From 634e9bccc65592100a40849912fe7bb0a52e1b24 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 31 Jan 2022 18:18:10 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .rubocop_todo.yml                             |   1 +
 .rubocop_todo/gitlab/namespaced_class.yml     |   1 +
 .rubocop_todo/rails/save_bang.yml             |  13 -
 GITLAB_PAGES_VERSION                          |   2 +-
 .../clusters_list/components/agents.vue       |  55 ++-
 .../components/clusters_view_all.vue          |   4 +-
 .../javascripts/clusters_list/constants.js    |   3 +
 .../components/group_select.vue               |  24 +-
 .../components/invite_members_modal.vue       |   5 +
 .../init_invite_members_modal.js              |   1 +
 .../permissions/components/settings_panel.vue |   2 +-
 .../secondary_navigation_elements.scss        |   5 +-
 app/assets/stylesheets/pages/clusters.scss    |  14 +-
 .../admin/requests_profiles_controller.rb     |  21 ++
 .../projects/clusters_controller.rb           |   1 +
 .../projects/commits_controller.rb            |  12 +-
 .../projects/project_members_controller.rb    |   3 +-
 .../settings/repository_controller.rb         |   2 +-
 app/helpers/invite_members_helper.rb          |   8 +-
 app/helpers/nav_helper.rb                     |   2 +-
 app/models/project.rb                         |   8 +
 app/models/users/callout.rb                   |   5 +-
 .../container_scanning_create_service.rb      |  25 ++
 .../admin/requests_profiles/index.html.haml   |  22 ++
 .../layouts/nav/sidebar/_admin.html.haml      |   4 +
 app/workers/all_queues.yml                    |   9 +
 app/workers/requests_profiles_worker.rb       |  18 +
 .../development/ci_bulk_insert_tags.yml       |   2 +-
 .../ops/show_gitlab_agent_feedback.yml        |   8 +
 config/initializers/1_settings.rb             |   3 +
 config/initializers/request_profiler.rb       |   1 +
 .../20210216182125_user_sast_jobs.yml         |  23 --
 ...10216182127_user_secret_detection_jobs.yml |  23 --
 .../20210216182116_user_sast_jobs.yml         |  20 --
 ...10216182118_user_secret_detection_jobs.yml |  20 --
 config/routes/admin.rb                        |   1 +
 ...us-filter-does-accept-active-or-paused.yml |  18 +
 ...r_registry_enabled_to_project_features3.rb |   1 -
 ...525075724_clean_up_pending_builds_table.rb |   2 +-
 ...e_protected_attribute_to_pending_builds.rb |   2 +-
 .../postgresql/replication_and_failover.md    |   7 +-
 doc/api/graphql/reference/index.md            |  25 ++
 doc/api/merge_requests.md                     |   6 +-
 doc/api/runners.md                            |  82 +++--
 doc/api/usage_data.md                         |   2 +-
 doc/ci/cloud_services/aws/index.md            |   2 +-
 doc/ci/pipelines/job_artifacts.md             |   3 +-
 doc/ci/yaml/index.md                          |   2 +-
 .../documentation/styleguide/word_list.md     |   4 +
 .../service_ping/metrics_dictionary.md        |   2 +-
 .../service_ping/review_guidelines.md         |   2 +-
 doc/development/snowplow/index.md             |   8 +-
 doc/development/snowplow/review_guidelines.md |   2 +-
 .../img/object_hierarchy_example_V14_10.png   | Bin 0 -> 55849 bytes
 ...lue_stream_analytics_aggregated_backend.md | 330 ++++++++++++++++++
 doc/topics/git/lfs/index.md                   |   2 +-
 doc/update/deprecations.md                    |  18 +
 .../container_scanning/index.md               |   1 +
 .../coverage_fuzzing/index.md                 |   5 +-
 .../terraform_module_registry/index.md        |   2 +-
 lib/api/ci/runners.rb                         |  13 +-
 .../backfill_integrations_type_new.rb         |   2 +-
 .../backfill_user_namespace.rb                |   2 +-
 .../primary_key_batching_strategy.rb          |   2 +-
 ...y_column_using_background_migration_job.rb |   2 +-
 .../delete_orphaned_deployments.rb            |   2 +-
 .../remove_vulnerability_finding_links.rb     |   4 +-
 .../update_timelogs_null_spent_at.rb          |  11 +-
 lib/gitlab/backtrace_cleaner.rb               |   1 +
 lib/gitlab/database/dynamic_model_helpers.rb  |  15 +-
 lib/gitlab/database/migration_helpers.rb      |  12 +
 .../backfill_partitioned_table.rb             |   2 +-
 .../table_management_helpers.rb               |   1 -
 lib/gitlab/profiler.rb                        |   1 +
 lib/gitlab/request_profiler.rb                |  36 ++
 lib/gitlab/request_profiler/middleware.rb     | 107 ++++++
 lib/gitlab/request_profiler/profile.rb        |  43 +++
 .../ci_configuration/base_build_action.rb     |   1 +
 .../container_scanning_build_action.rb        |  30 ++
 locale/gitlab.pot                             |  38 +-
 .../maven_gradle_repository_spec.rb           |  10 +-
 .../requests_profiles_controller_spec.rb      |  72 ++++
 .../projects/commits_controller_spec.rb       |  20 ++
 .../settings/repository_controller_spec.rb    |  14 +
 .../admin/admin_requests_profiles_spec.rb     | 136 ++++++++
 .../groups/members/manage_groups_spec.rb      |  20 ++
 .../projects/members/invite_group_spec.rb     | 135 +++----
 .../clusters_list/components/agents_spec.js   |  82 ++++-
 .../components/group_select_spec.js           |  33 +-
 .../components/invite_members_modal_spec.js   |   2 +
 .../components/settings_panel_spec.js         |   2 +-
 spec/helpers/invite_members_helper_spec.rb    |  27 +-
 spec/lib/backup/manager_spec.rb               |   6 +-
 .../cycle_analytics/records_fetcher_spec.rb   |  14 +-
 spec/lib/gitlab/auth/ldap/user_spec.rb        |  28 +-
 spec/lib/gitlab/auth/o_auth/user_spec.rb      |  74 ++--
 spec/lib/gitlab/auth/saml/user_spec.rb        |  46 +--
 spec/lib/gitlab/auth_spec.rb                  |  16 +-
 spec/lib/gitlab/authorized_keys_spec.rb       |   2 +-
 spec/lib/gitlab/backtrace_cleaner_spec.rb     |   1 +
 .../bitbucket_server_import/importer_spec.rb  |   4 +-
 .../database/dynamic_model_helpers_spec.rb    |  17 +-
 .../gitlab/database/migration_helpers_spec.rb |  48 +++
 .../project/create_service_spec.rb            |   6 +-
 .../gitlab/request_profiler/profile_spec.rb   |  61 ++++
 spec/lib/gitlab/request_profiler_spec.rb      |  56 +++
 .../container_scanning_build_action_spec.rb   | 191 ++++++++++
 .../sast_build_action_spec.rb                 |   9 +
 .../sast_iac_build_action_spec.rb             |   4 +
 .../secret_detection_build_action_spec.rb     |   4 +
 spec/models/project_spec.rb                   |  23 ++
 spec/requests/api/ci/runners_spec.rb          |  90 +++--
 spec/requests/request_profiler_spec.rb        |  56 +++
 .../container_scanning_create_service_spec.rb |  19 +
 114 files changed, 2114 insertions(+), 438 deletions(-)
 create mode 100644 app/controllers/admin/requests_profiles_controller.rb
 create mode 100644 app/services/security/ci_configuration/container_scanning_create_service.rb
 create mode 100644 app/views/admin/requests_profiles/index.html.haml
 create mode 100644 app/workers/requests_profiles_worker.rb
 create mode 100644 config/feature_flags/ops/show_gitlab_agent_feedback.yml
 delete mode 100644 config/metrics/counts_28d/20210216182125_user_sast_jobs.yml
 delete mode 100644 config/metrics/counts_28d/20210216182127_user_secret_detection_jobs.yml
 delete mode 100644 config/metrics/counts_all/20210216182116_user_sast_jobs.yml
 delete mode 100644 config/metrics/counts_all/20210216182118_user_secret_detection_jobs.yml
 create mode 100644 data/deprecations/14-8-runner-api-status-filter-does-accept-active-or-paused.yml
 create mode 100644 doc/development/value_stream_analytics/img/object_hierarchy_example_V14_10.png
 create mode 100644 doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
 create mode 100644 lib/gitlab/request_profiler.rb
 create mode 100644 lib/gitlab/request_profiler/middleware.rb
 create mode 100644 lib/gitlab/request_profiler/profile.rb
 create mode 100644 lib/security/ci_configuration/container_scanning_build_action.rb
 create mode 100644 spec/controllers/admin/requests_profiles_controller_spec.rb
 create mode 100644 spec/features/admin/admin_requests_profiles_spec.rb
 create mode 100644 spec/lib/gitlab/request_profiler/profile_spec.rb
 create mode 100644 spec/lib/gitlab/request_profiler_spec.rb
 create mode 100644 spec/lib/security/ci_configuration/container_scanning_build_action_spec.rb
 create mode 100644 spec/requests/request_profiler_spec.rb
 create mode 100644 spec/services/security/ci_configuration/container_scanning_create_service_spec.rb

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 43eb86942f9..300706a4d8e 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -160,6 +160,7 @@ Lint/MixedRegexpCaptureTypes:
     - 'lib/gitlab/diff/suggestions_parser.rb'
     - 'lib/gitlab/github_import/representation/note.rb'
     - 'lib/gitlab/metrics/system.rb'
+    - 'lib/gitlab/request_profiler/profile.rb'
     - 'lib/gitlab/slash_commands/issue_move.rb'
     - 'lib/gitlab/slash_commands/issue_new.rb'
     - 'lib/gitlab/slash_commands/run.rb'
diff --git a/.rubocop_todo/gitlab/namespaced_class.yml b/.rubocop_todo/gitlab/namespaced_class.yml
index 6858dcc36ce..40afa0d0667 100644
--- a/.rubocop_todo/gitlab/namespaced_class.yml
+++ b/.rubocop_todo/gitlab/namespaced_class.yml
@@ -875,6 +875,7 @@ Gitlab/NamespacedClass:
   - app/workers/repository_import_worker.rb
   - app/workers/repository_remove_remote_worker.rb
   - app/workers/repository_update_remote_mirror_worker.rb
+  - app/workers/requests_profiles_worker.rb
   - app/workers/run_pipeline_schedule_worker.rb
   - app/workers/schedule_merge_request_cleanup_refs_worker.rb
   - app/workers/schedule_migrate_external_diffs_worker.rb
diff --git a/.rubocop_todo/rails/save_bang.yml b/.rubocop_todo/rails/save_bang.yml
index 2f3e3e5e682..e1698a83682 100644
--- a/.rubocop_todo/rails/save_bang.yml
+++ b/.rubocop_todo/rails/save_bang.yml
@@ -2,16 +2,3 @@
 Rails/SaveBang:
   Exclude:
   - ee/spec/lib/analytics/merge_request_metrics_calculator_spec.rb
-  - spec/lib/backup/manager_spec.rb
-  - spec/lib/gitlab/alerting/alert_spec.rb
-  - spec/lib/gitlab/analytics/cycle_analytics/records_fetcher_spec.rb
-  - spec/lib/gitlab/auth/ldap/user_spec.rb
-  - spec/lib/gitlab/auth/o_auth/user_spec.rb
-  - spec/lib/gitlab/auth/saml/user_spec.rb
-  - spec/lib/gitlab/auth_spec.rb
-  - spec/lib/gitlab/authorized_keys_spec.rb
-  - spec/lib/gitlab/bitbucket_server_import/importer_spec.rb
-  - spec/lib/gitlab/cycle_analytics/base_event_fetcher_spec.rb
-  - spec/lib/gitlab/database/custom_structure_spec.rb
-  - spec/lib/gitlab/database/partitioning_migration_helpers/table_management_helpers_spec.rb
-  - spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
diff --git a/GITLAB_PAGES_VERSION b/GITLAB_PAGES_VERSION
index ba0a719118c..a63cb35e6f0 100644
--- a/GITLAB_PAGES_VERSION
+++ b/GITLAB_PAGES_VERSION
@@ -1 +1 @@
-1.51.0
+1.52.0
diff --git a/app/assets/javascripts/clusters_list/components/agents.vue b/app/assets/javascripts/clusters_list/components/agents.vue
index 4fc421e7c31..bf096f53e9d 100644
--- a/app/assets/javascripts/clusters_list/components/agents.vue
+++ b/app/assets/javascripts/clusters_list/components/agents.vue
@@ -1,11 +1,29 @@
 <script>
-import { GlAlert, GlKeysetPagination, GlLoadingIcon } from '@gitlab/ui';
-import { MAX_LIST_COUNT, ACTIVE_CONNECTION_TIME } from '../constants';
+import { GlAlert, GlKeysetPagination, GlLoadingIcon, GlBanner } from '@gitlab/ui';
+import { s__ } from '~/locale';
+import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
+import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
+import {
+  MAX_LIST_COUNT,
+  ACTIVE_CONNECTION_TIME,
+  AGENT_FEEDBACK_ISSUE,
+  AGENT_FEEDBACK_KEY,
+} from '../constants';
 import getAgentsQuery from '../graphql/queries/get_agents.query.graphql';
 import AgentEmptyState from './agent_empty_state.vue';
 import AgentTable from './agent_table.vue';
 
