From 48419e9a6f1396e5bfbef3b90b34d5dc37d3d7cc Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Thu, 19 Dec 2024 00:31:47 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .rubocop_todo/performance/flat_map.yml        |   1 +
 GITLAB_KAS_VERSION                            |   2 +-
 Gemfile.checksum                              |   2 +-
 Gemfile.lock                                  |   2 +-
 Gemfile.next.checksum                         |   2 +-
 Gemfile.next.lock                             |   2 +-
 .../javascripts/blob_edit/blob_bundle.js      |   9 +-
 .../javascripts/blob_edit/blob_edit_header.js |  42 ++
 app/assets/javascripts/blob_edit/edit_blob.js |   4 +
 .../pipeline_mini_graph/job_action_button.vue |   2 +-
 .../ci/pipeline_mini_graph/pipeline_stage.vue |   9 +-
 .../javascripts/invite_members/constants.js   |   6 +-
 .../components/model_experiments_header.vue   |  10 +-
 .../notes/components/comment_form.vue         |  43 +-
 .../components/toggle_replies_widget.vue      |   2 +-
 app/assets/javascripts/notes/i18n.js          |   2 +
 .../components/commit_changes_modal.vue       |  50 +-
 .../repository/pages/blob_edit_header.vue     | 128 ++++
 app/helpers/blob_helper.rb                    |  15 +
 .../concerns/web_hooks/auto_disabling.rb      |  12 +-
 .../chat_message/pipeline_message.rb          |   2 +-
 app/views/projects/blob/edit.html.haml        |  19 +-
 config/initializers/01_secret_token.rb        |  23 +-
 .../initializers/active_record_encryption.rb  |  14 +
 .../delete_orphaned_project_namespaces.yml    |   8 +
 ...ets_to_incidents_for_parity_with_issues.rb |  37 ++
 ...ueue_delete_orphaned_project_namespaces.rb |  29 +
 db/schema_migrations/20241125145919           |   1 +
 db/schema_migrations/20241218091609           |   1 +
 .../dedicated/configure_instance.md           | 578 +-----------------
 .../dedicated/configure_instance/index.md     | 113 ++++
 .../configure_instance/network_security.md    | 281 +++++++++
 .../dedicated/configure_instance/saml.md      | 132 ++++
 .../configure_instance/users_notifications.md |  50 ++
 .../dedicated/create_instance.md              |   8 +-
 .../dedicated/hosted_runners.md               |   2 +-
 doc/administration/dedicated/index.md         |   6 +-
 doc/administration/dedicated/monitor.md       |  36 ++
 doc/development/application_secrets.md        |  80 ++-
 doc/subscriptions/gitlab_dedicated/index.md   |  18 +-
 .../gitlab_dedicated_for_government/index.md  |   4 +-
 .../vulnerability_management_policy.md        |  10 +-
 .../vulnerabilities/index.md                  |  16 +-
 .../vulnerability_report/index.md             |   9 -
 doc/user/group/saml_sso/troubleshooting.md    |   2 +-
 doc/user/profile/comment_templates.md         |   8 +-
 .../members/sharing_projects_groups.md        |  31 +-
 .../delete_orphaned_project_namespaces.rb     |  35 ++
 .../migration_helpers/work_items/widgets.rb   |  16 +-
 .../work_items/base_type_importer.rb          |   4 +
 locale/gitlab.pot                             |   9 +-
 package.json                                  |   2 +-
 qa/qa/page/component/note.rb                  |  14 +
 qa/qa/page/file/shared/editor.rb              |  26 +
 qa/qa/page/file/show.rb                       |   5 +-
 .../file/delete_file_via_web_spec.rb          |   3 +-
 .../repository/file/edit_file_via_web_spec.rb |   3 +-
 .../source_editor_toolbar_spec.rb             |   3 +-
 .../user/user_inherited_access_spec.rb        |   5 +-
 qa/qa/tools/ci/non_empty_suites.rb            |  87 +++
 qa/qa/tools/ci/runnable_specs.rb              |  94 ---
 qa/spec/tools/ci/non_empty_suites_spec.rb     |  19 +
 qa/spec/tools/ci/runnables_specs_spec.rb      |  67 --
 qa/tasks/ci.rake                              |   2 +-
 scripts/rspec_helpers.sh                      |  88 ++-
 .../merge_request/batch_comments_spec.rb      |   2 +-
 .../maintainer_edits_fork_spec.rb             |   7 +
 spec/features/projects/blobs/edit_spec.rb     |  26 +-
 .../projects/files/editing_a_file_spec.rb     |  14 +-
 .../projects/files/user_edits_files_spec.rb   |  80 ++-
 .../files/user_replaces_files_spec.rb         |   2 +-
 spec/frontend/blob_edit/blob_bundle_spec.js   |   5 +-
 spec/frontend/blob_edit/edit_blob_spec.js     |   9 +-
 .../pipeline_stage_spec.js                    |  57 +-
 .../components/invite_modal_base_spec.js      |   2 +-
 .../model_experiments_header_spec.js          |   8 -
 .../notes/components/comment_form_spec.js     |  26 +-
 .../components/commit_changes_modal_spec.js   | 130 ++--
 .../repository/pages/blob_edit_header_spec.js | 142 +++++
 spec/helpers/blob_helper_spec.rb              |  86 ++-
 spec/initializers/secret_token_spec.rb        |  34 +-
 ...delete_orphaned_project_namespaces_spec.rb |  72 +++
 .../work_items/widgets_spec.rb                |  10 +-
 .../identity/passthrough_spec.rb              |   2 +-
 .../identity/restore_spec.rb                  |   6 +-
 ...delete_orphaned_project_namespaces_spec.rb |  44 ++
 ...o_incidents_for_parity_with_issues_spec.rb |   8 +
 spec/models/application_record_spec.rb        |   2 +-
 spec/models/hooks/web_hook_spec.rb            | 156 +++--
 .../chat_message/pipeline_message_spec.rb     |   2 +-
 .../mutations/work_items/convert_spec.rb      |   1 -
 spec/requests/api/merge_requests_spec.rb      |   6 +-
 .../web_hooks/log_execution_service_spec.rb   |   7 +-
 .../add_work_item_widget_shared_examples.rb   |  10 +-
 yarn.lock                                     |  13 +-
 95 files changed, 2198 insertions(+), 1116 deletions(-)
 create mode 100644 app/assets/javascripts/blob_edit/blob_edit_header.js
 create mode 100644 app/assets/javascripts/repository/pages/blob_edit_header.vue
 create mode 100644 config/initializers/active_record_encryption.rb
 create mode 100644 db/docs/batched_background_migrations/delete_orphaned_project_namespaces.yml
 create mode 100644 db/migrate/20241218091609_add_widgets_to_incidents_for_parity_with_issues.rb
 create mode 100644 db/post_migrate/20241125145919_queue_delete_orphaned_project_namespaces.rb
 create mode 100644 db/schema_migrations/20241125145919
 create mode 100644 db/schema_migrations/20241218091609
 create mode 100644 doc/administration/dedicated/configure_instance/index.md
 create mode 100644 doc/administration/dedicated/configure_instance/network_security.md
 create mode 100644 doc/administration/dedicated/configure_instance/saml.md
 create mode 100644 doc/administration/dedicated/configure_instance/users_notifications.md
 create mode 100644 doc/administration/dedicated/monitor.md
 create mode 100644 lib/gitlab/background_migration/delete_orphaned_project_namespaces.rb
 create mode 100644 qa/qa/tools/ci/non_empty_suites.rb
 delete mode 100644 qa/qa/tools/ci/runnable_specs.rb
 create mode 100644 qa/spec/tools/ci/non_empty_suites_spec.rb
 delete mode 100644 qa/spec/tools/ci/runnables_specs_spec.rb
 create mode 100644 spec/frontend/repository/pages/blob_edit_header_spec.js
 create mode 100644 spec/lib/gitlab/background_migration/delete_orphaned_project_namespaces_spec.rb
 create mode 100644 spec/migrations/20241125145919_queue_delete_orphaned_project_namespaces_spec.rb
 create mode 100644 spec/migrations/20241211091609_add_widgets_to_incidents_for_parity_with_issues_spec.rb

diff --git a/.rubocop_todo/performance/flat_map.yml b/.rubocop_todo/performance/flat_map.yml
index 8c4f00ffbc7..c3df4d38e8c 100644
--- a/.rubocop_todo/performance/flat_map.yml
+++ b/.rubocop_todo/performance/flat_map.yml
@@ -14,3 +14,4 @@ Performance/FlatMap:
     - 'lib/gitlab/diff/file_collection/base.rb'
     - 'lib/gitlab/instrumentation/redis_cluster_validator.rb'
     - 'lib/gitlab/testing/request_inspector_middleware.rb'
+    - 'qa/qa/tools/ci/non_empty_suites.rb'
diff --git a/GITLAB_KAS_VERSION b/GITLAB_KAS_VERSION
index c24639752e2..1afdaca08a7 100644
--- a/GITLAB_KAS_VERSION
+++ b/GITLAB_KAS_VERSION
@@ -1 +1 @@
-781102090c60f0693fd827e01e78895294f8f1eb
+b7f4b9ff2339e859904e03269288487b390e3795
diff --git a/Gemfile.checksum b/Gemfile.checksum
index c9da6140093..10c8cae6109 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -785,6 +785,6 @@
 {"name":"xml-simple","version":"1.1.9","platform":"ruby","checksum":"d21131e519c86f1a5bc2b6d2d57d46e6998e47f18ed249b25cad86433dbd695d"},
 {"name":"xpath","version":"3.2.0","platform":"ruby","checksum":"6dfda79d91bb3b949b947ecc5919f042ef2f399b904013eb3ef6d20dd3a4082e"},
 {"name":"yajl-ruby","version":"1.4.3","platform":"ruby","checksum":"8c974d9c11ae07b0a3b6d26efea8407269b02e4138118fbe3ef0d2ec9724d1d2"},
-{"name":"yard","version":"0.9.26","platform":"ruby","checksum":"30594aa05cf737aa725c73444c7be3d54a443d0e258e1503da4eb1a0822cf963"},
+{"name":"yard","version":"0.9.37","platform":"ruby","checksum":"a6e910399e78e613f80ba9add9ba7c394b1a935f083cccbef82903a3d2a26992"},
 {"name":"zeitwerk","version":"2.6.7","platform":"ruby","checksum":"61767a6158480df290d0d2a3fd860d8ba3a28ba113837668ee94b657716a1409"}
 ]
diff --git a/Gemfile.lock b/Gemfile.lock
index 663f28b947f..478ebde042c 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1967,7 +1967,7 @@ GEM
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yajl-ruby (1.4.3)
-    yard (0.9.26)
+    yard (0.9.37)
     zeitwerk (2.6.7)
 
 PLATFORMS
diff --git a/Gemfile.next.checksum b/Gemfile.next.checksum
index 3cecf1ebd03..7cc38ac0531 100644
--- a/Gemfile.next.checksum
+++ b/Gemfile.next.checksum
@@ -797,6 +797,6 @@
 {"name":"xml-simple","version":"1.1.9","platform":"ruby","checksum":"d21131e519c86f1a5bc2b6d2d57d46e6998e47f18ed249b25cad86433dbd695d"},
 {"name":"xpath","version":"3.2.0","platform":"ruby","checksum":"6dfda79d91bb3b949b947ecc5919f042ef2f399b904013eb3ef6d20dd3a4082e"},
 {"name":"yajl-ruby","version":"1.4.3","platform":"ruby","checksum":"8c974d9c11ae07b0a3b6d26efea8407269b02e4138118fbe3ef0d2ec9724d1d2"},
-{"name":"yard","version":"0.9.26","platform":"ruby","checksum":"30594aa05cf737aa725c73444c7be3d54a443d0e258e1503da4eb1a0822cf963"},
+{"name":"yard","version":"0.9.37","platform":"ruby","checksum":"a6e910399e78e613f80ba9add9ba7c394b1a935f083cccbef82903a3d2a26992"},
 {"name":"zeitwerk","version":"2.6.7","platform":"ruby","checksum":"61767a6158480df290d0d2a3fd860d8ba3a28ba113837668ee94b657716a1409"}
 ]
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 7b4959768cc..ab006674f6f 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -1995,7 +1995,7 @@ GEM
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yajl-ruby (1.4.3)
-    yard (0.9.26)
+    yard (0.9.37)
     zeitwerk (2.6.7)
 
 PLATFORMS
diff --git a/app/assets/javascripts/blob_edit/blob_bundle.js b/app/assets/javascripts/blob_edit/blob_bundle.js
index 730ea9fe801..7e097041beb 100644
--- a/app/assets/javascripts/blob_edit/blob_bundle.js
+++ b/app/assets/javascripts/blob_edit/blob_bundle.js
@@ -1,6 +1,6 @@
 import $ from 'jquery';
 import { createAlert } from '~/alert';
-import NewCommitForm from '../new_commit_form';
+import initBlobEditHeader from '~/blob_edit/blob_edit_header';
 
 export default () => {
   const editBlobForm = $('.js-edit-blob-form');
@@ -20,8 +20,7 @@ export default () => {
 
     import('./edit_blob')
       .then(({ default: EditBlob } = {}) => {
-        // eslint-disable-next-line no-new
-        new EditBlob({
+        const editor = new EditBlob({
           assetsPath: `${urlRoot}${assetsPath}`,
           filePath,
           currentAction,
@@ -30,6 +29,8 @@ export default () => {
           isMarkdown,
           previewMarkdownPath,
         });
+
+        initBlobEditHeader(editor);
       })
       .catch((e) =>
         createAlert({
@@ -47,8 +48,6 @@ export default () => {
       window.onbeforeunload = null;
     });
 
-    new NewCommitForm(editBlobForm); // eslint-disable-line no-new
-
     // returning here blocks page navigation
     window.onbeforeunload = () => '';
   }
diff --git a/app/assets/javascripts/blob_edit/blob_edit_header.js b/app/assets/javascripts/blob_edit/blob_edit_header.js
new file mode 100644
index 00000000000..83db372ac3f
--- /dev/null
+++ b/app/assets/javascripts/blob_edit/blob_edit_header.js
@@ -0,0 +1,42 @@
+import Vue from 'vue';
+import { parseBoolean } from '~/lib/utils/common_utils';
+import BlobEditHeader from '~/repository/pages/blob_edit_header.vue';
+
+export default function initBlobEditHeader(editor) {
+  const el = document.querySelector('.js-blob-edit-header');
+
+  if (!el) {
+    return null;
+  }
+
+  const {
+    updatePath,
+    cancelPath,
+    originalBranch,
+    targetBranch,
+    canPushCode,
+    canPushToBranch,
+    emptyRepo,
+    blobName,
+    branchAllowsCollaboration,
+    lastCommitSha,
+  } = el.dataset;
+
+  return new Vue({
+    el,
+    provide: {
+      editor,
+      updatePath,
+      cancelPath,
+      originalBranch,
+      targetBranch,
+      blobName,
+      lastCommitSha,
+      emptyRepo: parseBoolean(emptyRepo),
+      canPushCode: parseBoolean(canPushCode),
+      canPushToBranch: parseBoolean(canPushToBranch),
+      branchAllowsCollaboration: parseBoolean(branchAllowsCollaboration),
+    },
+    render: (createElement) => createElement(BlobEditHeader),
+  });
+}
diff --git a/app/assets/javascripts/blob_edit/edit_blob.js b/app/assets/javascripts/blob_edit/edit_blob.js
index 123e59bdff0..0a35ba64c07 100644
--- a/app/assets/javascripts/blob_edit/edit_blob.js
+++ b/app/assets/javascripts/blob_edit/edit_blob.js
@@ -216,4 +216,8 @@ export default class EditBlob {
     this.$toggleButton.toggleClass('soft-wrap-active', this.isSoftWrapped);
     this.editor.updateOptions({ wordWrap: this.isSoftWrapped ? 'on' : 'off' });
   }
+
+  getFileContent() {
+    return this.editor?.getValue();
+  }
 }
diff --git a/app/assets/javascripts/ci/pipeline_mini_graph/job_action_button.vue b/app/assets/javascripts/ci/pipeline_mini_graph/job_action_button.vue
index 9667615c50f..34d2970243b 100644
--- a/app/assets/javascripts/ci/pipeline_mini_graph/job_action_button.vue
+++ b/app/assets/javascripts/ci/pipeline_mini_graph/job_action_button.vue
@@ -118,7 +118,7 @@ export default {
 <template>
   <div>
     <gl-button
-      v-gl-tooltip.viewport.right
+      v-gl-tooltip.viewport.left
       :title="jobAction.title"
       :aria-label="jobAction.title"
       :disabled="isLoading"
diff --git a/app/assets/javascripts/ci/pipeline_mini_graph/pipeline_stage.vue b/app/assets/javascripts/ci/pipeline_mini_graph/pipeline_stage.vue
index f09c4306fd3..b557142e5a2 100644
--- a/app/assets/javascripts/ci/pipeline_mini_graph/pipeline_stage.vue
+++ b/app/assets/javascripts/ci/pipeline_mini_graph/pipeline_stage.vue
@@ -62,9 +62,7 @@ export default {
       skip() {
         return !this.isDropdownOpen;
       },
-      pollInterval() {
-        return this.pollInterval;
-      },
+      pollInterval: PIPELINE_POLL_INTERVAL_DEFAULT,
       update(data) {
         return data?.ciPipelineStage?.jobs?.nodes || [];
       },
@@ -87,9 +85,6 @@ export default {
     isLoading() {
       return this.$apollo.queries.stageJobs.loading;
     },
-    pollInterval() {
-      return this.isDropdownOpen ? PIPELINE_POLL_INTERVAL_DEFAULT : 0;
-    },
   },
   mounted() {
     toggleQueryPollingByVisibility(this.$apollo.queries.stageJobs);
@@ -97,9 +92,11 @@ export default {
   methods: {
     onHideDropdown() {
       this.isDropdownOpen = false;
+      this.$apollo.queries.stageJobs.stopPolling();
     },
     onShowDropdown() {
       this.isDropdownOpen = true;
+      this.$apollo.queries.stageJobs.startPolling(PIPELINE_POLL_INTERVAL_DEFAULT);
 
       // used for tracking in the pipeline table
       this.$emit('miniGraphStageClick');
diff --git a/app/assets/javascripts/invite_members/constants.js b/app/assets/javascripts/invite_members/constants.js
index 050f6e77272..6ab27194398 100644
--- a/app/assets/javascripts/invite_members/constants.js
+++ b/app/assets/javascripts/invite_members/constants.js
@@ -43,7 +43,7 @@ export const MEMBERS_TO_PROJECT_CELEBRATE_INTRO_TEXT = s__(
 );
 export const MEMBERS_SEARCH_FIELD = s__('InviteMembersModal|Username, name or email address');
 export const MEMBERS_PLACEHOLDER = s__(
-  'InviteMembersModal|Select from existing GitLab usernames or enter email addresses',
+  'InviteMembersModal|Select from GitLab usernames or enter email addresses',
 );
 
 export const GROUP_MODAL_DEFAULT_TITLE = s__('InviteMembersModal|Invite a group');
@@ -76,7 +76,7 @@ export const GROUP_MODAL_TO_PROJECT_ALERT_LINK = helpPagePath(
 export const GROUP_SEARCH_FIELD = s__('InviteMembersModal|Select a group to invite');
 export const GROUP_PLACEHOLDER = s__('InviteMembersModal|Search for a group to invite');
 
-export const ACCESS_LEVEL = s__('InviteMembersModal|Select a role');
+export const ACCESS_LEVEL = s__('InviteMembersModal|Select maximum role');
 export const ACCESS_EXPIRE_DATE = s__('InviteMembersModal|Access expiration date (optional)');
 export const TOAST_MESSAGE_SUCCESSFUL = s__('InviteMembersModal|Members were successfully added.');
 export const QUEUED_MESSAGE_SUCCESSFUL = s__(
@@ -84,7 +84,7 @@ export const QUEUED_MESSAGE_SUCCESSFUL = s__(
 );
 export const INVALID_FEEDBACK_MESSAGE_DEFAULT = s__('InviteMembersModal|Something went wrong');
 export const READ_MORE_TEXT = s__(
-  `InviteMembersModal|%{linkStart}Read more%{linkEnd} about role permissions. You can change this later.`,
+  `InviteMembersModal|%{linkStart}Read more%{linkEnd} about role permissions. You can change this later. Invited members are limited to this role or their current group role, whichever is lower.`,
 );
 export const READ_MORE_ACCESS_EXPIRATION_TEXT = s__(
   `InviteMembersModal|%{linkStart}Read more%{linkEnd} about access expiration`,
diff --git a/app/assets/javascripts/ml/experiment_tracking/components/model_experiments_header.vue b/app/assets/javascripts/ml/experiment_tracking/components/model_experiments_header.vue
index 2fffc1490d4..c5179411870 100644
--- a/app/assets/javascripts/ml/experiment_tracking/components/model_experiments_header.vue
+++ b/app/assets/javascripts/ml/experiment_tracking/components/model_experiments_header.vue
@@ -1,20 +1,17 @@
 <script>
 import {
-  GlBadge,
   GlDisclosureDropdown,
   GlDisclosureDropdownGroup,
   GlDisclosureDropdownItem,
   GlModalDirective,
 } from '@gitlab/ui';
-import { __, s__ } from '~/locale';
-import { helpPagePath } from '~/helpers/help_page_helper';
+import { s__ } from '~/locale';
 import TitleArea from '~/vue_shared/components/registry/title_area.vue';
 import { MLFLOW_USAGE_MODAL_ID } from '../routes/experiments/index/constants';
 import MlflowModal from '../routes/experiments/index/components/mlflow_usage_modal.vue';
 
 export default {
   components: {
-    GlBadge,
     GlDisclosureDropdown,
     GlDisclosureDropdownGroup,
     GlDisclosureDropdownItem,
@@ -43,11 +40,9 @@ export default {
     },
   },
   i18n: {
-    experimentBadgeLabel: __('Experiment'),
     createTitle: s__('MlModelRegistry|Create'),
     importMlflow: s__('MlModelRegistry|Create experiments using MLflow'),
   },
-  experimentDocHref: helpPagePath('user/project/ml/experiment_tracking/index.md'),
   mlflowModalId: MLFLOW_USAGE_MODAL_ID,
 };
 </script>
@@ -58,9 +53,6 @@ export default {
       <div class="gl-flex gl-grow gl-items-center">
         <span class="gl-inline-flex gl-items-center gl-gap-3" data-testid="page-heading">
           {{ pageTitle }}
-          <gl-badge variant="info" :href="$options.experimentDocHref">
-            {{ $options.i18n.experimentBadgeLabel }}
-          </gl-badge>
           <slot></slot>
         </span>
       </div>
diff --git a/app/assets/javascripts/notes/components/comment_form.vue b/app/assets/javascripts/notes/components/comment_form.vue
index cdf9d562c5b..3717952f157 100644
--- a/app/assets/javascripts/notes/components/comment_form.vue
+++ b/app/assets/javascripts/notes/components/comment_form.vue
@@ -173,6 +173,11 @@ export default {
     isEpic() {
       return constants.NOTEABLE_TYPE_MAPPING[this.noteableType] === constants.EPIC_NOTEABLE_TYPE;
     },
+    isMergeRequest() {
+      return (
+        constants.NOTEABLE_TYPE_MAPPING[this.noteableType] === constants.MERGE_REQUEST_NOTEABLE_TYPE
+      );
+    },
     trackingLabel() {
       return slugifyWithUnderscore(`${this.commentButtonTitle} button`);
     },
@@ -187,11 +192,6 @@ export default {
 
       return null;
     },
-    commentNowButtonTitle() {
-      return this.noteType === constants.COMMENT
-        ? this.$options.i18n.addCommentNow
-        : this.$options.i18n.addThreadNow;
-    },
   },
   watch: {
     noteIsInternal(val) {
@@ -238,7 +238,7 @@ export default {
           isDraft,
         };
 
-        if (this.noteType === constants.DISCUSSION) {
+        if (this.noteType === constants.DISCUSSION || isDraft) {
           noteData.data.note.type = constants.DISCUSSION_NOTE;
         }
 
@@ -406,24 +406,23 @@ export default {
                 />
               </gl-form-checkbox>
               <template v-if="hasDrafts">
-                <comment-type-dropdown
-                  v-model="noteType"
-                  class="gl-mr-3"
-                  data-testid="add-to-review-dropdown"
+                <gl-button
                   :disabled="disableSubmitButton"
-                  :tracking-label="trackingLabel"
-                  is-review-dropdown
-                  :noteable-display-name="noteableDisplayName"
-                  :discussions-require-resolution="discussionsRequireResolution"
+                  data-testid="add-to-review-button"
+                  category="primary"
+                  variant="confirm"
+                  class="gl-mr-3"
                   @click="handleSaveDraft()"
-                />
+                >
+                  {{ $options.i18n.addToReview }}
+                </gl-button>
                 <gl-button
                   :disabled="disableSubmitButton"
                   data-testid="add-comment-now-button"
                   category="secondary"
                   class="gl-mr-3"
                   @click.prevent="handleSave()"
-                  >{{ commentNowButtonTitle }}</gl-button
+                  >{{ $options.i18n.addCommentNow }}</gl-button
                 >
               </template>
               <template v-else>
@@ -438,6 +437,18 @@ export default {
                   :discussions-require-resolution="discussionsRequireResolution"
                   @click="handleSave"
                 />
+                <template v-if="isMergeRequest">
+                  <gl-button
+                    :disabled="disableSubmitButton"
+                    data-testid="start-review-button"
+                    category="secondary"
+                    variant="confirm"
+                    class="gl-mr-3"
+                    @click="handleSaveDraft()"
+                  >
+                    {{ $options.i18n.startReview }}
+                  </gl-button>
+                </template>
               </template>
               <gl-button
                 v-if="canToggleIssueState"
diff --git a/app/assets/javascripts/notes/components/toggle_replies_widget.vue b/app/assets/javascripts/notes/components/toggle_replies_widget.vue
index 98afaa4e6fd..c9ba1fc0bc1 100644
--- a/app/assets/javascripts/notes/components/toggle_replies_widget.vue
+++ b/app/assets/javascripts/notes/components/toggle_replies_widget.vue
@@ -60,7 +60,7 @@ export default {
 <template>
   <li
     :class="{ '!gl-rounded-b-base gl-text-subtle': collapsed }"
-    class="toggle-replies-widget gl-border-r gl-border-l !gl-flex gl-flex-wrap gl-items-center gl-border-l-section gl-border-r-section gl-bg-subtle gl-px-5 gl-py-2"
+    class="toggle-replies-widget gl-border-r gl-border-l !gl-flex gl-flex-wrap gl-items-center gl-border-l-section gl-border-r-section gl-bg-subtle gl-px-5 gl-py-2 gl-leading-24"
     :aria-expanded="ariaState"
   >
     <gl-button
diff --git a/app/assets/javascripts/notes/i18n.js b/app/assets/javascripts/notes/i18n.js
index 384aa841a5c..6b3ae79a982 100644
--- a/app/assets/javascripts/notes/i18n.js
+++ b/app/assets/javascripts/notes/i18n.js
@@ -51,6 +51,8 @@ export const COMMENT_FORM = {
     saveThread: __('Add thread to review'),
     saveComment: __('Add comment to review'),
   },
+  addToReview: __('Add to review'),
+  startReview: __('Start review'),
   addCommentNow: __('Add comment now'),
   addThreadNow: __('Add thread now'),
 };
diff --git a/app/assets/javascripts/repository/components/commit_changes_modal.vue b/app/assets/javascripts/repository/components/commit_changes_modal.vue
index 074cfe1c766..871226a711a 100644
--- a/app/assets/javascripts/repository/components/commit_changes_modal.vue
+++ b/app/assets/javascripts/repository/components/commit_changes_modal.vue
@@ -153,6 +153,7 @@ export default {
           variant: 'confirm',
           loading: this.loading,
           disabled: this.loading || !this.form.state || !this.valid,
+          'data-testid': 'commit-change-modal-commit-button',
         },
       };
 
