5352f4347943133349123
\ No newline at end of file
diff --git a/db/schema_migrations/20240503174832 b/db/schema_migrations/20240503174832
new file mode 100644
index 00000000000..019309ec38a
--- /dev/null
+++ b/db/schema_migrations/20240503174832
@@ -0,0 +1 @@
+ca5f6d8e698550c3f3711cbcc2b52f4c17236ad065bf2b4abb703e9fff658770
\ No newline at end of file
diff --git a/db/schema_migrations/20240503175120 b/db/schema_migrations/20240503175120
new file mode 100644
index 00000000000..e099fd3e598
--- /dev/null
+++ b/db/schema_migrations/20240503175120
@@ -0,0 +1 @@
+d07a24c6ebe58b72d8d2dc95e9f4f00347ff35add81ad13bec8c40497f599f8b
\ No newline at end of file
diff --git a/db/schema_migrations/20240503175735 b/db/schema_migrations/20240503175735
new file mode 100644
index 00000000000..49557a5c70d
--- /dev/null
+++ b/db/schema_migrations/20240503175735
@@ -0,0 +1 @@
+824e428c16fde2be4c72dd1d426ec3dc1e8e10f6c72018df26a7eea6ab6eb26c
\ No newline at end of file
diff --git a/db/schema_migrations/20240503180347 b/db/schema_migrations/20240503180347
new file mode 100644
index 00000000000..d32a8a6300a
--- /dev/null
+++ b/db/schema_migrations/20240503180347
@@ -0,0 +1 @@
+dabe889047ccac9b5b354f83bd8f910936aca26a968fe79fb1cdcab0fd618dd2
\ No newline at end of file
diff --git a/db/schema_migrations/20240503180517 b/db/schema_migrations/20240503180517
new file mode 100644
index 00000000000..1148098dbca
--- /dev/null
+++ b/db/schema_migrations/20240503180517
@@ -0,0 +1 @@
+aafee50b23b182e7f8674086accdb7239e31c709bcc810d7a5fd88f455ea758b
\ No newline at end of file
diff --git a/db/schema_migrations/20240507231644 b/db/schema_migrations/20240507231644
new file mode 100644
index 00000000000..fccbe4f78a9
--- /dev/null
+++ b/db/schema_migrations/20240507231644
@@ -0,0 +1 @@
+2879df8b5e17741acdafa450706f7d93901e183c96a148136b9bc39d1d8a6833
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 2077330b664..2f03bacc85a 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -9249,45 +9249,6 @@ CREATE SEQUENCE geo_events_id_seq
 
 ALTER SEQUENCE geo_events_id_seq OWNED BY geo_events.id;
 
-CREATE TABLE geo_hashed_storage_attachments_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL,
-    old_attachments_path text NOT NULL,
-    new_attachments_path text NOT NULL
-);
-
-CREATE SEQUENCE geo_hashed_storage_attachments_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_hashed_storage_attachments_events_id_seq OWNED BY geo_hashed_storage_attachments_events.id;
-
-CREATE TABLE geo_hashed_storage_migrated_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL,
-    repository_storage_name text NOT NULL,
-    old_disk_path text NOT NULL,
-    new_disk_path text NOT NULL,
-    old_wiki_disk_path text NOT NULL,
-    new_wiki_disk_path text NOT NULL,
-    old_storage_version smallint,
-    new_storage_version smallint NOT NULL,
-    old_design_disk_path text,
-    new_design_disk_path text
-);
-
-CREATE SEQUENCE geo_hashed_storage_migrated_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_hashed_storage_migrated_events_id_seq OWNED BY geo_hashed_storage_migrated_events.id;
-
 CREATE TABLE geo_node_namespace_links (
     id integer NOT NULL,
     geo_node_id integer NOT NULL,
@@ -9383,97 +9344,6 @@ CREATE SEQUENCE geo_repositories_changed_events_id_seq
 
 ALTER SEQUENCE geo_repositories_changed_events_id_seq OWNED BY geo_repositories_changed_events.id;
 
-CREATE TABLE geo_repository_created_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL,
-    repository_storage_name text NOT NULL,
-    repo_path text NOT NULL,
-    wiki_path text,
-    project_name text NOT NULL
-);
-
-CREATE SEQUENCE geo_repository_created_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_repository_created_events_id_seq OWNED BY geo_repository_created_events.id;
-
-CREATE TABLE geo_repository_deleted_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL,
-    repository_storage_name text NOT NULL,
-    deleted_path text NOT NULL,
-    deleted_wiki_path text,
-    deleted_project_name text NOT NULL
-);
-
-CREATE SEQUENCE geo_repository_deleted_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_repository_deleted_events_id_seq OWNED BY geo_repository_deleted_events.id;
-
-CREATE TABLE geo_repository_renamed_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL,
-    repository_storage_name text NOT NULL,
-    old_path_with_namespace text NOT NULL,
-    new_path_with_namespace text NOT NULL,
-    old_wiki_path_with_namespace text NOT NULL,
-    new_wiki_path_with_namespace text NOT NULL,
-    old_path text NOT NULL,
-    new_path text NOT NULL
-);
-
-CREATE SEQUENCE geo_repository_renamed_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_repository_renamed_events_id_seq OWNED BY geo_repository_renamed_events.id;
-
-CREATE TABLE geo_repository_updated_events (
-    id bigint NOT NULL,
-    branches_affected integer NOT NULL,
-    tags_affected integer NOT NULL,
-    project_id integer NOT NULL,
-    source smallint NOT NULL,
-    new_branch boolean DEFAULT false NOT NULL,
-    remove_branch boolean DEFAULT false NOT NULL,
-    ref text
-);
-
-CREATE SEQUENCE geo_repository_updated_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_repository_updated_events_id_seq OWNED BY geo_repository_updated_events.id;
-
-CREATE TABLE geo_reset_checksum_events (
-    id bigint NOT NULL,
-    project_id integer NOT NULL
-);
-
-CREATE SEQUENCE geo_reset_checksum_events_id_seq
-    START WITH 1
-    INCREMENT BY 1
-    NO MINVALUE
-    NO MAXVALUE
-    CACHE 1;
-
-ALTER SEQUENCE geo_reset_checksum_events_id_seq OWNED BY geo_reset_checksum_events.id;
-
 CREATE TABLE ghost_user_migrations (
     id bigint NOT NULL,
     user_id bigint NOT NULL,
@@ -19400,10 +19270,6 @@ ALTER TABLE ONLY geo_event_log ALTER COLUMN id SET DEFAULT nextval('geo_event_lo
 
 ALTER TABLE ONLY geo_events ALTER COLUMN id SET DEFAULT nextval('geo_events_id_seq'::regclass);
 
-ALTER TABLE ONLY geo_hashed_storage_attachments_events ALTER COLUMN id SET DEFAULT nextval('geo_hashed_storage_attachments_events_id_seq'::regclass);
-
-ALTER TABLE ONLY geo_hashed_storage_migrated_events ALTER COLUMN id SET DEFAULT nextval('geo_hashed_storage_migrated_events_id_seq'::regclass);
-
 ALTER TABLE ONLY geo_node_namespace_links ALTER COLUMN id SET DEFAULT nextval('geo_node_namespace_links_id_seq'::regclass);
 
 ALTER TABLE ONLY geo_node_statuses ALTER COLUMN id SET DEFAULT nextval('geo_node_statuses_id_seq'::regclass);
@@ -19412,16 +19278,6 @@ ALTER TABLE ONLY geo_nodes ALTER COLUMN id SET DEFAULT nextval('geo_nodes_id_seq
 
 ALTER TABLE ONLY geo_repositories_changed_events ALTER COLUMN id SET DEFAULT nextval('geo_repositories_changed_events_id_seq'::regclass);
 
-ALTER TABLE ONLY geo_repository_created_events ALTER COLUMN id SET DEFAULT nextval('geo_repository_created_events_id_seq'::regclass);
-
-ALTER TABLE ONLY geo_repository_deleted_events ALTER COLUMN id SET DEFAULT nextval('geo_repository_deleted_events_id_seq'::regclass);
-
-ALTER TABLE ONLY geo_repository_renamed_events ALTER COLUMN id SET DEFAULT nextval('geo_repository_renamed_events_id_seq'::regclass);
-
-ALTER TABLE ONLY geo_repository_updated_events ALTER COLUMN id SET DEFAULT nextval('geo_repository_updated_events_id_seq'::regclass);
-
-ALTER TABLE ONLY geo_reset_checksum_events ALTER COLUMN id SET DEFAULT nextval('geo_reset_checksum_events_id_seq'::regclass);
-
 ALTER TABLE ONLY ghost_user_migrations ALTER COLUMN id SET DEFAULT nextval('ghost_user_migrations_id_seq'::regclass);
 
 ALTER TABLE ONLY gitlab_subscription_histories ALTER COLUMN id SET DEFAULT nextval('gitlab_subscription_histories_id_seq'::regclass);
@@ -21519,12 +21375,6 @@ ALTER TABLE ONLY geo_event_log
 ALTER TABLE ONLY geo_events
     ADD CONSTRAINT geo_events_pkey PRIMARY KEY (id);
 
-ALTER TABLE ONLY geo_hashed_storage_attachments_events
-    ADD CONSTRAINT geo_hashed_storage_attachments_events_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY geo_hashed_storage_migrated_events
-    ADD CONSTRAINT geo_hashed_storage_migrated_events_pkey PRIMARY KEY (id);
-
 ALTER TABLE ONLY geo_node_namespace_links
     ADD CONSTRAINT geo_node_namespace_links_pkey PRIMARY KEY (id);
 
@@ -21537,21 +21387,6 @@ ALTER TABLE ONLY geo_nodes
 ALTER TABLE ONLY geo_repositories_changed_events
     ADD CONSTRAINT geo_repositories_changed_events_pkey PRIMARY KEY (id);
 
-ALTER TABLE ONLY geo_repository_created_events
-    ADD CONSTRAINT geo_repository_created_events_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY geo_repository_deleted_events
-    ADD CONSTRAINT geo_repository_deleted_events_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY geo_repository_renamed_events
-    ADD CONSTRAINT geo_repository_renamed_events_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY geo_repository_updated_events
-    ADD CONSTRAINT geo_repository_updated_events_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY geo_reset_checksum_events
-    ADD CONSTRAINT geo_reset_checksum_events_pkey PRIMARY KEY (id);
-
 ALTER TABLE ONLY ghost_user_migrations
     ADD CONSTRAINT ghost_user_migrations_pkey PRIMARY KEY (id);
 
@@ -25681,10 +25516,6 @@ CREATE INDEX index_geo_event_log_on_geo_event_id ON geo_event_log USING btree (g
 
 CREATE INDEX index_geo_event_log_on_repositories_changed_event_id ON geo_event_log USING btree (repositories_changed_event_id) WHERE (repositories_changed_event_id IS NOT NULL);
 
-CREATE INDEX index_geo_hashed_storage_attachments_events_on_project_id ON geo_hashed_storage_attachments_events USING btree (project_id);
-
-CREATE INDEX index_geo_hashed_storage_migrated_events_on_project_id ON geo_hashed_storage_migrated_events USING btree (project_id);
-
 CREATE INDEX index_geo_node_namespace_links_on_geo_node_id ON geo_node_namespace_links USING btree (geo_node_id);
 
 CREATE UNIQUE INDEX index_geo_node_namespace_links_on_geo_node_id_and_namespace_id ON geo_node_namespace_links USING btree (geo_node_id, namespace_id);
@@ -25701,18 +25532,6 @@ CREATE INDEX index_geo_nodes_on_primary ON geo_nodes USING btree ("primary");
 
 CREATE INDEX index_geo_repositories_changed_events_on_geo_node_id ON geo_repositories_changed_events USING btree (geo_node_id);
 
-CREATE INDEX index_geo_repository_created_events_on_project_id ON geo_repository_created_events USING btree (project_id);
-
-CREATE INDEX index_geo_repository_deleted_events_on_project_id ON geo_repository_deleted_events USING btree (project_id);
-
-CREATE INDEX index_geo_repository_renamed_events_on_project_id ON geo_repository_renamed_events USING btree (project_id);
-
-CREATE INDEX index_geo_repository_updated_events_on_project_id ON geo_repository_updated_events USING btree (project_id);
-
-CREATE INDEX index_geo_repository_updated_events_on_source ON geo_repository_updated_events USING btree (source);
-
-CREATE INDEX index_geo_reset_checksum_events_on_project_id ON geo_reset_checksum_events USING btree (project_id);
-
 CREATE INDEX index_ghost_user_migrations_on_consume_after_id ON ghost_user_migrations USING btree (consume_after, id);
 
 CREATE UNIQUE INDEX index_ghost_user_migrations_on_user_id ON ghost_user_migrations USING btree (user_id);
@@ -26183,6 +26002,8 @@ CREATE INDEX index_members_on_invite_email ON members USING btree (invite_email)
 
 CREATE UNIQUE INDEX index_members_on_invite_token ON members USING btree (invite_token);
 
+CREATE INDEX index_members_on_lower_invite_email ON members USING btree (lower((invite_email)::text));
+
 CREATE INDEX index_members_on_member_namespace_id_compound ON members USING btree (member_namespace_id, type, requested_at, id);
 
 CREATE INDEX index_members_on_member_role_id ON members USING btree (member_role_id);
@@ -31439,9 +31260,6 @@ ALTER TABLE ONLY packages_tags
 ALTER TABLE ONLY boards_epic_board_positions
     ADD CONSTRAINT fk_rails_1ecfd9f2de FOREIGN KEY (epic_id) REFERENCES epics(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY geo_repository_created_events
-    ADD CONSTRAINT fk_rails_1f49e46a61 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY external_status_checks
     ADD CONSTRAINT fk_rails_1f5a8aa809 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
@@ -31538,9 +31356,6 @@ ALTER TABLE ONLY dependency_proxy_image_ttl_group_policies
 ALTER TABLE ONLY group_group_links
     ADD CONSTRAINT fk_rails_2b2353ca49 FOREIGN KEY (shared_with_group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY geo_repository_updated_events
-    ADD CONSTRAINT fk_rails_2b70854c08 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY packages_debian_group_component_files
     ADD CONSTRAINT fk_rails_2b8992dd83 FOREIGN KEY (architecture_id) REFERENCES packages_debian_group_architectures(id) ON DELETE RESTRICT;
 
@@ -31772,9 +31587,6 @@ ALTER TABLE ONLY snippet_user_mentions
 ALTER TABLE ONLY protected_environment_approval_rules
     ADD CONSTRAINT fk_rails_4e554f96f5 FOREIGN KEY (protected_environment_id) REFERENCES protected_environments(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY geo_repository_renamed_events
-    ADD CONSTRAINT fk_rails_4e6524febb FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY aws_roles
     ADD CONSTRAINT fk_rails_4ed56f4720 FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 
@@ -31994,9 +31806,6 @@ ALTER TABLE ONLY vulnerability_findings_remediations
 ALTER TABLE ONLY resource_iteration_events
     ADD CONSTRAINT fk_rails_6830c13ac1 FOREIGN KEY (merge_request_id) REFERENCES merge_requests(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY geo_hashed_storage_migrated_events
-    ADD CONSTRAINT fk_rails_687ed7d7c5 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY plan_limits
     ADD CONSTRAINT fk_rails_69f8b6184f FOREIGN KEY (plan_id) REFERENCES plans(id) ON DELETE CASCADE;
 