 export default {
+  i18n: {
+    feedbackBannerTitle: s__('ClusterAgents|Tell us what you think'),
+    feedbackBannerText: s__(
+      'ClusterAgents|We would love to learn more about your experience with the GitLab Agent.',
+    ),
+    feedbackBannerButton: s__('ClusterAgents|Give feedback'),
+    error: s__('ClusterAgents|An error occurred while loading your Agents'),
+  },
+  AGENT_FEEDBACK_ISSUE,
+  AGENT_FEEDBACK_KEY,
   apollo: {
     agents: {
       query: getAgentsQuery,
@@ -31,7 +49,10 @@ export default {
     GlAlert,
     GlKeysetPagination,
     GlLoadingIcon,
+    GlBanner,
+    LocalStorageSync,
   },
+  mixins: [glFeatureFlagMixin()],
   inject: ['projectPath'],
   props: {
     defaultBranchName: {
@@ -57,6 +78,7 @@ export default {
         last: null,
       },
       folderList: {},
+      feedbackBannerDismissed: false,
     };
   },
   computed: {
@@ -86,6 +108,12 @@ export default {
     treePageInfo() {
       return this.agents?.project?.repository?.tree?.trees?.pageInfo || {};
     },
+    feedbackBannerEnabled() {
+      return this.glFeatures.showGitlabAgentFeedback;
+    },
+    feedbackBannerClasses() {
+      return this.isChildComponent ? 'gl-my-2' : 'gl-mb-4';
+    },
   },
   methods: {
     reloadAgents() {
@@ -142,6 +170,9 @@ export default {
       const count = this.agents?.project?.clusterAgents?.count;
       this.$emit('onAgentsLoad', count);
     },
+    handleBannerClose() {
+      this.feedbackBannerDismissed = true;
+    },
   },
 };
 </script>
@@ -151,6 +182,24 @@ export default {
 
   <section v-else-if="agentList">
     <div v-if="agentList.length">
+      <local-storage-sync
+        v-if="feedbackBannerEnabled"
+        v-model="feedbackBannerDismissed"
+        :storage-key="$options.AGENT_FEEDBACK_KEY"
+      >
+        <gl-banner
+          v-if="!feedbackBannerDismissed"
+          variant="introduction"
+          :class="feedbackBannerClasses"
+          :title="$options.i18n.feedbackBannerTitle"
+          :button-text="$options.i18n.feedbackBannerButton"
+          :button-link="$options.AGENT_FEEDBACK_ISSUE"
+          @close="handleBannerClose"
+        >
+          <p>{{ $options.i18n.feedbackBannerText }}</p>
+        </gl-banner>
+      </local-storage-sync>
+
       <agent-table
         :agents="agentList"
         :default-branch-name="defaultBranchName"
@@ -166,6 +215,6 @@ export default {
   </section>
 
   <gl-alert v-else variant="danger" :dismissible="false">
-    {{ s__('ClusterAgents|An error occurred while loading your GitLab Agents') }}
+    {{ $options.i18n.error }}
   </gl-alert>
 </template>
diff --git a/app/assets/javascripts/clusters_list/components/clusters_view_all.vue b/app/assets/javascripts/clusters_list/components/clusters_view_all.vue
index bd1a15dba8c..b730c0adfa2 100644
--- a/app/assets/javascripts/clusters_list/components/clusters_view_all.vue
+++ b/app/assets/javascripts/clusters_list/components/clusters_view_all.vue
@@ -123,7 +123,7 @@ export default {
     <div v-show="!isLoading" data-testid="clusters-cards-container">
       <gl-card
         header-class="gl-bg-white gl-display-flex gl-align-items-center gl-justify-content-space-between gl-py-4"
-        body-class="gl-pb-0"
+        body-class="gl-pb-0 cluster-card-item"
         footer-class="gl-text-right"
       >
         <template #header>
@@ -198,7 +198,7 @@ export default {
       <gl-card
         class="gl-mt-6"
         header-class="gl-bg-white gl-display-flex gl-align-items-center gl-justify-content-space-between"
-        body-class="gl-pb-0"
+        body-class="gl-pb-0 cluster-card-item"
         footer-class="gl-text-right"
       >
         <template #header>
diff --git a/app/assets/javascripts/clusters_list/constants.js b/app/assets/javascripts/clusters_list/constants.js
index da00599a406..436ace4a821 100644
--- a/app/assets/javascripts/clusters_list/constants.js
+++ b/app/assets/javascripts/clusters_list/constants.js
@@ -267,3 +267,6 @@ export const MODAL_TYPE_EMPTY = 'empty_state';
 export const MODAL_TYPE_REGISTER = 'agent_registration';
 
 export const DELETE_AGENT_MODAL_ID = 'delete-agent-modal-%{agentName}';
+
+export const AGENT_FEEDBACK_ISSUE = 'https://gitlab.com/gitlab-org/gitlab/-/issues/342696';
+export const AGENT_FEEDBACK_KEY = 'agent_feedback_banner';
diff --git a/app/assets/javascripts/invite_members/components/group_select.vue b/app/assets/javascripts/invite_members/components/group_select.vue
index 1213413e8bb..04a8ec3400f 100644
--- a/app/assets/javascripts/invite_members/components/group_select.vue
+++ b/app/assets/javascripts/invite_members/components/group_select.vue
@@ -38,6 +38,10 @@ export default {
       required: false,
       default: null,
     },
+    invalidGroups: {
+      type: Array,
+      required: true,
+    },
   },
   data() {
     return {
@@ -75,18 +79,26 @@ export default {
       this.isFetching = true;
       return this.fetchGroups()
         .then((response) => {
-          this.groups = response.map((group) => ({
-            id: group.id,
-            name: group.full_name,
-            path: group.path,
-            avatarUrl: group.avatar_url,
-          }));
+          this.groups = this.processGroups(response);
           this.isFetching = false;
         })
         .catch(() => {
           this.isFetching = false;
         });
     }, SEARCH_DELAY),
+    processGroups(response) {
+      const rawGroups = response.map((group) => ({
+        id: group.id,
+        name: group.full_name,
+        path: group.path,
+        avatarUrl: group.avatar_url,
+      }));
+
+      return this.filterOutInvalidGroups(rawGroups);
+    },
+    filterOutInvalidGroups(groups) {
+      return groups.filter((group) => this.invalidGroups.indexOf(group.id) === -1);
+    },
     selectGroup(group) {
       this.selectedGroup = group;
 
diff --git a/app/assets/javascripts/invite_members/components/invite_members_modal.vue b/app/assets/javascripts/invite_members/components/invite_members_modal.vue
index 15eeb51ec24..16a2de737ca 100644
--- a/app/assets/javascripts/invite_members/components/invite_members_modal.vue
+++ b/app/assets/javascripts/invite_members/components/invite_members_modal.vue
@@ -107,6 +107,10 @@ export default {
       type: Array,
       required: true,
     },
+    invalidGroups: {
+      type: Array,
+      required: true,
+    },
   },
   data() {
     return {
@@ -431,6 +435,7 @@ export default {
           :access-levels="accessLevels"
           :groups-filter="groupSelectFilter"
           :parent-group-id="groupSelectParentId"
+          :invalid-groups="invalidGroups"
           @input="handleMembersTokenSelectClear"
         />
       </gl-form-group>
diff --git a/app/assets/javascripts/invite_members/init_invite_members_modal.js b/app/assets/javascripts/invite_members/init_invite_members_modal.js
index 2cc056f2ddb..27e23a4b305 100644
--- a/app/assets/javascripts/invite_members/init_invite_members_modal.js
+++ b/app/assets/javascripts/invite_members/init_invite_members_modal.js
@@ -40,6 +40,7 @@ export default function initInviteMembersModal() {
           defaultAccessLevel: parseInt(el.dataset.defaultAccessLevel, 10),
           groupSelectFilter: el.dataset.groupsFilter,
           groupSelectParentId: parseInt(el.dataset.parentId, 10),
+          invalidGroups: JSON.parse(el.dataset.invalidGroups || '[]'),
           tasksToBeDoneOptions: JSON.parse(el.dataset.tasksToBeDoneOptions || '[]'),
           projects: JSON.parse(el.dataset.projects || '[]'),
           usersFilter: el.dataset.usersFilter,
diff --git a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
index d5e00f54e91..184bda4410f 100644
--- a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
+++ b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
@@ -280,7 +280,7 @@ export default {
       }
 
       return s__(
-        'ProjectSettings|View and edit files in this project. Non-project members will only have read access.',
+        'ProjectSettings|View and edit files in this project. Non-project members have only read access.',
       );
     },
     cveIdRequestIsDisabled() {
diff --git a/app/assets/stylesheets/framework/secondary_navigation_elements.scss b/app/assets/stylesheets/framework/secondary_navigation_elements.scss
index 563075b911c..8cad55f414a 100644
--- a/app/assets/stylesheets/framework/secondary_navigation_elements.scss
+++ b/app/assets/stylesheets/framework/secondary_navigation_elements.scss
@@ -18,7 +18,6 @@
       line-height: 28px;
       color: $gl-text-color-secondary;
       border: 0;
-      border-bottom: 2px solid transparent;
       white-space: nowrap;
 
       &:hover,
@@ -26,7 +25,7 @@
       &:focus {
         text-decoration: none;
         color: $black;
-        border-bottom: 2px solid $gray-darkest;
+        box-shadow: inset 0 -2px 0 0 $gray-darkest;
       }
     }
 
@@ -40,7 +39,7 @@
     a.active {
       color: $black;
       font-weight: $gl-font-weight-bold;
-      border-bottom: 2px solid var(--gl-theme-accent, $theme-indigo-500);
+      box-shadow: inset 0 -2px 0 0 var(--gl-theme-accent, $theme-indigo-500);
 
       .badge.badge-pill {
         color: $black;
diff --git a/app/assets/stylesheets/pages/clusters.scss b/app/assets/stylesheets/pages/clusters.scss
index 5a091c14e53..d9ad82d4e4b 100644
--- a/app/assets/stylesheets/pages/clusters.scss
+++ b/app/assets/stylesheets/pages/clusters.scss
@@ -7,13 +7,6 @@
     }
   }
 
-  .gl-card-body {
-    @include media-breakpoint-up(sm) {
-      @include gl-pt-2;
-      min-height: 372px;
-    }
-  }
-
   @include media-breakpoint-down(xs) {
     .nav-controls {
       @include gl-w-full;
@@ -27,6 +20,13 @@
   }
 }
 
+.cluster-card-item {
+  @include media-breakpoint-up(sm) {
+    @include gl-pt-2;
+    min-height: 372px;
+  }
+}
+
 .agent-activity-list {
   .system-note .timeline-entry-inner {
     .timeline-icon {
diff --git a/app/controllers/admin/requests_profiles_controller.rb b/app/controllers/admin/requests_profiles_controller.rb
new file mode 100644
index 00000000000..fbbe8c24637
--- /dev/null
+++ b/app/controllers/admin/requests_profiles_controller.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class Admin::RequestsProfilesController < Admin::ApplicationController
+  feature_category :not_owned
+
+  def index
+    @profile_token = Gitlab::RequestProfiler.profile_token
+    @profiles      = Gitlab::RequestProfiler.all.group_by(&:request_path)
+  end
+
+  def show
+    clean_name = Rack::Utils.clean_path_info(params[:name])
+    profile    = Gitlab::RequestProfiler.find(clean_name)
+
+    unless profile && profile.content_type
+      return redirect_to admin_requests_profiles_path, alert: 'Profile not found'
+    end
+
+    send_file profile.file_path, type: "#{profile.content_type}; charset=utf-8", disposition: 'inline'
+  end
+end
diff --git a/app/controllers/projects/clusters_controller.rb b/app/controllers/projects/clusters_controller.rb
index 8f45fa1cb9f..440375bf3c9 100644
--- a/app/controllers/projects/clusters_controller.rb
+++ b/app/controllers/projects/clusters_controller.rb
@@ -6,6 +6,7 @@ class Projects::ClustersController < Clusters::ClustersController
 
   before_action do
     push_frontend_feature_flag(:prometheus_computed_alerts)
+    push_frontend_feature_flag(:show_gitlab_agent_feedback, type: :ops, default_enabled: :yaml)
   end
 
   layout 'project'
diff --git a/app/controllers/projects/commits_controller.rb b/app/controllers/projects/commits_controller.rb
index 1ca35903703..82a13b60b13 100644
--- a/app/controllers/projects/commits_controller.rb
+++ b/app/controllers/projects/commits_controller.rb
@@ -67,11 +67,11 @@ class Projects::CommitsController < Projects::ApplicationController
   def set_commits
     render_404 unless @path.empty? || request.format == :atom || @repository.blob_at(@commit.id, @path) || @repository.tree(@commit.id, @path).entries.present?
 