@@ -229,6 +230,7 @@ export default {
       this.$refs.message?.$el.focus();
     },
     async handlePrimaryAction(e) {
+      window.onbeforeunload = null;
       e.preventDefault(); // Prevent modal from closing
 
       if (this.showLfsWarning) {
@@ -264,6 +266,7 @@ export default {
     v-bind="$attrs"
     :modal-id="modalId"
     :title="title"
+    data-testid="commit-change-modal"
     :action-primary="primaryOptions"
     :action-cancel="cancelOptions"
     @primary="handlePrimaryAction"
@@ -346,16 +349,18 @@ export default {
                 </gl-form-radio>
               </gl-form-radio-group>
               <div v-if="createNewBranch" class="gl-ml-6">
-                <gl-form-input
-                  v-model="form.fields['branch_name'].value"
-                  v-validation:[form.showValidation]
-                  :state="form.fields['branch_name'].state"
-                  :disabled="loading"
-                  name="branch_name"
-                  required
-                  :placeholder="__('example-branch-name')"
-                  class="gl-mt-2"
-                />
+                <gl-form-group :invalid-feedback="form.fields['branch_name'].feedback">
+                  <gl-form-input
+                    v-model="form.fields['branch_name'].value"
+                    v-validation:[form.showValidation]
+                    :state="form.fields['branch_name'].state"
+                    :disabled="loading"
+                    name="branch_name"
+                    :placeholder="__('example-branch-name')"
+                    required
+                    class="gl-mt-2"
+                  />
+                </gl-form-group>
                 <gl-form-checkbox v-if="createNewBranch" v-model="createNewMr" class="gl-mt-4">
                   <span>
                     {{ $options.i18n.CREATE_MR_LABEL }}
@@ -367,17 +372,20 @@ export default {
               <label for="branchNameInput">
                 {{ $options.i18n.NEW_BRANCH_LABEl }}
               </label>
-              <gl-form-input
-                id="branchNameInput"
-                v-model="form.fields['branch_name'].value"
-                v-validation:[form.showValidation]
-                :state="form.fields['branch_name'].state"
-                :disabled="loading"
-                name="branch_name"
-                required
-                :placeholder="__('example-branch-name')"
-                class="gl-mt-2"
-              />
+              <gl-form-group :invalid-feedback="form.fields['branch_name'].feedback">
+                <gl-form-input
+                  id="branchNameInput"
+                  v-model="form.fields['branch_name'].value"
+                  v-validation:[form.showValidation]
+                  :state="form.fields['branch_name'].state"
+                  :disabled="loading"
+                  name="branch_name"
+                  required
+                  :placeholder="__('example-branch-name')"
+                  class="gl-mt-2"
+                />
+              </gl-form-group>
+
               <gl-form-checkbox v-model="createNewMr" class="gl-mt-4">
                 <span>
                   {{ $options.i18n.CREATE_MR_LABEL }}
diff --git a/app/assets/javascripts/repository/pages/blob_edit_header.vue b/app/assets/javascripts/repository/pages/blob_edit_header.vue
new file mode 100644
index 00000000000..b932c4e035c
--- /dev/null
+++ b/app/assets/javascripts/repository/pages/blob_edit_header.vue
@@ -0,0 +1,128 @@
+<script>
+import { GlButton } from '@gitlab/ui';
+import { uniqueId } from 'lodash';
+import axios from '~/lib/utils/axios_utils';
+import { __, sprintf } from '~/locale';
+import CommitChangesModal from '~/repository/components/commit_changes_modal.vue';
+import { getParameterByName, visitUrl } from '~/lib/utils/url_utility';
+import { createAlert } from '~/alert';
+import { BLOB_EDIT_ERROR } from '~/blob_edit/constants';
+import getRefMixin from '../mixins/get_ref';
+
+export default {
+  components: {
+    CommitChangesModal,
+    GlButton,
+  },
+  mixins: [getRefMixin],
+  inject: [
+    'editor',
+    'updatePath',
+    'cancelPath',
+    'originalBranch',
+    'targetBranch',
+    'blobName',
+    'canPushCode',
+    'canPushToBranch',
+    'emptyRepo',
+    'branchAllowsCollaboration',
+    'lastCommitSha',
+  ],
+  data() {
+    return {
+      isCommitChangeModalOpen: false,
+      fileContent: null,
+      filePath: null,
+    };
+  },
+  computed: {
+    updateModalId() {
+      return uniqueId('update-modal');
+    },
+    updateModalCommitMessage() {
+      return sprintf(__('Edit %{name}'), { name: this.blobName });
+    },
+    fromMergeRequestIid() {
+      return getParameterByName('from_merge_request_iid') || '';
+    },
+  },
+  methods: {
+    handleCancelButtonClick() {
+      window.onbeforeunload = null;
+    },
+    openModal() {
+      this.fileContent = this.editor.getFileContent();
+      this.filePath = this.editor.filepathFormMediator?.$filenameInput?.val();
+      this.$refs[this.updateModalId].show();
+    },
+    handleBlobEdit(formData) {
+      formData.append('file', this.fileContent);
+      formData.append('file_path', this.filePath);
+      formData.append('last_commit_sha', this.lastCommitSha);
+      formData.append('from_merge_request_iid', this.fromMergeRequestIid);
+
+      // Object.fromEntries is used here to handle potential line ending mutations in `FormData`.
+      // `FormData` uses the "multipart/form-data" format (RFC 2388), which follows MIME data stream rules (RFC 2046).
+      // These specifications require line breaks to be represented as CRLF sequences in the canonical form.
+      // See https://stackoverflow.com/questions/69835705/formdata-textarea-puts-r-carriage-return-when-sent-with-post for more details.
+      const data = Object.fromEntries(formData);
+
+      return axios({
+        method: 'put',
+        url: this.updatePath,
+        data,
+      })
+        .then((response) => {
+          if (response.data.filePath) {
+            visitUrl(response.data.filePath);
+          } else {
+            this.$ref.commitChangesModal.hide();
+            createAlert({ message: BLOB_EDIT_ERROR, captureError: true });
+          }
+        })
+        .catch(() => {
+          createAlert({ message: BLOB_EDIT_ERROR, captureError: true });
+        });
+    },
+  },
+  i18n: {
+    headerText: __('Edit file'),
+    cancelButtonText: __('Cancel'),
+    commitButtonText: __('Commit changes'),
+    confirmationMessage: __('Leave edit mode? All unsaved changes will be lost.'),
+  },
+};
+</script>
+
+<template>
+  <div class="gl-mb-4 gl-mt-5 gl-items-center gl-justify-between md:gl-flex lg:gl-my-5">
+    <h1 class="gl-heading-1 gl-inline-block md:!gl-mb-0">
+      {{ $options.i18n.headerText }}
+    </h1>
+    <div class="gl-flex gl-gap-3">
+      <gl-button
+        :data-confirm="$options.i18n.confirmationMessage"
+        :href="cancelPath"
+        data-confirm-btn-variant="danger"
+        data-testid="blob-edit-header-cancel-button"
+        @click="handleCancelButtonClick"
+        >{{ $options.i18n.cancelButtonText }}</gl-button
+      >
+      <gl-button variant="confirm" data-testid="blob-edit-header-commit-button" @click="openModal">
+        {{ $options.i18n.commitButtonText }}
+      </gl-button>
+    </div>
+    <commit-changes-modal
+      :ref="updateModalId"
+      :modal-id="updateModalId"
+      :commit-message="updateModalCommitMessage"
+      :target-branch="targetBranch || ref"
+      :original-branch="originalBranch || ref"
+      :can-push-code="canPushCode"
+      :empty-repo="emptyRepo"
+      :can-push-to-branch="canPushToBranch"
+      :branch-allows-collaboration="branchAllowsCollaboration"
+      @submit-form="handleBlobEdit"
+    />
+  </div>
+</template>
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb
index 91c82bdea76..523eb97f1d5 100644
--- a/app/helpers/blob_helper.rb
+++ b/app/helpers/blob_helper.rb
@@ -317,6 +317,21 @@ module BlobHelper
       ref: ref
     }
   end
+
+  def edit_blob_app_data(project, id, blob, ref)
+    {
+      update_path: project_update_blob_path(project, id),
+      cancel_path: project_blob_path(project, id),
+      original_branch: ref,
+      target_branch: selected_branch,
+      can_push_code: can?(current_user, :push_code, project).to_s,
+      can_push_to_branch: project.present(current_user: current_user).can_current_user_push_to_branch?(ref).to_s,
+      empty_repo: project.empty_repo?.to_s,
+      blob_name: blob.name,
+      branch_allows_collaboration: project.branch_allows_collaboration?(current_user, ref).to_s,
+      last_commit_sha: @last_commit_sha
+    }
+  end
 end
 
 BlobHelper.prepend_mod_with('BlobHelper')
diff --git a/app/models/concerns/web_hooks/auto_disabling.rb b/app/models/concerns/web_hooks/auto_disabling.rb
index 0f4d9f9df59..3499f0056fd 100644
--- a/app/models/concerns/web_hooks/auto_disabling.rb
+++ b/app/models/concerns/web_hooks/auto_disabling.rb
@@ -34,7 +34,7 @@ module WebHooks
 
       # A hook is disabled if:
       #
-      # - we are no longer in the grace-perod (recent_failures > ?)
+      # - we have exceeded the grace FAILURE_THRESHOLD (recent_failures > ?)
       # - and either:
       #   - disabled_until is nil (i.e. this was set by WebHook#fail!)
       #   - or disabled_until is in the future (i.e. this was set by WebHook#backoff!)
@@ -52,8 +52,8 @@ module WebHooks
 
       # A hook is executable if:
       #
-      # - we are still in the grace-period (recent_failures <= ?)
-      # - OR we have exceeded the grace period and neither of the following is true:
+      # - we have not yet exceeeded the grace FAILURE_THRESHOLD (recent_failures <= ?)
+      # - OR we have exceeded the grace FAILURE_THRESHOLD and neither of the following is true:
       #   - disabled_until is nil (i.e. this was set by WebHook#fail!)
       #   - disabled_until is in the future (i.e. this was set by WebHook#backoff!)
       # - AND silent mode is not enabled.
@@ -99,11 +99,11 @@ module WebHooks
       save(validate: false)
     end
 
-    # Don't actually back-off until FAILURE_THRESHOLD failures have been seen
-    # we mark the grace-period using the recent_failures counter
+    # Don't actually back-off until a grace level of FAILURE_THRESHOLD failures have been seen
+    # tracked in the recent_failures counter
     def backoff!
       return unless auto_disabling_enabled?
-      return if permanently_disabled? || (backoff_count >= MAX_FAILURES && temporarily_disabled?)
+      return if permanently_disabled? || temporarily_disabled?
 
       attrs = { recent_failures: next_failure_count }
 
diff --git a/app/models/integrations/chat_message/pipeline_message.rb b/app/models/integrations/chat_message/pipeline_message.rb
index c41af1ebdd9..73ec6c477cd 100644
--- a/app/models/integrations/chat_message/pipeline_message.rb
+++ b/app/models/integrations/chat_message/pipeline_message.rb
@@ -130,7 +130,7 @@ module Integrations
       def yaml_error_field
         {
           title: s_("ChatMessage|Invalid CI config YAML file"),
-          value: pipeline.yaml_errors,
+          value: pipeline.error_messages,
           short: false
         }
       end
diff --git a/app/views/projects/blob/edit.html.haml b/app/views/projects/blob/edit.html.haml
index d607a94ca5d..d6b825621e7 100644
--- a/app/views/projects/blob/edit.html.haml
+++ b/app/views/projects/blob/edit.html.haml
@@ -3,6 +3,7 @@
 - content_for :prefetch_asset_tags do
   - webpack_preload_asset_tag('monaco')
 - add_page_specific_style 'page_bundles/editor'
+
 - if @conflict
   = render Pajamas::AlertComponent.new(alert_options: { class: 'gl-mb-5 gl-mt-5' },
     variant: :danger,
@@ -18,8 +19,17 @@
         - blob_url = project_blob_path(@project, @id)
         = _('Someone edited the file the same time you did. Please check out %{link_start}the file %{icon}%{link_end} and make sure your changes will not unintentionally remove theirs.').html_safe % { link_start: blob_link_start % { url: blob_url }, link_end: link_end , icon: external_link_icon }
 
-%h1.page-title.gl-text-size-h-display.blob-edit-page-title
-  Edit file
+
+.js-blob-edit-header{ data: edit_blob_app_data(@project, @id, @blob, @ref) }
+  .gl-mb-4.gl-mt-5.gl-items-center.gl-justify-between.md:gl-flex.lg:gl-my-5
+    %h1{ class: 'md:!gl-mb-0 gl-heading-1 gl-inline-block' }
+      = _('Edit file')
+    .gl-flex.gl-gap-3
+      = render Pajamas::ButtonComponent.new do
+        = _('Cancel')
+      = render Pajamas::ButtonComponent.new(variant: :confirm) do
+        = _('Commit changes')
+
 .file-editor
   = gl_tabs_nav({ class: 'js-edit-mode nav-links gl-border-0'}) do
     = gl_tab_link_to _('Write'), '#editor', { tab_class: 'active' }
@@ -28,8 +38,3 @@
 
   = form_tag(project_update_blob_path(@project, @id), method: :put, class: 'js-quick-submit js-edit-blob-form', data: blob_editor_paths(@project, 'put')) do
     = render 'projects/blob/editor', ref: @ref, path: @path, blob_data: @blob.data
-    = render 'shared/new_commit_form', placeholder: "Update #{@blob.name}"
-    = hidden_field_tag 'last_commit_sha', @last_commit_sha
-    = hidden_field_tag 'content', '', id: "file-content"
-    = hidden_field_tag 'from_merge_request_iid', params[:from_merge_request_iid]
-    = render 'projects/commit_button', ref: @ref, cancel_path: project_blob_path(@project, @id)
diff --git a/config/initializers/01_secret_token.rb b/config/initializers/01_secret_token.rb
index c9f44a03889..0671ec5eb17 100644
--- a/config/initializers/01_secret_token.rb
+++ b/config/initializers/01_secret_token.rb
@@ -65,7 +65,19 @@ class SecretsInitializer
       secret_key_base: generate_new_secure_token,
       otp_key_base: generate_new_secure_token,
       db_key_base: generate_new_secure_token,
-      openid_connect_signing_key: generate_new_rsa_private_key
+      openid_connect_signing_key: generate_new_rsa_private_key,
+      # 1. We set the following two keys as an array to support keys rotation.
+      #    The last key in the array is always used to encrypt data:
+      #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21
+      #    while all the keys are used (in the order they're defined) to decrypt data:
+      #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.
+      #    This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that
+      #    runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976
+      # 2. We use the same method and length as Rails' defaults:
+      #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540
+      active_record_encryption_primary_key: [generate_new_secure_random_alphanumeric(32)],
+      active_record_encryption_deterministic_key: [generate_new_secure_random_alphanumeric(32)],
+      active_record_encryption_key_derivation_salt: generate_new_secure_random_alphanumeric(32)
     }
 
     # encrypted_settings_key_base is optional for now
@@ -85,6 +97,10 @@ class SecretsInitializer
     OpenSSL::PKey::RSA.new(2048).to_pem
   end
 
+  def generate_new_secure_random_alphanumeric(chars)
+    SecureRandom.alphanumeric(chars)
+  end
+
   def warn_missing_secret(secret)
     return if rails_env.test?
 
@@ -93,10 +109,11 @@ class SecretsInitializer
   end
 
   def set_missing_keys(defaults)
-    defaults.stringify_keys.each_with_object({}) do |(key, default), missing|
+    defaults.each_with_object({}) do |(key, default), missing|
       next if Rails.application.credentials.public_send(key).present?
 
       warn_missing_secret(key)
+
       missing[key] = Rails.application.credentials[key] = default
     end
   end
@@ -113,7 +130,7 @@ class SecretsInitializer
 
     File.write(
       secrets_file_path,
-      YAML.dump(secrets_from_file),
+      YAML.dump(secrets_from_file.deep_stringify_keys),
       mode: 'w', perm: 0o600
     )
   end
diff --git a/config/initializers/active_record_encryption.rb b/config/initializers/active_record_encryption.rb
new file mode 100644
index 00000000000..09cffed5be0
--- /dev/null
+++ b/config/initializers/active_record_encryption.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Normally, this would automatically be setup by `ActiveRecord::Encryption` initializer, see
+# https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railtie.rb#L331-L335,
+# but since we're setting `Rails.application.credentials.active_record_encryption` manually in
+# `config/initializers/01_secret_token.rb`, the `ActiveRecord::Encryption` initializer runs prior
+# to that. We don't want to mess up with the initializer chain, so we configure
+# `ActiveRecord::Encryption` here instead.
+ActiveRecord::Encryption.configure(
+  primary_key: Rails.application.credentials.active_record_encryption_primary_key,
+  deterministic_key: Rails.application.credentials.active_record_encryption_deterministic_key,
+  key_derivation_salt: Rails.application.credentials.active_record_encryption_key_derivation_salt,
+  store_key_references: true # this is very important to know what key was used to encrypt a given attribute
+)
diff --git a/db/docs/batched_background_migrations/delete_orphaned_project_namespaces.yml b/db/docs/batched_background_migrations/delete_orphaned_project_namespaces.yml
new file mode 100644
index 00000000000..ca2817230af
--- /dev/null
+++ b/db/docs/batched_background_migrations/delete_orphaned_project_namespaces.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: DeleteOrphanedProjectNamespaces
+description: Deletes orhpaned project namespaces whose parent's does not exist
+feature_category: groups_and_projects
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172420
+milestone: '17.8'
+queued_migration_version: 20241125145919
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/migrate/20241218091609_add_widgets_to_incidents_for_parity_with_issues.rb b/db/migrate/20241218091609_add_widgets_to_incidents_for_parity_with_issues.rb
new file mode 100644
index 00000000000..191933283f7
--- /dev/null
+++ b/db/migrate/20241218091609_add_widgets_to_incidents_for_parity_with_issues.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+class AddWidgetsToIncidentsForParityWithIssues < Gitlab::Database::Migration[2.2]
+  include Gitlab::Database::MigrationHelpers::WorkItems::Widgets
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+  disable_ddl_transaction!
+  milestone '17.8'
+
+  WORK_ITEM_TYPE_ENUM_VALUE = 1 # incident
+  WIDGETS = [
+    {
+      name: 'Labels',
+      widget_type: 3
+    },
+    {
+      name: 'Milestone',
+      widget_type: 4
+    },
+    {
+      name: 'Start and due date',
+      widget_type: 6
+    },
+    {
+      name: 'Iteration',
+      widget_type: 9
+    }
+  ]
+
+  def up
+    add_widget_definitions(type_enum_value: WORK_ITEM_TYPE_ENUM_VALUE, widgets: WIDGETS)
+  end
+
+  def down
+    remove_widget_definitions(type_enum_value: WORK_ITEM_TYPE_ENUM_VALUE, widgets: WIDGETS)
+  end
+end
diff --git a/db/post_migrate/20241125145919_queue_delete_orphaned_project_namespaces.rb b/db/post_migrate/20241125145919_queue_delete_orphaned_project_namespaces.rb
new file mode 100644
index 00000000000..ef8e993a0b8
--- /dev/null
+++ b/db/post_migrate/20241125145919_queue_delete_orphaned_project_namespaces.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class QueueDeleteOrphanedProjectNamespaces < Gitlab::Database::Migration[2.2]
+  milestone '17.8'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "DeleteOrphanedProjectNamespaces"
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 3_000
+  SUB_BATCH_SIZE = 100
+
+  def up
+    return unless Gitlab.com_except_jh? && !Gitlab.staging?
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :namespaces,
+      :id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :namespaces, :id, [])
+  end
+end
diff --git a/db/schema_migrations/20241125145919 b/db/schema_migrations/20241125145919
new file mode 100644
index 00000000000..cc128ea5943
--- /dev/null
+++ b/db/schema_migrations/20241125145919
@@ -0,0 +1 @@
+e8b27f29e5d3e5212e5ecd13566ab8f6b1150d7b20c57121a469df6a97782a9b
\ No newline at end of file
diff --git a/db/schema_migrations/20241218091609 b/db/schema_migrations/20241218091609
new file mode 100644
index 00000000000..818afc03023
--- /dev/null
+++ b/db/schema_migrations/20241218091609
@@ -0,0 +1 @@
+25ed259ed64e8f655a9ab3c849238f33d46207ec0baaa3ebaed7c797e90ac854
\ No newline at end of file
diff --git a/doc/administration/dedicated/configure_instance.md b/doc/administration/dedicated/configure_instance.md
index 9e8123f870b..c57dd5308e3 100644
--- a/doc/administration/dedicated/configure_instance.md
+++ b/doc/administration/dedicated/configure_instance.md
@@ -1,575 +1,13 @@
 ---
-stage: SaaS Platforms
-group: GitLab Dedicated
-description: Configure your GitLab Dedicated instance with Switchboard.
-info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+redirect_to: 'configure_instance/index.md'
+remove_date: '2025-03-13'
 ---
 
-# Configure your GitLab Dedicated instance
+<!-- markdownlint-disable -->
 
-DETAILS:
-**Tier:** Ultimate
-**Offering:** GitLab Dedicated
+This document was moved to [another location](configure_instance/index.md).
 