@@ -32282,9 +32091,6 @@ ALTER TABLE ONLY approval_project_rules_groups
 ALTER TABLE ONLY vulnerability_occurrences
     ADD CONSTRAINT fk_rails_90fed4faba FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY geo_reset_checksum_events
-    ADD CONSTRAINT fk_rails_910a06f12b FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY project_error_tracking_settings
     ADD CONSTRAINT fk_rails_910a2b8bd9 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
@@ -32771,9 +32577,6 @@ ALTER TABLE ONLY alert_management_alert_assignees
 ALTER TABLE ONLY packages_terraform_module_metadata
     ADD CONSTRAINT fk_rails_d48f21a84b FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE SET NULL;
 
-ALTER TABLE ONLY geo_hashed_storage_attachments_events
-    ADD CONSTRAINT fk_rails_d496b088e9 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
-
 ALTER TABLE p_ci_job_annotations
     ADD CONSTRAINT fk_rails_d4d0c0fa0f FOREIGN KEY (partition_id, job_id) REFERENCES p_ci_builds(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE;
 
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 23b25f6a6ec..f7cf3526aaf 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -7599,6 +7599,24 @@ Input type: `RepositionImageDiffNoteInput`
 | <a id="mutationrepositionimagediffnoteerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 | <a id="mutationrepositionimagediffnotenote"></a>`note` | [`Note`](#note) | Note after mutation. |
 
+### `Mutation.runnerCacheClear`
+
+Input type: `RunnerCacheClearInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationrunnercacheclearclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationrunnercacheclearprojectid"></a>`projectId` | [`ProjectID!`](#projectid) | Global ID of the project that will have its runner cache cleared. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationrunnercacheclearclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationrunnercacheclearerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+
 ### `Mutation.runnerCreate`
 
 DETAILS:
@@ -22263,6 +22281,8 @@ Returns [`WorkItemStateCountsType`](#workitemstatecountstype).
 | <a id="groupworkitemstatecountsiid"></a>`iid` | [`String`](#string) | IID of the work item. For example, "1". |
 | <a id="groupworkitemstatecountsiids"></a>`iids` | [`[String!]`](#string) | List of IIDs of work items. For example, `["1", "2"]`. |
 | <a id="groupworkitemstatecountsin"></a>`in` | [`[IssuableSearchableField!]`](#issuablesearchablefield) | Specify the fields to perform the search in. Defaults to `[TITLE, DESCRIPTION]`. Requires the `search` argument.'. |
+| <a id="groupworkitemstatecountsincludeancestors"></a>`includeAncestors` | [`Boolean`](#boolean) | Include work items from ancestor groups. |
+| <a id="groupworkitemstatecountsincludedescendants"></a>`includeDescendants` | [`Boolean`](#boolean) | Include work items from descendant groups and projects. |
 | <a id="groupworkitemstatecountsrequirementlegacywidget"></a>`requirementLegacyWidget` **{warning-solid}** | [`RequirementLegacyFilterInput`](#requirementlegacyfilterinput) | **Deprecated** in GitLab 15.9. Use work item IID filter instead. |
 | <a id="groupworkitemstatecountssearch"></a>`search` | [`String`](#string) | Search query for title or description. |
 | <a id="groupworkitemstatecountssort"></a>`sort` | [`WorkItemSort`](#workitemsort) | Sort work items by criteria. |
@@ -22308,6 +22328,8 @@ four standard [pagination arguments](#pagination-arguments):
 | <a id="groupworkitemsiid"></a>`iid` | [`String`](#string) | IID of the work item. For example, "1". |
 | <a id="groupworkitemsiids"></a>`iids` | [`[String!]`](#string) | List of IIDs of work items. For example, `["1", "2"]`. |
 | <a id="groupworkitemsin"></a>`in` | [`[IssuableSearchableField!]`](#issuablesearchablefield) | Specify the fields to perform the search in. Defaults to `[TITLE, DESCRIPTION]`. Requires the `search` argument.'. |
+| <a id="groupworkitemsincludeancestors"></a>`includeAncestors` | [`Boolean`](#boolean) | Include work items from ancestor groups. |
+| <a id="groupworkitemsincludedescendants"></a>`includeDescendants` | [`Boolean`](#boolean) | Include work items from descendant groups and projects. |
 | <a id="groupworkitemsrequirementlegacywidget"></a>`requirementLegacyWidget` **{warning-solid}** | [`RequirementLegacyFilterInput`](#requirementlegacyfilterinput) | **Deprecated** in GitLab 15.9. Use work item IID filter instead. |
 | <a id="groupworkitemssearch"></a>`search` | [`String`](#string) | Search query for title or description. |
 | <a id="groupworkitemssort"></a>`sort` | [`WorkItemSort`](#workitemsort) | Sort work items by criteria. |
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index 7be0d6afbeb..1b565d471a1 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -110,6 +110,26 @@ We've deprecated the use of `ref` and `sha` in API calls to `GET /projects/:id/c
 
 <div class="deprecation breaking-change" data-milestone="18.0">
 
+### Breaking change to the Maven repository group permissions
+
+<div class="deprecation-notes">
+- Announced in GitLab <span class="milestone">16.6</span>
+- Removal in GitLab <span class="milestone">18.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/393933).
+</div>
+
+The Maven repository exposes an API endpoint at the group level that allows Maven clients to download files from a specific package. The package finder first locates the package within the group, and then finds the file within the package.
+However, there is a limitation that affects duplicate package names hosted in different projects. The Maven package finder always returns the most recent package, but the "most recent" filter depends on user permissions. It is possible for a user with different permissions in different projects to download the wrong Maven package.
+
+In GitLab 18.0, the package finder logic will be fixed so that the "most recent" package is the last updated name and version of a package in a group. User permissions will be checked after the most recent package is found.
+After the change, download requests for users without correct permissions will be rejected. If your workflow depends on the current bugged behavior, this fix will introduce a breaking change.
+
+The change will be introduced in GitLab 16.6 behind a feature flag. If you are interested in enabling the feature flag for your group, leave a comment in [issue 393933](https://gitlab.com/gitlab-org/gitlab/-/issues/393933).
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="18.0">
+
 ### Default CI/CD job token (`CI_JOB_TOKEN`) scope changed
 
 <div class="deprecation-notes">
@@ -134,6 +154,24 @@ In 16.3, the names of these settings were changed to clarify their meanings: the
 
 <div class="deprecation breaking-change" data-milestone="18.0">
 
+### Dependency Proxy: Access tokens to have additional scope checks
+
+<div class="deprecation-notes">
+- Announced in GitLab <span class="milestone">16.7</span>
+- Removal in GitLab <span class="milestone">18.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/431386).
+</div>
+
+When using the Dependency Proxy for containers with a group access token or personal access token, `docker login` and `docker pull` requests with insufficient scopes for Dependency Proxy are not rejected.
+
+GitLab 18.0 adds checks for group or personal access tokens authenticating with the dependency proxy for containers. This is a breaking change, because tokens without the required scopes will fail.
+
+To help avoid being impacted by this breaking change, create new access tokens with the [required scopes](https://docs.gitlab.com/ee/user/packages/dependency_proxy/#authenticate-with-the-dependency-proxy), and update your workflow variables and scripts with those new tokens.
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="18.0">
+
 ### Deprecate License Scanning CI/CD artifact report type
 
 <div class="deprecation-notes">
@@ -708,26 +746,6 @@ can change `## Step - 1` to `## Step 1` to ensure in-page links continue to work
 
 <div class="deprecation breaking-change" data-milestone="17.0">
 
-### Breaking change to the Maven repository group permissions
-
-<div class="deprecation-notes">
-- Announced in GitLab <span class="milestone">16.6</span>
-- Removal in GitLab <span class="milestone">17.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
-- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/393933).
-</div>
-
-The Maven repository exposes an API endpoint at the group level that allows Maven clients to download files from a specific package. The package finder first locates the package within the group, and then finds the file within the package.
-However, there is a limitation that affects duplicate package names hosted in different projects. The Maven package finder always returns the most recent package, but the "most recent" filter depends on user permissions. It is possible for a user with different permissions in different projects to download the wrong Maven package.
-
-In GitLab 17.0, the package finder logic will be fixed so that the "most recent" package is the last updated name and version of a package in a group. User permissions will be checked after the most recent package is found.
-After the change, download requests for users without correct permissions will be rejected. If your workflow depends on the current bugged behavior, this fix will introduce a breaking change.
-
-The change will be introduced in GitLab 16.6 behind a feature flag. If you are interested in enabling the feature flag for your group, leave a comment in [issue 393933](https://gitlab.com/gitlab-org/gitlab/-/issues/393933).
-
-</div>
-
-<div class="deprecation breaking-change" data-milestone="17.0">
-
 ### CiRunner.projects default sort is changing to `id_desc`
 
 <div class="deprecation-notes">
@@ -794,24 +812,6 @@ These three variables will be removed in GitLab 17.0.
 
 <div class="deprecation breaking-change" data-milestone="17.0">
 
-### Dependency Proxy: Access tokens to have additional scope checks
-
-<div class="deprecation-notes">
-- Announced in GitLab <span class="milestone">16.7</span>
-- Removal in GitLab <span class="milestone">17.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
-- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/431386).
-</div>
-
-When using the Dependency Proxy for containers with a group access token or personal access token, `docker login` and `docker pull` requests with insufficient scopes for Dependency Proxy are not rejected.
-
-GitLab 17.0 adds checks for group or personal access tokens authenticating with the dependency proxy for containers. This is a breaking change, because tokens without the required scopes will fail.
-
-To help avoid being impacted by this breaking change, create new access tokens with the [required scopes](https://docs.gitlab.com/ee/user/packages/dependency_proxy/#authenticate-with-the-dependency-proxy), and update your workflow variables and scripts with those new tokens.
-
-</div>
-
-<div class="deprecation breaking-change" data-milestone="17.0">
-
 ### Dependency Scanning incorrect SBOM metadata properties
 
 <div class="deprecation-notes">
diff --git a/doc/user/ai_experiments.md b/doc/user/ai_experiments.md
new file mode 100644
index 00000000000..1a91c9a9e2f
--- /dev/null
+++ b/doc/user/ai_experiments.md
@@ -0,0 +1,176 @@
+---
+stage: AI-powered
+group: AI Model Validation
+description: AI-powered features and functionality.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# GitLab Duo Experiments
+
+The following GitLab Duo features are in the
+[Experiment](../policy/experiment-beta-support.md#experiment) phase.
+
+## Explain code in the Web UI with Code explanation
+
+DETAILS:
+**Tier:** Freely available for Premium and Ultimate for a limited time. In the future, will require Premium or Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md).
+**Offering:** GitLab.com
+**Status:** Experiment
+
+> - Introduced in GitLab 15.11 as an [Experiment](../policy/experiment-beta-support.md#experiment) on GitLab.com.
+
+To use this feature:
+
+- The parent group of the project must:
+  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
+- You must:
+  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
+  - Have sufficient permissions to view the project.
+
+GitLab can help you get up to speed faster if you:
+
+- Spend a lot of time trying to understand pieces of code that others have created, or
+- Struggle to understand code written in a language that you are not familiar with.
+
+By using a large language model, GitLab can explain the code in natural language.
+
+To explain your code:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select any file in your project that contains code.
+1. On the file, select the lines that you want to have explained.
+1. On the left side, select the question mark (**{question}**). You might have to scroll to the first line of your selection to view it. This sends the selected code, together with a prompt, to provide an explanation to the large language model.
+1. A drawer is displayed on the right side of the page. Wait a moment for the explanation to be generated.
+1. Provide feedback about how satisfied you are with the explanation, so we can improve the results.
+
+You can also have code explained in the context of a merge request. To explain
+code in a merge request:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Code > Merge requests**, then select your merge request.
+1. On the secondary menu, select **Changes**.
+1. On the file you would like explained, select the three dots (**{ellipsis_v}**) and select **View File @ $SHA**.
+
+   A separate browser tab opens and shows the full file with the latest changes.
+
+1. On the new tab, select the lines that you want to have explained.
+1. On the left side, select the question mark (**{question}**). You might have to scroll to the first line of your selection to view it. This sends the selected code, together with a prompt, to provide an explanation to the large language model.
+1. A drawer is displayed on the right side of the page. Wait a moment for the explanation to be generated.
+1. Provide feedback about how satisfied you are with the explanation, so we can improve the results.
+
+![How to use the Explain Code Experiment](img/explain_code_experiment.png)
+
+We cannot guarantee that the large language model produces results that are correct. Use the explanation with caution.
+
+## Summarize issue discussions with Discussion summary
+
+DETAILS:
+**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
+**Offering:** GitLab.com
+**Status:** Experiment
+
+> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10344) in GitLab 16.0 as an [Experiment](../policy/experiment-beta-support.md#experiment).
+
+To use this feature:
+
+- The parent group of the issue must:
+  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
+- You must:
+  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
+  - Have sufficient permissions to view the issue.
+
+You can generate a summary of discussions on an issue:
+
+1. In an issue, scroll to the **Activity** section.
+1. Select **View summary**.
+
+The comments in the issue are summarized in as many as 10 list items.
+The summary is displayed only for you.
+
+Provide feedback on this experimental feature in [issue 407779](https://gitlab.com/gitlab-org/gitlab/-/issues/407779).
+
+**Data usage**: When you use this feature, the text of all comments on the issue are sent to the large
+language model referenced above.
+
+## Forecast deployment frequency with Value stream forecasting
+
+DETAILS:
+**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
+**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Status:** Experiment
+
+> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10228) in GitLab 16.2 as an [Experiment](../policy/experiment-beta-support.md#experiment).
+
+To use this feature:
+
+- The parent group of the project must:
+  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
+- You must:
+  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
+  - Have sufficient permissions to view the CI/CD analytics.
+
+In CI/CD Analytics, you can view a forecast of deployment frequency:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Analyze > CI/CD analytics**.
+1. Select the **Deployment frequency** tab.
+1. Turn on the **Show forecast** toggle.
+1. On the confirmation dialog, select **Accept testing terms**.
+
+The forecast is displayed as a dotted line on the chart. Data is forecasted for a duration that is half of the selected date range.
+For example, if you select a 30-day range, a forecast for the following 15 days is displayed.
+
+![Forecast deployment frequency](img/forecast_deployment_frequency.png)
+
+Provide feedback on this experimental feature in [issue 416833](https://gitlab.com/gitlab-org/gitlab/-/issues/416833).
+
+## Root cause analysis
+
+DETAILS:
+**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
+**Offering:** GitLab.com
+**Status:** Experiment
+
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123692) in GitLab 16.2 as an [Experiment](../policy/experiment-beta-support.md#experiment).
+
+To use this feature:
+
+- The parent group of the project must:
+  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
+- You must:
+  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
+  - Have sufficient permissions to view the CI/CD job.
+
+When the feature is available, the "Root cause analysis" button will appears on
+a failed CI/CD job. Selecting this button generates an analysis regarding the
+reason for the failure.
+
+## Summarize an issue with Issue description generation
+
+DETAILS:
+**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
+**Offering:** GitLab.com
+**Status:** Experiment
+
+> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10762) in GitLab 16.3 as an [Experiment](../policy/experiment-beta-support.md#experiment).
+
+To use this feature:
+
+- The parent group of the project must:
+  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
+- You must:
+  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
+  - Have sufficient permissions to view the issue.
+
+You can generate the description for an issue from a short summary.
+
+1. Create a new issue.
+1. Above the **Description** field, select **AI actions > Generate issue description**.
+1. Write a short description and select **Submit**.
+
+The issue description is replaced with AI-generated text.
+
+Provide feedback on this experimental feature in [issue 409844](https://gitlab.com/gitlab-org/gitlab/-/issues/409844).
+
+**Data usage**: When you use this feature, the text you enter is sent to the large
+language model referenced above.
diff --git a/doc/user/ai_features.md b/doc/user/ai_features.md
index 3a050949618..bb17fda35d2 100644
--- a/doc/user/ai_features.md
+++ b/doc/user/ai_features.md
@@ -13,7 +13,9 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 GitLab Duo is a set of AI-assisted features across the GitLab DevSecOps platform. These features aim to help increase velocity and solve key pain points across the software development lifecycle. GitLab Duo features are accessible through the [IDE extension](../editor_extensions/index.md) and the GitLab UI. Some of the features are also accessible through [GitLab Duo Chat](gitlab_duo_chat.md), which is available in both interfaces.
 