-    limit = params[:limit].to_i
+    limit = permitted_params[:limit].to_i
     @limit = limit > 0 ? limit : COMMITS_DEFAULT_LIMIT # limit can only ever be a positive number
-    @offset = (params[:offset] || 0).to_i
-    search = params[:search]
-    author = params[:author]
+    @offset = (permitted_params[:offset] || 0).to_i
+    search = permitted_params[:search]
+    author = permitted_params[:author]
 
     @commits =
       if search.present?
@@ -87,4 +87,8 @@ class Projects::CommitsController < Projects::ApplicationController
     @commits = @commits.with_latest_pipeline(@ref)
     @commits = set_commits_for_rendering(@commits)
   end
+
+  def permitted_params
+    params.permit(:limit, :offset, :search, :author)
+  end
 end
diff --git a/app/controllers/projects/project_members_controller.rb b/app/controllers/projects/project_members_controller.rb
index e8074f7d793..dc0614c6bdd 100644
--- a/app/controllers/projects/project_members_controller.rb
+++ b/app/controllers/projects/project_members_controller.rb
@@ -13,8 +13,7 @@ class Projects::ProjectMembersController < Projects::ApplicationController
   def index
     @sort = params[:sort].presence || sort_value_name
 
-    @skip_groups = @project.invited_group_ids
-    @skip_groups += @project.group.self_and_ancestors_ids if @project.group
+    @skip_groups = @project.related_group_ids
 
     @group_links = @project.project_group_links
     @group_links = @group_links.search(params[:search_groups]) if params[:search_groups].present?
diff --git a/app/controllers/projects/settings/repository_controller.rb b/app/controllers/projects/settings/repository_controller.rb
index d750bd201e2..a28c08e87cb 100644
--- a/app/controllers/projects/settings/repository_controller.rb
+++ b/app/controllers/projects/settings/repository_controller.rb
@@ -25,7 +25,7 @@ module Projects
         if result[:status] == :success
           flash[:notice] = _('Repository cleanup has started. You will receive an email once the cleanup operation is complete.')
         else
-          flash[:alert] = status.fetch(:message, _('Failed to upload object map file'))
+          flash[:alert] = result.fetch(:message, _('Failed to upload object map file'))
         end
 
         redirect_to project_settings_repository_path(project)
diff --git a/app/helpers/invite_members_helper.rb b/app/helpers/invite_members_helper.rb
index 8b26b646fdd..19a23550268 100644
--- a/app/helpers/invite_members_helper.rb
+++ b/app/helpers/invite_members_helper.rb
@@ -21,6 +21,11 @@ module InviteMembersHelper
   end
 
   def group_select_data(group)
+    # This should only be used for groups to load the invite group modal.
+    # For instance the invite groups modal should not call this from a project scope
+    # this is only to be called in scope of a group context as noted in this thread
+    # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/79036#note_821465513
+    # the group sharing in projects disabling is explained there as well
     if group.root_ancestor.namespace_settings.prevent_sharing_groups_outside_hierarchy
       { groups_filter: 'descendant_groups', parent_id: group.root_ancestor.id }
     else
@@ -32,7 +37,8 @@ module InviteMembersHelper
     dataset = {
       id: source.id,
       name: source.name,
-      default_access_level: Gitlab::Access::GUEST
+      default_access_level: Gitlab::Access::GUEST,
+      invalid_groups: source.related_group_ids
     }
 
     if show_invite_members_for_task?(source)
diff --git a/app/helpers/nav_helper.rb b/app/helpers/nav_helper.rb
index d4d3fddb2cd..1c4d294baa7 100644
--- a/app/helpers/nav_helper.rb
+++ b/app/helpers/nav_helper.rb
@@ -56,7 +56,7 @@ module NavHelper
   end
 
   def admin_monitoring_nav_links
-    %w(system_info background_migrations background_jobs health_check)
+    %w(system_info background_migrations background_jobs health_check requests_profiles)
   end
 
   def admin_analytics_nav_links
diff --git a/app/models/project.rb b/app/models/project.rb
index f6e97404efe..1b920ab57b0 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2618,6 +2618,14 @@ class Project < ApplicationRecord
     [project&.id, root_group&.id]
   end
 
+  def related_group_ids
+    ids = invited_group_ids
+
+    ids += group.self_and_ancestors_ids if group
+
+    ids
+  end
+
   def package_already_taken?(package_name, package_version, package_type:)
     Packages::Package.with_name(package_name)
       .with_version(package_version)
diff --git a/app/models/users/callout.rb b/app/models/users/callout.rb
index 8394192c5ae..5c39e29a128 100644
--- a/app/models/users/callout.rb
+++ b/app/models/users/callout.rb
@@ -40,8 +40,9 @@ module Users
       profile_personal_access_token_expiry: 37,  # EE-only
       terraform_notification_dismissed: 38,
       security_newsletter_callout: 39,
-      verification_reminder: 40,                  # EE-only
-      ci_deprecation_warning_for_types_keyword: 41
+      verification_reminder: 40, # EE-only
+      ci_deprecation_warning_for_types_keyword: 41,
+      security_training_feature_promotion: 42 # EE-only
     }
 
     validates :feature_name,
diff --git a/app/services/security/ci_configuration/container_scanning_create_service.rb b/app/services/security/ci_configuration/container_scanning_create_service.rb
new file mode 100644
index 00000000000..788533575e6
--- /dev/null
+++ b/app/services/security/ci_configuration/container_scanning_create_service.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Security
+  module CiConfiguration
+    class ContainerScanningCreateService < ::Security::CiConfiguration::BaseCreateService
+      private
+
+      def action
+        Security::CiConfiguration::ContainerScanningBuildAction.new(project.auto_devops_enabled?, existing_gitlab_ci_content).generate
+      end
+
+      def next_branch
+        'set-container-scanning-config'
+      end
+
+      def message
+        _('Configure Container Scanning in `.gitlab-ci.yml`, creating this file if it does not already exist')
+      end
+
+      def description
+        _('Configure Container Scanning in `.gitlab-ci.yml` using the GitLab managed template. You can [add variable overrides](https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings) to customize Container Scanning settings.')
+      end
+    end
+  end
+end
diff --git a/app/views/admin/requests_profiles/index.html.haml b/app/views/admin/requests_profiles/index.html.haml
new file mode 100644
index 00000000000..9d42a2bfa93
--- /dev/null
+++ b/app/views/admin/requests_profiles/index.html.haml
@@ -0,0 +1,22 @@
+- page_title _('Requests Profiles')
+
+%h3.page-title
+  = page_title
+
+.bs-callout.clearfix
+  = html_escape(_('Pass the header %{codeOpen} X-Profile-Token: %{profile_token} %{codeClose} to profile the request')) % { profile_token: @profile_token, codeOpen: '<code>'.html_safe, codeClose: '</code>'.html_safe }
+
+- if @profiles.present?
+  .gl-mt-3
+    - @profiles.each do |path, profiles|
+      .card
+        .card-header
+          %code= path
+        %ul.content-list
+          - profiles.each do |profile|
+            %li
+              = link_to profile.time.to_s(:long) + ' ' + profile.profile_mode.capitalize,
+                admin_requests_profile_path(profile)
+- else
+  %p
+    = _('No profiles found')
diff --git a/app/views/layouts/nav/sidebar/_admin.html.haml b/app/views/layouts/nav/sidebar/_admin.html.haml
index f661d6277d6..f820f911d61 100644
--- a/app/views/layouts/nav/sidebar/_admin.html.haml
+++ b/app/views/layouts/nav/sidebar/_admin.html.haml
@@ -103,6 +103,10 @@
             = link_to admin_health_check_path, title: _('Health Check') do
               %span
                 = _('Health Check')
+          = nav_link(controller: :requests_profiles) do
+            = link_to admin_requests_profiles_path, title: _('Requests Profiles') do
+              %span
+                = _('Requests Profiles')
           - if Gitlab::CurrentSettings.current_application_settings.grafana_enabled?
             = nav_link do
               = link_to Gitlab::CurrentSettings.current_application_settings.grafana_url, target: '_blank', title: _('Metrics Dashboard'), rel: 'noopener noreferrer' do
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index 39c69d6cf50..e07a2a6ef1d 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -597,6 +597,15 @@
   :weight: 1
   :idempotent:
   :tags: []
+- :name: cronjob:requests_profiles
+  :worker_name: RequestsProfilesWorker
+  :feature_category: :source_code_management
+  :has_external_dependencies:
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent:
+  :tags: []
 - :name: cronjob:schedule_merge_request_cleanup_refs
   :worker_name: ScheduleMergeRequestCleanupRefsWorker
   :feature_category: :code_review
diff --git a/app/workers/requests_profiles_worker.rb b/app/workers/requests_profiles_worker.rb
new file mode 100644
index 00000000000..e02b63fb621
--- /dev/null
+++ b/app/workers/requests_profiles_worker.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class RequestsProfilesWorker # rubocop:disable Scalability/IdempotentWorker
+  include ApplicationWorker
+
+  data_consistency :always
+
+  # rubocop:disable Scalability/CronWorkerContext
+  # This worker does not perform work scoped to a context
+  include CronjobQueue
+  # rubocop:enable Scalability/CronWorkerContext
+
+  feature_category :source_code_management
+
+  def perform
+    Gitlab::RequestProfiler.remove_all_profiles
+  end
+end
diff --git a/config/feature_flags/development/ci_bulk_insert_tags.yml b/config/feature_flags/development/ci_bulk_insert_tags.yml
index 6b8ad4ef39d..52a3e22379c 100644
--- a/config/feature_flags/development/ci_bulk_insert_tags.yml
+++ b/config/feature_flags/development/ci_bulk_insert_tags.yml
@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/346124
 milestone: '14.6'
 type: development
 group: group::pipeline execution
-default_enabled: false
+default_enabled: true
diff --git a/config/feature_flags/ops/show_gitlab_agent_feedback.yml b/config/feature_flags/ops/show_gitlab_agent_feedback.yml
new file mode 100644
index 00000000000..2e2af65fea8
--- /dev/null
+++ b/config/feature_flags/ops/show_gitlab_agent_feedback.yml
@@ -0,0 +1,8 @@
+---
+name: show_gitlab_agent_feedback
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78567
+rollout_issue_url: 
+milestone: '14.8'
+type: ops
+group: group::configure
+default_enabled: true
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 4110fa1df0d..8244f570a18 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -479,6 +479,9 @@ Settings.cron_jobs['import_export_project_cleanup_worker']['job_class'] = 'Impor
 Settings.cron_jobs['ci_archive_traces_cron_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['ci_archive_traces_cron_worker']['cron'] ||= '17 * * * *'
 Settings.cron_jobs['ci_archive_traces_cron_worker']['job_class'] = 'Ci::ArchiveTracesCronWorker'
+Settings.cron_jobs['requests_profiles_worker'] ||= Settingslogic.new({})
+Settings.cron_jobs['requests_profiles_worker']['cron'] ||= '0 0 * * *'
+Settings.cron_jobs['requests_profiles_worker']['job_class'] = 'RequestsProfilesWorker'
 Settings.cron_jobs['remove_expired_members_worker'] ||= Settingslogic.new({})
 Settings.cron_jobs['remove_expired_members_worker']['cron'] ||= '10 0 * * *'
 Settings.cron_jobs['remove_expired_members_worker']['job_class'] = 'RemoveExpiredMembersWorker'
diff --git a/config/initializers/request_profiler.rb b/config/initializers/request_profiler.rb
index deabe2d3caa..2eb9f53d2a3 100644
--- a/config/initializers/request_profiler.rb
+++ b/config/initializers/request_profiler.rb
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
 Rails.application.configure do |config|
+  config.middleware.use(Gitlab::RequestProfiler::Middleware)
   config.middleware.use(Gitlab::Middleware::Speedscope)
 end
diff --git a/config/metrics/counts_28d/20210216182125_user_sast_jobs.yml b/config/metrics/counts_28d/20210216182125_user_sast_jobs.yml
deleted file mode 100644
index e8d8b469b2e..00000000000
--- a/config/metrics/counts_28d/20210216182125_user_sast_jobs.yml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-data_category: operational
-key_path: usage_activity_by_stage_monthly.secure.user_sast_jobs
-description: Users who run a SAST job
-product_section: sec
-product_stage: secure
-product_group: group::static analysis
-product_category: static_application_security_testing
-value_type: number
-status: active
-time_frame: 28d
-data_source: database
-distribution:
-- ce
-- ee
-tier:
-- free
-- premium
-- ultimate
-performance_indicator_type:
-- gmau
-- paid_gmau
-milestone: "<13.9"
diff --git a/config/metrics/counts_28d/20210216182127_user_secret_detection_jobs.yml b/config/metrics/counts_28d/20210216182127_user_secret_detection_jobs.yml
deleted file mode 100644
index 67a1c63b528..00000000000
--- a/config/metrics/counts_28d/20210216182127_user_secret_detection_jobs.yml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-data_category: operational
-key_path: usage_activity_by_stage_monthly.secure.user_secret_detection_jobs
-description: Users who run a Secret Detection job
-product_section: sec
-product_stage: secure
-product_group: group::static analysis
-product_category: secret_detection
-value_type: number
-status: active
-time_frame: 28d
-data_source: database
-distribution:
-- ce
-- ee
-tier:
-- free
-- premium
-- ultimate
-performance_indicator_type:
-- gmau
-- paid_gmau
-milestone: "<13.9"
diff --git a/config/metrics/counts_all/20210216182116_user_sast_jobs.yml b/config/metrics/counts_all/20210216182116_user_sast_jobs.yml
deleted file mode 100644
index b4822d0d89b..00000000000
--- a/config/metrics/counts_all/20210216182116_user_sast_jobs.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-data_category: operational
-key_path: usage_activity_by_stage.secure.user_sast_jobs
-description: Count of SAST jobs per user
-product_section: sec
-product_stage: secure
-product_group: group::static analysis
-product_category: static_application_security_testing
-value_type: number
-status: active
-time_frame: all
-data_source: database
-distribution:
-- ce
-- ee
-tier:
-- free
-- premium
-- ultimate
-milestone: "<13.9"
diff --git a/config/metrics/counts_all/20210216182118_user_secret_detection_jobs.yml b/config/metrics/counts_all/20210216182118_user_secret_detection_jobs.yml
deleted file mode 100644
index 6dde13f823b..00000000000
--- a/config/metrics/counts_all/20210216182118_user_secret_detection_jobs.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-data_category: operational
-key_path: usage_activity_by_stage.secure.user_secret_detection_jobs
-description: Count of Secret Detection Jobs per user
-product_section: sec
-product_stage: secure
-product_group: group::static analysis
-product_category: secret_detection
-value_type: number
-status: active
-time_frame: all
-data_source: database
-distribution:
-- ce
-- ee
-tier:
-- free
-- premium
-- ultimate
-milestone: "<13.9"
diff --git a/config/routes/admin.rb b/config/routes/admin.rb
index da5df8bfdb3..ed1afc9efa3 100644
--- a/config/routes/admin.rb
+++ b/config/routes/admin.rb
@@ -100,6 +100,7 @@ namespace :admin do
   resource :background_jobs, controller: 'background_jobs', only: [:show]
 