-The instructions on this page guide you through configuring your GitLab Dedicated instance, including enabling and updating the settings for [available functionality](../../subscriptions/gitlab_dedicated/index.md#available-features).
-
-Any functionality in the GitLab application that is not controlled by the SaaS environment can be configured by using the [**Admin** area](../../administration/admin_area.md).
-
-Examples of SaaS environment settings include `gitlab.rb` configurations and access to shell, Rails console, and PostgreSQL console.
-These environment settings cannot be changed by tenants.
-
-GitLab Dedicated Engineers also don't have direct access to tenant environments, except for [break glass situations](../../subscriptions/gitlab_dedicated/index.md#access-controls).
-
-NOTE:
-An instance refers to a GitLab Dedicated deployment, whereas a tenant refers to a customer.
-
-## Configure your instance using Switchboard
-
-You can use Switchboard to make limited configuration changes to your GitLab Dedicated instance.
-
-The following configuration settings are available in Switchboard:
-
-- [IP allowlist](#ip-allowlist)
-- [SAML settings](#saml)
-- [Custom certificates](#custom-certificates)
-- [Outbound private links](#outbound-private-link)
-- [Private hosted zones](#private-hosted-zones)
-
-Prerequisites:
-
-- You must have the [Admin](#add-users-to-an-instance) role.
-
-To make a configuration change:
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Follow the instructions in the relevant sections below.
-
-For all other instance configurations, submit a support ticket according to the
-[configuration change request policy](#configuration-change-request-policy).
-
-### Apply configuration changes in Switchboard
-
-You can apply configuration changes made in Switchboard immediately or defer them until your next scheduled weekly [maintenance window](../../administration/dedicated/maintenance.md#maintenance-windows).
-
-When you apply changes immediately:
-
-- Deployment can take up to 90 minutes.
-- Changes are applied in the order they're saved.
-- You can save multiple changes and apply them in one batch.
-
-After the deployment job is complete, you receive an email notification. Check your spam folder if you do not see a notification in your main inbox.
-All users with access to view or edit your tenant in Switchboard receive a notification for each change. For more information, see [Manage Switchboard notification preferences](#manage-notification-preferences).
-
-NOTE:
-You only receive email notifications for changes made by a Switchboard tenant administrator. Changes made by a GitLab Operator (for example, a GitLab version update completed during a maintenance window) do not trigger email notifications.
-
-## Configuration change log
-
-The **Configuration change log** page in Switchboard tracks changes made to your GitLab Dedicated instance.
-
-Each change log entry includes the following details:
-
-| Field                | Description                                                                                                                                   |
-|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
-| Configuration change | Name of the configuration setting that changed.                                                                                               |
-| User                 | Email address of the user that made the configuration change. For changes made by a GitLab Operator, this value appears as `GitLab Operator`. |
-| IP                   | IP address of the user that made the configuration change. For changes made by a GitLab Operator, this value appears as `Unavailable`.        |
-| Status               | Whether the configuration change is initiated, in progress, completed, or deferred.                                                           |
-| Start time           | Start date and time when the configuration change is initiated, in UTC.                                                                       |
-| End time             | End date and time when the configuration change is deployed, in UTC.                                                                          |
-
-Each configuration change has a status:
-
-| Status | Description |
-|---|---|
-| Initiated | Configuration change is made in Switchboard, but not yet deployed to the instance. |
-| In progress | Configuration change is actively being deployed to the instance. |
-| Complete | Configuration change has been deployed to the instance. |
-| Delayed | Initial job to deploy a change has failed and the change has not yet been assigned to a new job. |
-
-### View the configuration change log
-
-To view the configuration change log:
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. Select your tenant.
-1. At the top of the page, select **Configuration change log**.
-
-Each configuration change appears as an entry in the table. Select **View details** to see more information about each change.
-
-## Configuration change request policy
-
-This policy does not apply to configuration changes made by a GitLab Dedicated instance admin using Switchboard.
-
-Configuration changes requested with a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) adhere to the following policies:
-
-- Are applied during your environment's weekly four-hour maintenance window.
-- Can be requested for options specified during onboarding or for optional features listed on this page.
-- May be postponed to the following week if GitLab needs to perform high-priority maintenance tasks.
-- Can't be applied outside the weekly maintenance window unless they qualify for [emergency support](https://about.gitlab.com/support/#how-to-engage-emergency-support).
-
-NOTE:
-Even if a change request meets the minimum lead time, it might not be applied during the upcoming maintenance window.
-
-## Bring your own domain (BYOD)
-
-You can use a [custom hostname](../../subscriptions/gitlab_dedicated/index.md#bring-your-own-domain) to access your GitLab Dedicated instance. You can also provide a custom hostname for the bundled container registry and Kubernetes Agent Server (KAS) services.
-
-### Let's Encrypt certificates
-
-GitLab Dedicated integrates with [Let's Encrypt](https://letsencrypt.org/), a free, automated, and open source certificate authority. When you use a custom hostname, Let's Encrypt automatically issues and renews SSL/TLS certificates for your domain.
-
-This integration uses the [`http-01` challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) to obtain certificates through Let's Encrypt.
-
-### Set up DNS records
-
-To use a custom hostname with GitLab Dedicated, you must update your domain's DNS records.
-
-Prerequisites:
-
-- Access to your domain host's DNS settings.
-
-To set up DNS records for a custom hostname with GitLab Dedicated:
-
-1. Sign in to your domain host's website.
-
-1. Go to the DNS settings.
-
-1. Add a `CNAME` record that points your custom hostname to your GitLab Dedicated tenant. For example:
-
-   ```plaintext
-    gitlab.my-company.com.  CNAME  my-tenant.gitlab-dedicated.com
-   ```
-
-1. Optional. If your domain has an existing `CAA` record, update it to include [Let's Encrypt](https://letsencrypt.org/docs/caa/) as a valid certificate authority. If your domain does not have any `CAA` records, you can skip this step. For example:
-
-   ```plaintext
-   example.com.  IN  CAA 0 issue "pki.goog"
-   example.com.  IN  CAA 0 issue "letsencrypt.org"
-   ```
-
-   In this example, the `CAA` record defines Google Trust Services (`pki.goog`) and Let's Encrypt (`letsencrypt.org`) as certificate authorities that are allowed to issue certificates for your domain.
-
-1. Save your changes and wait for the DNS changes to propagate.
-
-### Add your custom hostname
-
-To add a custom hostname to your existing GitLab Dedicated instance, submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
-
-## SMTP email service
-
-You can configure an [SMTP](../../subscriptions/gitlab_dedicated/index.md#email-service) email service for your GitLab Dedicated instance.
-
-To configure an SMTP email service, submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) with the credentials and settings for your SMTP server.
-
-## Inbound Private Link
-
-[AWS Private Link](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) allows users and applications in your VPC on AWS to securely connect to the GitLab Dedicated endpoint without network traffic going over the public internet.
-
-To enable the Inbound Private Link:
-
-1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650). In the body of your support ticket, include the IAM principals for the AWS users or roles in your AWS organization that are establishing the VPC endpoints in your AWS account. The IAM principals must be [IAM role principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-roles) or [IAM user principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-users). GitLab Dedicated uses these IAM Principals for access-control. These IAM principals are the only ones able to set up an endpoint to the service.
-1. After your IAM Principals have been allowlisted, GitLab [creates the Endpoint Service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) and communicates the `Service Endpoint Name` on the support ticket. The service name is generated by AWS upon creation of the service endpoint.
-   - GitLab handles the domain verification for the Private DNS name, so that DNS resolution of the tenant instance domain name in your VPC resolves to the PrivateLink endpoint.
-   - The endpoint service is available in two Availability Zones. These are either the zones you chose during onboarding or two randomly selected zones if you didn't specify any.
-1. In your own AWS account, create an [Endpoint Interface](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in your VPC, with the following settings:
-   - Service Endpoint Name: use the name provided by GitLab on the support ticket.
-   - Private DNS names enabled: yes.
-   - Subnets: choose all matching subnets.
-
-1. After you create the endpoint, use the instance URL provided to you during onboarding to securely connect to your GitLab Dedicated instance from your VPC, without the traffic going over the public internet.
-
-## Outbound Private Link
-
-Outbound private links allow your GitLab Dedicated instance and the hosted runners for GitLab Dedicated to securely communicate with services running in your VPC on AWS without exposing any traffic to the public internet.
-
-This type of connection allows GitLab functionality to access private services:
-
-- For the GitLab Dedicated instance:
-
-  - [webhooks](../../user/project/integrations/webhooks.md)
-  - import or mirror projects and repositories
-
-- For hosted runners:
-
-  - custom secrets managers
-  - artifacts or job images stored in your infrastructure
-  - deployments into your infrastructure
-
-Consider the following:
-
-- You can only establish private links between VPCs in the same region. Therefore, you can only establish a connection in the regions specified for your Dedicated instance.
-- The connection requires the [Availability Zone IDs (AZ IDs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#az-ids) for the two Availability Zones (AZs) in the regions that you selected during onboarding.
-- If you did not specify any AZs during onboarding to Dedicated, GitLab randomly selects both AZ IDs.
-
-### Add an outbound private link with Switchboard
-
-Prerequisites:
-
-- [Create the endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) for your internal service to be available to GitLab Dedicated.
-- Configure a Network Load Balancer (NLB) for the endpoint service in the Availability Zones (AZs) where your Dedicated instance is deployed. Either:
-  - Use the AZs listed in the Outbound private link configuration in Switchboard.
-  - Enable the NLB in every AZ in the region.
-- Add the ARN of the role that GitLab Dedicated uses to connect to your endpoint service to the Allowed Principals list on the Endpoint Service. You can find this ARN in Switchboard under Outbound private link IAM principal. For more information, see [Manage permissions](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions).
-- Recommended. Set **Acceptance required** to **No** to enable GitLab Dedicated to connect in a single operation. If set to **Yes**, you must manually accept the connection after it's initiated.
-
-  NOTE:
-  If you set **Acceptance required** to **Yes**, Switchboard cannot accurately determine when the link is accepted. After you manually accept the link, the status shows as **Pending** instead of **Active** until next scheduled maintenance. After maintenance, the link status refreshes and shows as connected.
-
-- Once the endpoint service is created, note the Service Name and if you have enabled Private DNS or not.
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **Outbound private link**.
-1. Complete the fields.
-1. To add endpoint services, select **Add endpoint service**. You can add up to ten endpoint services per region. At least one endpoint service is required to save the region.
-1. Select **Save**.
-1. Optional. To add an outbound private link for a second region, select **Add outbound connection**, then repeat the previous steps.
-
-### Delete an outbound private link with Switchboard
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **Outbound private link**.
-1. Go to the outbound private link you want to delete, then select **Delete** (**{remove}**).
-1. Select **Delete**.
-1. Optional. To delete all the links in a region, from the region header, select **Delete** (**{remove}**). This also deletes the region configuration.
-
-### Add an outbound private link with a support request
-
-1. [Create the Endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) through which your internal service
-   will be available to GitLab Dedicated. Provide the associated `Service Endpoint Name` on a new
-   [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
-1. Make sure you have configured a Network Load Balancer (NLB) for the endpoint service in the two AZs to which your Dedicated instance was deployed. If you did not specify these during onboarding to Dedicated, you must either:
-   - Submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) to request the AZ IDs required to enable the connection and ensure the NLB is enabled in those AZs.
-   - Ensure the NLB is enabled in every AZ in the region.
-1. In your [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), GitLab will provide you with the ARN of an
-   IAM role that will be initiating the connection to your endpoint service. You must ensure this ARN is included, or otherwise covered by other
-   entries, in the list of "Allowed Principals" on the Endpoint Service, as described by the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions).
-   Though it's optional, you should you add it explicitly, allowing you to set `Acceptance required` to No so that Dedicated can connect in a single operation.
-   If you leave `Acceptance required` as Yes, then you must manually accept the connection after Dedicated has initiated it.
-1. To connect to services using the Endpoint, the Dedicated services require a DNS name. Private Link automatically creates an internal name, but
-   it is machine-generated and not generally directly useful. There are two options available:
-   - In your Endpoint Service, enable [Private DNS name](https://docs.aws.amazon.com/vpc/latest/privatelink/manage-dns-names.html), perform the
-     required validation, and let GitLab know in the support ticket that you are using this option. If `Acceptance Required` is set to Yes on your
-     Endpoint Service, also note this on the support ticket because Dedicated will need to initiate the connection without Private DNS, wait for you
-     to confirm it has been accepted, and then update the connection to enable the use of Private DNS.
-   - Dedicated can manage a Private Hosted Zone (PHZ) within the Dedicated AWS Account and alias any arbitrary DNS names to the endpoint, directing
-     requests for those names to your endpoint service. These aliases are known as PHZ entries. For more information, see [Private hosted zones](#private-hosted-zones).
-
-GitLab then configures the tenant instance to create the necessary Endpoint Interfaces based on the service names you provided. Any matching outbound
-connections made from the tenant instance are directed through the PrivateLink into your VPC.
-
-### Private hosted zones
-
-A private hosted zone (PHZ) creates custom DNS aliases (CNAMEs) that resolve in your GitLab Dedicated instance's network. 
-
-Use a PHZ when you want to:
-
-- Create multiple DNS names or aliases that use a single endpoint, such as when running a reverse proxy to connect to multiple services.
-- Use a private domain that cannot be validated by public DNS.
-
-PHZs are commonly used with reverse PrivateLink to create readable domain names instead of using AWS-generated endpoint names. For example, you can use `alpha.beta.tenant.gitlab-dedicated.com` instead of `vpce-0987654321fedcba0-k99y1abc.vpce-svc-0a123bcd4e5f678gh.eu-west-1.vpce.amazonaws.com`.
-
-In some cases, you can also use PHZs to create aliases that resolve to publicly accessible DNS names. For example, you can create an internal DNS name that resolves to a public endpoint when you need internal systems to access a service through its private name.
-
-#### PHZ domain structure
-
-When using your GitLab Dedicated instance's domain as part of an alias, you must include two subdomains before the main domain, where:
-
-- The first subdomain becomes the name of the PHZ.
-- The second subdomain becomes the record entry for the alias.
-
-For example:
-
-- Valid PHZ entry: `subdomain2.subdomain1.<your-tenant-id>.gitlab-dedicated.com`.
-- Invalid PHZ entry: `subdomain1.<your-tenant-id>.gitlab-dedicated.com`.
-
-When not using your GitLab Dedicated instance domain, you must still provide:
-
-- A Private Hosted Zone (PHZ) name
-- A PHZ entry in the format `phz-entry.phz-name.com`
-
-To prevent shadowing of public DNS domains when the domain is created inside the Dedicated tenant, use at least two additional subdomain levels below any public domain for your PHZ entries. For example, if your tenant is hosted at `tenant.gitlab-dedicated.com`, your PHZ entry should be at least `subdomain1.subdomain2.tenant.gitlab-dedicated.com`, or if you own `customer.com` then at least `subdomain1.subdomain2.customer.com`, where `subdomain2` is not a public domain.
-
-#### Add a private hosted zone with Switchboard
-
-To add a private hosted zone:
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **Private hosted zones**.
-1. Select **Add private hosted zone entry**.
-1. Complete the fields.
-   - In the **Hostname** field, enter your Private Hosted Zone (PHZ) entry.
-   - For **Link type**, choose one of the following:
-     - For an outbound private link PHZ entry, select the endpoint service from the dropdown list.
-     Only links with the `Available` or `Pending Acceptance` status are shown.
-     - For other PHZ entries, provide a list of DNS aliases.
-1. Select **Save**.
-Your PHZ entry and any aliases should appear in the list.
-1. Scroll to the top of the page, and select whether to apply the changes immediately or during the next maintenance window.
-
-#### Add a private hosted zone with a support request
-
-If you are unable to use Switchboard to add a private hosted zone, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and provide a list of DNS names that should resolve to the endpoint service for the outbound private link. The list can be updated as needed.
-
-## Custom certificates
-
-Custom certificates establish trust between your GitLab Dedicated instance and certificates signed by non-public Certificate Authorities (CA). If you want to connect to a service that uses a certificate signed by a private or internal CA, you must first add that certificate to your GitLab Dedicated instance.
-
-### Add a custom certificate with Switchboard
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **Custom Certificate Authorities**.
-1. Select **+ Add Certificate**.
-1. Paste the certificate into the text box.
-1. Select **Save**.
-1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window.
-
-### Add a custom certificate with a Support Request
-
-If you are unable to use Switchboard to add a custom certificate, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and attach your custom public certificate files to request this change..
-
-### Maximum number of reverse PrivateLink connections
-
-GitLab Dedicated limits the number of reverse PrivateLink connections to 10.
-
-## IP allowlist
-
-GitLab Dedicated allows you to control which IP addresses can access your instance through an IP allowlist. Once the IP allowlist has been enabled, when an IP not on the allowlist tries to access your instance an `HTTP 403 Forbidden` response is returned.
-
-IP addresses that have been added to your IP allowlist can be viewed on the Configuration page in Switchboard. You can add or remove IP addresses from your allowlist with Switchboard.
-
-### Add an IP to the allowlist with Switchboard
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **Allowed Source List Config / IP allowlist**.
-1. Turn on the **Enable** toggle.
-1. Select **Add Item**.
-1. Enter the IP address and description. To add another IP address, repeat steps 5 and 6.
-1. Select **Save**.
-1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window. After the changes are applied, the IP addresses are added to the IP allowlist for your instance.
-
-### Add an IP to the allowlist with a Support Request
-
-If you are unable to use Switchboard to update your IP allowlist, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and specify a comma separated list of IP addresses that can access your GitLab Dedicated instance.
-
-### Enable OpenID Connect for your IP allowlist
-
-Using [GitLab as an OpenID Connect identity provider](../../integration/openid_connect_provider.md) requires internet access to the OpenID Connect verification endpoint.
-
-To enable access to the OpenID Connect endpoint while maintaining your IP allowlist:
-
-- In a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), request to allow access to the OpenID Connect endpoint.
-
-The configuration is applied during the next maintenance window.
-
-### Enable SCIM provisioning for your IP allowlist
-
-You can use SCIM with external identity providers to automatically provision and manage users. To use SCIM, your identity provider must be able to access the [instance SCIM API](../../development/internal_api/index.md#instance-scim-api) endpoints. By default, IP allowlisting blocks communication to these endpoints.
-
-To enable SCIM while maintaining your IP allowlist:
-
-- In a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), request to enable SCIM endpoints to the internet.
-
-The configuration is applied during the next maintenance window.
-
-### SAML
-
-You can [configure SAML single sign-on (SSO)](../../integration/saml.md#configure-saml-support-in-gitlab) for your GitLab Dedicated instance. Optionally, you can configure more than one SAML identity provider (IdP).
-
-The following SAML SSO options are available:
-
-- [Request signing](../../integration/saml.md#sign-saml-authentication-requests-optional)
-- [SAML SSO for groups](../../integration/saml.md#configure-users-based-on-saml-group-membership)
-- [Group sync](../../user/group/saml_sso/group_sync.md#configure-saml-group-sync)
-
-Prerequisites:
-
-- You must [set up the identity provider](../../integration/saml.md#set-up-identity-providers) before you can configure SAML for GitLab Dedicated.
-- To configure GitLab to sign SAML authentication requests, you must create a private key and public certificate pair for your GitLab Dedicated instance.
-
-NOTE:
-You can only configure one SAML IdP with Switchboard. If you configured a SAML IdP on your GitLab Dedicated instance before the introduction of support for multiple IdPs, you can manage that provider through Switchboard. To configure additional SAML IdPs, [submit a support request](#activate-saml-with-a-support-request).
-
-### Activate SAML with Switchboard
-
-To activate SAML for your GitLab Dedicated instance:
-
-1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
-1. At the top of the page, select **Configuration**.
-1. Expand **SAML Config**.
-1. Turn on the **Enable** toggle.
-1. Complete the required fields:
-   - SAML label
-   - IdP cert fingerprint
-   - IdP SSO target URL
-   - Name identifier format
-1. To configure users based on [SAML group membership](#saml-groups) or use [group sync](#group-sync), complete the following fields:
-   - SAML group attribute
-   - Admin groups
-   - Auditor groups
-   - External groups
-   - Required groups
-1. To configure [SAML request signing](#request-signing), complete the following fields:
-   - Issuer
-   - Attribute statements
-   - Security
-1. Select **Save**.
-1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window.
-1. To use group sync, [configure the SAML group links](../../user/group/saml_sso/group_sync.md#configure-saml-group-links).
-1. To verify the SAML configuration is successful:
-   - Check that the SSO button description is displayed on your instance's sign-in page.
-   - Go to the metadata URL of your instance (`https://INSTANCE-URL/users/auth/saml/metadata`). This page can be used to simplify much of the configuration of the identity provider, and manually validate the settings.
-
-### Activate SAML with a Support Request
-
-If you are unable to use Switchboard to activate or update SAML for your GitLab Dedicated instance, or if you need to configure more than one SAML IdP, then you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650):
-
-1. To make the necessary changes, include the desired [SAML configuration block](../../integration/saml.md#configure-saml-support-in-gitlab) for your GitLab application in your support ticket. At a minimum, GitLab needs the following information to enable SAML for your instance:
-   - IDP SSO Target URL
-   - Certificate fingerprint or certificate
-   - NameID format
-   - SSO login button description
-
-   ```json
-   "saml": {
-     "attribute_statements": {
-         //optional
-     },
-     "enabled": true,
-     "groups_attribute": "",
-     "admin_groups": [
-       // optional
-     ],
-     "idp_cert_fingerprint": "43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8",
-     "idp_sso_target_url": "https://login.example.com/idp",
-     "label": "IDP Name",
-     "name_identifier_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
-     "security": {
-       // optional
-     },
-     "auditor_groups": [
-       // optional
-     ],
-     "external_groups": [
-       // optional
-     ],
-     "required_groups": [
-       // optional
-     ],
-   }
-   ```
-
-1. After GitLab deploys the SAML configuration to your instance, you are notified on your support ticket.
-1. To verify the SAML configuration is successful:
-   - Check that the SSO login button description is displayed on your instance's login page.
-   - Go to the metadata URL of your instance, which is provided by GitLab in the support ticket. This page can be used to simplify much of the configuration of the identity provider, as well as manually validate the settings.
-
-### Request signing
-
-If [SAML request signing](../../integration/saml.md#sign-saml-authentication-requests-optional) is desired, a certificate must be obtained. This certificate can be self-signed which has the advantage of not having to prove ownership of an arbitrary Common Name (CN) to a public Certificate Authority (CA).
-
-NOTE:
-Because SAML request signing requires certificate signing, you must complete these steps to use SAML with this feature enabled.
-
-To enable SAML request signing:
-
-1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and indicate that you want request signing enabled.
-1. GitLab will work with you on sending the Certificate Signing Request (CSR) for you to sign. Alternatively, the CSR can be signed with a public CA.
-1. After the certificate is signed, you can then use the certificate and its associated private key to complete the `security` section of the [SAML configuration](#activate-saml-with-switchboard) in Switchboard.
-
-Authentication requests from GitLab to your identity provider can now be signed.
-
-### SAML groups
-
-With SAML groups you can configure GitLab users based on SAML group membership.
-
-To enable SAML groups, add the [required elements](../../integration/saml.md#configure-users-based-on-saml-group-membership) to your SAML configuration in [Switchboard](#activate-saml-with-switchboard) or to the SAML block you provide in a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
-
-### Group sync
-
-With [group sync](../../user/group/saml_sso/group_sync.md), you can sync users across identity provider groups to mapped groups in GitLab.
-
-To enable group sync:
-
-1. Add the [required elements](../../user/group/saml_sso/group_sync.md#configure-saml-group-sync) to your SAML configuration in [Switchboard](#activate-saml-with-switchboard) or to the SAML configuration block you provide in a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
-1. Configure the [Group Links](../../user/group/saml_sso/group_sync.md#configure-saml-group-links).
-
-## Add users to an instance
-
-Administrators can add Switchboard users to their GitLab Dedicated instance. There are two types of users:
-
-- **Read only**: Users can only view instance data.
-- **Admin**: Users can edit the instance configuration and manage users.
-
-To add a new user to your GitLab Dedicated instance:
-
-1. From the **Tenants** page, select **Manage** next to the tenant instance.
-1. From the top of the page, select **Users**.
-1. Select **New user**.
-1. Enter the **Email** and select a **Role** for the user.
-1. Select **Create**.
-
-An invitation to use Switchboard is sent to the user.
-
-### Manage notification preferences
-
-You can specify whether you want to receive email notifications from Switchboard. You will only receive notifications after you:
-
-- Receive an email invitation and first sign in to Switchboard.
-- Set up a password and two-factor authentication (2FA) for your user account.
-
-To manage your own email notification preferences:
-
-1. From any page, open the dropdown next to your user name.
-1. To stop receiving email notifications, select **Toggle email notifications off**.
-1. To resume receiving email notifications, select **Toggle email notifications on**.
-
-You will see an alert confirming that your notification preferences have been updated.
-
-## Application logs
-
-GitLab delivers [application logs](../../administration/logs/index.md) to an Amazon S3 bucket in the GitLab tenant account, which can be shared with you.
-
-Logs stored in the S3 bucket are retained indefinitely, until the one year retention policy is fully enforced. GitLab team members can view more information in confidential issue [483](https://gitlab.com/gitlab-com/gl-infra/gitlab-dedicated/team/-/issues/483).
-
-### Request bucket access
-
-To gain read only access to the S3 bucket with your application logs:
-
-1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) with the title `Customer Log Access`.
-1. In the body of the ticket, include a list of IAM Principal Amazon Resource Names (ARNs) that require access to the logs from the S3 bucket. The ARNs can be for users or roles.
-   
-   NOTE:
-   Specify the full ARN path without wildcards (`*`). Wildcard characters are not supported. GitLab team members can read more about the proposed feature to add wildcard support in this confidential issue: [7010](https://gitlab.com/gitlab-com/gl-infra/gitlab-dedicated/team/-/issues/7010).
-
-GitLab provides the name of the S3 bucket. Your authorized users or roles can then access all objects in the bucket. To verify access, you can use the [AWS CLI](https://aws.amazon.com/cli/).
-
-### Bucket contents and structure
-
-The Amazon S3 bucket contains a combination of infrastructure logs and application logs from the GitLab [log system](../../administration/logs/index.md).
-
-The logs in the bucket are encrypted using an AWS KMS key managed by GitLab. If you choose to enable [BYOK](../../administration/dedicated/create_instance.md#encrypted-data-at-rest-byok), the application logs are not encrypted with the key you provide.
-
-<!-- vale gitlab_base.Spelling = NO -->
-
-The logs in the S3 bucket are organized by date in `YYYY/MM/DD/HH` format. For example, a directory named `2023/10/12/13` contains logs from October 12, 2023 at 13:00 UTC. The logs are streamed into the bucket with [Amazon Kinesis Data Firehose](https://aws.amazon.com/firehose/).
-
-<!-- vale gitlab_base.Spelling = YES -->
-
-## Troubleshooting
-
-### Outbound Private Link
-
-If you have trouble establishing a connection after the Outbound Private Link has been set up, there are a few things in your AWS infrastructure that could be the cause of the problem. The specific things to check will vary based on the unexpected behavior you're seeking to fix. Things to check include:
-
-- Ensure that cross-zone load balancing is turned on in your Network Load Balancer (NLB).
-- Ensure that the Inbound Rules section of the appropriate Security Groups permits traffic from the correct IP ranges.
-- Ensure that the inbound traffic is mapped to the correct port on the Endpoint Service.
-- In Switchboard, expand **Outbound private link** and confirm that the details appear as you expect.
-- Ensure that you have [allowed requests to the local network from webhooks and integrations](../../security/webhooks.md#allow-requests-to-the-local-network-from-webhooks-and-integrations).
+<!-- This redirect file can be deleted after <2025-03-13>. -->
+<!-- Redirects that point to other docs in the same project expire in three months. -->
+<!-- Redirects that point to docs in a different project or site (link is not relative and starts with `https:`) expire in one year. -->
+<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/redirects.html -->
diff --git a/doc/administration/dedicated/configure_instance/index.md b/doc/administration/dedicated/configure_instance/index.md
new file mode 100644
index 00000000000..f23a4cd587d
--- /dev/null
+++ b/doc/administration/dedicated/configure_instance/index.md
@@ -0,0 +1,113 @@
+---
+stage: SaaS Platforms
+group: GitLab Dedicated
+description: Configure your GitLab Dedicated instance with Switchboard.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# Configure GitLab Dedicated
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab Dedicated
+
+The instructions on this page guide you through configuring your GitLab Dedicated instance, including enabling and updating the settings for [available functionality](../../../subscriptions/gitlab_dedicated/index.md#available-features).
+
+Any functionality in the GitLab application that is not controlled by the SaaS environment can be configured by using the [**Admin** area](../../../administration/admin_area.md).
+
+Examples of SaaS environment settings include `gitlab.rb` configurations and access to shell, Rails console, and PostgreSQL console.
+These environment settings cannot be changed by tenants.
+
+GitLab Dedicated Engineers also don't have direct access to tenant environments, except for [break glass situations](../../../subscriptions/gitlab_dedicated/index.md#access-controls).
+
+NOTE:
+An instance refers to a GitLab Dedicated deployment, whereas a tenant refers to a customer.
+
+## Configure your instance using Switchboard
+
+You can use Switchboard to make limited configuration changes to your GitLab Dedicated instance.
+
+The following configuration settings are available in Switchboard:
+
+- [IP allowlist](../configure_instance/network_security.md#ip-allowlist)
+- [SAML settings](../configure_instance/saml.md)
+- [Custom certificates](../configure_instance/network_security.md#custom-certificates)
+- [Outbound private links](../configure_instance/network_security.md#outbound-private-link)
+- [Private hosted zones](../configure_instance/network_security.md#private-hosted-zones)
+
+Prerequisites:
+
+- You must have the [Admin](../configure_instance/users_notifications.md#add-switchboard-users) role.
+
+To make a configuration change:
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Follow the instructions in the relevant sections below.
+
+For all other instance configurations, submit a support ticket according to the
+[configuration change request policy](../configure_instance/index.md#configuration-change-request-policy).
+
+### Apply configuration changes in Switchboard
+
+You can apply configuration changes made in Switchboard immediately or defer them until your next scheduled weekly [maintenance window](../../../administration/dedicated/maintenance.md#maintenance-windows).
+
+When you apply changes immediately:
+
+- Deployment can take up to 90 minutes.
+- Changes are applied in the order they're saved.
+- You can save multiple changes and apply them in one batch.
+
+After the deployment job is complete, you receive an email notification. Check your spam folder if you do not see a notification in your main inbox.
+All users with access to view or edit your tenant in Switchboard receive a notification for each change. For more information, see [Manage Switchboard notification preferences](../configure_instance/users_notifications.md#manage-notification-preferences).
+
+NOTE:
+You only receive email notifications for changes made by a Switchboard tenant administrator. Changes made by a GitLab Operator (for example, a GitLab version update completed during a maintenance window) do not trigger email notifications.
+
+## Configuration change log
+
+The **Configuration change log** page in Switchboard tracks changes made to your GitLab Dedicated instance.
+
+Each change log entry includes the following details:
+
+| Field                | Description                                                                                                                                   |
+|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
+| Configuration change | Name of the configuration setting that changed.                                                                                               |
+| User                 | Email address of the user that made the configuration change. For changes made by a GitLab Operator, this value appears as `GitLab Operator`. |
+| IP                   | IP address of the user that made the configuration change. For changes made by a GitLab Operator, this value appears as `Unavailable`.        |
+| Status               | Whether the configuration change is initiated, in progress, completed, or deferred.                                                           |
+| Start time           | Start date and time when the configuration change is initiated, in UTC.                                                                       |
+| End time             | End date and time when the configuration change is deployed, in UTC.                                                                          |
+
+Each configuration change has a status:
+
+| Status | Description |
+|---|---|
+| Initiated | Configuration change is made in Switchboard, but not yet deployed to the instance. |
+| In progress | Configuration change is actively being deployed to the instance. |
+| Complete | Configuration change has been deployed to the instance. |
+| Delayed | Initial job to deploy a change has failed and the change has not yet been assigned to a new job. |
+
+### View the configuration change log
+
+To view the configuration change log:
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. Select your tenant.
+1. At the top of the page, select **Configuration change log**.
+
+Each configuration change appears as an entry in the table. Select **View details** to see more information about each change.
+
+## Configuration change request policy
+
+This policy does not apply to configuration changes made by a GitLab Dedicated instance admin using Switchboard.
+
+Configuration changes requested with a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) adhere to the following policies:
+
+- Are applied during your environment's weekly four-hour maintenance window.
+- Can be requested for options specified during onboarding or for optional features listed on this page.
+- May be postponed to the following week if GitLab needs to perform high-priority maintenance tasks.
+- Can't be applied outside the weekly maintenance window unless they qualify for [emergency support](https://about.gitlab.com/support/#how-to-engage-emergency-support).
+
+NOTE:
+Even if a change request meets the minimum lead time, it might not be applied during the upcoming maintenance window.
diff --git a/doc/administration/dedicated/configure_instance/network_security.md b/doc/administration/dedicated/configure_instance/network_security.md
new file mode 100644
index 00000000000..4aa455a94f6
--- /dev/null
+++ b/doc/administration/dedicated/configure_instance/network_security.md
@@ -0,0 +1,281 @@
+---
+stage: SaaS Platforms
+group: GitLab Dedicated
+description: Configure network access and security settings for GitLab Dedicated.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# GitLab Dedicated network access and security
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab Dedicated
+
+## Bring your own domain (BYOD)
+
+You can use a [custom hostname](../../../subscriptions/gitlab_dedicated/index.md#bring-your-own-domain) to access your GitLab Dedicated instance. You can also provide a custom hostname for the bundled container registry and Kubernetes Agent Server (KAS) services.
+
+### Let's Encrypt certificates
+
+GitLab Dedicated integrates with [Let's Encrypt](https://letsencrypt.org/), a free, automated, and open source certificate authority. When you use a custom hostname, Let's Encrypt automatically issues and renews SSL/TLS certificates for your domain.
+
+This integration uses the [`http-01` challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) to obtain certificates through Let's Encrypt.
+
+### Set up DNS records
+
+To use a custom hostname with GitLab Dedicated, you must update your domain's DNS records.
+
+Prerequisites:
+
+- Access to your domain host's DNS settings.
+
+To set up DNS records for a custom hostname with GitLab Dedicated:
+
+1. Sign in to your domain host's website.
+
+1. Go to the DNS settings.
+
+1. Add a `CNAME` record that points your custom hostname to your GitLab Dedicated tenant. For example:
+
+   ```plaintext
+    gitlab.my-company.com.  CNAME  my-tenant.gitlab-dedicated.com
+   ```
+
+1. Optional. If your domain has an existing `CAA` record, update it to include [Let's Encrypt](https://letsencrypt.org/docs/caa/) as a valid certificate authority. If your domain does not have any `CAA` records, you can skip this step. For example:
+
+   ```plaintext
+   example.com.  IN  CAA 0 issue "pki.goog"
+   example.com.  IN  CAA 0 issue "letsencrypt.org"
+   ```
+
+   In this example, the `CAA` record defines Google Trust Services (`pki.goog`) and Let's Encrypt (`letsencrypt.org`) as certificate authorities that are allowed to issue certificates for your domain.
+
+1. Save your changes and wait for the DNS changes to propagate.
+
+### Add your custom hostname
+
+To add a custom hostname to your existing GitLab Dedicated instance, submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
+
+## Custom certificates
+
+Custom certificates establish trust between your GitLab Dedicated instance and certificates signed by non-public Certificate Authorities (CA). If you want to connect to a service that uses a certificate signed by a private or internal CA, you must first add that certificate to your GitLab Dedicated instance.
+
+### Add a custom certificate with Switchboard
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **Custom Certificate Authorities**.
+1. Select **+ Add Certificate**.
+1. Paste the certificate into the text box.
+1. Select **Save**.
+1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window.
+
+### Add a custom certificate with a Support Request
+
+If you are unable to use Switchboard to add a custom certificate, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and attach your custom public certificate files to request this change.
+
+## AWS Private Link connectivity
+
+### Inbound Private Link
+
+[AWS Private Link](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) allows users and applications in your VPC on AWS to securely connect to the GitLab Dedicated endpoint without network traffic going over the public internet.
+
+To enable the Inbound Private Link:
+
+1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650). In the body of your support ticket, include the IAM principals for the AWS users or roles in your AWS organization that are establishing the VPC endpoints in your AWS account. The IAM principals must be [IAM role principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-roles) or [IAM user principals](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-users). GitLab Dedicated uses these IAM Principals for access-control. These IAM principals are the only ones able to set up an endpoint to the service.
+1. After your IAM Principals have been allowlisted, GitLab [creates the Endpoint Service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) and communicates the `Service Endpoint Name` on the support ticket. The service name is generated by AWS upon creation of the service endpoint.
+   - GitLab handles the domain verification for the Private DNS name, so that DNS resolution of the tenant instance domain name in your VPC resolves to the PrivateLink endpoint.
+   - The endpoint service is available in two Availability Zones. These are either the zones you chose during onboarding or two randomly selected zones if you didn't specify any.
+1. In your own AWS account, create an [Endpoint Interface](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in your VPC, with the following settings:
+   - Service Endpoint Name: use the name provided by GitLab on the support ticket.
+   - Private DNS names enabled: yes.
+   - Subnets: choose all matching subnets.
+
+1. After you create the endpoint, use the instance URL provided to you during onboarding to securely connect to your GitLab Dedicated instance from your VPC, without the traffic going over the public internet.
+
+### Outbound Private Link
+
+Outbound private links allow your GitLab Dedicated instance and the hosted runners for GitLab Dedicated to securely communicate with services running in your VPC on AWS without exposing any traffic to the public internet.
+
+This type of connection allows GitLab functionality to access private services:
+
+- For the GitLab Dedicated instance:
+
+  - [webhooks](../../../user/project/integrations/webhooks.md)
+  - import or mirror projects and repositories
+
+- For hosted runners:
+
+  - custom secrets managers
+  - artifacts or job images stored in your infrastructure
+  - deployments into your infrastructure
+
+Consider the following:
+
+- You can only establish private links between VPCs in the same region. Therefore, you can only establish a connection in the regions specified for your Dedicated instance.
+- The connection requires the [Availability Zone IDs (AZ IDs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#az-ids) for the two Availability Zones (AZs) in the regions that you selected during onboarding.
+- If you did not specify any AZs during onboarding to Dedicated, GitLab randomly selects both AZ IDs.
+- GitLab Dedicated limits the number of outbound private link connections to 10.
+
+#### Add an outbound private link with Switchboard
+
+Prerequisites:
+
+- [Create the endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) for your internal service to be available to GitLab Dedicated.
+- Configure a Network Load Balancer (NLB) for the endpoint service in the Availability Zones (AZs) where your Dedicated instance is deployed. Either:
+  - Use the AZs listed in the Outbound private link configuration in Switchboard.
+  - Enable the NLB in every AZ in the region.
+- Add the ARN of the role that GitLab Dedicated uses to connect to your endpoint service to the Allowed Principals list on the Endpoint Service. You can find this ARN in Switchboard under Outbound private link IAM principal. For more information, see [Manage permissions](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions).
+- Recommended. Set **Acceptance required** to **No** to enable GitLab Dedicated to connect in a single operation. If set to **Yes**, you must manually accept the connection after it's initiated.
+
+  NOTE:
+  If you set **Acceptance required** to **Yes**, Switchboard cannot accurately determine when the link is accepted. After you manually accept the link, the status shows as **Pending** instead of **Active** until next scheduled maintenance. After maintenance, the link status refreshes and shows as connected.
+
+- Once the endpoint service is created, note the Service Name and if you have enabled Private DNS or not.
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **Outbound private link**.
+1. Complete the fields.
+1. To add endpoint services, select **Add endpoint service**. You can add up to ten endpoint services per region. At least one endpoint service is required to save the region.
+1. Select **Save**.
+1. Optional. To add an outbound private link for a second region, select **Add outbound connection**, then repeat the previous steps.
+
+#### Delete an outbound private link with Switchboard
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **Outbound private link**.
+1. Go to the outbound private link you want to delete, then select **Delete** (**{remove}**).
+1. Select **Delete**.
+1. Optional. To delete all the links in a region, from the region header, select **Delete** (**{remove}**). This also deletes the region configuration.
+
+#### Add an outbound private link with a support request
+
+1. [Create the Endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html) through which your internal service
+   will be available to GitLab Dedicated. Provide the associated `Service Endpoint Name` on a new
+   [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
+1. Make sure you have configured a Network Load Balancer (NLB) for the endpoint service in the two AZs to which your Dedicated instance was deployed. If you did not specify these during onboarding to Dedicated, you must either:
+   - Submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) to request the AZ IDs required to enable the connection and ensure the NLB is enabled in those AZs.
+   - Ensure the NLB is enabled in every AZ in the region.
+1. In your [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), GitLab will provide you with the ARN of an
+   IAM role that will be initiating the connection to your endpoint service. You must ensure this ARN is included, or otherwise covered by other
+   entries, in the list of "Allowed Principals" on the Endpoint Service, as described by the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions).
+   Though it's optional, you should you add it explicitly, allowing you to set `Acceptance required` to No so that Dedicated can connect in a single operation.
+   If you leave `Acceptance required` as Yes, then you must manually accept the connection after Dedicated has initiated it.
+1. To connect to services using the Endpoint, the Dedicated services require a DNS name. Private Link automatically creates an internal name, but
+   it is machine-generated and not generally directly useful. There are two options available:
+   - In your Endpoint Service, enable [Private DNS name](https://docs.aws.amazon.com/vpc/latest/privatelink/manage-dns-names.html), perform the
+     required validation, and let GitLab know in the support ticket that you are using this option. If `Acceptance Required` is set to Yes on your
+     Endpoint Service, also note this on the support ticket because Dedicated will need to initiate the connection without Private DNS, wait for you
+     to confirm it has been accepted, and then update the connection to enable the use of Private DNS.
+   - Dedicated can manage a Private Hosted Zone (PHZ) within the Dedicated AWS Account and alias any arbitrary DNS names to the endpoint, directing
+     requests for those names to your endpoint service. These aliases are known as PHZ entries. For more information, see [Private hosted zones](#private-hosted-zones).
+
+GitLab then configures the tenant instance to create the necessary Endpoint Interfaces based on the service names you provided. Any matching outbound
+connections made from the tenant instance are directed through the PrivateLink into your VPC.
+
+#### Troubleshooting
+
+If you have trouble establishing a connection after the Outbound Private Link has been set up, there are a few things in your AWS infrastructure that could be the cause of the problem. The specific things to check will vary based on the unexpected behavior you're seeking to fix. Things to check include:
+
+- Ensure that cross-zone load balancing is turned on in your Network Load Balancer (NLB).
+- Ensure that the Inbound Rules section of the appropriate Security Groups permits traffic from the correct IP ranges.
+- Ensure that the inbound traffic is mapped to the correct port on the Endpoint Service.
+- In Switchboard, expand **Outbound private link** and confirm that the details appear as you expect.
+- Ensure that you have [allowed requests to the local network from webhooks and integrations](../../../security/webhooks.md#allow-requests-to-the-local-network-from-webhooks-and-integrations).
+
+## Private hosted zones
+
+A private hosted zone (PHZ) creates custom DNS aliases (CNAMEs) that resolve in your GitLab Dedicated instance's network.
+
+Use a PHZ when you want to:
+
+- Create multiple DNS names or aliases that use a single endpoint, such as when running a reverse proxy to connect to multiple services.
+- Use a private domain that cannot be validated by public DNS.
+
+PHZs are commonly used with reverse PrivateLink to create readable domain names instead of using AWS-generated endpoint names. For example, you can use `alpha.beta.tenant.gitlab-dedicated.com` instead of `vpce-0987654321fedcba0-k99y1abc.vpce-svc-0a123bcd4e5f678gh.eu-west-1.vpce.amazonaws.com`.
+
+In some cases, you can also use PHZs to create aliases that resolve to publicly accessible DNS names. For example, you can create an internal DNS name that resolves to a public endpoint when you need internal systems to access a service through its private name.
+
+### PHZ domain structure
+
+When using your GitLab Dedicated instance's domain as part of an alias, you must include two subdomains before the main domain, where:
+
+- The first subdomain becomes the name of the PHZ.
+- The second subdomain becomes the record entry for the alias.
+
+For example:
+
+- Valid PHZ entry: `subdomain2.subdomain1.<your-tenant-id>.gitlab-dedicated.com`.
+- Invalid PHZ entry: `subdomain1.<your-tenant-id>.gitlab-dedicated.com`.
+
+When not using your GitLab Dedicated instance domain, you must still provide:
+
+- A Private Hosted Zone (PHZ) name
+- A PHZ entry in the format `phz-entry.phz-name.com`
+
+To prevent shadowing of public DNS domains when the domain is created inside the Dedicated tenant, use at least two additional subdomain levels below any public domain for your PHZ entries. For example, if your tenant is hosted at `tenant.gitlab-dedicated.com`, your PHZ entry should be at least `subdomain1.subdomain2.tenant.gitlab-dedicated.com`, or if you own `customer.com` then at least `subdomain1.subdomain2.customer.com`, where `subdomain2` is not a public domain.
+
+### Add a private hosted zone with Switchboard
+
+To add a private hosted zone:
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **Private hosted zones**.
+1. Select **Add private hosted zone entry**.
+1. Complete the fields.
+   - In the **Hostname** field, enter your Private Hosted Zone (PHZ) entry.
+   - For **Link type**, choose one of the following:
+     - For an outbound private link PHZ entry, select the endpoint service from the dropdown list.
+     Only links with the `Available` or `Pending Acceptance` status are shown.
+     - For other PHZ entries, provide a list of DNS aliases.
+1. Select **Save**.
+Your PHZ entry and any aliases should appear in the list.
+1. Scroll to the top of the page, and select whether to apply the changes immediately or during the next maintenance window.
+
+### Add a private hosted zone with a support request
+
+If you are unable to use Switchboard to add a private hosted zone, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and provide a list of DNS names that should resolve to the endpoint service for the outbound private link. The list can be updated as needed.
+
+## IP allowlist
+
+GitLab Dedicated allows you to control which IP addresses can access your instance through an IP allowlist. Once the IP allowlist has been enabled, when an IP not on the allowlist tries to access your instance an `HTTP 403 Forbidden` response is returned.
+
+IP addresses that have been added to your IP allowlist can be viewed on the Configuration page in Switchboard. You can add or remove IP addresses from your allowlist with Switchboard.
+
+### Add an IP to the allowlist with Switchboard
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **Allowed Source List Config / IP allowlist**.
+1. Turn on the **Enable** toggle.
+1. Select **Add Item**.
+1. Enter the IP address and description. To add another IP address, repeat steps 5 and 6.
+1. Select **Save**.
+1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window. After the changes are applied, the IP addresses are added to the IP allowlist for your instance.
+
+### Add an IP to the allowlist with a Support Request
+
+If you are unable to use Switchboard to update your IP allowlist, you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and specify a comma separated list of IP addresses that can access your GitLab Dedicated instance.
+
+### Enable OpenID Connect for your IP allowlist
+
+Using [GitLab as an OpenID Connect identity provider](../../../integration/openid_connect_provider.md) requires internet access to the OpenID Connect verification endpoint.
+
+To enable access to the OpenID Connect endpoint while maintaining your IP allowlist:
+
+- In a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), request to allow access to the OpenID Connect endpoint.
+
+The configuration is applied during the next maintenance window.
+
+### Enable SCIM provisioning for your IP allowlist
+
+You can use SCIM with external identity providers to automatically provision and manage users. To use SCIM, your identity provider must be able to access the [instance SCIM API](../../../development/internal_api/index.md#instance-scim-api) endpoints. By default, IP allowlisting blocks communication to these endpoints.
+
+To enable SCIM while maintaining your IP allowlist:
+
+- In a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650), request to enable SCIM endpoints to the internet.
+
+The configuration is applied during the next maintenance window.
diff --git a/doc/administration/dedicated/configure_instance/saml.md b/doc/administration/dedicated/configure_instance/saml.md
new file mode 100644
index 00000000000..9dc1c4e606c
--- /dev/null
+++ b/doc/administration/dedicated/configure_instance/saml.md
@@ -0,0 +1,132 @@
+---
+stage: SaaS Platforms
+group: GitLab Dedicated
+description: Configure SAML single sign-on (SSO) authentication for GitLab Dedicated.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# SAML single sign-on for GitLab Dedicated
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab Dedicated
+
+You can [configure SAML single sign-on (SSO)](../../../integration/saml.md#configure-saml-support-in-gitlab) for your GitLab Dedicated instance. Optionally, you can configure more than one SAML identity provider (IdP).
+
+The following SAML SSO options are available:
+
+- [Request signing](../../../integration/saml.md#sign-saml-authentication-requests-optional)
+- [SAML SSO for groups](../../../integration/saml.md#configure-users-based-on-saml-group-membership)
+- [Group sync](../../../user/group/saml_sso/group_sync.md#configure-saml-group-sync)
+
+Prerequisites:
+
+- You must [set up the identity provider](../../../integration/saml.md#set-up-identity-providers) before you can configure SAML for GitLab Dedicated.
+- To configure GitLab to sign SAML authentication requests, you must create a private key and public certificate pair for your GitLab Dedicated instance.
+
+NOTE:
+You can only configure one SAML IdP with Switchboard. If you configured a SAML IdP on your GitLab Dedicated instance before the introduction of support for multiple IdPs, you can manage that provider through Switchboard. To configure additional SAML IdPs, [submit a support request](#activate-saml-with-a-support-request).
+
+## Activate SAML with Switchboard
+
+To activate SAML for your GitLab Dedicated instance:
+
+1. Sign in to [Switchboard](https://console.gitlab-dedicated.com/).
+1. At the top of the page, select **Configuration**.
+1. Expand **SAML Config**.
+1. Turn on the **Enable** toggle.
+1. Complete the required fields:
+   - SAML label
+   - IdP cert fingerprint
+   - IdP SSO target URL
+   - Name identifier format
+1. To configure users based on [SAML group membership](#saml-groups) or use [group sync](#group-sync), complete the following fields:
+   - SAML group attribute
+   - Admin groups
+   - Auditor groups
+   - External groups
+   - Required groups
+1. To configure [SAML request signing](#request-signing), complete the following fields:
+   - Issuer
+   - Attribute statements
+   - Security
+1. Select **Save**.
+1. Scroll up to the top of the page and select whether to apply the changes immediately or during the next maintenance window.
+1. To use group sync, [configure the SAML group links](../../../user/group/saml_sso/group_sync.md#configure-saml-group-links).
+1. To verify the SAML configuration is successful:
+   - Check that the SSO button description is displayed on your instance's sign-in page.
+   - Go to the metadata URL of your instance (`https://INSTANCE-URL/users/auth/saml/metadata`). This page can be used to simplify much of the configuration of the identity provider, and manually validate the settings.
+
+## Activate SAML with a Support Request
+
+If you are unable to use Switchboard to activate or update SAML for your GitLab Dedicated instance, or if you need to configure more than one SAML IdP, then you can open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650):
+
+1. To make the necessary changes, include the desired [SAML configuration block](../../../integration/saml.md#configure-saml-support-in-gitlab) for your GitLab application in your support ticket. At a minimum, GitLab needs the following information to enable SAML for your instance:
+   - IDP SSO Target URL
+   - Certificate fingerprint or certificate
+   - NameID format
+   - SSO login button description
+
+   ```json
+   "saml": {
+     "attribute_statements": {
+         //optional
+     },
+     "enabled": true,
+     "groups_attribute": "",
+     "admin_groups": [
+       // optional
+     ],
+     "idp_cert_fingerprint": "43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8",
+     "idp_sso_target_url": "https://login.example.com/idp",
+     "label": "IDP Name",
+     "name_identifier_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+     "security": {
+       // optional
+     },
+     "auditor_groups": [
+       // optional
+     ],
+     "external_groups": [
+       // optional
+     ],
+     "required_groups": [
+       // optional
+     ],
+   }
+   ```
+
+1. After GitLab deploys the SAML configuration to your instance, you are notified on your support ticket.
+1. To verify the SAML configuration is successful:
+   - Check that the SSO login button description is displayed on your instance's login page.
+   - Go to the metadata URL of your instance, which is provided by GitLab in the support ticket. This page can be used to simplify much of the configuration of the identity provider, as well as manually validate the settings.
+
+## Request signing
+
+If [SAML request signing](../../../integration/saml.md#sign-saml-authentication-requests-optional) is desired, a certificate must be obtained. This certificate can be self-signed which has the advantage of not having to prove ownership of an arbitrary Common Name (CN) to a public Certificate Authority (CA).
+
+NOTE:
+Because SAML request signing requires certificate signing, you must complete these steps to use SAML with this feature enabled.
+
+To enable SAML request signing:
+
+1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) and indicate that you want request signing enabled.
+1. GitLab will work with you on sending the Certificate Signing Request (CSR) for you to sign. Alternatively, the CSR can be signed with a public CA.
+1. After the certificate is signed, you can then use the certificate and its associated private key to complete the `security` section of the [SAML configuration](#activate-saml-with-switchboard) in Switchboard.
+
+Authentication requests from GitLab to your identity provider can now be signed.
+
+## SAML groups
+
+With SAML groups you can configure GitLab users based on SAML group membership.
+
+To enable SAML groups, add the [required elements](../../../integration/saml.md#configure-users-based-on-saml-group-membership) to your SAML configuration in [Switchboard](#activate-saml-with-switchboard) or to the SAML block you provide in a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
+
+## Group sync
+
+With [group sync](../../../user/group/saml_sso/group_sync.md), you can sync users across identity provider groups to mapped groups in GitLab.
+
+To enable group sync:
+
+1. Add the [required elements](../../../user/group/saml_sso/group_sync.md#configure-saml-group-sync) to your SAML configuration in [Switchboard](#activate-saml-with-switchboard) or to the SAML configuration block you provide in a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
+1. Configure the [Group Links](../../../user/group/saml_sso/group_sync.md#configure-saml-group-links).
diff --git a/doc/administration/dedicated/configure_instance/users_notifications.md b/doc/administration/dedicated/configure_instance/users_notifications.md
new file mode 100644
index 00000000000..2e3fd4e5ba7
--- /dev/null
+++ b/doc/administration/dedicated/configure_instance/users_notifications.md
@@ -0,0 +1,50 @@
+---
+stage: SaaS Platforms
+group: GitLab Dedicated
+description: Manage Switchboard users and configure notification preferences, including SMTP email service settings.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# GitLab Dedicated users and notifications
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab Dedicated
+
+## Add Switchboard users
+
+Administrators can add Switchboard users to their GitLab Dedicated instance. There are two types of users:
+
+- **Read only**: Users can only view instance data.
+- **Admin**: Users can edit the instance configuration and manage users.
+
+To add a new user to your GitLab Dedicated instance:
+
+1. From the **Tenants** page, select **Manage** next to the tenant instance.
+1. From the top of the page, select **Users**.
+1. Select **New user**.
+1. Enter the **Email** and select a **Role** for the user.
+1. Select **Create**.
+
+An invitation to use Switchboard is sent to the user.
+
+### Manage notification preferences
+
+You can specify whether you want to receive email notifications from Switchboard. You will only receive notifications after you:
+
+- Receive an email invitation and first sign in to Switchboard.
+- Set up a password and two-factor authentication (2FA) for your user account.
+
+To manage your own email notification preferences:
+
+1. From any page, open the dropdown next to your user name.
+1. To stop receiving email notifications, select **Toggle email notifications off**.
+1. To resume receiving email notifications, select **Toggle email notifications on**.
+
+You will see an alert confirming that your notification preferences have been updated.
+
+## SMTP email service
+
+You can configure an [SMTP](../../../subscriptions/gitlab_dedicated/index.md#email-service) email service for your GitLab Dedicated instance.
+
+To configure an SMTP email service, submit a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) with the credentials and settings for your SMTP server.
diff --git a/doc/administration/dedicated/create_instance.md b/doc/administration/dedicated/create_instance.md
index 43800efc40b..af5806de9a2 100644
--- a/doc/administration/dedicated/create_instance.md
+++ b/doc/administration/dedicated/create_instance.md
@@ -201,7 +201,7 @@ Once your GitLab Dedicated instance is created, follow our recommendations on:
 