-Some features are still in development. View details about [support for each status](../policy/experiment-beta-support.md#experiment) (Experiment, Beta, Generally Available). Learn more about how to [enable GitLab Duo features](ai_features_enable.md).
+Some features are still in development. [View features in the Experiment phase](ai_experiments.md).
+
+Learn more about how to [turn GitLab Duo features on and off](ai_features_enable.md).
 
 GitLab is [transparent](https://handbook.gitlab.com/handbook/values/#transparency). As GitLab Duo features mature, the documentation will be updated to clearly state how and where you can access these capabilities.
 
@@ -22,8 +24,8 @@ GitLab is [transparent](https://handbook.gitlab.com/handbook/values/#transparenc
 | Helps you write code more efficiently by showing code suggestions as you type.<br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=hCAyCTacdAQ) | [Code Suggestions](project/repository/code_suggestions/index.md) | **Tier:** Premium and Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com, Self-managed, GitLab Dedicated <br>**Status:** Generally Available |
 | Processes and generates text and code in a conversational manner. Helps you quickly identify useful information in large volumes of text in issues, epics, code, and GitLab documentation. | [Chat](gitlab_duo_chat.md) | **Tier:** Freely available for Premium and Ultimate for a limited time<br>**Offering:** GitLab.com, Self-managed, GitLab Dedicated <br>**Status:** Generally Available |
 | Helps you discover or recall Git commands when and where you need them. | [Git suggestions](../editor_extensions/gitlab_cli/index.md#gitlab-duo-commands) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com<br>**Status:** Experiment |
-| Assists with quickly getting everyone up to speed on lengthy conversations to help ensure you are all on the same page.  <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=IcdxLfTIUgc) | [Discussion summary](#summarize-issue-discussions-with-discussion-summary) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
-| Generates issue descriptions. | [Issue description generation](#summarize-an-issue-with-issue-description-generation) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
+| Assists with quickly getting everyone up to speed on lengthy conversations to help ensure you are all on the same page.  <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=IcdxLfTIUgc) | [Discussion summary](ai_experiments.md#summarize-issue-discussions-with-discussion-summary) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
+| Generates issue descriptions. | [Issue description generation](ai_experiments.md#summarize-an-issue-with-issue-description-generation) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
 | Automates repetitive tasks and helps catch bugs early. <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=g6MS1JsRWgs) | [Test generation](gitlab_duo_chat.md#write-tests-in-the-ide) | **Tier:** Freely available for Premium and Ultimate for a limited time<br>In the future, will require Premium or Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com, Self-managed, GitLab Dedicated <br>**Status:** Beta |
 | Generates a description for the merge request based on the contents of the template. | [Merge request template population](project/merge_requests/ai_in_merge_requests.md#fill-in-merge-request-templates) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com<br>**Status:** Experiment |
 | Assists in creating faster and higher-quality reviews by automatically suggesting reviewers for your merge request. <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=ivwZQgh4Rxw) | [Suggested Reviewers](project/merge_requests/reviews/index.md#gitlab-duo-suggested-reviewers) | **Tier:** Ultimate <br>**Offering:** GitLab.com<br>**Status:** Generally Available |
@@ -31,192 +33,22 @@ GitLab is [transparent](https://handbook.gitlab.com/handbook/values/#transparenc
 | Helps ease merge request handoff between authors and reviewers and help reviewers efficiently understand suggestions. | [Code review summary](project/merge_requests/ai_in_merge_requests.md#summarize-my-merge-request-review) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
 | Helps you remediate vulnerabilities more efficiently, boost your skills, and write more secure code. <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=6sDf73QOav8) | [Vulnerability explanation](application_security/vulnerabilities/index.md#explaining-a-vulnerability) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com <br>**Status:** Beta |
 | Generates a merge request containing the changes required to mitigate a vulnerability. | [Vulnerability resolution](application_security/vulnerabilities/index.md#vulnerability-resolution) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
-| Helps you understand code by explaining it in English language. <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=1izKaLmmaCA) | [Code explanation](#explain-code-in-the-web-ui-with-code-explanation) | **Tier:** Freely available for Premium and Ultimate for a limited time<br>In the future, will require Premium or Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com <br>**Status:** Experiment |
-| Assists you in determining the root cause for a pipeline failure and failed CI/CD build. | [Root cause analysis](#root-cause-analysis) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
-| Assists you with predicting productivity metrics and identifying anomalies across your software development lifecycle. | [Value stream forecasting](#forecast-deployment-frequency-with-value-stream-forecasting) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com, Self-managed, GitLab Dedicated <br>**Status:** Experiment |
+| Helps you understand code by explaining it in English language. <br><br><i class="fa fa-youtube-play youtube" aria-hidden="true"></i> [Watch overview](https://www.youtube.com/watch?v=1izKaLmmaCA) | [Code explanation](ai_experiments.md#explain-code-in-the-web-ui-with-code-explanation) | **Tier:** Freely available for Premium and Ultimate for a limited time<br>In the future, will require Premium or Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com <br>**Status:** Experiment |
+| Assists you in determining the root cause for a pipeline failure and failed CI/CD build. | [Root cause analysis](ai_experiments.md#root-cause-analysis) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md)<br>**Offering:** GitLab.com <br>**Status:** Experiment |
+| Assists you with predicting productivity metrics and identifying anomalies across your software development lifecycle. | [Value stream forecasting](ai_experiments.md#forecast-deployment-frequency-with-value-stream-forecasting) | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com, Self-managed, GitLab Dedicated <br>**Status:** Experiment |
 | Processes and responds to your questions about your application's usage data. | [Product Analytics](analytics/analytics_dashboards.md#generate-a-custom-visualization-with-gitlab-duo)             | **Tier:** Freely available for Ultimate for a limited time<br>In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md) <br>**Offering:** GitLab.com <br>**Status:** Experiment |
 
 ## Disable GitLab Duo features for specific groups or projects or an entire instance
 
 Disable GitLab Duo features by [following these instructions](ai_features_enable.md).
 
-## Experimental AI features and how to use them
-
-The following subsections describe GitLab Duo features that are in the
-Experiment phase.
-
-### Explain code in the Web UI with Code explanation
-
-DETAILS:
-**Tier:** Freely available for Premium and Ultimate for a limited time. In the future, will require Premium or Ultimate with [GitLab Duo Pro](../subscriptions/subscription-add-ons.md).
-**Offering:** GitLab.com
-**Status:** Experiment
-
-> - Introduced in GitLab 15.11 as an [Experiment](../policy/experiment-beta-support.md#experiment) on GitLab.com.
-
-To use this feature:
-
-- The parent group of the project must:
-  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
-- You must:
-  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
-  - Have sufficient permissions to view the project.
-
-GitLab can help you get up to speed faster if you:
-
-- Spend a lot of time trying to understand pieces of code that others have created, or
-- Struggle to understand code written in a language that you are not familiar with.
-
-By using a large language model, GitLab can explain the code in natural language.
-
-To explain your code:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select any file in your project that contains code.
-1. On the file, select the lines that you want to have explained.
-1. On the left side, select the question mark (**{question}**). You might have to scroll to the first line of your selection to view it. This sends the selected code, together with a prompt, to provide an explanation to the large language model.
-1. A drawer is displayed on the right side of the page. Wait a moment for the explanation to be generated.
-1. Provide feedback about how satisfied you are with the explanation, so we can improve the results.
-
-You can also have code explained in the context of a merge request. To explain
-code in a merge request:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select **Code > Merge requests**, then select your merge request.
-1. On the secondary menu, select **Changes**.
-1. On the file you would like explained, select the three dots (**{ellipsis_v}**) and select **View File @ $SHA**.
-
-   A separate browser tab opens and shows the full file with the latest changes.
-
-1. On the new tab, select the lines that you want to have explained.
-1. On the left side, select the question mark (**{question}**). You might have to scroll to the first line of your selection to view it. This sends the selected code, together with a prompt, to provide an explanation to the large language model.
-1. A drawer is displayed on the right side of the page. Wait a moment for the explanation to be generated.
-1. Provide feedback about how satisfied you are with the explanation, so we can improve the results.
-
-![How to use the Explain Code Experiment](img/explain_code_experiment.png)
-
-We cannot guarantee that the large language model produces results that are correct. Use the explanation with caution.
-
-### Summarize issue discussions with Discussion summary
-
-DETAILS:
-**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
-**Offering:** GitLab.com
-**Status:** Experiment
-
-> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10344) in GitLab 16.0 as an [Experiment](../policy/experiment-beta-support.md#experiment).
-
-To use this feature:
-
-- The parent group of the issue must:
-  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
-- You must:
-  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
-  - Have sufficient permissions to view the issue.
-
-You can generate a summary of discussions on an issue:
-
-1. In an issue, scroll to the **Activity** section.
-1. Select **View summary**.
-
-The comments in the issue are summarized in as many as 10 list items.
-The summary is displayed only for you.
-
-Provide feedback on this experimental feature in [issue 407779](https://gitlab.com/gitlab-org/gitlab/-/issues/407779).
-
-**Data usage**: When you use this feature, the text of all comments on the issue are sent to the large
-language model referenced above.
-
-### Forecast deployment frequency with Value stream forecasting
-
-DETAILS:
-**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
-**Status:** Experiment
-
-> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10228) in GitLab 16.2 as an [Experiment](../policy/experiment-beta-support.md#experiment).
-
-To use this feature:
-
-- The parent group of the project must:
-  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
-- You must:
-  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
-  - Have sufficient permissions to view the CI/CD analytics.
-
-In CI/CD Analytics, you can view a forecast of deployment frequency:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select **Analyze > CI/CD analytics**.
-1. Select the **Deployment frequency** tab.
-1. Turn on the **Show forecast** toggle.
-1. On the confirmation dialog, select **Accept testing terms**.
-
-The forecast is displayed as a dotted line on the chart. Data is forecasted for a duration that is half of the selected date range.
-For example, if you select a 30-day range, a forecast for the following 15 days is displayed.
-
-![Forecast deployment frequency](img/forecast_deployment_frequency.png)
-
-Provide feedback on this experimental feature in [issue 416833](https://gitlab.com/gitlab-org/gitlab/-/issues/416833).
-
-### Root cause analysis
-
-DETAILS:
-**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
-**Offering:** GitLab.com
-**Status:** Experiment
-
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123692) in GitLab 16.2 as an [Experiment](../policy/experiment-beta-support.md#experiment).
-
-To use this feature:
-
-- The parent group of the project must:
-  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
-- You must:
-  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
-  - Have sufficient permissions to view the CI/CD job.
-
-When the feature is available, the "Root cause analysis" button will appears on
-a failed CI/CD job. Selecting this button generates an analysis regarding the
-reason for the failure.
-
-### Summarize an issue with Issue description generation
-
-DETAILS:
-**Tier:** Freely available for Ultimate for a limited time. In the future, will require Ultimate with [GitLab Duo Enterprise](../subscriptions/subscription-add-ons.md).
-**Offering:** GitLab.com
-**Status:** Experiment
-
-> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10762) in GitLab 16.3 as an [Experiment](../policy/experiment-beta-support.md#experiment).
-
-To use this feature:
-
-- The parent group of the project must:
-  - Enable the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features).
-- You must:
-  - Belong to at least one group with the [experiment and beta features setting](group/manage.md#enable-experiment-and-beta-features) enabled.
-  - Have sufficient permissions to view the issue.
-
-You can generate the description for an issue from a short summary.
-
-1. Create a new issue.
-1. Above the **Description** field, select **AI actions > Generate issue description**.
-1. Write a short description and select **Submit**.
-
-The issue description is replaced with AI-generated text.
-
-Provide feedback on this experimental feature in [issue 409844](https://gitlab.com/gitlab-org/gitlab/-/issues/409844).
-
-**Data usage**: When you use this feature, the text you enter is sent to the large
-language model referenced above.
-
 ## Language models
 
 | Feature | Large Language Model |
 |---|---|
 | [Git suggestions](https://gitlab.com/gitlab-org/gitlab/-/issues/409636) | Vertex AI Codey [`codechat-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-chat) |
-| [Discussion summary](#summarize-issue-discussions-with-discussion-summary) |Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) |
-| [Issue description generation](#summarize-an-issue-with-issue-description-generation) | Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) |
+| [Discussion summary](ai_experiments.md#summarize-issue-discussions-with-discussion-summary) |Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) |
+| [Issue description generation](ai_experiments.md#summarize-an-issue-with-issue-description-generation) | Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) |
 | [Code Suggestions](project/repository/code_suggestions/index.md) | For Code Completion: Vertex AI Codey [`code-gecko`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-completion)    For Code Generation: Anthropic [`Claude-3-Sonnet`](https://docs.anthropic.com/claude/docs/models-overview) |
 | [Test generation](gitlab_duo_chat.md#write-tests-in-the-ide) | Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) |
 | [Merge request template population](project/merge_requests/ai_in_merge_requests.md#fill-in-merge-request-templates) | Vertex AI Codey [`text-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/text) |
@@ -225,10 +57,10 @@ language model referenced above.
 | [Code review summary](project/merge_requests/ai_in_merge_requests.md#summarize-my-merge-request-review) | Vertex AI Codey [`text-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/text) |
 | [Vulnerability explanation](application_security/vulnerabilities/index.md#explaining-a-vulnerability) | Vertex AI Codey [`text-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/text)    Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison) if degraded performance |
 | [Vulnerability resolution](application_security/vulnerabilities/index.md#explaining-a-vulnerability) | Vertex AI Codey [`code-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-generation) |
-| [Code explanation](#explain-code-in-the-web-ui-with-code-explanation) | Vertex AI Codey [`codechat-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-chat) |
+| [Code explanation](ai_experiments.md#explain-code-in-the-web-ui-with-code-explanation) | Vertex AI Codey [`codechat-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-chat) |
 | [GitLab Duo Chat](gitlab_duo_chat.md) | Anthropic [`Claude-2.1`](https://docs.anthropic.com/claude/docs/models-overview#model-comparison)    Vertex AI Codey [`textembedding-gecko`](https://cloud.google.com/vertex-ai/generative-ai/docs/embeddings/get-text-embeddings) |
-| [Root cause analysis](#root-cause-analysis) | Vertex AI Codey [`text-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/text) |
-| [Value stream forecasting](#forecast-deployment-frequency-with-value-stream-forecasting) | Statistical forecasting |
+| [Root cause analysis](ai_experiments.md#root-cause-analysis) | Vertex AI Codey [`text-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/text) |
+| [Value stream forecasting](ai_experiments.md#forecast-deployment-frequency-with-value-stream-forecasting) | Statistical forecasting |
 | [Product analytics](analytics/analytics_dashboards.md#generate-a-custom-visualization-with-gitlab-duo) | Vertex AI Codey [`codechat-bison`](https://cloud.google.com/vertex-ai/generative-ai/docs/model-reference/code-chat) |
 
 ## Data usage
diff --git a/doc/user/gitlab_duo_chat.md b/doc/user/gitlab_duo_chat.md
index bb85309c95b..b7e41330a0f 100644
--- a/doc/user/gitlab_duo_chat.md
+++ b/doc/user/gitlab_duo_chat.md
@@ -110,7 +110,7 @@ You can also ask to explain specific job errors by copy-pasting the error messag
 
 - `Please explain this CI/CD job error message in the context of a Go project: build.sh: line 14: go command not found`
 
-Alternatively, you can use [root cause analysis in CI/CD](ai_features.md#root-cause-analysis).
+Alternatively, you can use [root cause analysis in CI/CD](ai_experiments.md#root-cause-analysis).
 