   resource :system_info, controller: 'system_info', only: [:show]
+  resources :requests_profiles, only: [:index, :show], param: :name, constraints: { name: /.+\.(html|txt)/ }
 
   resources :projects, only: [:index]
 
diff --git a/data/deprecations/14-8-runner-api-status-filter-does-accept-active-or-paused.yml b/data/deprecations/14-8-runner-api-status-filter-does-accept-active-or-paused.yml
new file mode 100644
index 00000000000..16dd0566a7d
--- /dev/null
+++ b/data/deprecations/14-8-runner-api-status-filter-does-accept-active-or-paused.yml
@@ -0,0 +1,18 @@
+- name: "REST API Runner will not accept `status` filter values of `active` or `paused`"
+  announcement_milestone: "14.8" # The milestone when this feature was first announced as deprecated.
+  announcement_date: "2022-02-22"
+  removal_milestone: "15.0" # the milestone when this feature is planned to be removed
+  removal_date: "2022-05-22" # the date of the milestone release when this feature is planned to be removed
+  breaking_change: true
+  body: | # Do not modify this line, instead modify the lines below.
+    The GitLab Runner REST endpoints will stop accepting `paused` or `active` as a status value in GitLab 15.0.
+
+    A runner's status will only relate to runner contact status, such as: `online`, `offline`.
+    Status values `paused` or `active` will no longer be accepted and will be replaced by the `paused` query parameter.
+
+    When checking for paused runners, API users are advised to specify `paused=true` as the query parameter.
+    When checking for active runners, specify `paused=false`.
+  stage: Verify
+  tiers: [Core, Premium, Ultimate]
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/351109
+  documentation_url: https://docs.gitlab.com/ee/api/runners.html
diff --git a/db/post_migrate/20210415155043_move_container_registry_enabled_to_project_features3.rb b/db/post_migrate/20210415155043_move_container_registry_enabled_to_project_features3.rb
index 6fd8d280c97..f63d7c5138b 100644
--- a/db/post_migrate/20210415155043_move_container_registry_enabled_to_project_features3.rb
+++ b/db/post_migrate/20210415155043_move_container_registry_enabled_to_project_features3.rb
@@ -2,7 +2,6 @@
 
 class MoveContainerRegistryEnabledToProjectFeatures3 < ActiveRecord::Migration[6.0]
   include Gitlab::Database::MigrationHelpers
-  include Gitlab::Database::DynamicModelHelpers
 
   BATCH_SIZE = 21_000
   MIGRATION = 'MoveContainerRegistryEnabledToProjectFeature'
diff --git a/db/post_migrate/20210525075724_clean_up_pending_builds_table.rb b/db/post_migrate/20210525075724_clean_up_pending_builds_table.rb
index c380f15188a..59b41dd2008 100644
--- a/db/post_migrate/20210525075724_clean_up_pending_builds_table.rb
+++ b/db/post_migrate/20210525075724_clean_up_pending_builds_table.rb
@@ -10,7 +10,7 @@ class CleanUpPendingBuildsTable < ActiveRecord::Migration[6.0]
   def up
     return unless Gitlab.dev_or_test_env? || Gitlab.com?
 
-    each_batch_range('ci_pending_builds', of: BATCH_SIZE) do |min, max|
+    each_batch_range('ci_pending_builds', connection: connection, of: BATCH_SIZE) do |min, max|
       execute <<~SQL
         DELETE FROM ci_pending_builds
           USING ci_builds
diff --git a/db/post_migrate/20210610102413_migrate_protected_attribute_to_pending_builds.rb b/db/post_migrate/20210610102413_migrate_protected_attribute_to_pending_builds.rb
index f47ff244d7a..47a6e39e87a 100644
--- a/db/post_migrate/20210610102413_migrate_protected_attribute_to_pending_builds.rb
+++ b/db/post_migrate/20210610102413_migrate_protected_attribute_to_pending_builds.rb
@@ -8,7 +8,7 @@ class MigrateProtectedAttributeToPendingBuilds < ActiveRecord::Migration[6.1]
   def up
     return unless Gitlab.dev_or_test_env? || Gitlab.com?
 
-    each_batch_range('ci_pending_builds', of: 1000) do |min, max|
+    each_batch_range('ci_pending_builds', connection: connection, of: 1000) do |min, max|
       execute <<~SQL
         UPDATE ci_pending_builds
           SET protected = true
diff --git a/doc/administration/postgresql/replication_and_failover.md b/doc/administration/postgresql/replication_and_failover.md
index 5777f35bfcf..8c7151606a5 100644
--- a/doc/administration/postgresql/replication_and_failover.md
+++ b/doc/administration/postgresql/replication_and_failover.md
@@ -1029,7 +1029,7 @@ Considering these, you should carefully plan your PostgreSQL upgrade:
    ```
 
    NOTE:
-   `gitlab-ctl pg-upgrade` tries to detect the role of the node. If for any reason the auto-detection does not work or you believe it did not detect the role correctly, you can use the `--leader` or `--replica` arguments to manually override it.
+   On a Geo secondary site, the Patroni leader node is called `standby leader`.
 
 1. Stop Patroni **only on replicas**.
 
@@ -1049,6 +1049,11 @@ Considering these, you should carefully plan your PostgreSQL upgrade:
    sudo gitlab-ctl pg-upgrade -V 12
    ```
 
+   NOTE:
+   `gitlab-ctl pg-upgrade` tries to detect the role of the node. If for any reason the auto-detection
+   does not work or you believe it did not detect the role correctly, you can use the `--leader` or
+   `--replica` arguments to manually override it.
+
 1. Check the status of the leader and cluster. You can proceed only if you have a healthy leader:
 
    ```shell
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 76c853ea1f8..6a876db1165 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1018,6 +1018,30 @@ Input type: `CommitCreateInput`
 | <a id="mutationcommitcreatecontent"></a>`content` | [`[String!]`](#string) | Contents of the commit. |
 | <a id="mutationcommitcreateerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 
+### `Mutation.configureContainerScanning`
+
+Configure Container Scanning for a project by enabling Container Scanning in a new or modified
+`.gitlab-ci.yml` file in a new branch. The new branch and a URL to
+create a merge request are part of the response.
+
+Input type: `ConfigureContainerScanningInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationconfigurecontainerscanningclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationconfigurecontainerscanningprojectpath"></a>`projectPath` | [`ID!`](#id) | Full path of the project. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationconfigurecontainerscanningbranch"></a>`branch` | [`String`](#string) | Branch that has the new/modified `.gitlab-ci.yml` file. |
+| <a id="mutationconfigurecontainerscanningclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationconfigurecontainerscanningerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+| <a id="mutationconfigurecontainerscanningsuccesspath"></a>`successPath` | [`String`](#string) | Redirect path to use when the response is successful. |
+
 ### `Mutation.configureDependencyScanning`
 
 Configure Dependency Scanning for a project by enabling Dependency Scanning in a new or modified
@@ -17834,6 +17858,7 @@ Name of the feature that the callout is for.
 | <a id="usercalloutfeaturenameenumsecurity_configuration_devops_alert"></a>`SECURITY_CONFIGURATION_DEVOPS_ALERT` | Callout feature name for security_configuration_devops_alert. |
 | <a id="usercalloutfeaturenameenumsecurity_configuration_upgrade_banner"></a>`SECURITY_CONFIGURATION_UPGRADE_BANNER` | Callout feature name for security_configuration_upgrade_banner. |
 | <a id="usercalloutfeaturenameenumsecurity_newsletter_callout"></a>`SECURITY_NEWSLETTER_CALLOUT` | Callout feature name for security_newsletter_callout. |
+| <a id="usercalloutfeaturenameenumsecurity_training_feature_promotion"></a>`SECURITY_TRAINING_FEATURE_PROMOTION` | Callout feature name for security_training_feature_promotion. |
 | <a id="usercalloutfeaturenameenumsuggest_pipeline"></a>`SUGGEST_PIPELINE` | Callout feature name for suggest_pipeline. |
 | <a id="usercalloutfeaturenameenumsuggest_popover_dismissed"></a>`SUGGEST_POPOVER_DISMISSED` | Callout feature name for suggest_popover_dismissed. |
 | <a id="usercalloutfeaturenameenumtabs_position_highlight"></a>`TABS_POSITION_HIGHLIGHT` | Callout feature name for tabs_position_highlight. |
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index 56682f0f107..b91b0714274 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -44,7 +44,7 @@ placed on database-backed diffs. [Limits inherent to Gitaly](../development/diff
 still apply.
 
 - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/349031) in GitLab 14.7,
-field `merge_user` can be either user who merged this merge request, 
+field `merge_user` can be either user who merged this merge request,
 user who set it to merge when pipeline succeeds or `null`.
 Field `merged_by` (user who merged this merge request or `null`) has been deprecated.
 
@@ -1116,7 +1116,7 @@ POST /projects/:id/merge_requests
 | `milestone_id`             | integer | no       | The global ID of a milestone.                                                           |
 | `remove_source_branch`     | boolean | no       | Flag indicating if a merge request should remove the source branch when merging. |
 | `allow_collaboration`      | boolean | no       | Allow commits from members who can merge to the target branch.                   |
-| `allow_maintainer_to_push` | boolean | no       | [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/22665), see `allow_collaboration`. |
+| `allow_maintainer_to_push` | boolean | no       | Alias of `allow_collaboration`.                                                  |
 | `squash`                   | boolean | no       | Squash commits into a single commit when merging.                                |
 
 ```json
@@ -1278,7 +1278,7 @@ PUT /projects/:id/merge_requests/:merge_request_iid
 | `squash`                   | boolean | no       | Squash commits into a single commit when merging. |
 | `discussion_locked`        | boolean | no       | Flag indicating if the merge request's discussion is locked. If the discussion is locked only project members can add, edit or resolve comments. |
 | `allow_collaboration`      | boolean | no       | Allow commits from members who can merge to the target branch.                   |
-| `allow_maintainer_to_push` | boolean | no       | [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/22665), see `allow_collaboration`. |
+| `allow_maintainer_to_push` | boolean | no       | Alias of `allow_collaboration`.                                                  |
 
 Must include at least one non-required attribute from above.
 
diff --git a/doc/api/runners.md b/doc/api/runners.md
index 07914ec53a3..3cccb86194a 100644
--- a/doc/api/runners.md
+++ b/doc/api/runners.md
@@ -39,21 +39,27 @@ Get a list of specific runners available to the user.
 GET /runners
 GET /runners?scope=active
 GET /runners?type=project_type
-GET /runners?status=active
+GET /runners?status=online
+GET /runners?paused=true
 GET /runners?tag_list=tag1,tag2
 ```
 
-| Attribute   | Type           | Required | Description         |
-|-------------|----------------|----------|---------------------|
-| `scope`     | string         | no       | Deprecated: Use `type` or `status` instead. The scope of specific runners to show, one of: `active`, `paused`, `online`, `offline`; showing all runners if none provided |
-| `type`      | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type` |
-| `status`    | string         | no       | The status of runners to show, one of: `active`, `paused`, `online`, `offline` |
-| `tag_list`  | string array   | no       | List of the runner's tags |
+| Attribute  | Type         | Required | Description                                                                                                                                                                           |
+|------------|--------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `scope`    | string       | no       | Deprecated: Use `type` or `status` instead. The scope of specific runners to show, one of: `active`, `paused`, `online` and `offline`; showing all runners if none provided           |
+| `type`     | string       | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type`                                                                                                    |
+| `status`   | string       | no       | The status of runners to show, one of: `online` and `offline`. `active` and `paused` are also possible values which were deprecated in GitLab 14.8 and will be removed in GitLab 15.0 |
+| `paused`   | boolean      | no       | Whether to include only runners that are accepting or ignoring new jobs                                                                                                               |
+| `tag_list` | string array | no       | List of the runner's tags                                                                                                                                                             |
 
 ```shell
 curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/runners"
 ```
 
+NOTE:
+The `active` and `paused` values in the `status` query parameter were deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
+and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). They are replaced by the `paused` query parameter.
+
 NOTE:
 The `active` attribute in the response was deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
 and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). It is replaced by the `paused` attribute.
@@ -98,21 +104,27 @@ is restricted to users with the administrator role.
 GET /runners/all
 GET /runners/all?scope=online
 GET /runners/all?type=project_type
-GET /runners/all?status=active
+GET /runners/all?status=online
+GET /runners/all?paused=true
 GET /runners/all?tag_list=tag1,tag2
 ```
 
-| Attribute   | Type           | Required | Description         |
-|-------------|----------------|----------|---------------------|
-| `scope`     | string         | no       | Deprecated: Use `type` or `status` instead. The scope of runners to show, one of: `specific`, `shared`, `active`, `paused`, `online`, `offline`; showing all runners if none provided |
-| `type`      | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type` |
-| `status`    | string         | no       | The status of runners to show, one of: `active`, `paused`, `online`, `offline` |
-| `tag_list`  | string array   | no       | List of the runner's tags |
+| Attribute  | Type         | Required | Description                                                                                                                                                                              |
+|------------|--------------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `scope`    | string       | no       | Deprecated: Use `type` or `status` instead. The scope of runners to show, one of: `specific`, `shared`, `active`, `paused`, `online` and `offline`; showing all runners if none provided |
+| `type`     | string       | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type`                                                                                                       |
+| `status`   | string       | no       | The status of runners to show, one of: `online` and `offline`. `active` and `paused` are also possible values which were deprecated in GitLab 14.8 and will be removed in GitLab 15.0    |
+| `paused`   | boolean      | no       | Whether to include only runners that are accepting or ignoring new jobs                                                                                                                  |
+| `tag_list` | string array | no       | List of the runner's tags                                                                                                                                                                |
 
 ```shell
 curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/runners/all"
 ```
 
+NOTE:
+The `active` and `paused` values in the `status` query parameter were deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
+and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). They are replaced by the `paused` query parameter.
+
 NOTE:
 The `active` attribute in the response was deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
 and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). It is replaced by the `paused` attribute.
@@ -443,22 +455,28 @@ are listed if at least one shared runner is defined.
 GET /projects/:id/runners
 GET /projects/:id/runners?scope=active
 GET /projects/:id/runners?type=project_type
-GET /projects/:id/runners?status=active
+GET /projects/:id/runners/all?status=online
+GET /projects/:id/runners/all?paused=true
 GET /projects/:id/runners?tag_list=tag1,tag2
 ```
 
-| Attribute  | Type           | Required | Description         |
-|------------|----------------|----------|---------------------|
-| `id`       | integer/string | yes      | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user |
-| `scope`    | string         | no       | Deprecated: Use `type` or `status` instead. The scope of specific runners to show, one of: `active`, `paused`, `online`, `offline`; showing all runners if none provided |
-| `type`     | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type` |
-| `status`   | string         | no       | The status of runners to show, one of: `active`, `paused`, `online`, `offline` |
-| `tag_list` | string array   | no       | List of the runner's tags |
+| Attribute  | Type           | Required | Description                                                                                                                                                                           |
+|------------|----------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `id`       | integer/string | yes      | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user                                                                        |
+| `scope`    | string         | no       | Deprecated: Use `type` or `status` instead. The scope of specific runners to show, one of: `active`, `paused`, `online` and `offline`; showing all runners if none provided           |
+| `type`     | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type`                                                                                                    |
+| `status`   | string         | no       | The status of runners to show, one of: `online` and `offline`. `active` and `paused` are also possible values which were deprecated in GitLab 14.8 and will be removed in GitLab 15.0 |
+| `paused`   | boolean        | no       | Whether to include only runners that are accepting or ignoring new jobs                                                                                                               |
+| `tag_list` | string array   | no       | List of the runner's tags                                                                                                                                                             |
 
 ```shell
 curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/9/runners"
 ```
 
+NOTE:
+The `active` and `paused` values in the `status` query parameter were deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
+and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). They are replaced by the `paused` query parameter.
+
 NOTE:
 The `active` attribute in the response was deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
 and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). It is replaced by the `paused` attribute.
@@ -555,21 +573,27 @@ Shared runners are listed if at least one shared runner is defined.
 ```plaintext
 GET /groups/:id/runners
 GET /groups/:id/runners?type=group_type
-GET /groups/:id/runners?status=active
+GET /groups/:id/runners/all?status=online
+GET /groups/:id/runners/all?paused=true
 GET /groups/:id/runners?tag_list=tag1,tag2
 ```
 
-| Attribute  | Type           | Required | Description         |
-|------------|----------------|----------|---------------------|
-| `id`       | integer        | yes      | The ID of the group owned by the authenticated user |
-| `type`     | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type` |
-| `status`   | string         | no       | The status of runners to show, one of: `active`, `paused`, `online`, `offline` |
-| `tag_list` | string array   | no       | List of the runner's tags |
+| Attribute  | Type           | Required | Description                                                                                                                                                                           |
+|------------|----------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `id`       | integer        | yes      | The ID of the group owned by the authenticated user                                                                                                                                   |
+| `type`     | string         | no       | The type of runners to show, one of: `instance_type`, `group_type`, `project_type`                                                                                                    |
+| `status`   | string         | no       | The status of runners to show, one of: `online` and `offline`. `active` and `paused` are also possible values which were deprecated in GitLab 14.8 and will be removed in GitLab 15.0 |
+| `paused`   | boolean        | no       | Whether to include only runners that are accepting or ignoring new jobs                                                                                                               |
+| `tag_list` | string array   | no       | List of the runner's tags                                                                                                                                                             |
 
 ```shell
 curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/groups/9/runners"
 ```
 
+NOTE:
+The `active` and `paused` values in the `status` query parameter were deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
+and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). They are replaced by the `paused` query parameter.
+
 NOTE:
 The `active` attribute in the response was deprecated [in GitLab 14.8](https://gitlab.com/gitlab-org/gitlab/-/issues/347211).
 and will be removed in [GitLab 15.0](https://gitlab.com/gitlab-org/gitlab/-/issues/351109). It is replaced by the `paused` attribute.
diff --git a/doc/api/usage_data.md b/doc/api/usage_data.md
index 4809166f357..c7064ebf65b 100644
--- a/doc/api/usage_data.md
+++ b/doc/api/usage_data.md
@@ -13,7 +13,7 @@ The Service Data API is associated with [Service Ping](../development/service_pi
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/57270) in GitLab 13.11.
 
-Export all metric definitions as a single YAML file, similar to the [Metrics Dictionary](https://metrics.gitlab.com/index.html), for easier importing.
+Export all metric definitions as a single YAML file, similar to the [Metrics Dictionary](https://metrics.gitlab.com/), for easier importing.
 
 ```plaintext
 GET /usage_data/metric_definitions
diff --git a/doc/ci/cloud_services/aws/index.md b/doc/ci/cloud_services/aws/index.md
index f09b23db2c5..51aa08fecbe 100644
--- a/doc/ci/cloud_services/aws/index.md
+++ b/doc/ci/cloud_services/aws/index.md
@@ -30,7 +30,7 @@ Include the following information:
 
 After you create the identity provider, configure a [web identity role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) with conditions for limiting access to GitLab resources. Temporary credentials are obtained using [AWS Security Token Service](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html), so set the `Action` to [sts:AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html).
 
-For the full list of supported filtering types, see [Connect to cloud services](../index.md).
+For the full list of supported filtering types, see [Connect to cloud services](../index.md#configure-a-conditional-role-with-oidc-claims).
 
 ```json
 {
diff --git a/doc/ci/pipelines/job_artifacts.md b/doc/ci/pipelines/job_artifacts.md
index 5e6db736ed3..7679bf88330 100644
--- a/doc/ci/pipelines/job_artifacts.md
+++ b/doc/ci/pipelines/job_artifacts.md
@@ -194,7 +194,8 @@ artifacts:
 ### Add untracked files to artifacts
 
 Use [`artifacts:untracked`](../yaml/index.md#artifactsuntracked) to add all Git untracked
-files as artifacts (along with the paths defined in [`artifacts:paths`](../yaml/index.md#artifactspaths)).
+files as artifacts (along with the paths defined in [`artifacts:paths`](../yaml/index.md#artifactspaths)). Untracked
+files are those that haven't been added to the repository but exist in the repository checkout.
 
 Save all Git untracked files and files in `binaries`:
 
diff --git a/doc/ci/yaml/index.md b/doc/ci/yaml/index.md
index fc39c984964..aba47d25332 100644
--- a/doc/ci/yaml/index.md
+++ b/doc/ci/yaml/index.md
@@ -939,7 +939,7 @@ rspec:
 
 Use `artifacts:untracked` to add all Git untracked files as artifacts (along
 with the paths defined in `artifacts:paths`). `artifacts:untracked` ignores configuration
-in the repository's `.gitignore` file.
+in the repository's `.gitignore`, so matching artifacts in `.gitignore` are included.
 