 Also plan ahead if you need the following features:
 
-- [Inbound Private Link](../../administration/dedicated/configure_instance.md#inbound-private-link)
-- [Outbound Private Link](../../administration/dedicated/configure_instance.md#outbound-private-link)
-- [SAML SSO](../../administration/dedicated/configure_instance.md#saml)
-- [Bring your own domain](../../administration/dedicated/configure_instance.md#bring-your-own-domain-byod)
+- [Inbound Private Link](../../administration/dedicated/configure_instance/network_security.md#inbound-private-link)
+- [Outbound Private Link](../../administration/dedicated/configure_instance/network_security.md#outbound-private-link)
+- [SAML SSO](../../administration/dedicated/configure_instance/saml.md)
+- [Bring your own domain](../../administration/dedicated/configure_instance/network_security.md#bring-your-own-domain-byod)
diff --git a/doc/administration/dedicated/hosted_runners.md b/doc/administration/dedicated/hosted_runners.md
index c37f0596bef..7cb9f3270bb 100644
--- a/doc/administration/dedicated/hosted_runners.md
+++ b/doc/administration/dedicated/hosted_runners.md
@@ -171,7 +171,7 @@ Two outbound private links exist by default for all runners in the GitLab-manage
 
 These links are pre-configured and cannot be modified. The tenant's Prometheus instance is managed by GitLab and is not accessible to users.
 
-To use an outbound private link with other VPC services, manual configuration is required. For more information, see [Outbound private link](../../administration/dedicated/configure_instance.md#outbound-private-link).
+To use an outbound private link with other VPC services, manual configuration is required. For more information, see [Outbound private link](configure_instance/network_security.md#outbound-private-link).
 
 ## IP ranges
 
diff --git a/doc/administration/dedicated/index.md b/doc/administration/dedicated/index.md
index ebd0e58a572..eb6d2c0c275 100644
--- a/doc/administration/dedicated/index.md
+++ b/doc/administration/dedicated/index.md
@@ -5,7 +5,7 @@ description: Get started with GitLab Dedicated.
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
 
-# GitLab Dedicated
+# Administer GitLab Dedicated
 
 DETAILS:
 **Tier:** Ultimate
@@ -61,7 +61,7 @@ Geo does not use an active-active failover configuration. For more information,
 
 Optionally, private connectivity is available for your GitLab Dedicated instance, using [AWS PrivateLink](https://aws.amazon.com/privatelink/) as a connection gateway.
 
-Both [inbound](../../administration/dedicated/configure_instance.md#inbound-private-link) and [outbound](../../administration/dedicated/configure_instance.md#outbound-private-link) private links are supported.
+Both [inbound](../../administration/dedicated/configure_instance/network_security.md#inbound-private-link) and [outbound](../../administration/dedicated/configure_instance/network_security.md#outbound-private-link) private links are supported.
 
 ![Diagram of a GitLab-managed AWS VPC using AWS PrivateLink to connect with a customer-managed AWS VPC.](img/privatelink_diagram_v17_1.png)
 
@@ -82,5 +82,5 @@ GitLab team members with edit access can update the [source](https://lucid.app/l
 To get started with GitLab Dedicated, use Switchboard to:
 
 1. [Create your GitLab Dedicated instance](../../administration/dedicated/create_instance.md).
-1. [Configure your GitLab Dedicated instance](../../administration/dedicated/configure_instance.md).
+1. [Configure your GitLab Dedicated instance](../../administration/dedicated/configure_instance/index.md).
 1. [Create a hosted runner](../../administration/dedicated/hosted_runners.md).
diff --git a/doc/administration/dedicated/monitor.md b/doc/administration/dedicated/monitor.md
new file mode 100644
index 00000000000..fdb50beb42f
--- /dev/null
+++ b/doc/administration/dedicated/monitor.md
@@ -0,0 +1,36 @@
+---
+stage: SaaS Platforms
+group: GitLab Dedicated
+description: Access application logs and S3 bucket data to monitor your GitLab Dedicated instance.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# Monitor your GitLab Dedicated instance
+
+GitLab delivers [application logs](../../administration/logs/index.md) to an Amazon S3 bucket in the GitLab tenant account, which can be shared with you.
+
+Logs stored in the S3 bucket are retained indefinitely, until the one year retention policy is fully enforced. GitLab team members can view more information in confidential issue [483](https://gitlab.com/gitlab-com/gl-infra/gitlab-dedicated/team/-/issues/483).
+
+## Request access to application logs
+
+To gain read only access to the S3 bucket with your application logs:
+
+1. Open a [support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650) with the title `Customer Log Access`.
+1. In the body of the ticket, include a list of IAM Principal Amazon Resource Names (ARNs) that require access to the logs from the S3 bucket. The ARNs can be for users or roles.
+   
+   NOTE:
+   Specify the full ARN path without wildcards (`*`). Wildcard characters are not supported. GitLab team members can read more about the proposed feature to add wildcard support in this confidential issue: [7010](https://gitlab.com/gitlab-com/gl-infra/gitlab-dedicated/team/-/issues/7010).
+
+GitLab provides the name of the S3 bucket. Your authorized users or roles can then access all objects in the bucket. To verify access, you can use the [AWS CLI](https://aws.amazon.com/cli/).
+
+## S3 bucket contents and structure
+
+The Amazon S3 bucket contains a combination of infrastructure logs and application logs from the GitLab [log system](../../administration/logs/index.md).
+
+The logs in the bucket are encrypted using an AWS KMS key managed by GitLab. If you choose to enable [BYOK](../../administration/dedicated/create_instance.md#encrypted-data-at-rest-byok), the application logs are not encrypted with the key you provide.
+
+<!-- vale gitlab_base.Spelling = NO -->
+
+The logs in the S3 bucket are organized by date in `YYYY/MM/DD/HH` format. For example, a directory named `2023/10/12/13` contains logs from October 12, 2023 at 13:00 UTC. The logs are streamed into the bucket with [Amazon Kinesis Data Firehose](https://aws.amazon.com/firehose/).
+
+<!-- vale gitlab_base.Spelling = YES -->
diff --git a/doc/development/application_secrets.md b/doc/development/application_secrets.md
index 7e730ef6373..1b1e710fc5d 100644
--- a/doc/development/application_secrets.md
+++ b/doc/development/application_secrets.md
@@ -12,37 +12,81 @@ This page is a development guide for application secrets.
 
 |Entry                             |Description                                                        |
 |---                               |---                                                                |
-|`secret_key_base`                 | The base key to be used for generating a various secrets          |
+| `secret_key_base`                | The base key to be used for generating a various secrets          |
 | `otp_key_base`                   | The base key for One Time Passwords, described in [User management](../raketasks/user_management.md#rotate-two-factor-authentication-encryption-key)              |
-|`db_key_base`                     | The base key to encrypt the data for `attr_encrypted` columns     |
-|`openid_connect_signing_key`      | The signing key for OpenID Connect                                |
+| `db_key_base`                    | The base key to encrypt the data for `attr_encrypted` columns     |
+| `openid_connect_signing_key`     | The signing key for OpenID Connect                                |
 | `encrypted_settings_key_base`    | The base key to encrypt settings files with                       |
+| `active_record_encryption_primary_key` | The base key to non-deterministically-encrypt data for `ActiveRecord::Encryption` encrypted columns |
+| `active_record_encryption_deterministic_key` | The base key to deterministically-encrypt data for `ActiveRecord::Encryption` encrypted columns |
+| `active_record_encryption_key_derivation_salt` | The derivation salt to encrypt data for `ActiveRecord::Encryption` encrypted columns |
 
 ## Where the secrets are stored
 
 |Installation type                  |Location                                                          |
 |---                                |---                                                               |
-| Linux package                     |[`/etc/gitlab/gitlab-secrets.json`](https://docs.gitlab.com/omnibus/settings/backups.html#backup-and-restore-omnibus-gitlab-configuration)                                 |
-| Cloud Native GitLab Charts        |[Kubernetes Secrets](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/f65c3d37fc8cf09a7987544680413552fb666aac/doc/installation/secrets.md#gitlab-rails-secret)|
-| Self-compiled                     |`<path-to-gitlab-rails>/config/secrets.yml` (Automatically generated by [01_secret_token.rb](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb))                       |
+| Linux package                     |[`/etc/gitlab/gitlab-secrets.json`](https://docs.gitlab.com/omnibus/settings/backups.html#backup-and-restore-omnibus-gitlab-configuration) |
+| Cloud Native GitLab Charts        |[Kubernetes Secrets](https://docs.gitlab.com/charts/installation/secrets.html#gitlab-rails-secret) |
+| Self-compiled                     |`<path-to-gitlab-rails>/config/secrets.yml` (Automatically generated by [`config/initializers/01_secret_token.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb)) |
 
 ## Warning: Before you add a new secret to application secrets
 
-Before you add a new secret to [`config/initializers/01_secret_token.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb),
-make sure you also update Omnibus GitLab or updates fail. Omnibus is responsible for writing the `secrets.yml` file.
-If Omnibus doesn't know about a secret, Rails attempts to write to the file, but this fails because Rails doesn't have write access.
-The same rules apply to Cloud Native GitLab charts, you must update the charts at first.
-In case you need the secret to have same value on each node (which is usually the case) you need to make sure it's configured for all
-GitLab.com environments prior to changing this file.
+### Add support to Omnibus GitLab and the Cloud Native GitLab charts
+
+Before you add a new secret to
+[`config/initializers/01_secret_token.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb),
+make sure you also update Omnibus GitLab and the Cloud Native GitLab charts, or the update will fail.
+Both installation methods are responsible for writing the `config/secrets.yml` file.
+If if they don't know about a secret, Rails attempts to write to the file, and fails because it doesn't
+have write access.
 