 For more practical examples, see the [GitLab Duo examples](gitlab_duo_examples.md).
 
diff --git a/doc/user/gitlab_duo_examples.md b/doc/user/gitlab_duo_examples.md
index fec093bcf39..837a05fd241 100644
--- a/doc/user/gitlab_duo_examples.md
+++ b/doc/user/gitlab_duo_examples.md
@@ -48,7 +48,7 @@ CI/CD configuration is needed.
   Please show a .gitignore and .gitlab-ci.yml configuration for a C# project.
   ```
 
-- If your CI/CD job fails, [Root Cause Analysis](ai_features.md#root-cause-analysis)
+- If your CI/CD job fails, [Root Cause Analysis](ai_experiments.md#root-cause-analysis)
   can help understand the problem. Alternatively, you can copy the error message into
   GitLab Duo Chat, and ask for help:
 
diff --git a/doc/user/project/service_desk/configure.md b/doc/user/project/service_desk/configure.md
index 2a242c74feb..4bc8344f73b 100644
--- a/doc/user/project/service_desk/configure.md
+++ b/doc/user/project/service_desk/configure.md
@@ -99,12 +99,7 @@ To create a custom thank you email template:
 
 ### New participant email
 
-> - `new_participant` email [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/299261) in GitLab 17.0 [with a flag](../../../administration/feature_flags.md) named `issue_email_participants`. Disabled by default.
-> - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/299261) in GitLab 17.0.
-
-FLAG:
-The availability of this feature is controlled by a feature flag.
-For more information, see the history.
+> - `new_participant` email [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/299261) in GitLab 17.0.
 
 When an [external participant](external_participants.md) is added to the ticket, GitLab sends a **new participant email** to let them know they are part of the conversation.
 Without additional configuration, GitLab sends the default new participant email.
diff --git a/doc/user/project/service_desk/external_participants.md b/doc/user/project/service_desk/external_participants.md
index 6c9fbfea89b..f02ea9a1621 100644
--- a/doc/user/project/service_desk/external_participants.md
+++ b/doc/user/project/service_desk/external_participants.md
@@ -10,13 +10,7 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed
 
-> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/3758) in GitLab 17.0 [with a flag](../../../administration/feature_flags.md) named `issue_email_participants`. Disabled by default.
-> - [Enabled on GitLab.com](https://gitlab.com/groups/gitlab-org/-/epics/3758) in GitLab 17.0.
-
-FLAG:
-The availability of this feature is controlled by a feature flag.
-For more information, see the history.
-This feature is available for testing, but not ready for production use.
+> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/3758) in GitLab 17.0.
 
 External participants are users without a GitLab account that can interact with an issue or Service Desk ticket only by email.
 They get notified of public comments on an issue or ticket by [Service Desk emails](configure.md#customize-emails-sent-to-external-participants).
diff --git a/doc/user/report_abuse.md b/doc/user/report_abuse.md
index 70e0a245671..904eb466ede 100644
--- a/doc/user/report_abuse.md
+++ b/doc/user/report_abuse.md
@@ -35,7 +35,7 @@ You can report a user through their:
 To report abuse from a user's profile page:
 
 1. Anywhere in GitLab, select the name of the user.
-1. In the upper-right corner of the user's profile select the vertical ellipsis (**{ellipsis_v}**), then **Report abuse to administrator**.
+1. In the upper-right corner of the user's profile select the vertical ellipsis (**{ellipsis_v}**), then **Report abuse**.
 1. Select a reason for reporting the user.
 1. Complete an abuse report.
 1. Select **Send report**.
@@ -59,7 +59,7 @@ A URL to the reported user's comment is pre-filled in the abuse report's
 ## Report abuse from an issue
 
 1. On the issue, in the upper-right corner, select **Issue actions** (**{ellipsis_v}**).
-1. Select **Report abuse to administrator**.
+1. Select **Report abuse**.
 1. Select a reason for reporting the user.
 1. Complete an abuse report.
 1. Select **Send report**.
diff --git a/lib/gitlab/bitbucket_server_import/importers/pull_request_importer.rb b/lib/gitlab/bitbucket_server_import/importers/pull_request_importer.rb
index c474bf2af4e..6d743d69c27 100644
--- a/lib/gitlab/bitbucket_server_import/importers/pull_request_importer.rb
+++ b/lib/gitlab/bitbucket_server_import/importers/pull_request_importer.rb
@@ -56,7 +56,11 @@ module Gitlab
           description += author_line
           description += object[:description] if object[:description]
 
-          mentions_converter.convert(description)
+          if Feature.enabled?(:bitbucket_server_convert_mentions_to_users, project.creator)
+            description = mentions_converter.convert(description)
+          end
+
+          description
         end
 
         def author_line
diff --git a/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer.rb b/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer.rb
index c330b499af7..558a2ccff7b 100644
--- a/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer.rb
+++ b/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer.rb
@@ -225,7 +225,11 @@ module Gitlab
             note = "*By #{comment.author_username} (#{comment.author_email})*\n\n"
           end
 
-          comment_note = mentions_converter.convert(comment.note)
+          comment_note = if Feature.enabled?(:bitbucket_server_convert_mentions_to_users, project.creator)
+                           mentions_converter.convert(comment.note)
+                         else
+                           comment.note
+                         end
 
           note +=
             # Provide some context for replying
diff --git a/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml
index f11de5c12c5..63b928aa91c 100644
--- a/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml
@@ -134,7 +134,7 @@ semgrep-sast:
     name: "$SAST_ANALYZER_IMAGE"
   variables:
     SEARCH_MAX_DEPTH: 20
-    SAST_ANALYZER_IMAGE_TAG: 4
+    SAST_ANALYZER_IMAGE_TAG: 5
     SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/semgrep:$SAST_ANALYZER_IMAGE_TAG$SAST_IMAGE_SUFFIX"
   rules:
     - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
diff --git a/lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml
index 6b464134977..2dd8e87323b 100644
--- a/lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/SAST.latest.gitlab-ci.yml
@@ -145,7 +145,7 @@ semgrep-sast:
     name: "$SAST_ANALYZER_IMAGE"
   variables:
     SEARCH_MAX_DEPTH: 20
-    SAST_ANALYZER_IMAGE_TAG: 4
+    SAST_ANALYZER_IMAGE_TAG: 5
     SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/semgrep:$SAST_ANALYZER_IMAGE_TAG$SAST_IMAGE_SUFFIX"
   rules:
     - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1'
diff --git a/lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml
index bd9ab8d4915..8b1bdd1f60a 100644
--- a/lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml
@@ -153,12 +153,12 @@ secrets:
       - $SECURE_BINARIES_DOWNLOAD_IMAGES == "true" &&
           $SECURE_BINARIES_ANALYZERS =~ /\bsecrets\b/
   variables:
-    SECURE_BINARIES_ANALYZER_VERSION: "4"
+    SECURE_BINARIES_ANALYZER_VERSION: "6"
 
 semgrep:
   extends: .download_images
   variables:
-    SECURE_BINARIES_ANALYZER_VERSION: "3"
+    SECURE_BINARIES_ANALYZER_VERSION: "5"
   only:
     variables:
       - $SECURE_BINARIES_DOWNLOAD_IMAGES == "true" &&
diff --git a/lib/gitlab/xml_converter.rb b/lib/gitlab/xml_converter.rb
index 2c089ed1342..95def4f63ad 100644
--- a/lib/gitlab/xml_converter.rb
+++ b/lib/gitlab/xml_converter.rb
@@ -7,6 +7,8 @@ module Gitlab
   class XmlConverter < ActiveSupport::XMLConverter
     # Override the default Nokogiri parser in to allow parsing huge XML files
     def initialize(xml, disallowed_types = nil)
+      return unless xml.present?
+
       if xml.size > MAX_XML_SIZE
         raise ArgumentError, format(_("The XML file must be less than %{max_size} MB."),
           max_size: MAX_XML_SIZE / 1.megabyte)
@@ -19,6 +21,12 @@ module Gitlab
       @xml = normalize_keys(doc.to_hash)
       @disallowed_types = disallowed_types || DISALLOWED_TYPES
     end
+
+    def to_h
+      return unless @xml.present?
+
+      super
+    end
   end
 end
 # rubocop:enable Gitlab/NamespacedClass
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 3923ca03481..b95fd40e18a 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3104,6 +3104,9 @@ msgstr ""
 msgid "Add existing issue"
 msgstr ""
 
+msgid "Add group or project"
+msgstr ""
+
 msgid "Add header and footer to emails. Please note that color settings will only be applied within the application interface"
 msgstr ""
 
@@ -9740,7 +9743,7 @@ msgstr ""
 msgid "CI/CD limits"
 msgstr ""
 
-msgid "CI/CD|No projects have been added to the scope"
+msgid "CI/CD|No %{itemType}s have been added to the scope"
 msgstr ""
 
 msgid "CICDAnalytics|%{percent}%{percentSymbol}"
@@ -9796,7 +9799,7 @@ msgstr ""
 msgid "CICD|Add an existing project to the scope"
 msgstr ""
 
-msgid "CICD|Allow CI job tokens from the following projects to access this project"
+msgid "CICD|Allow access to this project from authorized groups or projects by adding them to the allowlist. It is a security risk to disable this feature, because unauthorized projects might attempt to retrieve an active token and access the API. %{linkStart}Learn more%{linkEnd}."
 msgstr ""
 
 msgid "CICD|Auto DevOps"
@@ -9829,7 +9832,7 @@ msgstr ""
 msgid "CICD|Enable feature to limit job token access to the following projects."
 msgstr ""
 
-msgid "CICD|Enable feature to limit job token access, so only the projects in this list can access this project with a CI/CD job token."
+msgid "CICD|Groups and projects with access"
 msgstr ""
 
 msgid "CICD|Jobs"
@@ -9847,15 +9850,15 @@ msgstr ""
 msgid "CICD|Maintainer"
 msgstr ""
 
+msgid "CICD|No access is currently allowed to this project. Enable feature to authorize access from groups or projects in the allowlist below."
+msgstr ""
+
 msgid "CICD|Pipelines and jobs cannot be cancelled"
 msgstr ""
 
 msgid "CICD|Prevent CI/CD job tokens from this project from being used to access other projects unless the other project is added to the allowlist. It is a security risk to disable this feature, because unauthorized projects might attempt to retrieve an active token and access the API. %{linkStart}Learn more%{linkEnd}."
 msgstr ""
 
-msgid "CICD|Prevent access to this project from other project CI/CD job tokens, unless the other project is added to the allowlist. It is a security risk to disable this feature, because unauthorized projects might attempt to retrieve an active token and access the API. %{linkStart}Learn more%{linkEnd}."
-msgstr ""
-
 msgid "CICD|The %{boldStart}Limit access %{boldEnd}%{italicAndBoldStart}from%{italicAndBoldEnd}%{boldStart} this project%{boldEnd} setting is deprecated and will be removed in the 18.0 milestone. Use the %{boldStart}Limit access %{boldEnd}%{italicAndBoldStart}to%{italicAndBoldEnd}%{boldStart} this project%{boldEnd} setting and allowlist instead. %{linkStart}How do I do this?%{linkEnd}"
 msgstr ""
 
@@ -37145,6 +37148,9 @@ msgstr ""
 msgid "Paste epic link"
 msgstr ""
 
+msgid "Paste group path (i.e. gitlab-org) or project path (i.e. gitlab-org/gitlab)"
+msgstr ""
+
 msgid "Paste issue link"
 msgstr ""
 
@@ -40157,9 +40163,6 @@ msgstr ""
 msgid "Project was not found or you do not have permission to add this project to Security Dashboards."
 msgstr ""
 
-msgid "Project with access"
-msgstr ""
-
 msgid "Project: %{name}"
 msgstr ""
 
@@ -40526,7 +40529,7 @@ msgstr ""
 msgid "ProjectSettings|Branches created from issues follow this pattern."
 msgstr ""
 
-msgid "ProjectSettings|Build, test, and deploy your changes."
+msgid "ProjectSettings|Build, test, and deploy your changes. Does not apply to project integrations."
 msgstr ""
 
 msgid "ProjectSettings|Checkbox is visible and selected by default."
@@ -43218,7 +43221,7 @@ msgstr ""
 msgid "ReportAbuse|Link to spam"
 msgstr ""
 
-msgid "ReportAbuse|Report abuse to administrator"
+msgid "ReportAbuse|Report abuse"
 msgstr ""
 
 msgid "ReportAbuse|Screenshot"
@@ -62311,6 +62314,9 @@ msgstr ""
 msgid "protected"
 msgstr ""
 
+msgid "push option"
+msgstr ""
+
 msgid "reCAPTCHA"
 msgstr ""
 
diff --git a/package.json b/package.json
index 53d110727a9..4955fdbcaca 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,7 @@
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/svgs": "3.97.0",
     "@gitlab/ui": "80.1.0",
-    "@gitlab/web-ide": "^0.0.1-dev-20240502073110",
+    "@gitlab/web-ide": "^0.0.1-dev-20240508140740",
     "@mattiasbuelens/web-streams-adapter": "^0.1.0",
     "@rails/actioncable": "7.0.8-1",
     "@rails/ujs": "7.0.8-1",
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/add_new_branch_rule_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/add_new_branch_rule_spec.rb
index 9a102fe0212..dd16e87a3c7 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/add_new_branch_rule_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/add_new_branch_rule_spec.rb
@@ -2,7 +2,11 @@
 
 module QA
   RSpec.describe 'Create' do
-    describe 'Branch Rules Overview', product_group: :source_code do
+    describe 'Branch Rules Overview', product_group: :source_code, quarantine: {
+      type: :investigating,
+      issue: "https://gitlab.com/gitlab-org/gitlab/-/issues/452392",
+      only: { pipeline: %i[staging staging-canary] }
+    } do
       let(:branch_name) { 'new-branch' }
       let(:allowed_to_push_role) { Resource::ProtectedBranch::Roles::NO_ONE }
       let(:allowed_to_merge_role) { Resource::ProtectedBranch::Roles::MAINTAINERS }
diff --git a/qa/qa/specs/features/browser_ui/4_verify/pipeline/pipeline_with_image_pull_policy_spec.rb b/qa/qa/specs/features/browser_ui/4_verify/pipeline/pipeline_with_image_pull_policy_spec.rb
index 74dc89fd358..3ee1ef083fc 100644
--- a/qa/qa/specs/features/browser_ui/4_verify/pipeline/pipeline_with_image_pull_policy_spec.rb
+++ b/qa/qa/specs/features/browser_ui/4_verify/pipeline/pipeline_with_image_pull_policy_spec.rb
@@ -60,7 +60,7 @@ module QA
         end
 
         with_them do
-          it 'applies pull policy in job correctly', :smoke, testcase: params[:testcase] do
+          it 'applies pull policy in job correctly', testcase: params[:testcase] do
             visit_job
 
             if pull_image
diff --git a/spec/controllers/projects/branches_controller_spec.rb b/spec/controllers/projects/branches_controller_spec.rb
index 600f8047a1d..a35365cbdf4 100644
--- a/spec/controllers/projects/branches_controller_spec.rb
+++ b/spec/controllers/projects/branches_controller_spec.rb
@@ -658,6 +658,18 @@ RSpec.describe Projects::BranchesController, feature_category: :source_code_mana
       end
     end
 
+    context 'when page param is invalid' do
+      before do
+        get :index, format: :html, params: {
+          namespace_id: project.namespace, project_id: project, state: 'all', page: [2]
+        }
+      end
+
+      it 'ignores the invalid param, rendering the first page' do
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
     context 'sorting', :aggregate_failures do
       let(:sort) { 'name_asc' }
 
diff --git a/spec/features/incidents/user_views_incident_spec.rb b/spec/features/incidents/user_views_incident_spec.rb
index 9cad7fd37f0..85761c393b0 100644
--- a/spec/features/incidents/user_views_incident_spec.rb
+++ b/spec/features/incidents/user_views_incident_spec.rb