 **Keyword type**: Job keyword. You can use it only as part of a job or in the
 [`default` section](#default).
diff --git a/doc/development/documentation/styleguide/word_list.md b/doc/development/documentation/styleguide/word_list.md
index 7f84203a498..5fdc8404ed8 100644
--- a/doc/development/documentation/styleguide/word_list.md
+++ b/doc/development/documentation/styleguide/word_list.md
@@ -194,6 +194,10 @@ CI/CD is always uppercase. No need to spell it out on first use.
 Use **CI/CD minutes** instead of **CI minutes**, **pipeline minutes**, **pipeline minutes quota**, or
 **CI pipeline minutes**. This decision was made in [this issue](https://gitlab.com/gitlab-org/gitlab/-/issues/342813).
 
+## CI/CD tunnel
+
+Use lowercase for **tunnel** in **CI/CD tunnel**.
+
 ## click
 
 Do not use **click**. Instead, use **select** with buttons, links, menu items, and lists.
diff --git a/doc/development/service_ping/metrics_dictionary.md b/doc/development/service_ping/metrics_dictionary.md
index 1be6f6b9719..f7f5a201aa3 100644
--- a/doc/development/service_ping/metrics_dictionary.md
+++ b/doc/development/service_ping/metrics_dictionary.md
@@ -7,7 +7,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 # Metrics Dictionary Guide
 
 [Service Ping](index.md) metrics are defined in the
-[Metrics Dictionary](https://metrics.gitlab.com/index.html).
+[Metrics Dictionary](https://metrics.gitlab.com/).
 This guide describes the dictionary and how it's implemented.
 
 ## Metrics Definition and validation
diff --git a/doc/development/service_ping/review_guidelines.md b/doc/development/service_ping/review_guidelines.md
index eb64d460b5a..137e11608cf 100644
--- a/doc/development/service_ping/review_guidelines.md
+++ b/doc/development/service_ping/review_guidelines.md
@@ -14,7 +14,7 @@ general best practices for code reviews, refer to our [code review guide](../cod
 ## Resources for reviewers
 
 - [Service Ping Guide](index.md)
-- [Metrics Dictionary](https://metrics.gitlab.com/index.html)
+- [Metrics Dictionary](https://metrics.gitlab.com/)
 
 ## Review process
 
diff --git a/doc/development/snowplow/index.md b/doc/development/snowplow/index.md
index bf627d977ae..4b5dd82315b 100644
--- a/doc/development/snowplow/index.md
+++ b/doc/development/snowplow/index.md
@@ -170,12 +170,12 @@ Snowplow JavaScript adds [web-specific parameters](https://docs.snowplowanalytic
 
 For different stages in the processing pipeline, there are several tools that monitor Snowplow events tracking:
 
-- [Product Intelligence Grafana dashboard](https://dashboards.gitlab.net/d/product-intelligence-main/product-intelligence-product-intelligence?orgId=1) monitors backend events sent from GitLab.com instance to collectors fleet. This dashboard provides information about: 
+- [Product Intelligence Grafana dashboard](https://dashboards.gitlab.net/d/product-intelligence-main/product-intelligence-product-intelligence?orgId=1) monitors backend events sent from GitLab.com instance to collectors fleet. This dashboard provides information about:
   - The number of events that successfully reach Snowplow collectors.
-  - The number of events that failed to reach Snowplow collectors. 
+  - The number of events that failed to reach Snowplow collectors.
   - The number of backend events that were sent.
 - [AWS CloudWatch dashboard](https://console.aws.amazon.com/cloudwatch/home?region=us-east-1#dashboards:name=SnowPlow;start=P3D) monitors the state of the events processing pipeline. The pipeline starts from Snowplow collectors, through to enrichers and pseudonymization, and up to persistence on S3 bucket from which events are imported to Snowflake Data Warehouse. To view this dashboard AWS access is required, follow this [instruction](https://gitlab.com/gitlab-org/growth/product-intelligence/snowplow-pseudonymization#monitoring) if you are interested in getting one.
-- [SiSense dashboard](https://app.periscopedata.com/app/gitlab/417669/Snowplow-Summary-Dashboard) provides information about the number of good and bad events imported into the Data Warehouse, in addition to the total number of imported Snowplow events. 
+- [SiSense dashboard](https://app.periscopedata.com/app/gitlab/417669/Snowplow-Summary-Dashboard) provides information about the number of good and bad events imported into the Data Warehouse, in addition to the total number of imported Snowplow events.
 
 For more information, see this [video walk-through](https://www.youtube.com/watch?v=NxPS0aKa_oU).
 
@@ -183,7 +183,7 @@ For more information, see this [video walk-through](https://www.youtube.com/watc
 
 - [Snowplow data structure](https://docs.snowplowanalytics.com/docs/understanding-your-pipeline/canonical-event/)
 - [Our Iglu schema registry](https://gitlab.com/gitlab-org/iglu)
-- [List of events used in our codebase (Event Dictionary)](https://metrics.gitlab.com/snowplow.html)
+- [List of events used in our codebase (Event Dictionary)](https://metrics.gitlab.com/snowplow/)
 - [Product Intelligence Guide](https://about.gitlab.com/handbook/product/product-intelligence-guide/)
 - [Service Ping Guide](../service_ping/index.md)
 - [Product Intelligence Direction](https://about.gitlab.com/direction/product-intelligence/)
diff --git a/doc/development/snowplow/review_guidelines.md b/doc/development/snowplow/review_guidelines.md
index 69fad1794e2..0359636380b 100644
--- a/doc/development/snowplow/review_guidelines.md
+++ b/doc/development/snowplow/review_guidelines.md
@@ -14,7 +14,7 @@ general best practices for code reviews, refer to our [code review guide](../cod
 ## Resources for reviewers
 
 - [Snowplow Guide](index.md)
-- [Event Dictionary](https://metrics.gitlab.com/snowplow.html)
+- [Event Dictionary](https://metrics.gitlab.com/snowplow/)
 