 **Examples**
 
-- [Change for self-compiled installation](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/27581)
-- [Change for Linux package installation](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/3267)
-- [Change for Linux package installation](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4158)
-- [Change for Cloud Native installation](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/1318)
+- [Change for self-compiled installation](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175154)
+- [Change for Omnibus GitLab installation](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/8026)
+- [Change for Cloud Native installation](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/3988)
+
+### Populate the secrets in live environments
+
+Additionally, in case you need the secret to have the same value on all nodes (which is usually the case),
+you need to make sure
+[it's configured for all live environments (GitLab.com, staging, pre)](https://gitlab.com/gitlab-com/gl-infra/k8s-workloads/gitlab-com/-/blob/master/releases/gitlab-external-secrets/values/values.yaml.gotmpl)
+prior to changing this file.
+
+### Document the new secrets
+
+#### Add the new secrets to this documentation file
+
+The new secrets should be documented in `doc/development/application_secrets.md`.
+
+#### Mention the new secrets in the next release upgrade notes
+
+The new secrets should be mentioned in the next release notes, in the upgrade section.
+
+For instance, for the 17.8 release, the notes would go in `data/release_posts/17_8/17-8-upgrade.yml` and contain something like the following:
+
+```yaml
+---
+upgrades:
+  - reporter: <your username>  # item author username
+    description: |
+      In Gitlab 17.8, three new secrets have been added to support the upcoming encryption framework:
+      - `active_record_encryption_primary_key`
+      - `active_record_encryption_deterministic_key`
+      - `active_record_encryption_key_derivation_salt`
+
+      **If you have a multi-node configuration, you should ensure these secrets are the same on all nodes.** Otherwise, the application will automatically generate the missing secrets.
+
+      If you use the [GitLab helm chart](https://docs.gitlab.com/charts/) and disabled the [shared-secrets chart](https://docs.gitlab.com/charts/charts/shared-secrets/), you will need to [manually create these secrets](https://docs.gitlab.com/charts/installation/secrets.html#gitlab-rails-secret).
+```
+
+#### Mention the new secrets in the next Cloud Native GitLab charts upgrade notes
+
+The new secrets should be mentioned in the current major release upgrade notes.
+
+For instance, for 8.8, you should document the new secrets in <https://docs.gitlab.com/charts/releases/8_0.html>.
 
 ## Further iteration
 
-We may either deprecate or remove this automatic secret generation `01_secret_token.rb` in the future.
-See [issue 222690](https://gitlab.com/gitlab-org/gitlab/-/issues/222690) for more information.
+We may either deprecate or remove this automatic secret generation performed by `config/initializers/01_secret_token.rb` in the future.
+See [issue #222690](https://gitlab.com/gitlab-org/gitlab/-/issues/222690) for more information.
diff --git a/doc/subscriptions/gitlab_dedicated/index.md b/doc/subscriptions/gitlab_dedicated/index.md
index 02b6f955f53..d649f54910a 100644
--- a/doc/subscriptions/gitlab_dedicated/index.md
+++ b/doc/subscriptions/gitlab_dedicated/index.md
@@ -38,16 +38,16 @@ GitLab Dedicated provides the following security features to protect your data a
 
 You can configure [SAML single sign-on (SSO)](../../integration/saml.md) using any number of SAML providers for authentication. Your instance acts as the service provider, and you provide the necessary configuration for GitLab to communicate with your Identity Providers (IdPs). SAML request signing, group sync, and SAML groups are supported.
 
-For more information, see how to configure [SAML](../../administration/dedicated/configure_instance.md#saml) for your instance.
+For more information, see how to configure [SAML](../../administration/dedicated/configure_instance/saml.md) for your instance.
 
 #### Secure networking
 
 Two connectivity options are available:
 
-- Public connectivity with IP allowlists: By default, your instance is publicly accessible. You can [configure an IP allowlist](../../administration/dedicated/configure_instance.md#ip-allowlist) to restrict access to specified IP addresses.
-- Private connectivity with AWS PrivateLink: You can configure [AWS PrivateLink](https://aws.amazon.com/privatelink/) for [inbound](../../administration/dedicated/configure_instance.md#inbound-private-link) and [outbound](../../administration/dedicated/configure_instance.md#outbound-private-link) connections.
+- Public connectivity with IP allowlists: By default, your instance is publicly accessible. You can [configure an IP allowlist](../../administration/dedicated/configure_instance/network_security.md#ip-allowlist) to restrict access to specified IP addresses.
+- Private connectivity with AWS PrivateLink: You can configure [AWS PrivateLink](https://aws.amazon.com/privatelink/) for [inbound](../../administration/dedicated/configure_instance/network_security.md#inbound-private-link) and [outbound](../../administration/dedicated/configure_instance/network_security.md#outbound-private-link) connections.
 
-For private connections to internal resources using non-public certificates, you can also [specify trusted certificates](../../administration/dedicated/configure_instance.md#custom-certificates).
+For private connections to internal resources using non-public certificates, you can also [specify trusted certificates](../../administration/dedicated/configure_instance/network_security.md#custom-certificates).
 
 #### Data encryption
 
@@ -59,7 +59,7 @@ For more information, see [Encrypted data at rest (BYOK)](../../administration/d
 
 #### Email service
 
-By default, [Amazon Simple Email Service (Amazon SES)](https://aws.amazon.com/ses/) is used to send emails securely. As an alternative, you can [configure your own email service](../../administration/dedicated/configure_instance.md#smtp-email-service) using SMTP.
+By default, [Amazon Simple Email Service (Amazon SES)](https://aws.amazon.com/ses/) is used to send emails securely. As an alternative, you can [configure your own email service](../../administration/dedicated/configure_instance/users_notifications.md#smtp-email-service) using SMTP.
 
 ### Compliance
 
@@ -96,7 +96,7 @@ In tenant accounts, GitLab Dedicated uses:
 
 #### Audit and observability
 
-You can access [application logs](../../administration/dedicated/configure_instance.md#application-logs) for auditing and observability purposes. These logs provide insights into system activities and user actions, helping you monitor your instance and maintain compliance requirements.
+You can access [application logs](../../administration/dedicated/monitor.md) for auditing and observability purposes. These logs provide insights into system activities and user actions, helping you monitor your instance and maintain compliance requirements.
 
 ### Bring your own domain
 
@@ -135,7 +135,7 @@ Custom domains for GitLab Pages are not supported. For example, if you added a c
 You can control access to your Pages website with:
 
 - [GitLab Pages access control](../../user/project/pages/pages_access_control.md).
-- [IP allowlists](../../administration/dedicated/configure_instance.md#ip-allowlist). Any existing IP allowlists for your GitLab Dedicated instances are applied.
+- [IP allowlists](../../administration/dedicated/configure_instance/network_security.md#ip-allowlist). Any existing IP allowlists for your GitLab Dedicated instances are applied.
 
 GitLab Pages for Dedicated:
 
@@ -168,8 +168,8 @@ You can use [SCIM for user management](../../api/scim.md) or [GitLab as an OpenI
 
 To use these features with IP allowlists:
 
-- [Enable SCIM provisioning for your IP allowlist](../../administration/dedicated/configure_instance.md#enable-scim-provisioning-for-your-ip-allowlist)
-- [Enable OpenID Connect for your IP allowlist](../../administration/dedicated/configure_instance.md#enable-openid-connect-for-your-ip-allowlist)
+- [Enable SCIM provisioning for your IP allowlist](../../administration/dedicated/configure_instance/network_security.md#enable-scim-provisioning-for-your-ip-allowlist)
+- [Enable OpenID Connect for your IP allowlist](../../administration/dedicated/configure_instance/network_security.md#enable-openid-connect-for-your-ip-allowlist)
 
 ### Pre-production environments
 
diff --git a/doc/subscriptions/gitlab_dedicated_for_government/index.md b/doc/subscriptions/gitlab_dedicated_for_government/index.md
index 8c8d6d97f11..3f0e369df94 100644
--- a/doc/subscriptions/gitlab_dedicated_for_government/index.md
+++ b/doc/subscriptions/gitlab_dedicated_for_government/index.md
@@ -49,7 +49,7 @@ DETAILS:
 
 GitLab Dedicated for Government supports instance-level [SAML OmniAuth](../../integration/saml.md). Your GitLab Dedicated instance acts as the service provider, and you must provide the necessary [configuration](../../integration/saml.md#configure-saml-support-in-gitlab) for GitLab to communicate with your IdP.
 
-SAML [request signing](../../integration/saml.md#sign-saml-authentication-requests-optional), [group sync](../../user/group/saml_sso/group_sync.md#configure-saml-group-sync), and [SAML groups](../../integration/saml.md#configure-users-based-on-saml-group-membership) are supported. For more information on how to configure SAML for your instance, see [SAML](../../administration/dedicated/configure_instance.md#saml).
+SAML [request signing](../../integration/saml.md#sign-saml-authentication-requests-optional), [group sync](../../user/group/saml_sso/group_sync.md#configure-saml-group-sync), and [SAML groups](../../integration/saml.md#configure-users-based-on-saml-group-membership) are supported. For more information on how to configure SAML for your instance, see [SAML](../../administration/dedicated/configure_instance/saml.md).
 
 #### Encryption
 
@@ -62,7 +62,7 @@ DETAILS:
 
 Email sent from GitLab Dedicated uses [Amazon Simple Email Service (Amazon SES)](https://aws.amazon.com/ses/). The connection to Amazon SES is encrypted.
 
-To send application email using an SMTP server instead of Amazon SES, you can [configure your own email service](../../administration/dedicated/configure_instance.md#smtp-email-service).
+To send application email using an SMTP server instead of Amazon SES, you can [configure your own email service](../../administration/dedicated/configure_instance/users_notifications.md#smtp-email-service).
 
 #### Isolation
 
diff --git a/doc/user/application_security/policies/vulnerability_management_policy.md b/doc/user/application_security/policies/vulnerability_management_policy.md
index ba17a5c2d08..5fc5e049639 100644
--- a/doc/user/application_security/policies/vulnerability_management_policy.md
+++ b/doc/user/application_security/policies/vulnerability_management_policy.md
@@ -22,11 +22,11 @@ detected. This can help reduce the workload of triaging vulnerabilities.
 When a scanner detects a vulnerability on the default branch, the scanner creates a vulnerability
 record with the status **Needs triage**. After the vulnerability has been remediated and the next
 security scan runs, the scan adds **No longer detected** to the record's activity log but the
-record's status does not change. You can change the status to **Resolved** either manually or by
-using a vulnerability management policy. Using a vulnerability management policy ensures rules are
-applied consistently. For example, you can create a policy that marks as resolved those
-vulnerabilities that are no longer detected on the default branch, but only those created by SAST
-and are of low risk.
+record's status does not change. You can change the status to **Resolved** either
+[manually](../vulnerabilities/index.md#change-the-status-of-a-vulnerability) or by using a
+vulnerability management policy. Using a vulnerability management policy ensures rules are applied
+consistently. For example, you can create a policy that marks as resolved those vulnerabilities that
+are no longer detected on the default branch, but only those created by SAST and are of low risk.
 
 The vulnerability management policy is applied when a pipeline runs against the default branch.
 For each vulnerability that is no longer detected and matches the policy's rules:
diff --git a/doc/user/application_security/vulnerabilities/index.md b/doc/user/application_security/vulnerabilities/index.md
index b854a21d51b..3f1f9ce6f37 100644
--- a/doc/user/application_security/vulnerabilities/index.md
+++ b/doc/user/application_security/vulnerabilities/index.md
@@ -27,11 +27,6 @@ including:
 If the scanner determined the vulnerability to be a false positive, an alert message is included at
 the top of the vulnerability's page.
 
-When a vulnerability is no longer detected in a project's default branch, you should
-change its status to **Resolved**. This ensures that if it is accidentally reintroduced in a future
-merge, it is reported again as a new record. To change the status of multiple vulnerabilities, use
-the Vulnerability Report's [Activity filter](../vulnerability_report/index.md#activity-filter).
-
 ## Explaining a vulnerability
 