@@ -46,7 +46,7 @@ RSpec.describe "User views incident", feature_category: :incident_management do
         it 'shows incident actions', :js do
           click_button 'Incident actions'
 
-          expect(page).to have_button 'Report abuse to administrator'
+          expect(page).to have_button 'Report abuse'
         end
       end
     end
diff --git a/spec/features/issues/issue_header_spec.rb b/spec/features/issues/issue_header_spec.rb
index 6c5daa29631..227ecd72c2e 100644
--- a/spec/features/issues/issue_header_spec.rb
+++ b/spec/features/issues/issue_header_spec.rb
@@ -27,7 +27,7 @@ RSpec.describe 'issue header', :js, feature_category: :team_planning do
 
       it 'shows the "New related issue", "Report abuse", and "Delete issue" items', :aggregate_failures do
         expect(page).to have_link 'New related issue'
-        expect(page).to have_button 'Report abuse to administrator'
+        expect(page).to have_button 'Report abuse'
         expect(page).to have_button 'Delete issue'
         expect(page).not_to have_link 'Submit as spam'
       end
@@ -71,7 +71,7 @@ RSpec.describe 'issue header', :js, feature_category: :team_planning do
       it 'does not show "Report abuse" button in dropdown' do
         click_button 'Issue actions'
 
-        expect(page).not_to have_button 'Report abuse to administrator'
+        expect(page).not_to have_button 'Report abuse'
       end
     end
   end
@@ -116,7 +116,7 @@ RSpec.describe 'issue header', :js, feature_category: :team_planning do
 
       it 'only shows the "New related issue" and "Report abuse" items', :aggregate_failures do
         expect(page).to have_link 'New related issue'
-        expect(page).to have_button 'Report abuse to administrator'
+        expect(page).to have_button 'Report abuse'
         expect(page).not_to have_link 'Submit as spam'
         expect(page).not_to have_button 'Delete issue'
       end
@@ -160,7 +160,7 @@ RSpec.describe 'issue header', :js, feature_category: :team_planning do
       it 'does not show "Report abuse" button in dropdown' do
         click_button 'Issue actions'
 
-        expect(page).not_to have_button 'Report abuse to administrator'
+        expect(page).not_to have_button 'Report abuse'
       end
     end
   end
diff --git a/spec/features/projects/releases/user_views_release_spec.rb b/spec/features/projects/releases/user_views_release_spec.rb
index 35e73c23e4b..545bb8ee15d 100644
--- a/spec/features/projects/releases/user_views_release_spec.rb
+++ b/spec/features/projects/releases/user_views_release_spec.rb
@@ -37,7 +37,7 @@ RSpec.describe 'User views Release', :js, feature_category: :continuous_delivery
   end
 
   it 'renders the release details' do
-    within('.release-block') do
+    within_testid('release-block') do
       expect(page).to have_content(release.name)
       expect(page).to have_content(release.tag)
       expect(page).to have_content(release.commit.short_id)
diff --git a/spec/features/projects/releases/user_views_releases_spec.rb b/spec/features/projects/releases/user_views_releases_spec.rb
index 9d0a6377d44..be37325d9d9 100644
--- a/spec/features/projects/releases/user_views_releases_spec.rb
+++ b/spec/features/projects/releases/user_views_releases_spec.rb
@@ -97,7 +97,7 @@ RSpec.describe 'User views releases', :js, feature_category: :continuous_deliver
 
       shared_examples 'releases sort order' do
         it "sorts the releases #{description}" do
-          card_titles = page.all('.release-block .card-title', minimum: expected_releases.count)
+          card_titles = page.all('[data-testid="release-block"] .gl-new-card-title', minimum: expected_releases.count)
 
           card_titles.each_with_index do |title, index|
             expect(title).to have_content(expected_releases[index].name)
@@ -133,7 +133,7 @@ RSpec.describe 'User views releases', :js, feature_category: :continuous_deliver
     it 'renders release info except for Git-related data' do
       visit project_releases_path(project)
 
-      within('.release-block', match: :first) do
+      within_testid('release-block', match: :first) do
         expect(page).to have_content(release_v3.description)
         expect(page).to have_content(release_v3.tag)
         expect(page).to have_content(release_v3.name)
diff --git a/spec/finders/issues_finder_spec.rb b/spec/finders/issues_finder_spec.rb
index f17d728b0b5..ed96622a10e 100644
--- a/spec/finders/issues_finder_spec.rb
+++ b/spec/finders/issues_finder_spec.rb
@@ -6,4 +6,67 @@ RSpec.describe IssuesFinder, feature_category: :team_planning do
   include_context 'Issues or WorkItems Finder context', :issue
 
   it_behaves_like 'issues or work items finder', :issue, '{Issues|WorkItems}Finder#execute context'
+
+  context 'when filtering by group_id' do
+    include_context '{Issues|WorkItems}Finder#execute context', :issue
+
+    let(:params) { { group_id: group.id } }
+    let(:scope) { 'all' }
+
+    context 'when include_subgroup param not set' do
+      it 'returns all group items' do
+        expect(items).to contain_exactly(item1, item5)
+      end
+
+      context 'when projects outside the group are passed' do
+        let(:params) { { group_id: group.id, projects: [project2.id] } }
+
+        it 'returns no items' do
+          expect(items).to be_empty
+        end
+      end
+
+      context 'when projects of the group are passed' do
+        let(:params) { { group_id: group.id, projects: [project1.id] } }
+
+        it 'returns the item within the group and projects' do
+          expect(items).to contain_exactly(item1, item5)
+        end
+      end
+
+      context 'when projects of the group are passed as a subquery' do
+        let(:params) { { group_id: group.id, projects: Project.id_in(project1.id) } }
+
+        it 'returns the item within the group and projects' do
+          expect(items).to contain_exactly(item1, item5)
+        end
+      end
+
+      context 'when release_tag is passed as a parameter' do
+        let(:params) { { group_id: group.id, release_tag: 'dne-release-tag' } }
+
+        it 'ignores the release_tag parameter' do
+          expect(items).to contain_exactly(item1, item5)
+        end
+      end
+    end
+
+    context 'when include_subgroup param is true' do
+      before do
+        params[:include_subgroups] = true
+      end
+
+      it 'returns all group and subgroup items' do
+        expect(items).to contain_exactly(item1, item4, item5)
+      end
+
+      context 'when mixed projects are passed' do
+        let(:params) { { group_id: group.id, projects: [project2.id, project3.id] } }
+
+        it 'returns the item within the group and projects' do
+          expect(items).to contain_exactly(item4)
+        end
+      end
+    end
+  end
 end
diff --git a/spec/finders/work_items/work_items_finder_spec.rb b/spec/finders/work_items/work_items_finder_spec.rb
index 24dba57b7a9..f2987450b71 100644
--- a/spec/finders/work_items/work_items_finder_spec.rb
+++ b/spec/finders/work_items/work_items_finder_spec.rb
@@ -10,18 +10,25 @@ RSpec.describe WorkItems::WorkItemsFinder, feature_category: :team_planning do
   context 'when group parameter is present' do
     include_context '{Issues|WorkItems}Finder#execute context', :work_item
 
-    let_it_be(:group_level_item) { create(:work_item, :group_level, namespace: group, author: user) }
-    let_it_be(:group_level_confidential_item) do
+    let_it_be(:group_work_item) { create(:work_item, :group_level, namespace: group, author: user) }
+    let_it_be(:group_confidential_work_item) do
       create(:work_item, :confidential, :group_level, namespace: group, author: user2)
     end
 
+    let_it_be(:subgroup_work_item) { create(:work_item, :group_level, namespace: subgroup, author: user) }
+    let_it_be(:subgroup_confidential_work_item) do
+      create(:work_item, :confidential, :group_level, namespace: subgroup, author: user2)
+    end
+
+    let_it_be(:subgroup2) { create(:group, :private, parent: group) }
+    let_it_be(:subgroup2_work_item) { create(:work_item, :group_level, namespace: subgroup2, author: user) }
+    let_it_be(:subgroup2_confidential_work_item) do
+      create(:work_item, :confidential, :group_level, namespace: subgroup2, author: user2)
+    end
+
     let(:params) { { group_id: group } }
     let(:scope) { 'all' }
 
-    it 'returns group level work items' do
-      expect(items).to contain_exactly(item1, item5, group_level_item)
-    end
-
     context 'when namespace_level_work_items is disabled' do
       before do
         stub_feature_flags(namespace_level_work_items: false)
@@ -32,24 +39,104 @@ RSpec.describe WorkItems::WorkItemsFinder, feature_category: :team_planning do
       end
     end
 
+    it 'returns group level work items' do
+      expect(items).to contain_exactly(group_work_item)
+    end
+
     context 'when user has access to confidential items' do
       before do
         group.add_reporter(user)
       end
 
       it 'includes confidential group-level items' do
-        expect(items).to contain_exactly(item1, item5, group_level_item, group_level_confidential_item)
+        expect(items).to contain_exactly(group_work_item, group_confidential_work_item)
+      end
+    end
+
+    context 'when include_descendants is true' do
+      before do
+        params[:include_descendants] = true
       end
 
-      context 'when namespace_level_work_items is disabled' do
-        before do
-          stub_feature_flags(namespace_level_work_items: false)
+      context 'when user does not have access to all subgroups' do
+        it 'includes work items from subgroups and child projects with access' do
+          expect(items).to contain_exactly(group_work_item, subgroup_work_item, item1, item4, item5)
+        end
+      end
+
+      context 'when user has read access to all subgroups' do
+        before_all do
+          subgroup2.add_guest(user)
         end
 
-        it 'only returns project-level items' do
-          expect(items).to contain_exactly(item1, item5)
+        it 'includes work items from subgroups and child projects with access' do
+          expect(items).to contain_exactly(
+            group_work_item,
+            subgroup_work_item,
+            subgroup2_work_item,
+            item1,
+            item4,
+            item5
+          )
         end
       end
+
+      context 'when user can access all confidential items' do
+        before_all do
+          group.add_reporter(user)
+        end
+
+        it 'includes confidential items from subgroups and child projects' do
+          expect(items).to contain_exactly(
+            group_work_item,
+            group_confidential_work_item,
+            subgroup_work_item,
+            subgroup_confidential_work_item,
+            subgroup2_work_item,
+            subgroup2_confidential_work_item,
+            item1,
+            item4,
+            item5
+          )
+        end
+      end
+
+      context 'when user can access confidential issues of certain subgroups only' do
+        before_all do
+          subgroup2.add_reporter(user)
+        end
+
+        it 'includes confidential items from subgroups and child projects with access' do
+          expect(items).to contain_exactly(
+            group_work_item,
+            subgroup_work_item,
+            subgroup2_work_item,
+            subgroup2_confidential_work_item,
+            item1,
+            item4,
+            item5
+          )
+        end
+      end
+    end
+
+    context 'when include_ancestors is true' do
+      let(:params) { { group_id: subgroup, include_ancestors: true } }
+
+      it 'includes work items from ancestor groups' do
+        expect(items).to contain_exactly(group_work_item, subgroup_work_item)
+      end
+    end
+
+    context 'when both include_descendants and include_ancestors are true' do
+      let_it_be(:sub_subgroup) { create(:group, parent: subgroup) }
+      let_it_be(:sub_subgroup_work_item) { create(:work_item, :group_level, namespace: sub_subgroup, author: user) }
+
+      let(:params) { { group_id: subgroup, include_descendants: true, include_ancestors: true } }
+
+      it 'includes work items from ancestor groups, subgroups, and child projects' do
+        expect(items).to contain_exactly(group_work_item, subgroup_work_item, sub_subgroup_work_item, item4)
+      end
     end
   end
 end
diff --git a/spec/frontend/ide/init_gitlab_web_ide_spec.js b/spec/frontend/ide/init_gitlab_web_ide_spec.js
index 3a75e110c73..69bd7c2a3a8 100644
--- a/spec/frontend/ide/init_gitlab_web_ide_spec.js
+++ b/spec/frontend/ide/init_gitlab_web_ide_spec.js
@@ -36,13 +36,13 @@ const TEST_START_REMOTE_PARAMS = {
   remotePath: '/test/projects/f oo',
   connectionToken: '123abc',
 };
-const TEST_EXTENSIONS_GALLERY_SETTINGS = JSON.stringify({
+const TEST_EXTENSIONS_GALLERY_SETTINGS = {
   enabled: true,
   vscode_settings: {
     item_url: 'https://gitlab.test/vscode/marketplace/item/url',
     service_url: 'https://gitlab.test/vscode/marketplace/service/url',
   },
-});
+};
 const TEST_EDITOR_FONT_SRC_URL = 'http://gitlab.test/assets/gitlab-mono/GitLabMono.woff2';
 const TEST_EDITOR_FONT_FORMAT = 'woff2';
 const TEST_EDITOR_FONT_FAMILY = 'GitLab Mono';
@@ -143,6 +143,7 @@ describe('ide/init_gitlab_web_ide', () => {
         },
         featureFlags: {
           settingsSync: true,
+          crossOriginExtensionHost: false,
         },
         editorFont: {
           fallbackFontFamily: 'monospace',
@@ -271,13 +272,16 @@ describe('ide/init_gitlab_web_ide', () => {
   });
 
   describe('when extensionsGallerySettings is in dataset', () => {
-    beforeEach(() => {
-      findRootElement().dataset.extensionsGallerySettings = TEST_EXTENSIONS_GALLERY_SETTINGS;
+    function setMockExtensionGallerySettingsDataset(
+      mockSettings = TEST_EXTENSIONS_GALLERY_SETTINGS,
+    ) {
+      findRootElement().dataset.extensionsGallerySettings = JSON.stringify(mockSettings);
 
       createSubject();
-    });
+    }
 
     it('calls start with element and extensionsGallerySettings', () => {
+      setMockExtensionGallerySettingsDataset();
       expect(start).toHaveBeenCalledTimes(1);
       expect(start).toHaveBeenCalledWith(
         findRootElement(),
@@ -292,5 +296,42 @@ describe('ide/init_gitlab_web_ide', () => {
         }),
       );
     });
+
+    it('calls start with element and crossOriginExtensionHost flag if extensionsGallerySettings is enabled', () => {
+      setMockExtensionGallerySettingsDataset();
+      expect(start).toHaveBeenCalledTimes(1);
+      expect(start).toHaveBeenCalledWith(
+        findRootElement(),
+        expect.objectContaining({
+          featureFlags: {
+            settingsSync: true,
+            crossOriginExtensionHost: true,
+          },
+        }),
+      );
+    });
+
+    it.each(['opt_in_unset', 'opt_in_disabled'])(
+      'calls start with element and crossOriginExtensionHost flag if extensionsGallerySettings reason is $reason',
+      (reason) => {
+        const TEST_EXTENSIONS_GALLERY_SETTINGS_WITH_REASON = {
+          ...TEST_EXTENSIONS_GALLERY_SETTINGS,
+          enabled: false,
+          reason,
+        };
+        setMockExtensionGallerySettingsDataset(TEST_EXTENSIONS_GALLERY_SETTINGS_WITH_REASON);
+
+        expect(start).toHaveBeenCalledTimes(1);
+        expect(start).toHaveBeenCalledWith(
+          findRootElement(),
+          expect.objectContaining({
+            featureFlags: {
+              settingsSync: true,
+              crossOriginExtensionHost: true,
+            },