 ## Review process
 
diff --git a/doc/development/value_stream_analytics/img/object_hierarchy_example_V14_10.png b/doc/development/value_stream_analytics/img/object_hierarchy_example_V14_10.png
new file mode 100644
index 0000000000000000000000000000000000000000..0e3c760fa3c261ae20d6320c43ae25ce35bb92e8
GIT binary patch
literal 55849
zcmd43cR1Jo|3CVaqCur)lw@WU(ICk#86_G@Hf3dG@6ixtlr6G_B$Sz18A;h8L{@ep
zd*pX}_I|(5b*|sJ&iVdvuIpUqx<1pJ*X#LwJ|2(z{kHB;pY!MBXg4x#BnX05{*0_D
zL9B5i2#SUERQSoR8$pBkuML)Gu38fWjV<|aih~Zp_#gWSd0DB84((&#?62%-os;-A
zx2EP*&8s7HTZ7qn&kC|_tGKOjGd8}`>x$lyCq{aHOfuWHn?7Li<H{=Eb}iUDUMeB}
z^pV>Kd3m$q^w`@dc1pD`tUT`S66oX4UqAcXDcW_f-H+O*C+vSlpFBa!NUYKK6|7`%
z9$<(F54RLJRLP+4TdWtX!0Brs#5lK>{D*CPm2GVdr#Ifa?R*=*sz0{VK+nK{qw9*g
zIvXF~L+5*cf5>T|uYc#$C#A_Q@4~x(fAXc=XYbz+-|s|zg}(3hljMI2R{s0rKG}f3
zKfV=T_4mgj4S#?8|K`W~0#fmLwxgG6_KGo-l$2!V<lNKXzkfQxGcQkgac1=X*~nv_
z-ubO8>>M0xg(6;bW^CBbRb<n#_^U_ez|~i4PdZIYetvQ^uEA(uSdA_&)r)qwUUQ0y
zh|@IpmW||HZ3w@3nv<SiLo!3F*m9_z^{M0B&u{NjFC<%zH1oW;lC{R7WPvL_AwebK
zH0{rouueR}@87?B+`heLkEqRh+TF(vv`$S<P7ZaKO1#u8e0Esi@Zs(Ex3E<9yuUB#
zJbROd;Sllr$LBi{5sda?xY5}c+lqe=){!5VZ$0QAe#5|Et$=_)TU*<A+|HS^XLrg?
z%}#U&>^i9a{a4TX%&e@Qld*E=&u?uu$uUrOauWUXXUSqx9C!QU$B#fEadGjw?5Bc)
zg52EP4)NDp)34p%d(tU3KmUr-1>TTfv$J0KVt%b6@9Ak9!HF<!x3{?d%v*h@_wK`r
zgvT9WqNUhJ7#JJN52$EpDE;~KN6(R%{#iKDm}A<?F;E*Lp{!YG7ZSW%%;AvW`*f{h
z^+xy9)YQ7-vv1$NjX!yRGqaFG0X|zb?Tg;k3l}adcCY@CD<~)kwDR%s>F?`f|N8S%
z+T}?d9ekUDu9?}vlEYt2j$RsKD*hZP+=m<NU3tVRlWEkz*4ELX__3g{ke!Q*N>^9+
zQO$tSm*+c2S~CQAnliK{Zl!+>7u0_g5#f`Wc_=(0VmSC9KY!(uqo!MT?V_TlrVfAd
z<lV=Q8*u~SBDdnZE_eoUo!vIGw759(sk_v@wBIQ&O)X=@>{_YY%6Sb9->a{0ysfL-
zf@heSn|s>9LF8PtSn8a&p^_4fo}ON&+sdM0U{P{XlJ5Mko|Fs8n=kV2Y&JRC<<Li~
z6nTtx%U-ei!cSjc8&1BZW-06F*p1IQbolU{!om}xwj+1D-B&fO%&uR#!hplHZQHi;
zY!46OgMkqC!uPE4B|M`0OLG&7{w;n?M->LMZ{kuPg@=2ae0l!1v2okCLi_va>FJ3|
z_^0J1J`W$hZ%B|+DRpxV4-ePr|L{2QRT#hKJ3Nf@dFGl%N0_*GY!o?hB0({Xe|}}I
zdnPxhKiu2Lry-*IrRE7i_xe~Vy~TT*=s9Y%@+~QNczA}szTUrQ&mNr{H>j}hK1Chh
ze(Kbz<%dBy@DJ@}C!X4O(be#VD7>*AJQp!w(Oq)(>({SNgT<?VmI4!QKYskUw>Tyy
zhCA%()3dCstbqw)0VOY9yf7N9eHyq}I^VlVu)C^C&TwUEc08#0*1*S|#b%?O1&2?`
z$_{B}oKA@As|rvY!4`ZOZgKPGa&y3tS$nq6MczxPt`~5JZ(Nsh4I&O+%Y7sr$NgHl
z(0<|^E>2c<2NRRJNx`3$B?-H0ot>Ss3zdGmC32U)q^a>pNN7)p;YL(idn+DRfBU9c
z#3HD7mpjjHyj^H%9br4#;<s1ag*&yhe;GS^<VC4jM{eM)G~1O$+v-;j=>@o~t*whk
znGfj@t81_0c=j?kbmUpY%%2buVQ6V-xgMIAmF0Olq2Yuwf0&{_KTZIXLee&T?5Pmm
zOXWorlvFxZ{>%h%PulZVUnT3YW4m78_$)m$@`Zx9diCm1dk)`AjRIAkYRl@}@%Efe
zqb=z&7ccI>9y{bTZN#v9Hzo12tN7s@woC!%I2KkKWvE=GFiz%v@BCz+h|ByTX&D&`
zqPn^|kX=*u?p&AimMtveYY7?_@jbXuIXykLT>@G(a&mG+S$mFYmdO`hqHKD&DNFY~
zRrQ;}x|jf*-;=Yo-J`7;><15?E!whWi~E?}@#DwkXQhmnZd5$jnQz&%=BAlh4^Hb#
z>*b}1(uQPZmIeU|3W_UlY<MnbX!+qd_za-7s2SVyOSE^PcD-$FrRTf+qAZY8k=%yW
zbZ5uIZ{Un;g|j<dzI<8lD}Lt^HzhOHqMut1cRk!y>>Ma0FE1Y`RJuI%(7^5VX)lhT
zm7#<H-U08f1hYu&34^ab+xIK{h!J;PEZEbq`?ytNILp?p`y%XD|G2)&%cCF9cba)F
zqJDWQWh^1rtmE{`;!Fa{eSJ&%wTkITVGD(J{h^~y<f9rmX5M)v?pEL6;QmyLcXv04
zUT@DfX8+;r=-6<FdJD(z{Yv5c3bYQfvnRZhn-)5Jn6n1A`P9nFietsl*qG<X+{l-Q
z?p{J@kXimiAw{(#4JRaXo?lE=9kK3id2#iE$v27RUw3MsCUa&yewCAR%D^DepybXS
z$}YDhvq`t6XJ<pA8PYEDJ{_&6+Pvq=$m3dcgFD`mvfKv_xIC9%!o`<&A5_nl)Y6J}
zVBEbsK|Y9!@Q9CRyV+gBOz0RJZ-`K$B0hZnd}{U2%H!bRyUWWigk<C~v&@@cg_L5%
znX!q}Eq5#WM>JNRRZvifsN2+RPs>H14(NXj<_R>$nGH<1F5^YxshS!byzuM&mWu9$
zg@t$v-lj57$~e_jj+lr3%qK>e4`a=)Tu(h8uQqjL43&p3U8T0R_Sf`ub0lH(1uGsU
zbTGBwZx<S*LvNLPaOL~=GW#iP?d|WQ3plthObraaI*hts(cSGj#~iGX)W380ZoVI@
zzw0CjB1hd%tJukBxF$@1>|p3Mw{PG6wJ;ddhpiprxc2H)iBQ#9OUumKa1qC;#C|&d
zfUY)5;>+_(K^k_Ji_^mj-NJ5eZlX;^MMdS^YA-c<?)x0BWJt5w>Es_B6cps(rd7@H
zB2nrNmArrN3yp$pxb5pLqu;;B+B;Pz#%8m72b?Q)o_ksQ^vTY+41PS*5Cu;E+aY#_
zqfNnKVQMeg(H$dtCn_G&%Oo`DO!ij9`=fQU@$hWGMhzEp6nbMj>UF&)G^BlEfbnnu
z*M#O9n}*>&-S=KTb2vfs17X^GujQ58`fbE^wI#n{R{lCy%yqxWKr<fnruX-^EO^$F
zXCg{A0}Cv2t9LD-GtpI?@3!)$HsR8ZPvNYNrKluTTuvMBNl#1%%H1*VDq3hW_|<Sd
zdzyKGFJhkI$v$Jc#~cM|MncmZpFVv8h^fdu8!g7DqM|}|5IaoJ{f~>%Q_-D3AZ>;A
z0-N`Uc=Y!hOb!L$bJ3wGuuWy|wHpKYpfP>_6mdAdt4@4LNwu<}LFH96S|U^M(C}{I
zfS;?4m7j~9=gPZ7LqnZvF3#rjEKq)EYYPt&14s&aDV=Pt7(G=}S69`RrO#5RRNZ7W
zaA_+0risaOk=vIWv-GRVyS22mdVf|0CST6bE`9krs>Ja7u=Ss1$NqtVVI{t=yM%@F
zuvbjKJm>tw?`W77hmzA!Xm7DR-xn~CqJ!#5OT#RB@soh#NZzZ;&-h5df_R}Cwf^JQ
zU0q#=gceJ6Urv1Zjn(3m5Fh!HwjZA}H<r*!wQI+Y@0|tKR5>!;PRdV3Ise$%+71|%
z1Kd?8Oy9n9ry>5-rb)Mfk0IW^zOtx0=dAJ!>-OID@)B2B6OT<UJZXR9#xsY``z`1w
zS?1qFCrkSM7_kkvyBiuB>SM`zSFoCsP0A9C&0fxPKXvh0fyU^#Aw?GL*{K{o?U}li
z$8NTrACYn7Q>>2UY{}5hu(q-O_5CdaI!k2$i-3R1_}ACe`c?j?lFvQ0$*rlZq)Lzr
z2%QcJou%5Gel5?Ov9orI#PWG7UhARyICOU^D{E`c0sIFYGqc}jW>K+QF+kq&Sl8Z_
zI*HX6zbSQR$G-MjY}&Lb+qmiUME=(z$JYi0*sbz^X0)${9=OUjT#C<S<>x<FWYO}1
zQI4Hl$qcptwFdF%_gMca?hWkh?9bIQ_U4#>d$MNDnh)>ZNe{AS0WT-)7B(Mpy(@qI
z{Q1<;(Z-~Q+{vn`LunZ$@e+UL@BH{2DfjZ_%fPCu!7hh>VLjxzg5-Y)XqQCw_V%U#
z?*-nUUlWT{KWY}Kki-_EaH=U;IT?Vj3Fp4Lt?kMui;moJYiAuRb@eCxaYYtIlT_(f
zUwifT^`$Dui0e6#$ftC7M~-P&xVf&b6gq1BN$1)6w|A(G-+R$EKflCREfbXU;K2iq
zEmt?MUmrU(Wc1+S!^1|-x#r&#tO_(<omEH*Tti8jifg%;p>^`<0x@)Fi+C*VuQ)($
zVY*3q=H=-3w|5LoOn4ccO<P{X0ms*)GIGwiFOBB~URM;~v4@~#6uL`(AX(W`FY;FB
zGm2R1qz0&|q+V=(bzSj+k53#ve^_i67Y~n5%!V=s{TGca8LB<90p3F&L-=;=*m3cP
zJ9B->^ULW9hi`m}Me$RONl?2SPl6{bIlnbCKR>_dYTRvaBdobo%{6s(RcYzl2JOIW
z)4Azb%H}M6x#F3&uV05bbm|r*^l!FhdZG*{jPG`Kb{2J+&oqb-)UOn?E5&A2oVqE+
z77uj%)av?pq1<>^aU|B(ygok_UxlxG`Dt({By@;wWiCcASmAoaD8oso>{=_-aVPf_
zqwR&{?kk#T&CpKu=>mXI{3fu|m5P(3EEl5_k_X1dd{H0tI&#e%=DykY3=FK}<KqJ)
zjRkB?!8cHC+3SmS(0F6B0U+<bk56^bUQbyU7qQFf>i2-g-qzM`=HlYYeDzAYuhMUF
zrd7MI+-G~>s#xsI`z;bWmA;HAnuW)d&Yo4tF}XB7)IbS{EQe0Ynas}O+7)?OSC<ui
z{(g1P{ses5dF~x4>N&iNv*QnC?r(nk{(WD;-nelfO@9^%e^wc<*c+dp;CC{!vt_@%
zv8CI&^B&6L5u<v^SD);=UGHNL-o1Z6;j|wUe(BJ$V_xa$2f-!0A`Tn&4mBiL+S!F3
z$g}K`wi#`q1qvjweOg*t|HVIjM=ZMb0PMbROj2w><;Z{Y=3Qs!o{jg`oI7{U;rC}@
zLGw<LvCe|+0EIHGFEwNGwMk46CFZz|{j{$~SQtH+#Ey;YG&D5ofwItY=?@#$HeaoM
z|DF<zX{arW{lLM474D`HC!LRh19CVXP&C%3BAAYv+%5gHxCzV%l+Y8Tj^rW-)U(e_
zI5Fz`W_{e(WOO94IJ5=?0=To2FM#2=6-UYHA7?`H{P{=yi{h2j)gM0wa(I%U@ywa^
z_B8mb<d2n=r^SY)(l5XNKiK<px!iPg)$88qFo2H9eYz+SZe5Ir&r}=oJ&A~r-}_tj
z307vbv*8oiJL5<LyOZ*AS^wZ<H;dNVii(Pi@!Z$@=Z0R>E6T`54T0#V9Z`-N8t*P$
z%^6Mv>tYoZWh!%DeQoph_Bt`ED-l1tO9cwJEPi$ttY5$0Va&>F&kQLC&{PQP|07DU
z&EKFQ^@FU|wf_nVe?Jz#bZ+{ue!%cQ=nVgZ{P6K@BHN~ntFNiR$_KR!d{15iY?4CF
z*AAa0K{hB;kv@aIvY!Tj)w_F}dVc)49OuMqBWr=ZDPlXaV}iD_?Sl2<wDHZ({K<PJ
zO+dt!zki(VI*!MC1G|9iZG0Na_xy+G=%l5kGXc=M*zwQe!L3Nr-qSt<7|}bP*ZqUJ
zoWYqFG!wOqPh*RA!e4!4_CfEzg314IBme3s`u{$j|4m-`@5lc=wYG;*L$*IV8HFNf
z@Gr6m)PUKZ4aO!E%>T*aHZOG`EHH4YQ}n2yARP|AS7hYwe*lQCg+)MKm(!-S%ju0g
z?t`_=N>7e#a9^IRG8HDyDk+tVH<bYC6%`i?I{ebvBj)g{Ae&D>Ksj0SdNG8E`No+Q
zu(zK6evVvL0f7K^wkmOd*F8&G!);-Y9(f!yYcFePpfkx~g0c~QNOui3#_y5M$NWyq
z5bKGnD3Fe_va;v#?}E^)rEbMnx_ucBPlry<&Fv=)%*@U@IyzFdp0xj|p)v<9G2}=x
zm}&!|hRyf@Ae-Kk#Nt$q0A~$OjyF-Csr!D&R{!SB1H-#rGXT*qsHij?Hd8Y<|Eb?`