 DETAILS:
@@ -311,6 +306,17 @@ stateDiagram
     Resolved --> [*]
 ```
 
+## Vulnerability is no longer detected
+
+A vulnerability may be no longer detected because of changes made deliberately to remediate it or
+as a side effect of other changes. When a security scan runs and a vulnerability is no longer
+detected in the default branch, the scanner adds **No longer detected** to the record's activity log
+but the record's status does not change. Instead you should check and confirm the
+vulnerability has been resolved and if so,
+[manually change its status to **Resolved**](#change-the-status-of-a-vulnerability). You can also
+use a [vulnerability management policy](../policies/vulnerability_management_policy.md) to
+automatically change the status of vulnerabilities matching specific criteria to **Resolved**.
+
 ## Vulnerability dismissal reasons
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/4942) in GitLab 15.11 [with a flag](../../../administration/feature_flags.md) named `dismissal_reason`.
diff --git a/doc/user/application_security/vulnerability_report/index.md b/doc/user/application_security/vulnerability_report/index.md
index 048e6801a99..fcf032d312b 100644
--- a/doc/user/application_security/vulnerability_report/index.md
+++ b/doc/user/application_security/vulnerability_report/index.md
@@ -265,15 +265,6 @@ refreshed.
 
 ![Project Vulnerability Report](img/project_security_dashboard_status_change_v16_0.png)
 
-### Update a resolved vulnerability
-
-When a vulnerability is resolved by a merge request, it still appears in the vulnerability report.
-
-To update the vulnerability:
-
-1. Confirm that the resolved vulnerability has the status **no longer detected**. The status of a vulnerability is displayed on the [activity filter](../vulnerability_report/index.md#activity-filter) and the vulnerability record.
-1. Change the status of the vulnerability to **Resolved**.
-
 ## Sort vulnerabilities by date detected
 
 By default, vulnerabilities are sorted by severity level, with the highest-severity vulnerabilities listed at the top.
diff --git a/doc/user/group/saml_sso/troubleshooting.md b/doc/user/group/saml_sso/troubleshooting.md
index 427c5b546fe..f5988a0ebd1 100644
--- a/doc/user/group/saml_sso/troubleshooting.md
+++ b/doc/user/group/saml_sso/troubleshooting.md
@@ -14,7 +14,7 @@ This page contains possible solutions for problems you might encounter when usin
 
 - [SAML SSO for GitLab.com groups](index.md).
 - The self-managed instance-level [SAML OmniAuth Provider](../../../integration/saml.md).
-- [Switchboard](../../../administration/dedicated/configure_instance.md#activate-saml-with-switchboard) to configure SAML for GitLab Dedicated instances.
+- [Switchboard](../../../administration/dedicated/configure_instance/saml.md#activate-saml-with-switchboard) to configure SAML for GitLab Dedicated instances.
 
 ## SAML debugging tools
 
diff --git a/doc/user/profile/comment_templates.md b/doc/user/profile/comment_templates.md
index 113c2db8465..4cdc334b653 100644
--- a/doc/user/profile/comment_templates.md
+++ b/doc/user/profile/comment_templates.md
@@ -16,13 +16,9 @@ DETAILS:
 > - [Feature flag `saved_replies` removed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123363) in GitLab 16.6.
 > - Group-level saved replies [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12669) in GitLab 16.11 [with a flag](../../administration/feature_flags.md) named `group_saved_replies_flag`. Disabled by default.
 > - Group-level saved replies [enabled](https://gitlab.com/gitlab-org/gitlab/-/issues/440817) on GitLab.com and self-managed in GitLab 16.11.
-> - Group-level saved replies [generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/504028) in GitLab 17.7. Feature flag `group_saved_replies_flag` removed.
+> - Group-level saved replies [generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/504028) in GitLab 17.8. Feature flag `group_saved_replies_flag` removed.
 > - Project-level saved replies [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12669) in GitLab 17.0 [with a flag](../../administration/feature_flags.md) named `project_saved_replies_flag`. Enabled by default.
-> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/504028) in GitLab 17.7. Feature flag `project_saved_replies_flag` removed.
-
-FLAG:
-The availability of Project-level saved replies is controlled by a feature flag.
-For more information, see the history.
+> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/504028) in GitLab 17.8. Feature flag `project_saved_replies_flag` removed.
 
 With comment templates, create and reuse text for any text area in:
 
diff --git a/doc/user/project/members/sharing_projects_groups.md b/doc/user/project/members/sharing_projects_groups.md
index 317541d167b..588e370ba81 100644
--- a/doc/user/project/members/sharing_projects_groups.md
+++ b/doc/user/project/members/sharing_projects_groups.md
@@ -120,7 +120,7 @@ To invite a group to a project:
 1. Select **Manage > Members**.
 1. Select **Invite a group**.
 1. In the **Select a group to invite** list, select the group you want to invite.
-1. Select the highest [role](../../permissions.md) for users in the group.
+1. From the **Select maximum role** list, select the highest [role](../../permissions.md) the invited group's members can have in the project. Group members with a higher role are limited to this role, while members with a lower role keep their existing role.
 1. Optional. Select an **Access expiration date**.
    From that date onward, the invited group can no longer access the project.
 1. Select **Invite**.
@@ -140,6 +140,35 @@ The **Members** tab shows:
 
 The members of the invited group are not displayed on the **Members** tab unless the `webui_members_inherited_users` feature flag is enabled.
 
+#### Examples
+
+A project with the name `project-01` has the following direct members:
+
+- User A, Owner
+- User B, Maintainer
+
+A group with the name `group-01` has the following direct members:
+
+- User C, Owner
+- User D, Maintainer
+- User E, Reporter
+
+When `group-01` is invited to `project-01` with `Developer` permissions, users have the following roles:
+
+- User A, Owner
+- User B, Maintainer
+- User C, Developer
+- User D, Developer
+- User E, Reporter
+
+When `group-01` is invited to `project-01` with `Owner` permissions, users have the following roles:
+
+- User A, Owner
+- User B, Maintainer
+- User C, Owner
+- User D, Maintainer
+- User E, Reporter
+
 ### View a group's shared projects
 
 In a group, a shared project is a project to which the group members gained access through the [**Invite a group**](#invite-a-group-to-a-project) action.
diff --git a/lib/gitlab/background_migration/delete_orphaned_project_namespaces.rb b/lib/gitlab/background_migration/delete_orphaned_project_namespaces.rb
new file mode 100644
index 00000000000..4a4f0e6875d
--- /dev/null
+++ b/lib/gitlab/background_migration/delete_orphaned_project_namespaces.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class DeleteOrphanedProjectNamespaces < BatchedMigrationJob
+      operation_name :delete_orphaned_project_namespaces_records
+      feature_category :groups_and_projects
+
+      scope_to ->(relation) { relation.where(type: 'Project') }
+
+      class Project < ::ApplicationRecord
+        self.table_name = 'projects'
+      end
+
+      class ProjectNamespace < ::ApplicationRecord
+        self.table_name = 'namespaces'
+        self.inheritance_column = :_type_disabled
+      end
+
+      def perform
+        each_sub_batch do |sub_batch|
+          sub_batch
+          .joins("LEFT JOIN namespaces AS parent ON namespaces.parent_id = parent.id")
+          .where.not(parent_id: nil)
+          .where(parent: { id: nil })
+          .pluck(:id).each do |orphaned_namespace_id|
+            next if Project.exists?(project_namespace_id: orphaned_namespace_id)
+
+            ProjectNamespace.delete(orphaned_namespace_id)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/database/migration_helpers/work_items/widgets.rb b/lib/gitlab/database/migration_helpers/work_items/widgets.rb
index 8d32722aee6..a330bc17925 100644
--- a/lib/gitlab/database/migration_helpers/work_items/widgets.rb
+++ b/lib/gitlab/database/migration_helpers/work_items/widgets.rb
@@ -12,11 +12,21 @@ module Gitlab
           #
           # Define the following constants in the migration class
           # WORK_ITEM_TYPE_ENUM_VALUE = 8
+          # Use only one array item to add a single widget
           # WIDGETS = [
           #   {
           #     name: 'Designs',
           #     widget_type: 22
-          #   }
+          #   },
+          #   {
+          #     name: 'Weight',
+          #     widget_type: 8,
+          #     # widget_options is optional
+          #     widget_options: {
+          #       editable: true,
+          #       rollup: false
+          #     }
+          #   },
           # ]
           #
           # Then define the #up and down methods like this:
@@ -42,7 +52,9 @@ module Gitlab
             # if inconsistent data is present.
             return say(type_missing_message(type_enum_value)) unless work_item_type
 
-            widget_definitions = widgets.map { |w| w.merge(work_item_type_id: work_item_type.id) }
+            widget_definitions = widgets.map do |w|
+              { work_item_type_id: work_item_type.id, widget_options: nil }.merge(w)
+            end
 
             migration_widget_definition.upsert_all(
               widget_definitions,
diff --git a/lib/gitlab/database_importers/work_items/base_type_importer.rb b/lib/gitlab/database_importers/work_items/base_type_importer.rb
index 3dae18464d0..d1528c56fbb 100644
--- a/lib/gitlab/database_importers/work_items/base_type_importer.rb
+++ b/lib/gitlab/database_importers/work_items/base_type_importer.rb
@@ -64,10 +64,14 @@ module Gitlab
             :development,
             :email_participants,
             :hierarchy,
+            :iteration,
+            :labels,
             :linked_items,
+            :milestone,
             :notes,
             :notifications,
             :participants,
+            :start_and_due_date,
             :time_tracking
           ],
           test_case: [
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 35e415cdf60..10a6e92d124 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -30118,7 +30118,7 @@ msgstr ""
 msgid "InviteMembersModal|%{linkStart}Read more%{linkEnd} about access expiration"
 msgstr ""
 
-msgid "InviteMembersModal|%{linkStart}Read more%{linkEnd} about role permissions. You can change this later."
+msgid "InviteMembersModal|%{linkStart}Read more%{linkEnd} about role permissions. You can change this later. Invited members are limited to this role or their current group role, whichever is lower."
 msgstr ""
 
 msgid "InviteMembersModal|Access expiration date (optional)"
@@ -30184,10 +30184,10 @@ msgstr ""
 msgid "InviteMembersModal|Select a group to invite"
 msgstr ""
 
-msgid "InviteMembersModal|Select a role"
+msgid "InviteMembersModal|Select from GitLab usernames or enter email addresses"
 msgstr ""
 
-msgid "InviteMembersModal|Select from existing GitLab usernames or enter email addresses"
+msgid "InviteMembersModal|Select maximum role"
 msgstr ""
 
 msgid "InviteMembersModal|Show less"
@@ -54094,6 +54094,9 @@ msgstr ""
 msgid "Start merge train..."
 msgstr ""
 
+msgid "Start review"
+msgstr ""
+
 msgid "Start search"
 msgstr ""
 
diff --git a/package.json b/package.json
index 8a17c3560cc..d020c7dd558 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "@babel/core": "^7.23.7",
     "@babel/preset-env": "^7.23.7",
     "@csstools/postcss-global-data": "^2.1.1",
-    "@cubejs-client/core": "^0.36.2",
+    "@cubejs-client/core": "^1.0.0",
     "@floating-ui/dom": "^1.2.9",
     "@gitlab/application-sdk-browser": "^0.3.3",
     "@gitlab/at.js": "1.5.7",
diff --git a/qa/qa/page/component/note.rb b/qa/qa/page/component/note.rb
index 8cba760edee..d18778f9f16 100644
--- a/qa/qa/page/component/note.rb
+++ b/qa/qa/page/component/note.rb
@@ -15,6 +15,8 @@ module QA
 
           base.view 'app/assets/javascripts/notes/components/comment_form.vue' do
             element 'comment-field'
+            element 'add-to-review-button'
+            element 'start-review-button'
           end
 
           base.view 'app/assets/javascripts/notes/components/comment_type_dropdown.vue' do
@@ -156,6 +158,18 @@ module QA
           has_comment?(text)
         end
 
+        def start_review_with_comment(text)
+          fill_editor_element 'comment-field', text
+          click_element 'start-review-button'
+          has_comment?(text)
+        end
+
+        def add_comment_to_review(text)
+          fill_editor_element 'comment-field', text
+          click_element 'add-to-review-button'
+          has_comment?(text)
+        end
+
         def toggle_comments(position)
           all_elements('toggle-comments-button', minimum: position)[position - 1].click
         end
diff --git a/qa/qa/page/file/shared/editor.rb b/qa/qa/page/file/shared/editor.rb
index 86d044bb4fa..93db7b6807f 100644
--- a/qa/qa/page/file/shared/editor.rb
+++ b/qa/qa/page/file/shared/editor.rb
@@ -13,6 +13,18 @@ module QA
             base.view 'app/views/projects/blob/_editor.html.haml' do
               element 'source-editor-preview-container'
             end
+
+            base.view 'app/assets/javascripts/repository/components/commit_changes_modal.vue' do
+              element 'commit-change-modal'
+            end
+
+            base.view 'app/assets/javascripts/repository/components/commit_changes_modal.vue' do
+              element 'commit-change-modal-commit-button'
+            end
+
+            base.view 'app/assets/javascripts/repository/pages/blob_edit_header.vue' do
+              element 'blob-edit-header-commit-button'
+            end
           end
 
           def add_content(content)
@@ -27,6 +39,20 @@ module QA
             end
           end
 
+          def click_commit_changes_in_header
+            click_element('blob-edit-header-commit-button')
+          end
+
+          def commit_changes_through_modal
+            within_element 'commit-change-modal' do
+              click_element('commit-change-modal-commit-button')
+            end
+          end
+
+          def has_modal_commit_button?
+            has_element?('commit-change-modal-commit-button')
+          end
+
           private
 
           def text_area
diff --git a/qa/qa/page/file/show.rb b/qa/qa/page/file/show.rb
index 4637cedad41..6bb4b9b1b80 100644
--- a/qa/qa/page/file/show.rb
+++ b/qa/qa/page/file/show.rb
@@ -7,6 +7,7 @@ module QA
         include Shared::CommitMessage
         include Layout::Flash
         include Page::Component::BlobContent
+        include Shared::Editor
 
         view 'app/assets/javascripts/repository/components/blob_button_group.vue' do
           element 'lock-button'
@@ -34,10 +35,6 @@ module QA
         def explain_code
           click_element('question-icon')
         end
-
-        def click_commit_changes
-          click_on 'Commit changes'
-        end
       end
     end
   end
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/file/delete_file_via_web_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/file/delete_file_via_web_spec.rb
index 4085c4953f6..aaef69eda20 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/file/delete_file_via_web_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/file/delete_file_via_web_spec.rb
@@ -16,9 +16,10 @@ module QA
         Page::File::Show.perform do |file|
           file.click_delete
           file.add_commit_message(commit_message_for_delete)
-          file.click_commit_changes
         end
 
+        Page::File::Edit.perform(&:commit_changes_through_modal)
+
         Page::Project::Show.perform do |project|
           aggregate_failures 'file details' do
             expect(project).to have_notice('The file has been successfully deleted.')
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/file/edit_file_via_web_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/file/edit_file_via_web_spec.rb
index 11280c71618..8fa99a55c3b 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/file/edit_file_via_web_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/file/edit_file_via_web_spec.rb
@@ -19,8 +19,9 @@ module QA
         Page::File::Form.perform do |file|
           file.remove_content
           file.add_content(updated_file_content)
+          file.click_commit_changes_in_header
           file.add_commit_message(commit_message_for_update)
-          file.commit_changes
+          file.commit_changes_through_modal
         end
 
         Page::File::Show.perform do |file|
diff --git a/qa/qa/specs/features/browser_ui/3_create/source_editor/source_editor_toolbar_spec.rb b/qa/qa/specs/features/browser_ui/3_create/source_editor/source_editor_toolbar_spec.rb
index 37e7aa89861..52cc5ef8629 100644
--- a/qa/qa/specs/features/browser_ui/3_create/source_editor/source_editor_toolbar_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/source_editor/source_editor_toolbar_spec.rb
@@ -29,7 +29,8 @@ module QA
           file.add_content("# #{edited_readme_content}")
           file.preview
           expect(file.has_markdown_preview?('h1', edited_readme_content)).to be true
-          file.commit_changes
+          file.click_commit_changes_in_header
+          file.commit_changes_through_modal
         end
 
         Page::File::Show.perform do |file|
diff --git a/qa/qa/specs/features/browser_ui/9_data_stores/user/user_inherited_access_spec.rb b/qa/qa/specs/features/browser_ui/9_data_stores/user/user_inherited_access_spec.rb
index a49bf4c99c4..a5eea8d9849 100644
--- a/qa/qa/specs/features/browser_ui/9_data_stores/user/user_inherited_access_spec.rb
+++ b/qa/qa/specs/features/browser_ui/9_data_stores/user/user_inherited_access_spec.rb
@@ -36,8 +36,9 @@ module QA
 
           Page::File::Show.perform(&:click_edit)
 
-          Page::File::Form.perform do |file_form|
-            expect(file_form).to have_element('data-testid': 'commit-button')
+          Page::File::Edit.perform do |file|
+            file.click_commit_changes_in_header
+            expect(file).to have_modal_commit_button
           end
         end
       end
diff --git a/qa/qa/tools/ci/non_empty_suites.rb b/qa/qa/tools/ci/non_empty_suites.rb
new file mode 100644
index 00000000000..8cb0e8ac278
--- /dev/null
+++ b/qa/qa/tools/ci/non_empty_suites.rb
@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'open3'
+
+module QA
+  module Tools
+    module Ci
+      # Run count commands for scenarios and detect which ones have more than 0 examples to run
+      #
+      class NonEmptySuites
+        include Helpers
+
+        # @return [Array] scenarios that never run in test-on-omnibus pipeline
+        IGNORED_SCENARIOS = [
+          "QA::EE::Scenario::Test::Geo",
+          "QA::Scenario::Test::Instance::Airgapped"
+        ].freeze
+
+        def initialize(qa_tests)
+          @qa_tests = qa_tests
+        end
+
+        # Run counts and return runnable scenario list
+        #
+        # @return [String]
+        def fetch
+          logger.info("Checking for runnable suites")
+          scenarios.each_with_object([]) do |scenario, runnable_scenarios|
+            logger.info(" fetching runnable specs for '#{scenario}'")
+            next logger.info("  scenario is in ignore list, skipping") if IGNORED_SCENARIOS.include?(scenario)
+
+            out, err, status = run_command(scenario)
+
+            unless status.success?
+              logger.error("  example count failed!\n#{err}")
+              next
+            end
+
+            count = out.split("\n").last.to_i
+            logger.info("  found #{count} examples to run")
+            runnable_scenarios << scenario if count > 0
+          end.join(",")
+        end
+
+        private
+
+        attr_reader :qa_tests
+
+        # Get all defined scenarios
+        #
+        # @return [Array<String>]
+        def scenarios
+          foss_scenarios = scenario_classes(QA::Scenario::Test)
+          return foss_scenarios unless QA.const_defined?("QA::EE")
+
+          foss_scenarios + scenario_classes(QA::EE::Scenario::Test)
+        end
+
+        # Fetch scenario classes recursively
+        #
+        # @param [Module] mod
+        # @return [Array<String>]
+        def scenario_classes(mod)
+          mod.constants.map do |const|
+            c = mod.const_get(const, false)
+            next c.to_s if c.is_a?(Class)
+
+            scenario_classes(c)
+          end.flatten
+        end
+
+        # Run scenario count command
+        #
+        # @param [String] klass
+        # @return [String]
+        def run_command(klass)
+          cmd = ["bundle exec bin/qa"]
+          cmd << klass
+          cmd << "--count-examples-only --address http://dummy1.test"
+          cmd << "-- #{qa_tests}" unless qa_tests.blank?
+
+          Open3.capture3(cmd.join(" "))
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/tools/ci/runnable_specs.rb b/qa/qa/tools/ci/runnable_specs.rb
deleted file mode 100644
index 38eee2f37fd..00000000000
--- a/qa/qa/tools/ci/runnable_specs.rb
+++ /dev/null
@@ -1,94 +0,0 @@
-# frozen_string_literal: true
-
-module QA
-  module Tools
-    module Ci
-      # Execute rspec dry run to get list of executable specs for each scenario class
-      #
-      class RunnableSpecs
-        include Helpers
-
-        # @return [Array] scenarios that never run in test-on-omnibus pipeline
-        IGNORED_SCENARIOS = [
-          QA::EE::Scenario::Test::Geo,
-          QA::Scenario::Test::Instance::Airgapped,
-          QA::Scenario::Test::Sanity::Selectors
-        ].freeze
-
-        def initialize(qa_tests)
-          @qa_tests = qa_tests
-        end
-
-        # Return list of executable spec files for each scenario class
-        #
-        # @return [Hash<Class, Array<String>>]
-        def fetch
-          logger.info("Checking for runnable suites")
-          (scenarios - IGNORED_SCENARIOS).each_with_object({}) do |scenario, runnable_scenarios|
-            specs = fetch_specs(scenario)
-
-            logger.info("  found #{specs.size} spec files to run")
-            runnable_scenarios[scenario] = specs unless specs.empty?
-          end
-        end
-
-        private
-
-        attr_reader :qa_tests
-
-        # Get all defined scenarios
-        #
-        # @return [Array<String>]
-        def scenarios
-          foss_scenarios = scenario_classes(QA::Scenario::Test)
-          return foss_scenarios unless QA.const_defined?("QA::EE")
-
-          foss_scenarios + scenario_classes(QA::EE::Scenario::Test)
-        end
-
-        # Fetch scenario classes recursively
-        #
-        # @param [Module] mod
-        # @return [Array<Object>]
-        def scenario_classes(mod)
-          mod.constants.flat_map do |const|
-            c = mod.const_get(const, false)
-            next c if c.is_a?(Class)
-
-            scenario_classes(c)
-          end
-        end
-
-        # Fetch list of executable spec files for scenario class
-        #
-        # @param klass [Class]
-        # @return [Array<String>]
-        def fetch_specs(klass)
-          logger.info(" fetching runnable spec files for '#{klass}'")
-          Tempfile.open("test-metadata.json") do |file|
-            Process.fork do
-              err = StringIO.new
-              tags = klass.focus.presence || Specs::Runner::DEFAULT_SKIPPED_TAGS.map { |tag| "~#{tag}" }
-              args = ["--dry-run", *tags.flat_map { |tag| ["-t", tag.to_s] }]
-              qa_tests.blank? ? args.push(*Specs::Runner::DEFAULT_TEST_PATH_ARGS) : args.push(*qa_tests)
-
-              # Clear variables that automatically add formatters in spec_helper
-              %w[CI CI_SERVER COVERBAND_ENABLED].each { |var| ENV.delete(var) }
-              RSpec.configure { |config| config.add_formatter(QA::Support::JsonFormatter, file.path) }
-
-              status = RSpec::Core::Runner.run(args, err, StringIO.new)
-              logger.error("  subprocess failed! Err output: #{err.string}") if status.nonzero?
-              Kernel.exit(status)
-            end
-            _pid, status = Process.wait2
-            raise "Failed to fetch executable spec files for #{klass}" unless status.success?
-
-            JSON.load_file(file, symbolize_names: true)[:examples]
-              .map { |example| example[:file_path].gsub("./", "") }
-              .uniq
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/qa/spec/tools/ci/non_empty_suites_spec.rb b/qa/spec/tools/ci/non_empty_suites_spec.rb
new file mode 100644
index 00000000000..f71e07aa4b4
--- /dev/null
+++ b/qa/spec/tools/ci/non_empty_suites_spec.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+RSpec.describe QA::Tools::Ci::NonEmptySuites do
+  let(:non_empty_suites) { described_class.new(nil) }
+
+  let(:status) { instance_double(Process::Status, success?: true) }
+
+  before do
+    allow(Gitlab::QA::TestLogger).to receive(:logger).and_return(Logger.new(StringIO.new))
+    allow(Open3).to receive(:capture3).and_return(["output\n0", "", status])
+    allow(Open3).to receive(:capture3)
+      .with("bundle exec bin/qa QA::Scenario::Test::Instance::All --count-examples-only --address http://dummy1.test")
+      .and_return(["output\n1", "", status])
+  end
+
+  it "returns runnable test suites" do
+    expect(non_empty_suites.fetch).to eq("QA::Scenario::Test::Instance::All")
+  end
+end
diff --git a/qa/spec/tools/ci/runnables_specs_spec.rb b/qa/spec/tools/ci/runnables_specs_spec.rb
deleted file mode 100644
index bc9622a2966..00000000000
--- a/qa/spec/tools/ci/runnables_specs_spec.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-RSpec.describe QA::Tools::Ci::RunnableSpecs do
-  let(:runnable_specs) { described_class.new([]).fetch }
-
-  let(:config_mock) { instance_double(RSpec::Core::Configuration, add_formatter: nil) }
-  let(:run_result_file) { instance_double(File, path: "file_path") }
-  let(:rspec_json) { { examples: [] } }
-  let(:rspec_exit) { 0 }
-
-  before do
-    allow(ENV).to receive(:delete)
-    allow(Gitlab::QA::TestLogger).to receive(:logger).and_return(Logger.new(StringIO.new))
-    allow(Tempfile).to receive(:open).with("test-metadata.json").and_yield(run_result_file)
-    allow(JSON).to receive(:load_file).with(run_result_file, symbolize_names: true).and_return(rspec_json)
-    allow(RSpec).to receive(:configure).and_yield(config_mock)
-    allow(RSpec::Core::Runner).to receive(:run).and_return(rspec_exit)
-    allow(Process).to receive(:fork).and_yield
-    allow(Process).to receive(:wait2).and_return(
-      [1, instance_double(Process::Status, success?: rspec_exit.nonzero? ? false : true)]
-    )
-    allow(Kernel).to receive(:exit)
-  end
-
-  it "correctly configures formatter" do
-    runnable_specs
-
-    expect(config_mock).to have_received(:add_formatter)
-      .with(QA::Support::JsonFormatter, run_result_file.path)
-      .at_least(:once)
-  end
-
-  context "with rspec process failure" do
-    let(:rspec_exit) { 1 }
-
-    before do
-      # skip yielding fork block to correctly raise error
-      allow(Process).to receive(:fork)
-    end
-
-    it "raises error" do
-      expect { runnable_specs }.to raise_error(RuntimeError, /Failed to fetch executable spec files for .*/)
-    end
-  end
-
-  context "with rspec returning runnable specs" do
-    let(:rspec_json) do
-      {
-        examples: [
-          {
-            file_path: "./qa/specs/features/ee/test_spec.rb"
-          }
-        ]
-      }
-    end
-
-    it "returns runnable spec list" do
-      expect(runnable_specs.all? { |_k, v| v == ["qa/specs/features/ee/test_spec.rb"] }).to be true
-    end
-  end
-
-  context "with rspec returning no runnable specs" do
-    it "returns empty spec list" do
-      expect(runnable_specs.all? { |_k, v| v == [] }).to be true
-    end
-  end
-end
diff --git a/qa/tasks/ci.rake b/qa/tasks/ci.rake
index d41547334cb..d873184b78c 100644
--- a/qa/tasks/ci.rake
+++ b/qa/tasks/ci.rake
@@ -71,7 +71,7 @@ namespace :ci do
     end
 
     # always check all test suites in case a suite is defined but doesn't have any runnable specs
-    suites = QA::Tools::Ci::RunnableSpecs.new(tests).fetch.keys.join(",")
+    suites = QA::Tools::Ci::NonEmptySuites.new(tests).fetch
     append_to_file(env_file, <<~TXT)
       QA_SUITES='#{suites}'
       QA_TESTS='#{tests}'
diff --git a/scripts/rspec_helpers.sh b/scripts/rspec_helpers.sh
index 53d89e62581..36451d7e6b3 100644
--- a/scripts/rspec_helpers.sh
+++ b/scripts/rspec_helpers.sh
@@ -84,13 +84,7 @@ function rspec_simple_job() {
   local rspec_cmd="bin/rspec $(rspec_args "${1}" "${2}" "${3}")"
   echoinfo "Running RSpec command: ${rspec_cmd}"
 
-  eval "${rspec_cmd}" || exit_code=$?
-
-  if [[ "$AUTO_RETRY_INFRA_ERROR" == "true" ]]; then
-    change_exit_code_if_known_infra_error $exit_code || exit_code=$?
-  fi
-
-  exit $exit_code
+  eval "${rspec_cmd}"
 }
 
 function rspec_simple_job_with_retry () {
@@ -163,35 +157,35 @@ function debug_rspec_variables() {
 
 function handle_retry_rspec_in_new_process() {
   local rspec_run_status="${1}"
+  local new_exit_code="${1}"
   local rspec_retry_status=0
-  local known_flaky_tests_exit_code=1
 
   if [[ $rspec_run_status -eq 3 ]]; then
     echoerr "Not retrying failing examples since we failed early on purpose!"
-    change_exit_code_if_known_flaky_tests || known_flaky_tests_exit_code=$?
-    exit "${known_flaky_tests_exit_code}"
+    change_exit_code_if_applicable $rspec_run_status || new_exit_code=$?
+    exit "${new_exit_code}"
   fi
 
   if [[ $rspec_run_status -eq 2 ]]; then
     echoerr "Not retrying failing examples since there were errors happening outside of the RSpec examples!"
-    change_exit_code_if_known_flaky_tests || known_flaky_tests_exit_code=$?
-    exit "${known_flaky_tests_exit_code}"
+    change_exit_code_if_applicable $rspec_run_status || new_exit_code=$?
+    exit "${new_exit_code}"
   fi
 
-  if [[ $rspec_run_status -eq 1 ]]; then
+  if [[ $rspec_run_status -ne 0 ]]; then
     if is_rspec_last_run_results_file_missing; then
-      change_exit_code_if_known_flaky_tests || known_flaky_tests_exit_code=$?
-      exit "${known_flaky_tests_exit_code}"
+      change_exit_code_if_applicable $rspec_run_status || new_exit_code=$?
+      exit "${new_exit_code}"
     fi
 
     local failed_examples_count=$(grep -c " failed" "${RSPEC_LAST_RUN_RESULTS_FILE}")
     if [[ "${failed_examples_count}" -eq "${RSPEC_FAIL_FAST_THRESHOLD}" ]]; then
       echoerr "Not retrying failing examples since we reached the maximum number of allowed test failures!"
-      change_exit_code_if_known_flaky_tests || known_flaky_tests_exit_code=$?
-      exit "${known_flaky_tests_exit_code}"
+      change_exit_code_if_applicable $rspec_run_status || new_exit_code=$?
+      exit "${new_exit_code}"
     fi
 
-    retry_failed_rspec_examples || rspec_retry_status=$?
+    retry_failed_rspec_examples $rspec_run_status || rspec_retry_status=$?
   else
     echosuccess "No examples to retry, congrats!"
     exit "${rspec_run_status}"
@@ -204,15 +198,41 @@ function handle_retry_rspec_in_new_process() {
 
   # At this stage, we know the CI/CD job will fail.
   #
-  # We'll change the exit code of the CI job if the failure was due to a known flaky test.
-  change_exit_code_if_known_flaky_tests || known_flaky_tests_exit_code=$?
-  exit "${known_flaky_tests_exit_code}"
+  # We'll change the exit code of the CI job.
+  change_exit_code_if_applicable $rspec_retry_status || new_exit_code=$?
+  exit $new_exit_code
+}
+
+function change_exit_code_if_applicable() {
+  local previous_exit_status=$1
+  local found_known_flaky_test=$previous_exit_status
+  local found_infra_error=$previous_exit_status
+  local new_exit_code=$previous_exit_status
+
+  change_exit_code_if_known_flaky_tests $previous_exit_status || found_known_flaky_test=$?
+  change_exit_code_if_known_infra_error $previous_exit_status || found_infra_error=$?
+
+  # Update new_exit_code if either of the checks changed the values
+  # Ensure infra error exit code takes precedence because we want to retry it if possible
+  echo
+  echo "found_known_flaky_test: $found_known_flaky_test"
+  echo "found_infra_error: $found_infra_error"
+
+  if [[ $found_infra_error -ne $previous_exit_status ]]; then
+    new_exit_code=$found_infra_error
+    alert_job_in_slack $new_exit_code "Known infra error caused this job to fail"
+  elif [[ $found_known_flaky_test -ne $previous_exit_status ]]; then
+    new_exit_code=$found_known_flaky_test
+    alert_job_in_slack $new_exit_code "A Known flaky test caused this job to fail"
+  fi
+
+  echo "New exit code: $new_exit_code"
+  return $new_exit_code
 }
 
 function change_exit_code_if_known_flaky_tests() {
-  # Default exit status
-  new_exit_code=1
-
+  new_exit_code=$1
+  echo
   echo "*******************************************************"
   echo "Checking whether known flaky tests failed the job"
   echo "*******************************************************"
@@ -237,21 +257,24 @@ function change_exit_code_if_known_flaky_tests() {
 function change_exit_code_if_known_infra_error() {
   exit_code=$1
 
-  if [[ $exit_code -ne 0 ]]; then
+  if [[ "${DETECT_INFRA_ERRORS}" != "true" ]]; then
+    echoinfo "Auto-retrying infrastructure errors is disabled. Exiting with exit code ${exit_code}".
+  elif [[ $exit_code -ne 0 ]]; then
+    echo
     echo "*******************************************************"
-    echo "Checking whether there was a known infrastructure error"
+    echo "Checking whether known infra error failed the job"
     echo "*******************************************************"
 
-    found_infrastructure_error || found_infrastructure_error_status=$?
+    found_infrastructure_error_status=0
+    found_known_flaky_tests_output=$(found_infrastructure_error) || found_infrastructure_error_status=$?
 
     if [[ $found_infrastructure_error_status -eq 0 ]]; then
+      echo