+          }),
+        );
+      },
+    );
   });
 });
diff --git a/spec/frontend/issues/show/components/header_actions_spec.js b/spec/frontend/issues/show/components/header_actions_spec.js
index d52167c2db4..5c4d90e60c0 100644
--- a/spec/frontend/issues/show/components/header_actions_spec.js
+++ b/spec/frontend/issues/show/components/header_actions_spec.js
@@ -257,19 +257,19 @@ describe('HeaderActions component', () => {
       ${'desktop dropdown'} | ${findDesktopDropdownItems}
     `('$description', ({ findDropdownItems }) => {
       describe.each`
-        description                               | itemText                           | isItemVisible | canUpdateIssue | canCreateIssue | isIssueAuthor | canReportSpam | canPromoteToEpic | canDestroyIssue
-        ${`when user can update ${issueType}`}    | ${`Close ${issueType}`}            | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${`when user cannot update ${issueType}`} | ${`Close ${issueType}`}            | ${false}      | ${false}       | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${`when user can create ${issueType}`}    | ${`New related ${issueType}`}      | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${`when user cannot create ${issueType}`} | ${`New related ${issueType}`}      | ${false}      | ${true}        | ${false}       | ${true}       | ${true}       | ${true}          | ${true}
-        ${'when user can promote to epic'}        | ${'Promote to epic'}               | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${'when user cannot promote to epic'}     | ${'Promote to epic'}               | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${false}         | ${true}
-        ${'when user can report abuse'}           | ${'Report abuse to administrator'} | ${true}       | ${true}        | ${true}        | ${false}      | ${true}       | ${true}          | ${true}
-        ${'when user cannot report abuse'}        | ${'Report abuse to administrator'} | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${'when user can submit as spam'}         | ${'Submit as spam'}                | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${'when user cannot submit as spam'}      | ${'Submit as spam'}                | ${false}      | ${true}        | ${true}        | ${true}       | ${false}      | ${true}          | ${true}
-        ${`when user can delete ${issueType}`}    | ${`Delete ${issueType}`}           | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
-        ${`when user cannot delete ${issueType}`} | ${`Delete ${issueType}`}           | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${false}
+        description                               | itemText                      | isItemVisible | canUpdateIssue | canCreateIssue | isIssueAuthor | canReportSpam | canPromoteToEpic | canDestroyIssue
+        ${`when user can update ${issueType}`}    | ${`Close ${issueType}`}       | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${`when user cannot update ${issueType}`} | ${`Close ${issueType}`}       | ${false}      | ${false}       | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${`when user can create ${issueType}`}    | ${`New related ${issueType}`} | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${`when user cannot create ${issueType}`} | ${`New related ${issueType}`} | ${false}      | ${true}        | ${false}       | ${true}       | ${true}       | ${true}          | ${true}
+        ${'when user can promote to epic'}        | ${'Promote to epic'}          | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${'when user cannot promote to epic'}     | ${'Promote to epic'}          | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${false}         | ${true}
+        ${'when user can report abuse'}           | ${'Report abuse'}             | ${true}       | ${true}        | ${true}        | ${false}      | ${true}       | ${true}          | ${true}
+        ${'when user cannot report abuse'}        | ${'Report abuse'}             | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${'when user can submit as spam'}         | ${'Submit as spam'}           | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${'when user cannot submit as spam'}      | ${'Submit as spam'}           | ${false}      | ${true}        | ${true}        | ${true}       | ${false}      | ${true}          | ${true}
+        ${`when user can delete ${issueType}`}    | ${`Delete ${issueType}`}      | ${true}       | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${true}
+        ${`when user cannot delete ${issueType}`} | ${`Delete ${issueType}`}      | ${false}      | ${true}        | ${true}        | ${true}       | ${true}       | ${true}          | ${false}
       `(
         '$description',
         ({
diff --git a/spec/frontend/packages_and_registries/infrastructure_registry/components/details/components/__snapshots__/file_sha_spec.js.snap b/spec/frontend/packages_and_registries/infrastructure_registry/components/details/components/__snapshots__/file_sha_spec.js.snap
index a544a679ff4..eb71b81ab17 100644
--- a/spec/frontend/packages_and_registries/infrastructure_registry/components/details/components/__snapshots__/file_sha_spec.js.snap
+++ b/spec/frontend/packages_and_registries/infrastructure_registry/components/details/components/__snapshots__/file_sha_spec.js.snap
@@ -2,7 +2,7 @@
 
 exports[`FileSha renders 1`] = `
 <div
-  class="gl-align-items-top gl-border-b-1 gl-border-b-solid gl-border-gray-100 gl-display-flex gl-font-monospace gl-font-sm gl-py-2 gl-word-break-all"
+  class="gl-align-items-top gl-border-b-1 gl-border-b-solid gl-border-gray-100 gl-break-all gl-display-flex gl-font-monospace gl-font-sm gl-py-2"
 >
   <div>
     <div
diff --git a/spec/frontend/packages_and_registries/package_registry/components/details/__snapshots__/file_sha_spec.js.snap b/spec/frontend/packages_and_registries/package_registry/components/details/__snapshots__/file_sha_spec.js.snap
index a544a679ff4..eb71b81ab17 100644
--- a/spec/frontend/packages_and_registries/package_registry/components/details/__snapshots__/file_sha_spec.js.snap
+++ b/spec/frontend/packages_and_registries/package_registry/components/details/__snapshots__/file_sha_spec.js.snap
@@ -2,7 +2,7 @@
 
 exports[`FileSha renders 1`] = `
 <div
-  class="gl-align-items-top gl-border-b-1 gl-border-b-solid gl-border-gray-100 gl-display-flex gl-font-monospace gl-font-sm gl-py-2 gl-word-break-all"
+  class="gl-align-items-top gl-border-b-1 gl-border-b-solid gl-border-gray-100 gl-break-all gl-display-flex gl-font-monospace gl-font-sm gl-py-2"
 >
   <div>
     <div
diff --git a/spec/frontend/packages_and_registries/package_registry/components/list/__snapshots__/package_list_row_spec.js.snap b/spec/frontend/packages_and_registries/package_registry/components/list/__snapshots__/package_list_row_spec.js.snap
index 42a800b6317..0183449b8d2 100644
--- a/spec/frontend/packages_and_registries/package_registry/components/list/__snapshots__/package_list_row_spec.js.snap
+++ b/spec/frontend/packages_and_registries/package_registry/components/list/__snapshots__/package_list_row_spec.js.snap
@@ -30,7 +30,7 @@ exports[`packages_list_row renders 1`] = `
             data-testid="package-name"
           >
             <a
-              class="gl-min-w-0 gl-text-body gl-word-break-all"
+              class="gl-break-all gl-min-w-0 gl-text-body"
               data-testid="details-link"
             >
               @gitlab-org/package-15
diff --git a/spec/frontend/releases/components/release_block_header_spec.js b/spec/frontend/releases/components/release_block_header_spec.js
index dd39a1bce53..25f221bf659 100644
--- a/spec/frontend/releases/components/release_block_header_spec.js
+++ b/spec/frontend/releases/components/release_block_header_spec.js
@@ -1,4 +1,4 @@
-import { GlLink, GlBadge } from '@gitlab/ui';
+import { GlCard, GlLink, GlBadge } from '@gitlab/ui';
 import { merge } from 'lodash';
 import originalRelease from 'test_fixtures/api/releases/release.json';
 import setWindowLocation from 'helpers/set_window_location_helper';
@@ -17,7 +17,7 @@ describe('Release block header', () => {
       propsData: {
         release: merge({}, release, releaseUpdates),
       },
-      stubs: { GlBadge },
+      stubs: { GlCard, GlBadge },
     });
   };
 
@@ -25,7 +25,7 @@ describe('Release block header', () => {
     release = convertObjectPropsToCamelCase(originalRelease, { deep: true });
   });
 
-  const findHeader = () => wrapper.find('h2');
+  const findHeader = () => wrapper.findByTestId('release-block-title');
   const findHeaderLink = () => findHeader().findComponent(GlLink);
   const findEditButton = () => wrapper.find('.js-edit-button');
   const findBadge = () => wrapper.findComponent(GlBadge);
diff --git a/spec/frontend/token_access/inbound_token_access_spec.js b/spec/frontend/token_access/inbound_token_access_spec.js
index d82d65e3549..a7b0a9820b5 100644
--- a/spec/frontend/token_access/inbound_token_access_spec.js
+++ b/spec/frontend/token_access/inbound_token_access_spec.js
@@ -6,21 +6,24 @@ import { mountExtended, shallowMountExtended } from 'helpers/vue_test_utils_help
 import waitForPromises from 'helpers/wait_for_promises';
 import { createAlert } from '~/alert';
 import InboundTokenAccess from '~/token_access/components/inbound_token_access.vue';
-import inboundAddProjectCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_add_project_ci_job_token_scope.mutation.graphql';
+import inboundAddGroupOrProjectCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_add_group_or_project_ci_job_token_scope.mutation.graphql';
+import inboundRemoveGroupCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_remove_group_ci_job_token_scope.mutation.graphql';
 import inboundRemoveProjectCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_remove_project_ci_job_token_scope.mutation.graphql';
 import inboundUpdateCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_update_ci_job_token_scope.mutation.graphql';
 import inboundGetCIJobTokenScopeQuery from '~/token_access/graphql/queries/inbound_get_ci_job_token_scope.query.graphql';
-import inboundGetProjectsWithCIJobTokenScopeQuery from '~/token_access/graphql/queries/inbound_get_projects_with_ci_job_token_scope.query.graphql';
+import inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery from '~/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql';
 import {
   inboundJobTokenScopeEnabledResponse,
   inboundJobTokenScopeDisabledResponse,
-  inboundProjectsWithScopeResponse,
-  inboundAddProjectSuccessResponse,
+  inboundGroupsAndProjectsWithScopeResponse,
+  inboundAddGroupOrProjectSuccessResponse,
+  inboundRemoveGroupSuccess,
   inboundRemoveProjectSuccess,
   inboundUpdateScopeSuccessResponse,
 } from './mock_data';
 
 const projectPath = 'root/my-repo';
+const testGroupPath = 'gitlab-org';
 const testProjectPath = 'root/test';
 const message = 'An error occurred';
 const error = new Error(message);
@@ -38,12 +41,13 @@ describe('TokenAccess component', () => {
   const inboundJobTokenScopeDisabledResponseHandler = jest
     .fn()
     .mockResolvedValue(inboundJobTokenScopeDisabledResponse);
-  const inboundProjectsWithScopeResponseHandler = jest
+  const inboundGroupsAndProjectsWithScopeResponseHandler = jest
     .fn()
-    .mockResolvedValue(inboundProjectsWithScopeResponse);
-  const inboundAddProjectSuccessResponseHandler = jest
+    .mockResolvedValue(inboundGroupsAndProjectsWithScopeResponse);
+  const inboundAddGroupOrProjectSuccessResponseHandler = jest
     .fn()
-    .mockResolvedValue(inboundAddProjectSuccessResponse);
+    .mockResolvedValue(inboundAddGroupOrProjectSuccessResponse);
+  const inboundRemoveGroupSuccessHandler = jest.fn().mockResolvedValue(inboundRemoveGroupSuccess);
   const inboundRemoveProjectSuccessHandler = jest
     .fn()
     .mockResolvedValue(inboundRemoveProjectSuccess);
@@ -57,7 +61,8 @@ describe('TokenAccess component', () => {
   const findAddProjectBtn = () => wrapper.findByTestId('add-project-btn');
   const findCancelBtn = () => wrapper.findByRole('button', { name: 'Cancel' });
   const findProjectInput = () => wrapper.findComponent(GlFormInput);
-  const findRemoveProjectBtn = () => wrapper.findByRole('button', { name: 'Remove access' });
+  const findRemoveProjectBtnAt = (i) =>
+    wrapper.findAllByRole('button', { name: 'Remove access' }).at(i);
   const findToggleFormBtn = () => wrapper.findByTestId('toggle-form-btn');
   const findTokenDisabledAlert = () => wrapper.findComponent(GlAlert);
 
@@ -78,7 +83,10 @@ describe('TokenAccess component', () => {
     it('shows loading state while waiting on query to resolve', async () => {
       createComponent([
         [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
       ]);
 
       expect(findLoadingIcon().exists()).toBe(true);
@@ -89,25 +97,30 @@ describe('TokenAccess component', () => {
     });
   });
 
-  describe('fetching projects and scope', () => {
-    it('fetches projects and scope correctly', () => {
+  describe('fetching groups and projects and scope', () => {
+    it('fetches groups and projects and scope correctly', () => {
       const expectedVariables = {
         fullPath: 'root/my-repo',
       };
 
       createComponent([
         [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
       ]);
 
       expect(inboundJobTokenScopeEnabledResponseHandler).toHaveBeenCalledWith(expectedVariables);
-      expect(inboundProjectsWithScopeResponseHandler).toHaveBeenCalledWith(expectedVariables);
+      expect(inboundGroupsAndProjectsWithScopeResponseHandler).toHaveBeenCalledWith(
+        expectedVariables,
+      );
     });
 
-    it('handles fetch projects error correctly', async () => {
+    it('handles fetch groups and projects error correctly', async () => {
       createComponent([
         [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, failureHandler],
+        [inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery, failureHandler],
       ]);
 
       await waitForPromises();
@@ -120,7 +133,10 @@ describe('TokenAccess component', () => {
     it('handles fetch scope error correctly', async () => {
       createComponent([
         [inboundGetCIJobTokenScopeQuery, failureHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
       ]);
 
       await waitForPromises();
@@ -135,7 +151,10 @@ describe('TokenAccess component', () => {
     it('the toggle is on and the alert is hidden', async () => {
       createComponent([
         [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
       ]);
 
       await waitForPromises();
@@ -147,7 +166,10 @@ describe('TokenAccess component', () => {
     it('the toggle is off and the alert is visible', async () => {
       createComponent([
         [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeDisabledResponseHandler],
-        [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
       ]);
 
       await waitForPromises();
@@ -206,13 +228,23 @@ describe('TokenAccess component', () => {
     });
   });
 
-  describe('add project', () => {
-    it('calls add project mutation', async () => {
+  describe.each`
+    type         | testPath
+    ${'group'}   | ${testGroupPath}
+    ${'project'} | ${testProjectPath}
+  `('add $type', ({ testPath }) => {
+    it(`calls add group or project mutation`, async () => {
       createComponent(
         [
           [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-          [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