       echo "Changing the CI/CD job exit code to 110."
 
       exit_code=110
-
-      alert_job_in_slack $exit_code "Auto-retried due to infrastructure error."
-
     else
+      echo
       echo "Not changing the CI/CD job exit code."
     fi
   fi
@@ -416,15 +439,16 @@ function retry_failed_e2e_rspec_examples() {
 }
 
 function retry_failed_rspec_examples() {
+  local previous_exit_status=$1
   local rspec_run_status=0
 
   if [[ "${RETRY_FAILED_TESTS_IN_NEW_PROCESS}" != "true" ]]; then
     echoerr "Not retrying failing examples since \$RETRY_FAILED_TESTS_IN_NEW_PROCESS != 'true'!"
-    exit 1
+    exit $previous_exit_status
   fi
 
   if is_rspec_last_run_results_file_missing; then
-    exit 1
+    exit $previous_exit_status
   fi
 
   # Job metrics for influxDB/Grafana
diff --git a/spec/features/merge_request/batch_comments_spec.rb b/spec/features/merge_request/batch_comments_spec.rb
index d3006667e90..ecea99b9f16 100644
--- a/spec/features/merge_request/batch_comments_spec.rb
+++ b/spec/features/merge_request/batch_comments_spec.rb
@@ -144,7 +144,7 @@ RSpec.describe 'Merge request > Batch comments', :js, feature_category: :code_re
       end
 
       it 'can add comment to review' do
-        write_comment(selector: '.js-main-target-form', field: 'note-body', text: 'Its a draft comment', button_text: 'Add comment to review')
+        write_comment(selector: '.js-main-target-form', field: 'note-body', text: 'Its a draft comment', button_text: 'Add to review')
 
         expect(page).to have_selector('.draft-note', text: 'Its a draft comment')
 
diff --git a/spec/features/merge_request/maintainer_edits_fork_spec.rb b/spec/features/merge_request/maintainer_edits_fork_spec.rb
index 8618dca5873..f50af8dace9 100644
--- a/spec/features/merge_request/maintainer_edits_fork_spec.rb
+++ b/spec/features/merge_request/maintainer_edits_fork_spec.rb
@@ -40,6 +40,8 @@ RSpec.describe 'a maintainer edits files on a source-branch of an MR from a fork
   end
 
   it 'mentions commits will go to the source branch' do
+    click_button 'Commit changes'
+
     expect(page).to have_content('Your changes can be committed to fix because a merge request is open.')
   end
 
@@ -48,6 +50,11 @@ RSpec.describe 'a maintainer edits files on a source-branch of an MR from a fork
     editor_set_value(content)
 
     click_button 'Commit changes'
+
+    within_testid('commit-change-modal') do
+      click_button 'Commit changes'
+    end
+
     wait_for_requests
 
     expect(page).to have_content('Your changes have been committed successfully')
diff --git a/spec/features/projects/blobs/edit_spec.rb b/spec/features/projects/blobs/edit_spec.rb
index 0f5f7db5bf4..b1660b9c061 100644
--- a/spec/features/projects/blobs/edit_spec.rb
+++ b/spec/features/projects/blobs/edit_spec.rb
@@ -34,7 +34,13 @@ RSpec.describe 'Editing file blob', :js, feature_category: :source_code_manageme
       # there may be no diff and nothing to render.
       fill_editor(content: "class NextFeature#{object_id}\\nend\\n")
 
-      click_button 'Commit changes' if commit_changes
+      return unless commit_changes
+
+      click_button('Commit changes')
+
+      within_testid('commit-change-modal') do
+        click_button('Commit changes')
+      end
     end
 
     def fill_editor(content: 'class NextFeature\\nend\\n')
@@ -204,18 +210,23 @@ RSpec.describe 'Editing file blob', :js, feature_category: :source_code_manageme
 
         it 'shows blob editor with same branch' do
           expect(page).to have_current_path(project_edit_blob_path(project, tree_join(branch, file_path)))
-          expect(find('.js-branch-name').value).to eq(branch)
+
+          click_button('Commit changes')
+
+          expect(page).to have_selector('code', text: branch)
         end
       end
 
       context 'with protected branch' do
-        it 'shows blob editor with patch branch' do
+        it 'shows blob editor with patch branch and option to create MR' do
           freeze_time do
             visit project_edit_blob_path(project, tree_join(protected_branch, file_path))
 
-            epoch = Time.zone.now.strftime('%s%L').last(5)
+            click_button('Commit changes')
 
-            expect(find('.js-branch-name').value).to eq "#{user.username}-protected-branch-patch-#{epoch}"
+            epoch = Time.zone.now.strftime('%s%L').last(5)
+            expect(page).to have_checked_field _('Create a merge request for this change')
+            expect(find_field(_('Commit to a new branch')).value).to eq "#{user.username}-protected-branch-patch-#{epoch}"
           end
         end
       end
@@ -232,7 +243,10 @@ RSpec.describe 'Editing file blob', :js, feature_category: :source_code_manageme
 
       it 'shows blob editor with same branch' do
         expect(page).to have_current_path(project_edit_blob_path(project, tree_join(branch, file_path)))
-        expect(find('.js-branch-name').value).to eq(branch)
+
+        click_button('Commit changes')
+
+        expect(page).to have_selector('code', text: branch)
       end
     end
   end
diff --git a/spec/features/projects/files/editing_a_file_spec.rb b/spec/features/projects/files/editing_a_file_spec.rb
index 39e75f2cee6..58535c82453 100644
--- a/spec/features/projects/files/editing_a_file_spec.rb
+++ b/spec/features/projects/files/editing_a_file_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Projects > Files > User wants to edit a file', feature_category: :source_code_management do
+RSpec.describe 'Projects > Files > User wants to edit a file', :js, feature_category: :source_code_management do
   include ProjectForksHelper
   let(:project) { create(:project, :repository, :public) }
   let(:user) { project.first_owner }
@@ -28,7 +28,11 @@ RSpec.describe 'Projects > Files > User wants to edit a file', feature_category:
 
       click_button 'Commit changes'
 
-      expect(page).to have_content 'Someone edited the file the same time you did.'
+      within_testid('commit-change-modal') do
+        click_button('Commit changes')
+      end
+
+      expect(page).to have_content 'An error occurred editing the blob'
     end
   end
 
@@ -52,8 +56,12 @@ RSpec.describe 'Projects > Files > User wants to edit a file', feature_category:
         it 'renders an error message' do
           click_button 'Commit changes'
 
+          within_testid('commit-change-modal') do
+            click_button('Commit changes')
+          end
+
           expect(page).to have_content(
-            %(Error: Can't edit this file. The fork and upstream project have diverged. Edit the file on the fork)
+            'An error occurred editing the blob'
           )
         end
       end
diff --git a/spec/features/projects/files/user_edits_files_spec.rb b/spec/features/projects/files/user_edits_files_spec.rb
index 81cebde16ca..45867118071 100644
--- a/spec/features/projects/files/user_edits_files_spec.rb
+++ b/spec/features/projects/files/user_edits_files_spec.rb
@@ -17,6 +17,11 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
   let(:project_tree_path_root_ref) { project_tree_path(project, project.repository.root_ref) }
   let(:project2_tree_path_root_ref) { project_tree_path(project2, project2.repository.root_ref) }
 
+  let_it_be(:lf_text) { 'Line 1\nLine 2\nLine 3\n' }
+  let_it_be(:crlf_text) { 'Line 1\r\nLine 2\r\nLine 3\r\n"' }
+  let_it_be(:project_with_lf) { create(:project, :custom_repo, name: 'Project with lf', files: { 'lf_file.txt' => lf_text }) }
+  let_it_be(:project_with_crlf) { create(:project, :custom_repo, name: 'Project with crlf', files: { 'crlf_file.txt' => crlf_text }) }
+
   before do
     stub_feature_flags(vscode_web_ide: false)
 
@@ -81,9 +86,13 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
       find('.file-editor', match: :first)
 
       editor_set_value('*.rbca')
-      fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Commit changes')
 
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        click_button('Commit changes')
+      end
+
       expect(page).to have_current_path(project_blob_path(project, 'master/.gitignore'), ignore_query: true)
 
       wait_for_requests
@@ -97,9 +106,13 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
       find('.file-editor', match: :first)
 
       editor_set_value('*.rbca')
-      fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Commit changes')
 
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        click_button('Commit changes')
+      end
+
       expect(page).to have_current_path(project_blob_path(project, 'master/.gitignore'), ignore_query: true)
 
       wait_for_requests
@@ -117,10 +130,14 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
       find('.file-editor', match: :first)
 
       editor_set_value('*.rbca')
-      fill_in(:commit_message, with: 'New commit message', visible: true)
-      fill_in(:branch_name, with: 'new_branch_name', visible: true)
       click_button('Commit changes')
 
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        choose(option: true)
+        fill_in(:branch_name, with: 'new_branch_name', visible: true)
+        click_button('Commit changes')
+      end
       expect(page).to have_current_path(project_new_merge_request_path(project), ignore_query: true)
 
       click_link('Changes')
@@ -206,9 +223,13 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
       find('.file-editor', match: :first)
 
       editor_set_value('*.rbca')
-      fill_in(:commit_message, with: 'New commit message', visible: true)
       click_button('Commit changes')
 
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        click_button('Commit changes')
+      end
+
       fork = user.fork_of(project2.reload)
 
       expect(page).to have_current_path(project_new_merge_request_path(fork), ignore_query: true)
@@ -233,9 +254,13 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
         expect(page).not_to have_link('Fork')
 
         editor_set_value('*.rbca')
-        fill_in(:commit_message, with: 'Another commit', visible: true)
         click_button('Commit changes')
 
+        within_testid('commit-change-modal') do
+          fill_in(:commit_message, with: 'Another commit', visible: true)
+          click_button('Commit changes')
+        end
+
         fork = user.fork_of(project2)
 
         expect(page).to have_current_path(project_new_merge_request_path(fork), ignore_query: true)
@@ -264,4 +289,47 @@ RSpec.describe 'Projects > Files > User edits files', :js, feature_category: :so
       expect(find('.monaco-editor')).to have_content(json_text)
     end
   end
+
+  context 'for line endings', :js do
+    before_all do
+      project_with_lf.add_maintainer(user)
+      project_with_crlf.add_maintainer(user)
+    end
+
+    it 'does not mutate LF line endings' do
+      visit(project_edit_blob_path(project_with_lf, tree_join(project_with_lf.default_branch, 'lf_file.txt')))
+      wait_for_requests
+
+      find('.file-editor', match: :first)
+
+      click_button('Commit changes')
+
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        choose(option: true)
+        fill_in(:branch_name, with: 'new_branch_name', visible: true)
+        click_button('Commit changes')
+      end
+
+      expect(page).to have_content('Changes 0')
+    end
+
+    it 'does not mutate CRLF line endings' do
+      visit(project_edit_blob_path(project_with_crlf, tree_join(project_with_crlf.default_branch, 'crlf_file.txt')))
+      wait_for_requests
+
+      find('.file-editor', match: :first)
+
+      click_button('Commit changes')
+
+      within_testid('commit-change-modal') do
+        fill_in(:commit_message, with: 'New commit message', visible: true)
+        choose(option: true)
+        fill_in(:branch_name, with: 'new_branch_name', visible: true)
+        click_button('Commit changes')
+      end
+
+      expect(page).to have_content('Changes 0')
+    end
+  end
 end
diff --git a/spec/features/projects/files/user_replaces_files_spec.rb b/spec/features/projects/files/user_replaces_files_spec.rb
index 926efbd4c2c..da8bc710e17 100644
--- a/spec/features/projects/files/user_replaces_files_spec.rb
+++ b/spec/features/projects/files/user_replaces_files_spec.rb
@@ -48,7 +48,7 @@ RSpec.describe 'Projects > Files > User replaces files', :js, feature_category:
       click_on('Replace')
       find(".upload-dropzone-card").drop(File.join(Rails.root, 'spec', 'fixtures', 'doc_sample.txt'))
 
-      within_testid('upload-blob-modal') do
+      page.within('#modal-replace-blob') do
         fill_in(:commit_message, with: 'Replacement file commit message')
         click_button('Commit changes')
       end
diff --git a/spec/frontend/blob_edit/blob_bundle_spec.js b/spec/frontend/blob_edit/blob_bundle_spec.js
index ca75cb00fbd..b39e471272c 100644
--- a/spec/frontend/blob_edit/blob_bundle_spec.js
+++ b/spec/frontend/blob_edit/blob_bundle_spec.js
@@ -2,12 +2,14 @@ import $ from 'jquery';
 import { setHTMLFixture, resetHTMLFixture } from 'helpers/fixtures';
 import waitForPromises from 'helpers/wait_for_promises';
 import blobBundle from '~/blob_edit/blob_bundle';
+import initBlobEditHeader from '~/blob_edit/blob_edit_header';
 
 import SourceEditor from '~/blob_edit/edit_blob';
 import { createAlert } from '~/alert';
 
 jest.mock('~/blob_edit/edit_blob');
 jest.mock('~/alert');
+jest.mock('~/blob_edit/blob_edit_header');
 
 describe('BlobBundle', () => {
   beforeAll(() => {
@@ -27,7 +29,8 @@ describe('BlobBundle', () => {
     blobBundle();
     await waitForPromises();
     expect(SourceEditor).toHaveBeenCalled();
-
+    expect(initBlobEditHeader).toHaveBeenCalledTimes(1);
+    expect(initBlobEditHeader).toHaveBeenCalledWith(expect.any(SourceEditor));
     resetHTMLFixture();
   });
 
diff --git a/spec/frontend/blob_edit/edit_blob_spec.js b/spec/frontend/blob_edit/edit_blob_spec.js
index 27e45643758..974f0d57c0e 100644
--- a/spec/frontend/blob_edit/edit_blob_spec.js
+++ b/spec/frontend/blob_edit/edit_blob_spec.js
@@ -49,12 +49,14 @@ describe('Blob Editing', () => {
   const filePath = 'path/to/file.js';
   const useMock = jest.fn(() => markdownExtensions);
   const unuseMock = jest.fn();
+  const valueMock = 'test value';
+  const getValueMock = jest.fn().mockReturnValue('test value');
   const emitter = new Emitter();
   const mockInstance = {
     use: useMock,
     unuse: unuseMock,
     setValue: jest.fn(),
-    getValue: jest.fn().mockReturnValue('test value'),
+    getValue: getValueMock,
     focus: jest.fn(),
     onDidChangeModelLanguage: emitter.event,
     updateModelLanguage: jest.fn(),
@@ -114,6 +116,11 @@ describe('Blob Editing', () => {
         }),
       );
     });
+
+    it('returns content from the editor', () => {
+      expect(blobInstance.getFileContent()).toBe(valueMock);
+      expect(getValueMock).toHaveBeenCalled();
+    });
   });
 
   it('loads SourceEditorExtension and FileTemplateExtension by default', async () => {
diff --git a/spec/frontend/ci/pipeline_mini_graph/pipeline_stage_spec.js b/spec/frontend/ci/pipeline_mini_graph/pipeline_stage_spec.js
index 3be3e30c583..7d9e7985f52 100644
--- a/spec/frontend/ci/pipeline_mini_graph/pipeline_stage_spec.js
+++ b/spec/frontend/ci/pipeline_mini_graph/pipeline_stage_spec.js
@@ -54,8 +54,9 @@ describe('PipelineStage', () => {
   const findJobList = () => wrapper.findByTestId('pipeline-mini-graph-dropdown-menu-list');
   const findMergeTrainMessage = () => wrapper.findByTestId('merge-train-message');
 
-  const openStageDropdown = async () => {
+  const clickStageDropdown = async () => {
     await findDropdownButton().trigger('click');
+    await waitForPromises;
   };
 
   beforeEach(() => {
@@ -98,19 +99,19 @@ describe('PipelineStage', () => {
     });
 
     it('has the correct header title', async () => {
-      await openStageDropdown();
+      await clickStageDropdown();
 
       expect(findDropdownHeader().text()).toBe('Stage: build');
     });
 
     it('emits miniGraphStageClick', async () => {
-      await openStageDropdown();
+      await clickStageDropdown();
 
       expect(wrapper.emitted('miniGraphStageClick')).toHaveLength(1);
     });
 
     it('has fired the stage query', async () => {
-      await openStageDropdown();
+      await clickStageDropdown();
       const { stage } = defaultProps;
 
       expect(pipelineStageResponse).toHaveBeenCalledWith({ id: stage.id });
@@ -119,7 +120,7 @@ describe('PipelineStage', () => {
     describe('and query is loading', () => {
       it('renders a loading icon and no list', async () => {
         createComponent();
-        await openStageDropdown();
+        await clickStageDropdown();
 
         expect(findLoadingIcon().exists()).toBe(true);
         expect(findJobList().exists()).toBe(false);
@@ -128,8 +129,7 @@ describe('PipelineStage', () => {
 
     describe('and query is successful', () => {
       beforeEach(async () => {
-        await openStageDropdown();
-        await waitForPromises();
+        await clickStageDropdown();
       });
 
       it('renders a list and no loading icon', () => {
@@ -153,7 +153,7 @@ describe('PipelineStage', () => {
 
       it('throws an error for the pipeline query', async () => {
         await createComponent({ pipelineStageHandler: failedHandler });
-        await openStageDropdown();
+        await clickStageDropdown();
         await waitForPromises();
 
         expect(createAlert).toHaveBeenCalledWith({ message: pipelineStageJobsFetchError });
@@ -161,18 +161,55 @@ describe('PipelineStage', () => {
     });
   });
 
+  describe('polling', () => {
+    beforeEach(async () => {
+      pipelineStageResponse.mockResolvedValue(mockPipelineStageJobs);
+      await createComponent();
+    });
+
+    it('starts polling when dropdown is open', async () => {
+      await clickStageDropdown();
+      await waitForPromises();
+
+      expect(pipelineStageResponse).toHaveBeenCalledTimes(1);
+
+      jest.advanceTimersByTime(8000);
+
+      expect(pipelineStageResponse).toHaveBeenCalledTimes(2);
+    });
+
+    it('stops polling when dropdown is closed', async () => {
+      await clickStageDropdown();
+      await waitForPromises();
+
+      expect(pipelineStageResponse).toHaveBeenCalledTimes(1);
+
+      jest.advanceTimersByTime(8000);
+
+      expect(pipelineStageResponse).toHaveBeenCalledTimes(2);
+
+      await clickStageDropdown();
+      await waitForPromises();
+
+      jest.advanceTimersByTime(8000);
+
+      expect(pipelineStageResponse).toHaveBeenCalledTimes(2);
+    });
+  });
+
   describe('merge train message', () => {
     it('does not display a message if the pipeline is not part of a merge train', async () => {
       await createComponent();
-      await openStageDropdown();
+      await clickStageDropdown();
 
       expect(findMergeTrainMessage().exists()).toBe(false);
     });
+
     it('displays a message if the pipeline is part of a merge train', async () => {
       await createComponent({
         props: { isMergeTrain: true },
       });
-      await openStageDropdown();
+      await clickStageDropdown();
       await waitForPromises();
 
       expect(findMergeTrainMessage().exists()).toBe(true);
diff --git a/spec/frontend/invite_members/components/invite_modal_base_spec.js b/spec/frontend/invite_members/components/invite_modal_base_spec.js
index 717a0c98071..25726f18351 100644
--- a/spec/frontend/invite_members/components/invite_modal_base_spec.js
+++ b/spec/frontend/invite_members/components/invite_modal_base_spec.js
@@ -227,7 +227,7 @@ describe('InviteModalBase', () => {
 
     describe('when users limit is not reached', () => {
       const textRegex =
-        /Select a role\s*Read more about role permissions. You can change this later.\s*Access expiration date \(optional\)/;
+        /Select maximum role\s*Read more about role permissions. You can change this later. Invited members are limited to this role or their current group role, whichever is lower.\s*Access expiration date \(optional\)/;
 
       beforeEach(() => {
         createComponent({ props: { reachedLimit: false }, stubs: { GlModal, GlFormGroup } });
diff --git a/spec/frontend/ml/experiment_tracking/components/model_experiments_header_spec.js b/spec/frontend/ml/experiment_tracking/components/model_experiments_header_spec.js
index 1b11d1c32de..3acbd3ef265 100644
--- a/spec/frontend/ml/experiment_tracking/components/model_experiments_header_spec.js
+++ b/spec/frontend/ml/experiment_tracking/components/model_experiments_header_spec.js
@@ -1,4 +1,3 @@
-import { GlBadge } from '@gitlab/ui';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import ModelExperimentsHeader from '~/ml/experiment_tracking/components/model_experiments_header.vue';
 import TitleArea from '~/vue_shared/components/registry/title_area.vue';
@@ -17,7 +16,6 @@ describe('ml/experiment_tracking/components/model_experiments_header.vue', () =>
 
   beforeEach(createWrapper);
 
-  const findBadge = () => wrapper.findComponent(GlBadge);
   const findTitle = () => wrapper.findByTestId('page-heading');
   const findTitleArea = () => wrapper.findComponent(TitleArea);
   const findDropdown = () => wrapper.findByTestId('create-dropdown');
@@ -52,12 +50,6 @@ describe('ml/experiment_tracking/components/model_experiments_header.vue', () =>
     });
   });
 
-  it('link points to documentation', () => {
-    expect(findBadge().attributes().href).toBe(
-      '/help/user/project/ml/experiment_tracking/index.md',
-    );
-  });
-
   it('renders slots', () => {
     expect(wrapper.html()).toContain('Slot content');
   });
diff --git a/spec/frontend/notes/components/comment_form_spec.js b/spec/frontend/notes/components/comment_form_spec.js
index 0c6c35c6032..422e1244d3d 100644
--- a/spec/frontend/notes/components/comment_form_spec.js
+++ b/spec/frontend/notes/components/comment_form_spec.js
@@ -49,8 +49,8 @@ describe('issue_comment_form component', () => {
   const findCloseReopenButton = () => wrapper.findByTestId('close-reopen-button');
   const findMarkdownEditor = () => wrapper.findComponent(MarkdownEditor);
   const findMarkdownEditorTextarea = () => findMarkdownEditor().find('textarea');
-  const findAddToReviewDropdown = () => wrapper.findByTestId('add-to-review-dropdown');
-  const findAddToReviewButton = () => findAddToReviewDropdown().find('button');
+  const findStartReviewButton = () => wrapper.findByTestId('start-review-button');
+  const findAddToReviewButton = () => wrapper.findByTestId('add-to-review-button');
   const findAddCommentNowButton = () => wrapper.findByTestId('add-comment-now-button');
   const findConfidentialNoteCheckbox = () => wrapper.findByTestId('internal-note-checkbox');
   const findInternalNoteTooltipIcon = () => wrapper.findByTestId('question-o-icon');
@@ -469,6 +469,7 @@ describe('issue_comment_form component', () => {
                     note: 'a',
                     noteable_id: noteableDataMock.id,
                     noteable_type: 'Issue',
+                    type: 'DiscussionNote',
                   },
                 },
                 endpoint: notesDataMock.draftsPath,
@@ -488,6 +489,7 @@ describe('issue_comment_form component', () => {
                     note: 'a',
                     noteable_id: noteableDataMock.id,
                     noteable_type: 'Issue',
+                    type: 'DiscussionNote',
                   },
                 },
                 endpoint: notesDataMock.draftsPath,
@@ -868,7 +870,7 @@ describe('issue_comment_form component', () => {
   });
 
   describe('with batchComments in store', () => {
-    describe('add to review and comment now buttons', () => {
+    describe('start review, add to review and comment now buttons', () => {
       let store;
 
       beforeEach(() => {
@@ -876,10 +878,19 @@ describe('issue_comment_form component', () => {
         store.registerModule('batchComments', batchComments());
       });
 
-      it('when no drafts exist, should not render', () => {
+      it('when no drafts exist on non-merge request, should not render', () => {
         mountComponent({ store });
         expect(findCommentTypeDropdown().exists()).toBe(true);
-        expect(findAddToReviewDropdown().exists()).toBe(false);
+        expect(findStartReviewButton().exists()).toBe(false);
+        expect(findAddToReviewButton().exists()).toBe(false);
+        expect(findAddCommentNowButton().exists()).toBe(false);
+      });
+
+      it('when no drafts exist in a merge request, should render', () => {
+        mountComponent({ noteableType: constants.MERGE_REQUEST_NOTEABLE_TYPE, store });
+        expect(findCommentTypeDropdown().exists()).toBe(true);
+        expect(findStartReviewButton().exists()).toBe(true);
+        expect(findAddToReviewButton().exists()).toBe(false);
         expect(findAddCommentNowButton().exists()).toBe(false);
       });
 
@@ -888,11 +899,12 @@ describe('issue_comment_form component', () => {
           store.state.batchComments.drafts = [{ note: 'A' }];
         });
 
-        it('should render', async () => {
+        it('should render proper action elements', async () => {
           await mountComponent({ store });
           expect(findCommentTypeDropdown().exists()).toBe(false);
-          expect(findAddToReviewDropdown().exists()).toBe(true);
+          expect(findAddToReviewButton().exists()).toBe(true);
           expect(findAddCommentNowButton().exists()).toBe(true);
+          expect(findStartReviewButton().exists()).toBe(false);
         });
 
         it('clicking `add to review`, should call draft endpoint, set `isDraft` true', async () => {
diff --git a/spec/frontend/repository/components/commit_changes_modal_spec.js b/spec/frontend/repository/components/commit_changes_modal_spec.js
index 941ae8307c7..39365b20a19 100644
--- a/spec/frontend/repository/components/commit_changes_modal_spec.js
+++ b/spec/frontend/repository/components/commit_changes_modal_spec.js
@@ -12,6 +12,7 @@ import { mount } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import { RENDER_ALL_SLOTS_TEMPLATE, stubComponent } from 'helpers/stub_component';
+import setWindowLocation from 'helpers/set_window_location_helper';
 import CommitChangesModal from '~/repository/components/commit_changes_modal.vue';
 import { sprintf } from '~/locale';
 
@@ -88,77 +89,77 @@ describe('CommitChangesModal', () => {
       linkEnd: '',
     });
 
-    beforeEach(() => createComponent({ props: { isUsingLfs: true } }));
+    describe('LFS warning', () => {
+      beforeEach(() => createComponent({ props: { isUsingLfs: true } }));
 
-    it('renders a modal containing LFS text', () => {
-      expect(findModal().props('title')).toBe(lfsTitleText);
-      expect(findModal().text()).toContain(primaryLfsText);
-      expect(findModal().text()).toContain(secondaryLfsText);
-    });
+      it('renders a modal containing LFS text', () => {
+        expect(findModal().props('title')).toBe(lfsTitleText);
+        expect(findModal().text()).toContain(primaryLfsText);
+        expect(findModal().text()).toContain(secondaryLfsText);
+      });
 
-    it('hides the LFS content if the continue button is clicked', async () => {
-      findModal().vm.$emit('primary', { preventDefault: jest.fn() });
-      await nextTick();
+      it('hides the LFS content when the continue button is clicked', async () => {
+        findModal().vm.$emit('primary', { preventDefault: jest.fn() });
+        await nextTick();
 
-      expect(findModal().props('title')).not.toBe(lfsTitleText);
-      expect(findModal().text()).not.toContain(primaryLfsText);
-      expect(findModal().text()).not.toContain(secondaryLfsText);
+        expect(findModal().props('title')).not.toBe(lfsTitleText);
+        expect(findModal().text()).not.toContain(primaryLfsText);
+        expect(findModal().text()).not.toContain(secondaryLfsText);
+      });
     });
   });
 
-  describe('renders modal component', () => {
-    it('renders with correct props', () => {
-      createComponent();
+  it('renders Modal component', () => {
+    createComponent();
 
-      expect(findModal().props()).toMatchObject({
-        size: 'md',
-        actionPrimary: {
-          text: 'Commit changes',
-        },
-        actionCancel: {
-          text: 'Cancel',
-        },
-      });
-      expect(findSlot().exists()).toBe(false);
+    expect(findModal().props()).toMatchObject({
+      size: 'md',
+      actionPrimary: {
+        text: 'Commit changes',
+      },
+      actionCancel: {
+        text: 'Cancel',
+      },
     });
+    expect(findSlot().exists()).toBe(false);
+  });
 
-    it('renders the body slot when one is provided', () => {
-      createComponent({
-        slots: {
-          body: '<div data-testid="test-slot">test body slot</div>',
-        },
-      });
-      expect(findSlot().text()).toBe('test body slot');
+  it('renders the body slot when one is provided', () => {
+    createComponent({
+      slots: {
+        body: '<div data-testid="test-slot">test body slot</div>',
+      },
     });
+    expect(findSlot().text()).toBe('test body slot');
+  });
 
-    it('renders the form field slot when one is provided', () => {
-      createComponent({
-        slots: {
-          body: '<div data-testid="test-slot">test form fields slot</div>',
-        },
-      });
-      expect(findSlot().text()).toBe('test form fields slot');
+  it('renders the form field slot when one is provided', () => {
+    createComponent({
+      slots: {
+        body: '<div data-testid="test-slot">test form fields slot</div>',
+      },
     });
+    expect(findSlot().text()).toBe('test form fields slot');
+  });
 
-    it('disables actionable while loading', () => {
-      createComponent({ props: { loading: true } });
+  it('disables actionable while loading', () => {
+    createComponent({ props: { loading: true } });
 
-      expect(findModal().props('actionPrimary').attributes).toEqual(
-        expect.objectContaining({ disabled: true }),
-      );
-      expect(findModal().props('actionCancel').attributes).toEqual(
-        expect.objectContaining({ disabled: true }),
-      );
-      expect(findCommitTextarea().attributes()).toEqual(
-        expect.objectContaining({ disabled: 'true' }),
-      );
-      expect(findCurrentBranchRadioOption().attributes()).toEqual(
-        expect.objectContaining({ disabled: 'true' }),
-      );
-      expect(findNewBranchRadioOption().attributes()).toEqual(
-        expect.objectContaining({ disabled: 'true' }),
-      );
-    });
+    expect(findModal().props('actionPrimary').attributes).toEqual(
+      expect.objectContaining({ disabled: true }),
+    );
+    expect(findModal().props('actionCancel').attributes).toEqual(
+      expect.objectContaining({ disabled: true }),
+    );
+    expect(findCommitTextarea().attributes()).toEqual(
+      expect.objectContaining({ disabled: 'true' }),
+    );
+    expect(findCurrentBranchRadioOption().attributes()).toEqual(
+      expect.objectContaining({ disabled: 'true' }),
+    );
+    expect(findNewBranchRadioOption().attributes()).toEqual(
+      expect.objectContaining({ disabled: 'true' }),
+    );
   });
 
   describe('form', () => {
@@ -263,7 +264,12 @@ describe('CommitChangesModal', () => {
       ${'create_merge_request'} | ${undefined}                   | ${true}   | ${false}    | ${true}         | ${false}
     `(
       'passes $input as a hidden input with the correct value',
-      ({ input, value, emptyRepo, canPushCode, canPushToBranch, exist }) => {
+      ({ input, value, emptyRepo, canPushCode, canPushToBranch, exist, fromMergeRequestIid }) => {
+        if (fromMergeRequestIid) {
+          setWindowLocation(
+            `https://gitlab.test/foo?from_merge_request_iid=${fromMergeRequestIid}`,
+          );
+        }
         createComponent({
           props: {
             emptyRepo,
@@ -337,7 +343,9 @@ describe('CommitChangesModal', () => {
       });
 
       it('does not submit form', () => {
-        findModal().vm.$emit('primary', { preventDefault: () => {} });
+        findModal().vm.$emit('primary', {
+          preventDefault: () => {},
+        });
         expect(wrapper.emitted('submit-form')).toBeUndefined();
       });
     });
@@ -354,7 +362,9 @@ describe('CommitChangesModal', () => {
       });
 
       it('does not submit form', () => {
-        findModal().vm.$emit('primary', { preventDefault: () => {} });
+        findModal().vm.$emit('primary', {
+          preventDefault: () => {},
+        });
         expect(wrapper.emitted('submit-form')).toBeUndefined();
       });
     });
diff --git a/spec/frontend/repository/pages/blob_edit_header_spec.js b/spec/frontend/repository/pages/blob_edit_header_spec.js
new file mode 100644
index 00000000000..5f8d37f4a5b
--- /dev/null
+++ b/spec/frontend/repository/pages/blob_edit_header_spec.js
@@ -0,0 +1,142 @@
+import { nextTick } from 'vue';
+import MockAdapter from 'axios-mock-adapter';
+import { GlButton } from '@gitlab/ui';
+import axios from '~/lib/utils/axios_utils';
+import * as urlUtility from '~/lib/utils/url_utility';
+import { HTTP_STATUS_OK } from '~/lib/utils/http_status';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import CommitChangesModal from '~/repository/components/commit_changes_modal.vue';
+import BlobEditHeader from '~/repository/pages/blob_edit_header.vue';
+import { createAlert } from '~/alert';
+import { stubComponent } from 'helpers/stub_component';
+
+jest.mock('~/alert');
+jest.mock('lodash/uniqueId', () => {
+  return jest.fn((input) => `${input}1`);
+});
+
+describe('BlobEditHeader', () => {
+  let wrapper;
+  let mock;
+  let visitUrlSpy;
+
+  const content = 'some \r\n content \n';
+
+  const mockEditor = {
+    getFileContent: jest.fn().mockReturnValue(content),
+    filepathFormMediator: { $filenameInput: { val: jest.fn().mockReturnValue('.gitignore') } },
+  };
+
+  const createWrapper = () => {
+    return shallowMountExtended(BlobEditHeader, {
+      provide: {
+        editor: mockEditor,
+        updatePath: '/update',
+        cancelPath: '/cancel',
+        originalBranch: 'main',
+        targetBranch: 'feature',
+        blobName: 'test.js',