-          [inboundAddProjectCIJobTokenScopeMutation, inboundAddProjectSuccessResponseHandler],
+          [
+            inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+            inboundGroupsAndProjectsWithScopeResponseHandler,
+          ],
+          [
+            inboundAddGroupOrProjectCIJobTokenScopeMutation,
+            inboundAddGroupOrProjectSuccessResponseHandler,
+          ],
         ],
         mountExtended,
       );
@@ -220,21 +252,24 @@ describe('TokenAccess component', () => {
       await waitForPromises();
 
       await findToggleFormBtn().trigger('click');
-      await findProjectInput().vm.$emit('input', testProjectPath);
+      await findProjectInput().vm.$emit('input', testPath);
       findAddProjectBtn().trigger('click');
 
-      expect(inboundAddProjectSuccessResponseHandler).toHaveBeenCalledWith({
+      expect(inboundAddGroupOrProjectSuccessResponseHandler).toHaveBeenCalledWith({
         projectPath,
-        targetProjectPath: testProjectPath,
+        targetPath: testPath,
       });
     });
 
-    it('add project handles error correctly', async () => {
+    it('add group or project handles error correctly', async () => {
       createComponent(
         [
           [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-          [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
-          [inboundAddProjectCIJobTokenScopeMutation, failureHandler],
+          [
+            inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+            inboundGroupsAndProjectsWithScopeResponseHandler,
+          ],
+          [inboundAddGroupOrProjectCIJobTokenScopeMutation, failureHandler],
         ],
         mountExtended,
       );
@@ -242,7 +277,7 @@ describe('TokenAccess component', () => {
       await waitForPromises();
 
       await findToggleFormBtn().trigger('click');
-      await findProjectInput().vm.$emit('input', testProjectPath);
+      await findProjectInput().vm.$emit('input', testPath);
       findAddProjectBtn().trigger('click');
 
       await waitForPromises();
@@ -254,7 +289,10 @@ describe('TokenAccess component', () => {
       createComponent(
         [
           [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-          [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
+          [
+            inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+            inboundGroupsAndProjectsWithScopeResponseHandler,
+          ],
         ],
         mountExtended,
       );
@@ -265,7 +303,7 @@ describe('TokenAccess component', () => {
 
       expect(findProjectInput().exists()).toBe(true);
 
-      await findProjectInput().vm.$emit('input', testProjectPath);
+      await findProjectInput().vm.$emit('input', testPath);
 
       await findCancelBtn().trigger('click');
 
@@ -277,40 +315,50 @@ describe('TokenAccess component', () => {
     });
   });
 
-  describe('remove project', () => {
-    it('calls remove project mutation', async () => {
+  describe.each`
+    type         | index | mutation                                       | handler                               | target
+    ${'group'}   | ${0}  | ${inboundRemoveGroupCIJobTokenScopeMutation}   | ${inboundRemoveGroupSuccessHandler}   | ${'targetGroupPath'}
+    ${'project'} | ${1}  | ${inboundRemoveProjectCIJobTokenScopeMutation} | ${inboundRemoveProjectSuccessHandler} | ${'targetProjectPath'}
+  `('remove $type', ({ type, index, mutation, handler, target }) => {
+    it(`calls remove ${type} mutation`, async () => {
       createComponent(
         [
           [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-          [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
-          [inboundRemoveProjectCIJobTokenScopeMutation, inboundRemoveProjectSuccessHandler],
+          [
+            inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+            inboundGroupsAndProjectsWithScopeResponseHandler,
+          ],
+          [mutation, handler],
         ],
         mountExtended,
       );
 
       await waitForPromises();
 
-      findRemoveProjectBtn().trigger('click');
+      findRemoveProjectBtnAt(index).trigger('click');
 
-      expect(inboundRemoveProjectSuccessHandler).toHaveBeenCalledWith({
+      expect(handler).toHaveBeenCalledWith({
         projectPath,
-        targetProjectPath: 'root/ci-project',
+        [target]: expect.any(String),
       });
     });
 
-    it('remove project handles error correctly', async () => {
+    it(`remove ${type} handles error correctly`, async () => {
       createComponent(
         [
           [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
-          [inboundGetProjectsWithCIJobTokenScopeQuery, inboundProjectsWithScopeResponseHandler],
-          [inboundRemoveProjectCIJobTokenScopeMutation, failureHandler],
+          [
+            inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+            inboundGroupsAndProjectsWithScopeResponseHandler,
+          ],
+          [mutation, failureHandler],
         ],
         mountExtended,
       );
 
       await waitForPromises();
 
-      findRemoveProjectBtn().trigger('click');
+      findRemoveProjectBtnAt(index).trigger('click');
 
       await waitForPromises();
 
diff --git a/spec/frontend/token_access/mock_data.js b/spec/frontend/token_access/mock_data.js
index a4b5532108a..a3521f49eb7 100644
--- a/spec/frontend/token_access/mock_data.js
+++ b/spec/frontend/token_access/mock_data.js
@@ -81,9 +81,30 @@ export const updateScopeSuccess = {
   },
 };
 
+export const mockGroups = [
+  {
+    id: 1,
+    name: 'some-group',
+    fullPath: 'some-group',
+    __typename: 'Group',
+  },
+  {
+    id: 2,
+    name: 'another-group',
+    fullPath: 'another-group',
+    __typename: 'Group',
+  },
+  {
+    id: 3,
+    name: 'a-sub-group',
+    fullPath: 'another-group/a-sub-group',
+    __typename: 'Group',
+  },
+];
+
 export const mockProjects = [
   {
-    id: '1',
+    id: 1,
     name: 'merge-train-stuff',
     namespace: {
       id: '1235',
@@ -94,7 +115,7 @@ export const mockProjects = [
     __typename: 'Project',
   },
   {
-    id: '2',
+    id: 2,
     name: 'ci-project',
     namespace: {
       id: '1236',
@@ -108,12 +129,8 @@ export const mockProjects = [
 
 export const mockFields = [
   {
-    key: 'project',
-    label: 'Project with access',
-  },
-  {
-    key: 'namespace',
-    label: 'Namespace',
+    key: 'fullPath',
+    label: '',
   },
   {
     key: 'actions',
@@ -147,7 +164,7 @@ export const inboundJobTokenScopeDisabledResponse = {
   },
 };
 
-export const inboundProjectsWithScopeResponse = {
+export const inboundGroupsAndProjectsWithScopeResponse = {
   data: {
     project: {
       __typename: 'Project',
@@ -166,12 +183,23 @@ export const inboundProjectsWithScopeResponse = {
             },
           ],
         },
+        groupsAllowlist: {
+          __typename: 'GroupConnection',
+          nodes: [
+            {
+              __typename: 'Group',
+              fullPath: 'root/ci-group',
+              id: 'gid://gitlab/Group/45',
+              name: 'ci-group',
+            },
+          ],
+        },
       },
     },
   },
 };
 
-export const inboundAddProjectSuccessResponse = {
+export const inboundAddGroupOrProjectSuccessResponse = {
   data: {
     ciJobTokenScopeAddProject: {
       errors: [],
@@ -180,6 +208,15 @@ export const inboundAddProjectSuccessResponse = {
   },
 };
 
+export const inboundRemoveGroupSuccess = {
+  data: {
+    ciJobTokenScopeRemoveProject: {
+      errors: [],
+      __typename: 'CiJobTokenScopeRemoveGroupPayload',
+    },
+  },
+};
+
 export const inboundRemoveProjectSuccess = {
   data: {
     ciJobTokenScopeRemoveProject: {
diff --git a/spec/frontend/token_access/token_access_table_spec.js b/spec/frontend/token_access/token_access_table_spec.js
new file mode 100644
index 00000000000..df5c19028b3
--- /dev/null
+++ b/spec/frontend/token_access/token_access_table_spec.js
@@ -0,0 +1,56 @@
+import { GlButton, GlTableLite } from '@gitlab/ui';
+import { mountExtended } from 'helpers/vue_test_utils_helper';
+import TokenAccessTable from '~/token_access/components/token_access_table.vue';
+import { mockGroups, mockProjects, mockFields } from './mock_data';
+
+describe('Token access table', () => {
+  let wrapper;
+
+  const createComponent = (props) => {
+    wrapper = mountExtended(TokenAccessTable, {
+      provide: {
+        fullPath: 'root/ci-project',
+      },
+      propsData: {
+        ...props,
+      },
+    });
+  };
+
+  const findTable = () => wrapper.findComponent(GlTableLite);
+  const findDeleteButton = () => wrapper.findComponent(GlButton);
+  const findAllTableRows = (type) => wrapper.findAllByTestId(`${type}s-token-table-row`);
+  const findName = (type) => wrapper.findByTestId(`token-access-${type}-name`);
+
+  describe.each`
+    type         | isGroup  | items
+    ${'group'}   | ${true}  | ${mockGroups}
+    ${'project'} | ${false} | ${mockProjects}
+  `('when provided with $type', ({ type, isGroup, items }) => {
+    beforeEach(() => {
+      createComponent({
+        isGroup,
+        items,
+        tableFields: mockFields,
+      });
+    });
+
+    it('displays a table', () => {
+      expect(findTable().exists()).toBe(true);
+    });
+
+    it('displays the correct amount of table rows', () => {
+      expect(findAllTableRows(type)).toHaveLength(items.length);
+    });
+
+    it('delete button emits event with correct item to delete', async () => {
+      await findDeleteButton().trigger('click');
+
+      expect(wrapper.emitted('removeItem')).toEqual([[items[0]]]);
+    });
+
+    it('displays fullpath', () => {
+      expect(findName(type).text()).toBe(items[0].fullPath);
+    });
+  });
+});
diff --git a/spec/frontend/token_access/token_projects_table_spec.js b/spec/frontend/token_access/token_projects_table_spec.js
deleted file mode 100644
index 7a78befa0d7..00000000000
--- a/spec/frontend/token_access/token_projects_table_spec.js
+++ /dev/null
@@ -1,64 +0,0 @@
-import { GlTable, GlButton } from '@gitlab/ui';
-import { mountExtended } from 'helpers/vue_test_utils_helper';
-import TokenProjectsTable from '~/token_access/components/token_projects_table.vue';
-import { mockProjects, mockFields } from './mock_data';
-
-describe('Token projects table', () => {
-  let wrapper;
-
-  const defaultProps = {
-    tableFields: mockFields,
-    projects: mockProjects,
-  };
-
-  const createComponent = (props) => {
-    wrapper = mountExtended(TokenProjectsTable, {
-      provide: {
-        fullPath: 'root/ci-project',
-      },
-      propsData: {
-        ...defaultProps,
-        ...props,
-      },
-    });
-  };
-
-  const findTable = () => wrapper.findComponent(GlTable);
-  const findDeleteProjectBtn = () => wrapper.findComponent(GlButton);
-  const findAllDeleteProjectBtn = () => wrapper.findAllComponents(GlButton);
-  const findAllTableRows = () => wrapper.findAllByTestId('projects-token-table-row');
-  const findProjectNameCell = () => wrapper.findByTestId('token-access-project-name');
-
-  it('displays a table', () => {
-    createComponent();
-
-    expect(findTable().exists()).toBe(true);
-  });
-
-  it('displays the correct amount of table rows', () => {
-    createComponent();
-
-    expect(findAllTableRows()).toHaveLength(mockProjects.length);
-  });
-
-  it('delete project button emits event with correct project to delete', async () => {
-    createComponent();
-
-    await findDeleteProjectBtn().trigger('click');
-
-    expect(wrapper.emitted('removeProject')).toEqual([[mockProjects[0].fullPath]]);
-  });
-
-  it('does not show the remove icon if the project is locked', () => {
-    createComponent();
-
-    // currently two mock projects with one being a locked project
-    expect(findAllDeleteProjectBtn()).toHaveLength(1);
-  });
-
-  it('displays project fullpath', () => {
-    createComponent();
-
-    expect(findProjectNameCell().text()).toBe('root/merge-train-stuff');
-  });
-});
diff --git a/spec/helpers/markup_helper_spec.rb b/spec/helpers/markup_helper_spec.rb
index f5cfb7dcafa..dc540bcc327 100644
--- a/spec/helpers/markup_helper_spec.rb
+++ b/spec/helpers/markup_helper_spec.rb
@@ -25,7 +25,7 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
   end
 
   describe "#markdown" do
-    describe "referencing multiple objects" do
+    context "referencing multiple objects" do
       let(:actual) { "#{merge_request.to_reference} -> #{commit.to_reference} -> #{issue.to_reference}" }
 
       it "links to the merge request" do
@@ -44,7 +44,7 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
       end
     end
 
-    describe "override default project" do
+    context "override default project" do
       let(:actual) { issue.to_reference }
 
       let_it_be(:second_project) { create(:project, :public) }
@@ -56,7 +56,7 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
       end
     end
 
-    describe 'uploads' do
+    context 'uploads' do
       let(:text) { "![ImageTest](/uploads/test.png)" }
 
       let_it_be(:group) { create(:group) }
@@ -69,7 +69,7 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
         end
       end
 
-      describe 'inside a group' do
+      context 'inside a group' do
         before do
           helper.instance_variable_set(:@group, group)
           helper.instance_variable_set(:@project, nil)
@@ -80,7 +80,7 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
         end
       end
 
-      describe "with a group in the context" do
+      context "with a group in the context" do
         let_it_be(:project_in_group) { create(:project, group: group) }
 
         before do
@@ -153,6 +153,17 @@ RSpec.describe MarkupHelper, feature_category: :team_planning do
         end
       end
     end
+
+    context 'when there is a postprocessing option provided' do
+      it 'passes the postprocess options to the Markup::RenderingService' do
+        expect(Markup::RenderingService)
+          .to receive(:new)
+          .with('test', context: anything,
+            postprocess_context: a_hash_including(requested_path: 'path')).and_call_original
+
+        helper.markdown('test', {}, { requested_path: 'path' })
+      end
+    end
   end
 
   describe '#markdown_field' do
diff --git a/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_importer_spec.rb b/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_importer_spec.rb
index c3aa25669a8..9c11fb67f78 100644
--- a/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_importer_spec.rb
+++ b/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_importer_spec.rb
@@ -55,6 +55,18 @@ RSpec.describe Gitlab::BitbucketServerImport::Importers::PullRequestImporter, fe
       end
     end
 
+    context 'when the `bitbucket_server_convert_mentions_to_users` flag is disabled' do
+      before do
+        stub_feature_flags(bitbucket_server_convert_mentions_to_users: false)
+      end
+
+      it 'does not convert mentions' do
+        expect_next(Gitlab::Import::MentionsConverter, 'bitbucket_server', project).not_to receive(:convert)
+
+        importer.execute
+      end
+    end
+
     context 'when the `bitbucket_server_user_mapping_by_username` flag is disabled' do
       before do
         stub_feature_flags(bitbucket_server_user_mapping_by_username: false)
diff --git a/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer_spec.rb b/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer_spec.rb
index 5d7142ea593..e4f2854299a 100644