+        canPushCode: true,
+        canPushToBranch: true,
+        emptyRepo: false,
+        branchAllowsCollaboration: false,
+        lastCommitSha: '782426692977b2cedb4452ee6501a404410f9b00',
+      },
+      stubs: {
+        CommitChangesModal: stubComponent(CommitChangesModal, {
+          methods: {
+            show: jest.fn(),
+          },
+        }),
+      },
+    });
+  };
+
+  beforeEach(() => {
+    visitUrlSpy = jest.spyOn(urlUtility, 'visitUrl');
+    mock = new MockAdapter(axios);
+    wrapper = createWrapper();
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    mock.restore();
+  });
+
+  const findTitle = () => wrapper.find('h1');
+  const findButtons = () => wrapper.findAllComponents(GlButton);
+  const findCommitChangesModal = () => wrapper.findComponent(CommitChangesModal);
+  const findCommitChangesButton = () => wrapper.findByTestId('blob-edit-header-commit-button');
+  const findCancelButton = () => wrapper.findByTestId('blob-edit-header-cancel-button');
+
+  const submitForm = async () => {
+    findCommitChangesModal().vm.$emit('submit-form', new FormData());
+
+    await axios.waitForAll();
+  };
+
+  it('renders title with two buttons', () => {
+    expect(findTitle().text()).toBe('Edit file');
+    const buttons = findButtons();
+    expect(buttons).toHaveLength(2);
+    expect(buttons.at(0).text()).toBe('Cancel');
+    expect(buttons.at(1).text()).toBe('Commit changes');
+  });
+
+  it('opens commit changes modal with correct props', async () => {
+    findCommitChangesButton().vm.$emit('click');
+    await nextTick();
+    expect(mockEditor.getFileContent).toHaveBeenCalled();
+    expect(findCommitChangesModal().props()).toEqual({
+      modalId: 'update-modal1',
+      canPushCode: true,
+      canPushToBranch: true,
+      commitMessage: 'Edit test.js',
+      originalBranch: 'main',
+      targetBranch: 'feature',
+      isUsingLfs: false,
+      loading: false,
+      emptyRepo: false,
+      branchAllowsCollaboration: false,
+      valid: true,
+    });
+  });
+
+  it('shows confirmation message on cancel button', () => {
+    expect(findCancelButton().attributes('data-confirm')).toBe(
+      'Leave edit mode? All unsaved changes will be lost.',
+    );
+  });
+
+  it('on submit, redirects to the updated file', async () => {
+    findCommitChangesButton().vm.$emit('click');
+
+    mock.onPut('/update').replyOnce(HTTP_STATUS_OK, { filePath: '/update/path' });
+    await submitForm();
+
+    expect(mock.history.put).toHaveLength(1);
+    const putData = JSON.parse(mock.history.put[0].data);
+    expect(putData.file).toBe(content);
+    expect(visitUrlSpy).toHaveBeenCalledWith('/update/path');
+  });
+
+  it('creates alert when there is no filePath in response', async () => {
+    mock.onPut('/update').reply(HTTP_STATUS_OK);
+    await submitForm();
+
+    expect(createAlert).toHaveBeenCalledWith({
+      captureError: true,
+      message: 'An error occurred editing the blob',
+    });
+  });
+
+  it('on error, creates an alert error', async () => {
+    mock.onPut('/update').timeout();
+    await submitForm();
+
+    expect(createAlert).toHaveBeenCalledWith({
+      captureError: true,
+      message: 'An error occurred editing the blob',
+    });
+  });
+});
diff --git a/spec/helpers/blob_helper_spec.rb b/spec/helpers/blob_helper_spec.rb
index 7bf6fc7300e..1f4e870ae7a 100644
--- a/spec/helpers/blob_helper_spec.rb
+++ b/spec/helpers/blob_helper_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe BlobHelper do
+RSpec.describe BlobHelper, feature_category: :source_code_management do
   include TreeHelper
   include FakeBlobHelpers
   include Devise::Test::ControllerHelpers
@@ -211,7 +211,7 @@ RSpec.describe BlobHelper do
   end
 
   describe '#ide_edit_path' do
-    let(:project) { create(:project) }
+    let_it_be(:project) { create(:project) }
     let(:current_user) { create(:user) }
     let(:can_push_code) { true }
 
@@ -421,7 +421,6 @@ RSpec.describe BlobHelper do
       let_it_be(:user) { build_stubbed(:user) }
 
       before do
-        allow(helper).to receive(:current_user).and_return(user)
         allow(Ability).to receive(:allowed?).and_call_original
         allow(Ability).to receive(:allowed?).with(user, :download_code, project).and_return(true)
       end
@@ -434,6 +433,87 @@ RSpec.describe BlobHelper do
     end
   end
 
+  describe '#edit_blob_app_data' do
+    let(:project) { build_stubbed(:project) }
+    let(:user) { build_stubbed(:user) }
+    let(:blob) { fake_blob(path: 'test.rb', size: 100.bytes) }
+    let(:ref) { 'main' }
+    let(:id) { "#{ref}/#{blob.path}" }
+
+    before do
+      allow(helper).to receive(:current_user).and_return(user)
+      allow(helper).to receive(:selected_branch).and_return(ref)
+    end
+
+    it 'returns data related to blob editing' do
+      project_presenter = instance_double(ProjectPresenter)
+
+      allow(helper).to receive(:can?).with(user, :push_code, project).and_return(true)
+      allow(project).to receive(:present).and_return(project_presenter)
+      allow(project_presenter).to receive(:can_current_user_push_to_branch?).with(ref).and_return(true)
+      allow(project).to receive(:empty_repo?).and_return(false)
+      allow(blob).to receive(:stored_externally?).and_return(false)
+      allow(project).to receive(:branch_allows_collaboration?).with(user, ref).and_return(false)
+      assign(:last_commit_sha, '782426692977b2cedb4452ee6501a404410f9b00')
+
+      expect(helper.edit_blob_app_data(project, id, blob, ref)).to include({
+        update_path: project_update_blob_path(project, id),
+        cancel_path: project_blob_path(project, id),
+        original_branch: ref,
+        target_branch: ref,
+        can_push_code: 'true',
+        can_push_to_branch: 'true',
+        empty_repo: 'false',
+        blob_name: blob.name,
+        branch_allows_collaboration: 'false',
+        last_commit_sha: '782426692977b2cedb4452ee6501a404410f9b00'
+      })
+    end
+
+    context 'when user cannot push code' do
+      it 'returns false for push permissions' do
+        allow(helper).to receive(:can?).with(user, :push_code, project).and_return(false)
+
+        expect(helper.edit_blob_app_data(project, id, blob, ref)).to include(
+          can_push_code: 'false'
+        )
+      end
+    end
+
+    context 'when user cannot push to branch' do
+      it 'returns false for branch push permissions' do
+        project_presenter = instance_double(ProjectPresenter)
+
+        allow(project).to receive(:present).and_return(project_presenter)
+        allow(project_presenter).to receive(:can_current_user_push_to_branch?).with(ref).and_return(false)
+
+        expect(helper.edit_blob_app_data(project, id, blob, ref)).to include(
+          can_push_to_branch: 'false'
+        )
+      end
+    end
+
+    context 'when repository is empty' do
+      it 'returns true for empty_repo' do
+        allow(project).to receive(:empty_repo?).and_return(true)
+
+        expect(helper.edit_blob_app_data(project, id, blob, ref)).to include(
+          empty_repo: 'true'
+        )
+      end
+    end
+
+    context 'branch collaboration' do
+      it 'returns true when branch allows collaboration' do
+        allow(project).to receive(:branch_allows_collaboration?).with(user, ref).and_return(true)
+
+        expect(helper.edit_blob_app_data(project, id, blob, ref)).to include(
+          branch_allows_collaboration: 'true'
+        )
+      end
+    end
+  end
+
   describe "#copy_blob_source_button" do
     let(:project) { build_stubbed(:project) }
 
diff --git a/spec/initializers/secret_token_spec.rb b/spec/initializers/secret_token_spec.rb
index aaebb17f301..560f1d355a9 100644
--- a/spec/initializers/secret_token_spec.rb
+++ b/spec/initializers/secret_token_spec.rb
@@ -27,7 +27,8 @@ RSpec.describe SecretsInitializer do
   describe 'ensure acknowledged secrets in any installations' do
     let(:acknowledged_secrets) do
       %w[secret_key_base otp_key_base db_key_base openid_connect_signing_key encrypted_settings_key_base
-        rotated_encrypted_settings_key_base]
+        rotated_encrypted_settings_key_base active_record_encryption_primary_key
+        active_record_encryption_deterministic_key active_record_encryption_key_derivation_salt]
     end
 
     it 'does not allow to add a new secret without a proper handling' do
@@ -84,11 +85,15 @@ RSpec.describe SecretsInitializer do
         db_key_base
         otp_key_base
         openid_connect_signing_key
+        active_record_encryption_primary_key
+        active_record_encryption_deterministic_key
+        active_record_encryption_key_derivation_salt
       ]
     end
 
-    let(:hex_key) { /\h{128}/ }
-    let(:rsa_key) { /\A-----BEGIN RSA PRIVATE KEY-----\n.+\n-----END RSA PRIVATE KEY-----\n\Z/m }
+    let(:hex_key) { /\A\h{128}\z/ }
+    let(:rsa_key) { /\A-----BEGIN RSA PRIVATE KEY-----\n.+\n-----END RSA PRIVATE KEY-----\n\z/m }
+    let(:alphanumeric_key) { /\A[A-Za-z0-9]{32}\z/m }
 
     around do |example|
       # We store Rails.application.credentials as a hash so that we can revert to the original
@@ -134,9 +139,17 @@ RSpec.describe SecretsInitializer do
         expect(keys).to all(match(rsa_key))
       end
 
+      it 'generates alphanumeric keys for active_record_encryption items' do
+        initializer.execute!
+
+        expect(Rails.application.credentials.active_record_encryption_primary_key).to all(match(alphanumeric_key))
+        expect(Rails.application.credentials.active_record_encryption_deterministic_key).to all(match(alphanumeric_key))
+        expect(Rails.application.credentials.active_record_encryption_key_derivation_salt).to match(alphanumeric_key)
+      end
+
       it 'warns about the secrets to add to secrets.yml' do
         allowed_keys.each do |key|
-          expect(initializer).to receive(:warn_missing_secret).with(key)
+          expect(initializer).to receive(:warn_missing_secret).with(key.to_sym)
         end
 
         initializer.execute!
@@ -166,7 +179,7 @@ RSpec.describe SecretsInitializer do
         end
 
         it 'writes the encrypted_settings_key_base secret' do
-          expect(initializer).to receive(:warn_missing_secret).with('encrypted_settings_key_base')
+          expect(initializer).to receive(:warn_missing_secret).with(:encrypted_settings_key_base)
           expect(File).to receive(:write).with(fake_secret_file.path, any_args) do |_filename, contents, _options|
             new_secrets = YAML.safe_load(contents)[rails_env_name]
 
@@ -240,7 +253,16 @@ RSpec.describe SecretsInitializer do
 
     context 'with some secrets missing, some in ENV, some in Rails.application.credentials, some in secrets.yml' do
       let(:rails_env_name) { 'foo' }
-      let(:secrets_hash) { { rails_env_name => { 'otp_key_base' => 'otp_key_base' } } }
+      let(:secrets_hash) do
+        {
+          rails_env_name => {
+            'otp_key_base' => 'otp_key_base',
+            'active_record_encryption_primary_key' => ['primary_key'],
+            'active_record_encryption_deterministic_key' => ['deterministic_key'],
+            'active_record_encryption_key_derivation_salt' => 'key_derivation_salt'
+          }
+        }
+      end
 
       before do
         stub_env('SECRET_KEY_BASE', 'env_key')
diff --git a/spec/lib/gitlab/background_migration/delete_orphaned_project_namespaces_spec.rb b/spec/lib/gitlab/background_migration/delete_orphaned_project_namespaces_spec.rb
new file mode 100644
index 00000000000..a97a7f61906
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/delete_orphaned_project_namespaces_spec.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::BackgroundMigration::DeleteOrphanedProjectNamespaces, feature_category: :groups_and_projects do
+  let(:organizations) { table(:organizations) }
+  let(:namespaces) { table(:namespaces) }
+  let(:projects) { table(:projects) }
+  let!(:organization) { organizations.create!(name: 'gitlab', path: 'gitlab') }
+  let!(:parent) { namespaces.create!(name: 'Group', type: 'Group', path: 'space1', organization_id: organization.id) }
+  let!(:group) { namespaces.create!(name: 'GitLab', type: 'Group', path: 'group1', organization_id: organization.id) }
+  let!(:orphaned_projects) do
+    (1..4).map do |i|
+      namespaces.create!(name: "Project #{i}", path: "project_#{i}", type: 'Project', parent_id: parent.id,
+        organization_id: organization.id)
+    end
+  end
+
+  subject(:background_migration) do
+    described_class.new(
+      start_id: namespaces.without(parent).minimum(:id),
+      end_id: namespaces.maximum(:id),
+      batch_table: :namespaces,
+      batch_column: :id,
+      sub_batch_size: 1,
+      pause_ms: 0,
+      connection: ApplicationRecord.connection
+    ).perform
+  end
+
+  describe '#perform' do
+    before do
+      # Remove constraint to allow creation of invalid records
+      ApplicationRecord.connection.execute("ALTER TABLE namespaces DROP CONSTRAINT fk_7f813d8c90;")
+    end
+
+    after do
+      # Re-create constraint after the test
+      ApplicationRecord.connection.execute(<<~SQL)
+        ALTER TABLE ONLY namespaces ADD CONSTRAINT fk_7f813d8c90
+        FOREIGN KEY (parent_id) REFERENCES namespaces(id) ON DELETE RESTRICT NOT VALID;
+      SQL
+    end
+
+    it 'processes orphaned projects correctly' do
+      (1..4).map do |i|
+        namespaces.create!(name: "Group #{i}", path: "group_#{i}", type: 'Group', parent_id: group.id,
+          organization_id: organization.id)
+      end
+
+      project_namespace = namespaces.create!(
+        name: "Project 5",
+        path: "project_5",
+        type: 'Project',
+        parent_id: group.id,
+        organization_id: organization.id
+      )
+      projects.create!(
+        organization_id: organization.id,
+        namespace_id: group.id,
+        project_namespace_id: project_namespace.id,
+        name: 'Project 5',
+        path: 'project_5'
+      )
+
+      parent.destroy!
+
+      expect { background_migration }.to change { namespaces.count }.from(10).to(6)
+        .and change { namespaces.where(id: orphaned_projects.pluck(:id)).count }.from(4).to(0)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/database/migration_helpers/work_items/widgets_spec.rb b/spec/lib/gitlab/database/migration_helpers/work_items/widgets_spec.rb
index 6d38ed4d81f..51277089785 100644
--- a/spec/lib/gitlab/database/migration_helpers/work_items/widgets_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers/work_items/widgets_spec.rb
@@ -24,8 +24,12 @@ RSpec.describe Gitlab::Database::MigrationHelpers::WorkItems::Widgets, feature_c
         widget_type: 22
       },
       {
-        name: 'Another Test Widget',
-        widget_type: 23
+        name: 'Test widget with widget options',
+        widget_type: 23,
+        widget_options: {
+          rollup: false,
+          editable: true
+        }
       }
     ]
   end
@@ -46,7 +50,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers::WorkItems::Widgets, feature_c
   describe '#add_widget_definitions' do
     shared_examples 'properly executed up migration' do
       it 'upserts widget definitions' do
-        expected_widgets = widgets.map { |w| w.merge(work_item_type_id: work_item_type.id) }
+        expected_widgets = widgets.map { |w| { work_item_type_id: work_item_type.id, widget_options: nil }.merge(w) }
 
         expect(widget_definition_migration_model).to receive(:upsert_all)
           .with(expected_widgets, on_duplicate: :skip)
diff --git a/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb b/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb
index e7b6edac4d8..c0781381954 100644
--- a/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb
@@ -20,7 +20,7 @@ RSpec.describe Gitlab::SidekiqMiddleware::Identity::Passthrough, :request_store,
 
       context 'when user has a composite identity' do
         before do
-          allow(primary_user).to receive(:has_composite_identity?).and_return(true)
+          allow(primary_user).to receive(:composite_identity_enforced).and_return(true)
         end
 
         it 'adds composite identity to job payload' do
diff --git a/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb b/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb
index 0c5dfd3eba3..ed8497000a3 100644
--- a/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::SidekiqMiddleware::Identity::Restore, :request_store, feature_category: :system_access do
-  let_it_be(:primary_user) { create(:user, username: 'gitlab-duo') }
+  let_it_be(:primary_user) { create(:user) }
   let_it_be(:scoped_user) { create(:user) }
 
   let(:job) { { 'jid' => 123 } }
@@ -56,9 +56,7 @@ RSpec.describe Gitlab::SidekiqMiddleware::Identity::Restore, :request_store, fea
 
   describe 'composite identity restoration end-to-end' do
     before do
-      allow_any_instance_of(::User).to receive(:has_composite_identity?) do |user| # rubocop:disable RSpec/AnyInstanceOf -- works more reliably
-        user.username == 'gitlab-duo'
-      end
+      allow_any_instance_of(::User).to receive(:composite_identity_enforced).and_return(true) # rubocop:disable RSpec/AnyInstanceOf -- works more reliably
 
       ::Gitlab::Auth::Identity.new(primary_user).link!(scoped_user)
     end
diff --git a/spec/migrations/20241125145919_queue_delete_orphaned_project_namespaces_spec.rb b/spec/migrations/20241125145919_queue_delete_orphaned_project_namespaces_spec.rb
new file mode 100644
index 00000000000..8100aa1373f
--- /dev/null
+++ b/spec/migrations/20241125145919_queue_delete_orphaned_project_namespaces_spec.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueDeleteOrphanedProjectNamespaces, migration: :gitlab_main, feature_category: :groups_and_projects do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'does not schedule a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> { expect(batched_migration).not_to have_scheduled_batched_migration }
+      migration.after -> { expect(batched_migration).not_to have_scheduled_batched_migration }
+    end
+  end
+
+  context 'when executed on .com' do
+    before do
+      allow(Gitlab).to receive(:com_except_jh?).and_return(true)
+    end
+
+    describe '#up' do
+      it 'schedules background migration' do
+        migrate!
+
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :namespaces,
+          column_name: :id,
+          interval: described_class::DELAY_INTERVAL,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      end
+    end
+
+    describe '#down' do
+      it 'removes scheduled background migrations' do
+        migrate!
+        schema_migrate_down!
+
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      end
+    end
+  end
+end
diff --git a/spec/migrations/20241211091609_add_widgets_to_incidents_for_parity_with_issues_spec.rb b/spec/migrations/20241211091609_add_widgets_to_incidents_for_parity_with_issues_spec.rb
new file mode 100644
index 00000000000..59f8273994a
--- /dev/null
+++ b/spec/migrations/20241211091609_add_widgets_to_incidents_for_parity_with_issues_spec.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe AddWidgetsToIncidentsForParityWithIssues, :migration, feature_category: :team_planning do
+  it_behaves_like 'migration that adds widgets to a work item type'
+end
diff --git a/spec/models/application_record_spec.rb b/spec/models/application_record_spec.rb
index 0d3b4ceabaf..a79f4b33156 100644
--- a/spec/models/application_record_spec.rb
+++ b/spec/models/application_record_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe ApplicationRecord do
   describe '#id_in' do
     let(:records) { create_list(:user, 3) }
 
-    it 'returns records of the ids' do
+    it 'returns records of the ids', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/448906' do
       expect(User.id_in(records.last(2).map(&:id))).to eq(records.last(2))
     end
   end
diff --git a/spec/models/hooks/web_hook_spec.rb b/spec/models/hooks/web_hook_spec.rb
index b72528e9491..7f12807d380 100644
--- a/spec/models/hooks/web_hook_spec.rb
+++ b/spec/models/hooks/web_hook_spec.rb
@@ -600,86 +600,140 @@ RSpec.describe WebHook, feature_category: :webhooks do
 
   describe '#backoff!' do
     context 'when we have not backed off before' do
-      it 'increments the recent_failures count' do
-        expect { hook.backoff! }.to change(hook, :recent_failures).by(1)
+      it 'increments the recent_failures count but does not disable the hook yet' do
+        expect { hook.backoff! }.to change(hook, :recent_failures).to(1)
+        expect(hook.class.executable).to include(hook)
       end
     end
 
-    context 'when the recent failure value is the max value of a smallint' do
+    context 'when hook is at the failure threshold' do
       before do
-        hook.update!(recent_failures: 32767, disabled_until: 1.hour.ago)
+        WebHooks::AutoDisabling::FAILURE_THRESHOLD.times { hook.backoff! }
       end
 
-      it 'reduces to MAX_FAILURES' do
-        expect { hook.backoff! }.to change(hook, :recent_failures).to(WebHooks::AutoDisabling::MAX_FAILURES)
-      end
-    end
-
-    context 'when the recent failure value is MAX_FAILURES' do
-      before do
-        hook.update!(recent_failures: WebHooks::AutoDisabling::MAX_FAILURES, disabled_until: 1.hour.ago)
+      it 'is not yet disabled' do
+        expect(hook.class.executable).to include(hook)
+        expect(hook).to have_attributes(
+          recent_failures: WebHooks::AutoDisabling::FAILURE_THRESHOLD,
+          backoff_count: 0,
+          disabled_until: nil
+        )
       end
 
-      it 'does not change recent_failures' do
-        expect { hook.backoff! }.not_to change(hook, :recent_failures)
-      end
-    end
-
-    context 'when we have exhausted the grace period' do
-      before do
-        hook.update!(recent_failures: WebHooks::AutoDisabling::FAILURE_THRESHOLD)
-      end
-
-      it 'sets disabled_until to the next backoff' do
-        expect { hook.backoff! }.to change(hook, :disabled_until).to(hook.next_backoff.from_now)
-      end
-
-      it 'increments the backoff count' do
-        expect { hook.backoff! }.to change(hook, :backoff_count).by(1)
-      end
-
-      context 'when we have backed off MAX_FAILURES times' do
+      context 'when hook is next told to backoff' do
         before do
-          stub_const("WebHooks::AutoDisabling::MAX_FAILURES", 5)
-          (WebHooks::AutoDisabling::FAILURE_THRESHOLD + 5).times { hook.backoff! }
+          hook.backoff!
         end
 
-        it 'does not let the backoff count exceed the maximum failure count' do
-          expect { hook.backoff! }.not_to change(hook, :backoff_count)
+        it 'causes the hook to become disabled for initial backoff period' do
+          expect(hook.class.executable).not_to include(hook)
+          expect(hook).to have_attributes(
+            recent_failures: (WebHooks::AutoDisabling::FAILURE_THRESHOLD + 1),
+            backoff_count: 1,
+            disabled_until: 1.minute.from_now
+          )
         end
 
-        it 'does not change disabled_until', :skip_freeze_time do
-          travel_to(hook.disabled_until - 1.minute) do
-            expect { hook.backoff! }.not_to change(hook, :disabled_until)
+        context 'when the backoff time has elapsed', :skip_freeze_time do
+          it 'is no longer disabled' do
+            travel_to(hook.disabled_until + 1.minute) do
+              expect(hook.class.executable).to include(hook)
+            end
+          end
+
+          context 'when the hook is next told to backoff' do
+            it 'disables the hook again, increasing the backoff time exponentially' do
+              travel_to(hook.disabled_until + 1.minute) do
+                hook.backoff!
+
+                expect(hook.class.executable).not_to include(hook)
+                expect(hook).to have_attributes(
+                  recent_failures: (WebHooks::AutoDisabling::FAILURE_THRESHOLD + 2),
+                  backoff_count: 2,
+                  disabled_until: 2.minutes.from_now
+                )
+              end
+            end
           end
         end
+      end
+    end
 
-        it 'changes disabled_until when it has elapsed', :skip_freeze_time do
-          travel_to(hook.disabled_until + 1.minute) do
-            expect { hook.backoff! }.to change { hook.disabled_until }
-            expect(hook.backoff_count).to eq(WebHooks::AutoDisabling::MAX_FAILURES)
-          end
-        end
+    it 'does not do anything if the hook is currently temporarily disabled' do
+      allow(hook).to receive(:temporarily_disabled?).and_return(true)
+
+      sql_count = ActiveRecord::QueryRecorder.new { hook.backoff! }.count
+
+      expect(sql_count).to eq(0)
+    end
+
+    it 'does not do anything if the hook is currently permanently disabled' do
+      allow(hook).to receive(:permanently_disabled?).and_return(true)
+
+      sql_count = ActiveRecord::QueryRecorder.new { hook.backoff! }.count
+
+      expect(sql_count).to eq(0)
+    end
+
+    context 'when the counter are above MAX_FAILURES' do
+      let(:max_failures) { WebHooks::AutoDisabling::MAX_FAILURES }
+
+      before do
+        hook.update!(
+          recent_failures: (max_failures + 1),
+          backoff_count: (max_failures + 1),
+          disabled_until: 1.hour.ago
+        )
+      end
+
+      it 'reduces the counter to MAX_FAILURES' do
+        hook.backoff!
+
+        expect(hook).to have_attributes(
+          recent_failures: max_failures,
+          backoff_count: max_failures
+        )
       end
     end
   end
 
   describe '#failed!' do
-    it 'increments the failure count' do
-      expect { hook.failed! }.to change(hook, :recent_failures).by(1)
+    it 'increments the recent_failures count but does not disable the hook yet' do
+      expect { hook.failed! }.to change(hook, :recent_failures).to(1)
+      expect(hook.class.executable).to include(hook)
     end
 
-    context 'when the recent failure value is the max value of a smallint' do
+    context 'when hook is at the failure threshold' do
       before do
-        hook.update!(recent_failures: 32767)
+        WebHooks::AutoDisabling::FAILURE_THRESHOLD.times { hook.failed! }
       end
 
-      it 'does not change recent_failures' do
-        expect { hook.failed! }.not_to change(hook, :recent_failures)
+      it 'is not yet disabled' do
+        expect(hook.class.executable).to include(hook)
+        expect(hook).to have_attributes(
+          recent_failures: WebHooks::AutoDisabling::FAILURE_THRESHOLD,
+          backoff_count: 0,
+          disabled_until: nil
+        )
+      end
+
+      context 'when hook is next failed' do
+        before do
+          hook.failed!
+        end
+
+        it 'causes the hook to become disabled' do
+          expect(hook.class.executable).not_to include(hook)
+          expect(hook).to have_attributes(
+            recent_failures: (WebHooks::AutoDisabling::FAILURE_THRESHOLD + 1),
+            backoff_count: 0,
+            disabled_until: nil
+          )
+        end
       end
     end
 
-    it 'does not update the hook if the the failure count exceeds the maximum value' do
+    it 'does not do anything if recent_failures is at MAX_FAILURES' do
       hook.recent_failures = WebHooks::AutoDisabling::MAX_FAILURES
 
       sql_count = ActiveRecord::QueryRecorder.new { hook.failed! }.count
diff --git a/spec/models/integrations/chat_message/pipeline_message_spec.rb b/spec/models/integrations/chat_message/pipeline_message_spec.rb
index 0ca19e06a2b..672bb09db37 100644
--- a/spec/models/integrations/chat_message/pipeline_message_spec.rb
+++ b/spec/models/integrations/chat_message/pipeline_message_spec.rb
@@ -53,7 +53,7 @@ RSpec.describe Integrations::ChatMessage::PipelineMessage do
     test_pipeline = build(:ci_empty_pipeline, name: 'Build pipeline')
 
     allow(test_pipeline).to receive(:has_yaml_errors?).and_return(has_yaml_errors)
-    allow(test_pipeline).to receive(:yaml_errors).and_return("yaml error description here")
+    allow(test_pipeline).to receive(:error_messages).and_return("yaml error description here")
     allow(Ci::Pipeline).to receive(:find) { test_pipeline }
 
     allow(Gitlab::UrlBuilder).to receive(:build).with(test_commit).and_return("http://example.com/commit")
diff --git a/spec/requests/api/graphql/mutations/work_items/convert_spec.rb b/spec/requests/api/graphql/mutations/work_items/convert_spec.rb
index 425c6e69186..faea2f01a1b 100644
--- a/spec/requests/api/graphql/mutations/work_items/convert_spec.rb
+++ b/spec/requests/api/graphql/mutations/work_items/convert_spec.rb
@@ -54,7 +54,6 @@ RSpec.describe "Converts a work item to a new type", feature_category: :team_pla
       expect(response).to have_gitlab_http_status(:success)
       expect(work_item.reload.work_item_type.base_type).to eq('incident')
       expect(mutation_response['workItem']).to include('id' => work_item.to_global_id.to_s)
-      expect(work_item.reload.milestone).to be_nil
       expect(GlobalID.new(mutation_response.dig('workItem', 'workItemType', 'id')).model_id.to_i).to eq(
         new_type.correct_id
       )
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 4a1f3cb207c..8e3bbc826bf 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -2662,11 +2662,11 @@ RSpec.describe API::MergeRequests, :aggregate_failures, feature_category: :sourc
     end
 
     context 'when user is using a composite identity', :request_store, :sidekiq_inline do
-      let(:user) { create(:user, username: 'gitlab-duo') }
+      let(:user) { create(:user, username: 'user-with-composite-identity') }
 
       before do
-        allow_any_instance_of(::User).to receive(:has_composite_identity?) do |user|
-          user.username == 'gitlab-duo'
+        allow_any_instance_of(::User).to receive(:composite_identity_enforced) do |user|
+          user.username == 'user-with-composite-identity'
         end
       end
 
diff --git a/spec/services/web_hooks/log_execution_service_spec.rb b/spec/services/web_hooks/log_execution_service_spec.rb
index 255b6173429..e8d1d663d23 100644
--- a/spec/services/web_hooks/log_execution_service_spec.rb
+++ b/spec/services/web_hooks/log_execution_service_spec.rb
@@ -55,17 +55,14 @@ RSpec.describe WebHooks::LogExecutionService, feature_category: :webhooks do
 
     context 'obtaining an exclusive lease' do
       let(:lease_key) { "web_hooks:update_hook_failure_state:#{project_hook.id}" }
+      let(:response_category) { :error }
 
       it 'updates failure state using a lease that ensures fresh state is written' do
-        service = described_class.new(hook: project_hook, log_data: data, response_category: :error)
-        # Write state somewhere else, so that the hook is out-of-date
-        WebHook.find(project_hook.id).update!(recent_failures: 5, disabled_until: 10.minutes.from_now, backoff_count: 1)
-
         lease = stub_exclusive_lease(lease_key, timeout: described_class::LOCK_TTL)
 
         expect(lease).to receive(:try_obtain)
         expect(lease).to receive(:cancel)
-        expect { service.execute }.to change { WebHook.find(project_hook.id).backoff_count }.to(2)
+        expect { service.execute }.to change { WebHook.find(project_hook.id).recent_failures }.to(1)
       end
 
       context 'when a lease cannot be obtained' do
diff --git a/spec/support/shared_examples/migrations/add_work_item_widget_shared_examples.rb b/spec/support/shared_examples/migrations/add_work_item_widget_shared_examples.rb
index feffa0be38f..6ee3254d28c 100644
--- a/spec/support/shared_examples/migrations/add_work_item_widget_shared_examples.rb
+++ b/spec/support/shared_examples/migrations/add_work_item_widget_shared_examples.rb
@@ -84,8 +84,16 @@ RSpec.shared_examples 'migration that adds widgets to a work item type' do
       created_widgets = work_item_widget_definitions.last(widgets.size)
 
       widgets.each do |widget|
+        expected_attributes = {
+          work_item_type_id: work_item_type.id,
+          widget_type: widget[:widget_type],
+          name: widget[:name],
+          # Hashes from json from DB have string keys
+          widget_options: widget[:widget_options] ? widget[:widget_options].stringify_keys : nil
+        }
+
         expect(created_widgets).to include(
-          have_attributes(widget.merge(work_item_type_id: work_item_type.id))
+          have_attributes(expected_attributes)
         )
       end
     end
diff --git a/yarn.lock b/yarn.lock
index 8d460bb2010..0c6020d38aa 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1091,10 +1091,10 @@
   resolved "https://registry.yarnpkg.com/@csstools/utilities/-/utilities-1.0.0.tgz#42f3c213f2fb929324d465684ab9f46a0febd4bb"
   integrity sha512-tAgvZQe/t2mlvpNosA4+CkMiZ2azISW5WPAcdSalZlEjQvUfghHxfQcrCiK/7/CrfAWVxyM88kGFYO82heIGDg==
 
-"@cubejs-client/core@^0.36.2":
-  version "0.36.2"
-  resolved "https://registry.yarnpkg.com/@cubejs-client/core/-/core-0.36.2.tgz#bd785be0c33ea50cd123cfb42f614559fb16f940"
-  integrity sha512-sm8UJWIqtNqVnbMSFAAejL0wD77sR2h1qnaLr0l2Q9MiPRSmVKapS0iSJtn8Tpq1fOK82/nQCi88SA0qlOQ53g==
+"@cubejs-client/core@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/@cubejs-client/core/-/core-1.0.0.tgz#4cdd5d84e58c691f58eb94d2a908e0179117ea69"
+  integrity sha512-QuOrQgfu23Aswp2aluaDEZTCsv8VGHW7dJAAGChCWbOA638DKFU1pRlOvEDXhYVsQxUnUcT38hBk/VH614dOQw==
   dependencies:
     "@babel/runtime" "^7.1.2"
     core-js "^3.6.5"
@@ -9266,6 +9266,11 @@ iterall@^1.2.1:
   resolved "https://registry.yarnpkg.com/iterall/-/iterall-1.3.0.tgz#afcb08492e2915cbd8a0884eb93a8c94d0d72fea"
   integrity sha512-QZ9qOMdF+QLHxy1QIpUHUU1D5pS2CG2P69LF6L6CPjPYA/XMOmKV3PZpawHoAjHNyB0swdVTRxdYT4tbBbxqwg==
 
+jackspeak@^2.3.5, "jackspeak@npm:@gitlab/noop@1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/noop/-/noop-1.0.0.tgz#b1ecb8ae6b2abf9b2e28927e4fbb05b7a1b2704b"
+  integrity sha512-nOltttik5o2BjBo8LnyeTFzHoLpMY/XcCVOC+lm9ZwU+ivEam8wafacMF0KTbRn1KVrIoHYdo70QnqS+vJiOVw==
+
 jed@^1.1.1:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/jed/-/jed-1.1.1.tgz#7a549bbd9ffe1585b0cd0a191e203055bee574b4"