--- a/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer_spec.rb
+++ b/spec/lib/gitlab/bitbucket_server_import/importers/pull_request_notes_importer_spec.rb
@@ -180,6 +180,18 @@ RSpec.describe Gitlab::BitbucketServerImport::Importers::PullRequestNotesImporte
           end
         end
 
+        context 'when the `bitbucket_server_convert_mentions_to_users` flag is disabled' do
+          before do
+            stub_feature_flags(bitbucket_server_convert_mentions_to_users: false)
+          end
+
+          it 'does not convert mentions' do
+            expect(mentions_converter).not_to receive(:convert)
+
+            subject.execute
+          end
+        end
+
         it 'logs its progress' do
           expect_log(stage: 'import_standalone_pr_comments', message: 'starting')
           expect_log(stage: 'import_standalone_pr_comments', message: 'finished')
@@ -262,6 +274,18 @@ RSpec.describe Gitlab::BitbucketServerImport::Importers::PullRequestNotesImporte
           expect(reply_note.position.new_line).to eq(pr_inline_note.new_pos)
         end
 
+        context 'when the `bitbucket_server_convert_mentions_to_users` flag is disabled' do
+          before do
+            stub_feature_flags(bitbucket_server_convert_mentions_to_users: false)
+          end
+
+          it 'does not convert mentions' do
+            expect(mentions_converter).not_to receive(:convert)
+
+            subject.execute
+          end
+        end
+
         it 'logs its progress' do
           expect_log(stage: 'import_inline_comments', message: 'starting')
           expect_log(stage: 'import_inline_comments', message: 'finished')
diff --git a/spec/lib/gitlab/ci/parsers/test/junit_spec.rb b/spec/lib/gitlab/ci/parsers/test/junit_spec.rb
index 77a693f1d0d..03d9b1d5816 100644
--- a/spec/lib/gitlab/ci/parsers/test/junit_spec.rb
+++ b/spec/lib/gitlab/ci/parsers/test/junit_spec.rb
@@ -543,6 +543,20 @@ RSpec.describe Gitlab::Ci::Parsers::Test::Junit do
       end
     end
 
+    context 'when XML is empty string' do
+      let(:junit) { '' }
+
+      it 'returns 0 tests cases and has no errors' do
+        expect { subject }.not_to raise_error
+        expect(test_suite.suite_error).to be_nil
+
+        expect(test_cases).to be_empty
+        expect(test_suite.total_count).to eq(0)
+        expect(test_suite.success_count).to eq(0)
+        expect(test_suite.error_count).to eq(0)
+      end
+    end
+
     private
 
     def flattened_test_cases(test_suite)
diff --git a/spec/lib/gitlab/database/sharding_key_spec.rb b/spec/lib/gitlab/database/sharding_key_spec.rb
index 6f5fd0a465e..fe1ba0cbc31 100644
--- a/spec/lib/gitlab/database/sharding_key_spec.rb
+++ b/spec/lib/gitlab/database/sharding_key_spec.rb
@@ -71,7 +71,6 @@ RSpec.describe 'new tables missing sharding_key', feature_category: :cell do
       'ci_job_artifacts.project_id',
       'ci_namespace_monthly_usages.namespace_id', # https://gitlab.com/gitlab-org/gitlab/-/issues/321400
       'ci_builds_metadata.project_id',
-      'geo_repository_deleted_events.project_id', # https://gitlab.com/gitlab-org/gitlab/-/issues/439935
       'ldap_group_links.group_id',
       'namespace_descendants.namespace_id',
       'p_batched_git_ref_updates_deletions.project_id',
diff --git a/spec/lib/gitlab/xml_converter_spec.rb b/spec/lib/gitlab/xml_converter_spec.rb
index de513012758..8555a0d628a 100644
--- a/spec/lib/gitlab/xml_converter_spec.rb
+++ b/spec/lib/gitlab/xml_converter_spec.rb
@@ -36,5 +36,13 @@ RSpec.describe ::Gitlab::XmlConverter, feature_category: :pipeline_composition d
         expect { to_h }.to raise_error(ArgumentError, "The XML file must be less than 30 MB.")
       end
     end
+
+    context "when the xml is empty" do
+      let(:xml_data) { '' }
+
+      it "returns nil" do
+        expect(to_h).to eq(nil)
+      end
+    end
   end
 end
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index ca0bbf137a0..ec676a503c6 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -2523,36 +2523,7 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
 
       it { is_expected.to be_instance_of(Gitlab::Ci::Variables::Collection) }
 
-      context 'when feature flag remove_shared_jwts enabled' do
-        it { expect(subject.to_runner_variables).to eq(predefined_variables) }
-      end
-
-      context 'when feature flag remove_shared_jwts disabled' do
-        before do
-          stub_feature_flags(remove_shared_jwts: false)
-          predefined_variables.insert(11,
-            *[{ key: 'CI_JOB_JWT', value: 'ci.job.jwt', public: false, masked: true },
-            { key: 'CI_JOB_JWT_V1', value: 'ci.job.jwt', public: false, masked: true },
-            { key: 'CI_JOB_JWT_V2', value: 'ci.job.jwtv2', public: false, masked: true }])
-        end
-
-        it { expect(subject.to_runner_variables).to eq(predefined_variables) }
-
-        context 'when CI_JOB_JWT generation fails' do
-          [
-            OpenSSL::PKey::RSAError,
-            Gitlab::Ci::Jwt::NoSigningKeyError
-          ].each do |reason_to_fail|
-            it 'CI_JOB_JWT is not included' do
-              expect(Gitlab::Ci::Jwt).to receive(:for_build).and_raise(reason_to_fail)
-              expect(Gitlab::ErrorTracking).to receive(:track_exception)
-
-              expect { subject }.not_to raise_error
-              expect(subject.pluck(:key)).not_to include('CI_JOB_JWT')
-            end
-          end
-        end
-      end
+      it { expect(subject.to_runner_variables).to eq(predefined_variables) }
 
       it 'excludes variables that require an environment or user' do
         environment_based_variables_collection = subject.filter do |variable|
diff --git a/spec/requests/api/graphql/ci/catalog/resource_spec.rb b/spec/requests/api/graphql/ci/catalog/resource_spec.rb
index 876b9b76c6a..c3d8edb2175 100644
--- a/spec/requests/api/graphql/ci/catalog/resource_spec.rb
+++ b/spec/requests/api/graphql/ci/catalog/resource_spec.rb
@@ -274,6 +274,10 @@ RSpec.describe 'Query.ciCatalogResource', feature_category: :pipeline_compositio
         end
 
         it 'returns the version that matches the name' do
+          expect(::MarkupHelper).to receive(:markdown).with(
+            version1.readme.data, anything, { requested_path: version1.readme.path }
+          ).and_call_original
+
           post_query
 
           expect(graphql_data_at(:ciCatalogResource, :versions, :nodes)).to contain_exactly(
diff --git a/spec/requests/api/graphql/group/work_items_spec.rb b/spec/requests/api/graphql/group/work_items_spec.rb
index 5e9ec7f1e42..8c81be2981c 100644
--- a/spec/requests/api/graphql/group/work_items_spec.rb
+++ b/spec/requests/api/graphql/group/work_items_spec.rb
@@ -77,10 +77,7 @@ RSpec.describe 'getting a work_item list for a group', feature_category: :team_p
     it 'does not return confidential issues' do
       post_graphql(query, current_user: current_user)
 
-      expect(work_item_ids).to contain_exactly(
-        project_work_item.to_global_id.to_s,
-        group_work_item.to_global_id.to_s
-      )
+      expect(work_item_ids).to contain_exactly(group_work_item.to_global_id.to_s)
     end
   end
 
@@ -91,12 +88,41 @@ RSpec.describe 'getting a work_item list for a group', feature_category: :team_p
       post_graphql(query, current_user: current_user)
 
       expect(work_item_ids).to contain_exactly(
-        project_work_item.to_global_id.to_s,
         confidential_work_item.to_global_id.to_s,
         group_work_item.to_global_id.to_s
       )
     end
 
+    context 'when include_ancestors is true' do
+      let(:query_group) { sub_group }
+      let(:item_filter_params) { { include_ancestors: true } }
+
+      it 'includes ancestor group work items' do
+        post_graphql(query, current_user: current_user)
+
+        expect(work_item_ids).to contain_exactly(
+          confidential_work_item.to_global_id.to_s,
+          group_work_item.to_global_id.to_s,
+          sub_group_work_item.to_global_id.to_s
+        )
+      end
+    end
+
+    context 'when include_descendants is true' do
+      let(:item_filter_params) { { include_descendants: true } }
+
+      it 'includes subgroup and descendant project work items' do
+        post_graphql(query, current_user: current_user)
+
+        expect(work_item_ids).to contain_exactly(
+          confidential_work_item.to_global_id.to_s,
+          group_work_item.to_global_id.to_s,
+          sub_group_work_item.to_global_id.to_s,
+          project_work_item.to_global_id.to_s
+        )
+      end
+    end
+
     context 'when the namespace_level_work_items feature flag is disabled' do
       before do
         stub_feature_flags(namespace_level_work_items: false)
diff --git a/spec/requests/api/graphql/mutations/ci/runner/cache/clear_spec.rb b/spec/requests/api/graphql/mutations/ci/runner/cache/clear_spec.rb
new file mode 100644
index 00000000000..1859217b38a
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/ci/runner/cache/clear_spec.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'RunnerCacheClear', feature_category: :runner do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be_with_reload(:project) { create(:project, jobs_cache_index: 1) }
+
+  let(:mutation) do
+    graphql_mutation(:runner_cache_clear, { project_id: project.to_global_id.to_s }, 'errors')
+  end
+
+  let(:mutation_response) { graphql_mutation_response(:runner_cache_clear) }
+
+  context 'when the user has admin pipeline permission on the given project' do
+    before_all do
+      project.add_maintainer(current_user)
+    end
+
+    it 'clears the runner cache' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+      end.to change { project.reload.jobs_cache_index }.by(1)
+
+      expect(mutation_response['errors']).to be_empty
+    end
+  end
+
+  context 'when the user does not have admin pipeline permission' do
+    it_behaves_like 'a mutation that returns a top-level access error'
+
+    it 'does not clear the runner cache' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+      end.not_to change { project.reload.jobs_cache_index }
+    end
+  end
+end
diff --git a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
index be822b048b0..839d5b5fce5 100644
--- a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
+++ b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
@@ -203,66 +203,6 @@ RSpec.shared_examples 'issues or work items finder' do |factory, execute_context
         end
       end
 
-      context 'filtering by group_id' do
-        let(:params) { { group_id: group.id } }
-
-        context 'when include_subgroup param not set' do
-          it 'returns all group items' do
-            expect(items).to contain_exactly(item1, item5)
-          end
-
-          context 'when projects outside the group are passed' do
-            let(:params) { { group_id: group.id, projects: [project2.id] } }
-
-            it 'returns no items' do
-              expect(items).to be_empty
-            end
-          end
-
-          context 'when projects of the group are passed' do
-            let(:params) { { group_id: group.id, projects: [project1.id] } }
-
-            it 'returns the item within the group and projects' do
-              expect(items).to contain_exactly(item1, item5)
-            end
-          end
-
-          context 'when projects of the group are passed as a subquery' do
-            let(:params) { { group_id: group.id, projects: Project.id_in(project1.id) } }
-
-            it 'returns the item within the group and projects' do
-              expect(items).to contain_exactly(item1, item5)
-            end
-          end
-
-          context 'when release_tag is passed as a parameter' do
-            let(:params) { { group_id: group.id, release_tag: 'dne-release-tag' } }
-
-            it 'ignores the release_tag parameter' do
-              expect(items).to contain_exactly(item1, item5)
-            end
-          end
-        end
-
-        context 'when include_subgroup param is true' do
-          before do
-            params[:include_subgroups] = true
-          end
-
-          it 'returns all group and subgroup items' do
-            expect(items).to contain_exactly(item1, item4, item5)
-          end
-
-          context 'when mixed projects are passed' do
-            let(:params) { { group_id: group.id, projects: [project2.id, project3.id] } }
-
-            it 'returns the item within the group and projects' do
-              expect(items).to contain_exactly(item4)
-            end
-          end
-        end
-      end
-
       context 'filtering by author' do
         context 'by author ID' do
           let(:params) { { author_id: user2.id } }
diff --git a/spec/workers/gitlab/bitbucket_server_import/stage/import_repository_worker_spec.rb b/spec/workers/gitlab/bitbucket_server_import/stage/import_repository_worker_spec.rb
index 605ae643bcf..1531b30089c 100644
--- a/spec/workers/gitlab/bitbucket_server_import/stage/import_repository_worker_spec.rb
+++ b/spec/workers/gitlab/bitbucket_server_import/stage/import_repository_worker_spec.rb
@@ -24,6 +24,19 @@ RSpec.describe Gitlab::BitbucketServerImport::Stage::ImportRepositoryWorker, fea
         worker.perform(project.id)
       end
 
+      context 'when the bitbucket_server_convert_mentions_to_users flag is disabled' do
+        before do
+          stub_feature_flags(bitbucket_server_convert_mentions_to_users: false)
+        end
+
+        it 'skips the user import and schedules the next stage' do
+          expect(Gitlab::BitbucketServerImport::Stage::ImportPullRequestsWorker).to receive(:perform_async)
+            .with(project.id)
+
+          worker.perform(project.id)
+        end
+      end
+
       it 'logs stage start and finish' do
         expect(Gitlab::BitbucketServerImport::Logger)
           .to receive(:info).with(hash_including(message: 'starting stage', project_id: project.id))
diff --git a/vendor/gems/sidekiq-7.1.6/test/web_test.rb b/vendor/gems/sidekiq-7.1.6/test/web_test.rb
index c28d39f64ee..d4f635e48f4 100644
--- a/vendor/gems/sidekiq-7.1.6/test/web_test.rb
+++ b/vendor/gems/sidekiq-7.1.6/test/web_test.rb
@@ -127,9 +127,12 @@ describe Sidekiq::Web do
   end
 
   it "can display queues" do
-    assert Sidekiq::Client.push("queue" => :foo, "class" => WebJob, "args" => [1, 3])
+    Time.stub(:now, Time.now) do
+      assert Sidekiq::Client.push("queue" => :foo, "class" => WebJob, "args" => [1, 3])
+
+      get "/queues"
+    end
 
-    get "/queues"
     assert_equal 200, last_response.status
     assert_match(/foo/, last_response.body)
     refute_match(/HardJob/, last_response.body)
diff --git a/yarn.lock b/yarn.lock
index 53dca27bb81..329bfe13578 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1346,10 +1346,10 @@
     portal-vue "^2.1.6"
     vue-runtime-helpers "^1.1.2"
 
-"@gitlab/web-ide@^0.0.1-dev-20240502073110":
-  version "0.0.1-dev-20240502073110"
-  resolved "https://registry.yarnpkg.com/@gitlab/web-ide/-/web-ide-0.0.1-dev-20240502073110.tgz#71700be05b66d2a8da1a30052c0cc5da0351796b"
-  integrity sha512-uVaKHzRAFunyE5rjnbWXnUvclSxaEDBmjrx8nP8N7aBP+3+CE2Hid5JK58z39sFQx1K72gQ0EhTgRpbIZskJGg==
+"@gitlab/web-ide@^0.0.1-dev-20240508140740":
+  version "0.0.1-dev-20240508140740"
+  resolved "https://registry.yarnpkg.com/@gitlab/web-ide/-/web-ide-0.0.1-dev-20240508140740.tgz#571d3bc2905bd15971ea99f67860b89c0737071d"
+  integrity sha512-rZrkICiCT58AbNQaqiI1CLOW74yURFuxN5A+O2Rx1Kd1DIygyXgYtJ6mtqaiaqPCMx+32CaXhz0wVfbxMnbGSw==
 
 "@graphql-eslint/eslint-plugin@3.20.1":
   version "3.20.1"