zX(}W%bhdGN!Ed*4ieX)}Xvd?-$R+7qVIiSFr`fRu=^Xjgi;bXM$7gSi^|j4yt0;kp
zqnh{r{rfvVzZK3&=d^ZqMv-LU=fI2f^a{JwFD6bu<fcLAbWKe+5m#{awaaLdqzXcK
zM4xn)jyqp;ME)?HZfE|jeQf#p`QKyQ|47-{9eefa)uX5=8ew7K$+VT(@eaKLpa8}q
z|K;UnwJB;6T7$wohBSgLtPd1xdFvLP9AA8Ve6+DM)=btp8w6Q^kVKQP{qZG5r7vlC
z6up!kM-iP?8oXlu{O*63;bGfc&wZ9PgodW(t?40^&NsH3^ecTSh^Q0xoB7mUx^Pyt
z9af%3nI^FtQ3jrBIWuypdO46HQ@hlS@BrfI=?joJ4YCWG@qK8>8yBn(8WW(Yt)%2D
zQeFfxuUbr5Ss8-JT54*=XUU0)v2p=>GxPGmDR}U`WC`u>?+-3`IW~5)v&eBfv31+F
zH5L{Yf_0E=a1rH2j=xC_3!0A}PS~SrgSJ=KHxb{fSlsU_alOZmAP7`s>}$Z}E4eor
zpI=I&l8}&4865A(6SV3-lV4c)zPWjaot@p#w?g5@#zu~DUS8gJVBrB&v`l5tk-%Y%
zno}OvrUnl;B|j{A<Gw2HwS{H#wQJW%5N6u?GT(LSSYuNY9n>cvFn|nZd>1z_Z{YOP
zTz{Sm&w@vfc;%Y?{P~kX#B$%}y<+QuB#ANra8CV-M`jjZUvWYkI&k2C%{j%|h{JN(
z*0>R;jzqJ7+3N<=-BqW!f`*?O4&@8lh~=4e?82=;=&T6gQ>%}Yp-%Z?A|fK9vphe^
z4W5CWgN-bca*@};(NP!AJz(4vqQ<AEC+MNV$fT?1h*0*mRb>U}ck{6<L8GK%VPVO}
zhoXSVfI?$8J_K9$5lYfjeVc4v<2VxP4LBmB_tg5wr^lawju<Io)pJbf=t%DTp|w>l
zYU5CI>UL;#+X*2-!MO7Bav^2y7n+5al{#Kse`ug-JJQTbGy`-Cnst}BCaR{cC%(M6
z8ss!Rgxzcx-`Tf0!E{T6$q^>?5*NpaWNrVwCl$bGcaEp2Bv9p;b%a80_3{4j@#6#H
zJfyjZCr<)3`1fPWu(3fQI_Bu$;N2t!vbrC;dX41l>}+s!G=Ix)sFvFZAt9l7RHuh%
zm>ew&pM|@<tzH|}?P_wym+#%Xx4*ZSE#fkyrssexUpqP;4&%(w+eV4pl2(clbA0tS
zSwP|EoxmTTBG^ZuC}<VrYC5a0C(zjBN6fm4j#KQzI^I$Co1dTewiWwWf9pc@<et5I
z&k-M*nu2g1Q$R-bl!#bmiIrgJVkvmAdf!f;K5aAAUoDi^hZ@s60s1(Z+F@uj5~|Na
zp1L~W+2P;VyWUQQwNVQS(QjP&efH8lhQLh``~AC);5dX~11Rqcu{XcIx(DR&p`zlR
zp1!`1H#c;6X!aDbA3l6gptYlAI<l4W*#7<Zy}eOsxv82!l4wgVQxRafDge<#IGE1>
z;AN&b(~=G@4cYSM=H{;Tz(#bP`Jy%r$vkTr=w|}~Nuo(&b(y`StQ#m}jU+lED_cB{
z_G2iV1^M~)!11TPoqckIj>XRP?`Gb)YnSS|bN(FPX&DYlj`3mtt&zlz-D!&puLqkk
z`V=mh4feB<x)8MIfvx*=gWN#-?28u%P`cRvD$Wl?Gc*giD!<;{u$^Y_>+9=I$W)zm
zthCNE|5l#sKKs>BRyH^=kd09r^3f(bIxNOjrH2n52suQGG&tw_?ESZX`L@Z)+Mps?
z+1hdv@Frv!85yI7F5QTq1LAy0;f&VI#-^UB<2i4sUF4u*7y&xhfOAD6_WmC~P7^7P
zzkh`68iQ)b_R$~utZFU<w6z{@>?i)TnRS5Y9W`se=n|_?GB!SLYuDL#`ze%&T7e9}
z$8CgDpPw*Cli{auDdIzI?YW7^QJ~n3_;_wMHt82?*X*nRK!Gl<&Cnxk=6~r57Nd}_
z^#DxQ>e&>ixXI4g*jVoyCH3Y5bGfFJr%|sf>}n&0m7A|dYkMTEE8Nd49I(5N^UgQa
zG27YVkdTnJXHbm-YX;VO01DUmbZv?nBD+yl*2F?p37)qKl*kH0l}MMV&kP~lLPFar
zD=Sf@-k}9^wx(noHArjts$aR{4Mw>K2dTH+8++#AD4l{9yNU{@#rBw^rlI}2tj3S>
zCo9Le-8>2Dwo==D<sKZLn;p5dP_9WdPeFh-$Uy|lA8Ox<#@)-bAsy_Pg22h<H6Fx@
z5`?ft*N(i0tBa!<zow>c1HeW-eX3IIWV?)?#J}wA)q84dA`nfrkAELEVQ+8$bQmJL
zgGpaMuC&*Jn)<$#g)_b&Wj_y(ycLCmq@+jwhxx01k^33z(AR;98;0%a>FEXeeSLj(
z%*<Ar=cxZJdNq5Oa&LaU9UHq(qrhq%Z^%X{p>hrm^L)Flm7-f8q+Lq$dh}>3c{f>E
zS=j#6f0lnM6Ow3IrwRm0=GUN1QvQ`&!J)i-d^UJ(W_~a|J#Cf#yOib8>R>}*zJXB0
z{1Qrytd36XIc83Yc`A)nZy=dioPhb>hXR>SGbTVRv6-1$(K+swmX=D*T)A>(NU16J
z%h#`rASg|RQA%7gAWLlQ>{7B0qv?5vjOzEHq?781D7}${lV@g$8;{vy(<|umlX)2#
z76rM?gs9CBVQOk>aN~v^Rsn9$Y0$_1+j9?i>+&4~CpBKxDZb3e9v-WxMD=H>DjB3-
zA~_U9xj0-4nv=Jm->G7!8Li=P{V6fEu2Oe*@;MaRjlW}YU-pE@g-fU=TK=q={Pn90
z63eL{?$BcIw4k+@cefY5BlhjzFK1{Ovdq~UD@FM!`edO-$7}L#<>dOnA=`=^51X{S
z;Q8xC6qmL{-%U&7Q@wBjcHGCCgD7jK9%%!hMMXss1nRJR5A|T_>Ys<82|ga(1=fRB
zW+#4iKlMkcC!u%N^_pGHX=+>U-Ma^OXb4(OQub@HzGv}$5yea*|Ddoj{g_$LF8s!N
z8X8#*jXh&yV_FLizcp6ZsiTtsmts?SWRxs!B<gca)v7b{AqfzYQc|8GpP)M17#JG<
z7358SNoo{3<)rA3G^dJ|nqZG`xfxfMm+xa|rz~^7e+M?IFPQcL?UJHTTUxM1Z~geh
zXahJ69S*kMW+=&)z2zH<;F`qWtkxFCsU!YOWEQbPg<DJf6+6Sap`<nBnqBi{k<e;%
zCw`&)5@l%5TUl5Ho=LpiQqu=;$#BB%K&3x3pK)v7j$OOpyKVxzn+H%KRUvHY$#qBd
zD`_Sxt`Fs!8Y}BALw9BSaNo--ULk}x#O`h-8dSsNCoS4NOXLG`&dm}K7N)18qXYBs
z2npF4%CGqV1w^CJ?rf3P*H!<?BJ;|6rXxm=`fq=mpLeKU4iH~F^Jx<eO(MAHqk@9t
zv@GHp8bzI{7xurwGN&rvx9H5z3fC&MGlK~l2bAD*Z9MX*Dc46({Rf31c;H7Zx}xAW
zmETJVaNand(2+2)bI%?nh|!|<Jw2=11}Cn6+)=%*nmhzo>u|)%Prbn3PXCCs2uw~+
zc7QH;nk`V=ulw_7KT*4}GdFJBIO4YKAXp5&a0d&Ew#jP9fooIMJ?*P6bxcjK^~li#
z&jwZ-OjqxZ5o^db-APZc_%r%FJH3Wl<x@j1|Hvs{!|`?1oJ(Qe+=mW5A|Bx|8oZg!
z+Ok-wC=V}+b^reTSiEiaTY6Wu=U=*_uc2}(58t36Ns7qq$)z^6sUL}rTArSsE{7|d
zMDN87^!MMzsZ#s_>2W8-h<oq>R8>`VZr=38#wGQ5BS0u6B_+$THo>Q+=M^9vNujIZ
zav%Eo(l|Ic=s-~DUDFy!Z+Yx{&M%?=vH-@7Ye@hH6@fLZCd;B*{KJ414bzeJ)SLHs
zq@|fgbo|C@>*L_B-?HWY>(__-t&Zbc&O<)Ad-v}5!5H^SKyUnMg%D{#Lwdk3{8^dP
zPWduYH5&=VgY=mJM#yC&jV4g7JJ{4??Kz6eQxN?&K|@)GQj8Y<9p>7VR|XrPS$hKV
zODC!J0LsFkaMg8lfdL6XodEcMMnPd)t8K7-M-DIr8yj1>^X}cdp|f5#iKJx~4iSvz
z8zD_@Wo0=hr#Jnc&)SWLhliDISA72kLZY)FV(*sTJT^YU)VNnD2jb1;%b{;K%?&qE
z6VrcQn?OyVab21{B_%}xV)gr7wtSMRE<6Yah<1+Df|b!5VL3pLOaNaSP_Ko?3gi>-
zZ|HWo(wmOmVM1{B_NMjgx3<n5@^|&cad15OTh^jB>bO`SgY(-{r%zkO111alyG9L#
zkmbjL1Aovow=9J6`S+(MTN3Kj^dLo0REbx%{njbhgy;vg;{Q3>@E`RCBmaN*`_4Y$
zVl^Q+Iz7N&ouj_RH$W`BJv=;GOISpxgl3&YEx(gW(e%iECsLzIln<&03h%;ia;fLu
z^g&C$6;J(rdEqzNmA3BL^NI3KR;w&F*{$Kmq*nF@b~XoRXX{7$V@KmJ@=D2e((R#S
zbUp|Kb+VP=Lo2D~ASLqLhs&OVyzBo-c==C(@Y(zS_3sydBqJkt@7*IU5UYYcq+>hM
z{1$t_63->fP3{Hs9-#=O!RvZ@Yt+=#NSP0|p|aTubYPM~et68jaN#XOm88F?@2&W`
zu>+cKb^vo#LHUk5&y6QX1L_fV(s>ssk`&xcmGkHKeXI)?q!fx6OQpJ(TwPJI?x<;t
zETr@vghjye^})2DaFxMzi~cBz66sZ6e;zF2SMqH^e^2r`p9(Lc@mogSBM2bQQ%EA<
z5E1(jhd>#Tv$7I`JWj`iV9}K<y$Z$R3kVi`9~t58N`Ce%9+)-XZk&nh?325X9z9af
z9>fjKH<kT!1I2n;57?dBo3?>`v6WGjby$@81qbiwEOlpzi;HW^Hr|deLjGX`;Q;uG
zaLc}r8Q1bQ1KxY)<QxTy*}7xLT~ua;7F!tl&`o8a7lI>GQqhz_>8LQi8<>11Ffgzl
zfrBeouS%s}j0f!jC4ZP$5}3>m^&;A63BJ$0yl%JM#3O+Ch&-1Ct0OntwgQbY`B6O;
zwS9*$1qI>$XCe8@oF^qUN6pO7Z@a;IVL}trF}WXVYTg^hxKhEqCgTnuzipYi`Ob6v
z|B-$fl)(xih*x?~p|fsnf?v5lLdgpq@=vp1rQjp|eK>_HF=b_vMA_|io9ffl1W1em
zuuBl2!{L#Ulmw8955!@$0|2uUF2CMV_l8Z7&k8l2704OuFQ=-y?cKX~mcPDB5t0z3
zfxkQ;58d`g2*nFDQxAqu{5ja6L>UQ^LEcC>Wl=n{OMG#NofLtYPuP`1)ww$CY6&1k
zc=-AGg&#u)pPuMu*?%so3}F}&n3Pvk!~q56JO1W^f7LTKMneFqg{;j0qNE@e=O(mA
zL<?<(Z$oI<Cm^r|U`-Gn=`R>mtYTt&WXXO+NrLYOq;b48`4aS+EC9!9`ZXTOQ;Jbp
zYRrGP_DRA2i>`L}?Ep;DmDvu9i&|hK{lmjN?WwLv^fcg145JOilb&C=JG3D|SCHD~
z0&By?k+h8RBY(*_v?4G?ka?f$IpYWT`JX}k_Zdc_ik&SU5MnD~0_Qr#0*>5T4<=#r
z1J9C@lP>_LfncjhNlB%4z~VQ_^3TpbB6w0*ILvKz#r`irJfc^=9_-(KVsAub<aXkT
zxa%8k7Dh&SVkk&i9N!2uKu0{kknGRBefMrf;tYRS6Lze(_lNFoZPitvDp_YVLpfR5
zb?eskkBle~MldpDWiO_yA6+9!y=5;4TRip(zA6DbdOMzQx4Vyb3NC)F2V6Fpv6-pF
zn597dH)t#ZoyXEO3v)Yb;0ZnO_y580LGV%W>F8-|3v=^xP)m5`tY8`FjXj6n$KyX#
z@a7F0C+9kF3kFdeZWmWqT?2!=xIcj9-5_W0(PuusVCUuCxck`6GVF0LEEz1*ICv9;
z2a;7p8AJmL0tj*lEt!zy3StG9R8_<F+qQi>1%VSn9(~-R7u@PK1liQVX(<SZUS4SD
zWECtg&s1dl*4bGe=bohMbMC1ql-DizL$VFXUbD8cA_(~G@w7-!5gx#Ogd}tu3IcM(
zTgYD(0?x$xO`Gl@l+<->tgCo8L57D=HUS%H0c5r%AJ3l2Gx?(M>NB8;q>j!$^=u>7
zb5BX_5W@2Lv@fJFve3Fye-GtxDxu0`^CVwCKf1kp{ZY1hU;>fbyyVZKDfGNvJpOQT
zSEq;?mg82k8jA7fxnnQ#W|?&yBM3SQkNltS8XHx&Jp!z^ImZe_yoPwD6tM>B7ZFj>
z2TgpkchTccPUeOd^?mv<RI0gyj?NQ+;ca_66M^g)&qw>AdZ}z(1ON#Sgn!l$SdSir
zM9yjU4-W3O`6zwO9g&Qb4oJ{oY9Y-TCv9(iFQWh?+5}Ev^zBW~dbbmHV_TCCJQ23o
zT%b`KBU&j!Wkq8!#^~5H@#d_uauwt_%h|E3N>L&zE@y7uym<&}CYcmOMz6Q`nk&F%
z{j;;XJ4;-5qxdo$HQDj$^JhVmX6~`>QtjZ^d3n?XNJv6v=J~a6KvWe+UT0={Xz<Gc
z@_5lO-v0H=@~JJdDl0yD1^vv1VE7dPVp(o0PO_&?y{)NHyjj{3An|8C$)E++rGNNv
zX3q&bnp?MS{rde|22wIIEVp4M2e(t1tsu14+iD@-UZySd!8rNe-MeKqHJe~#%>!0e
zRD5?a+xYK-$xYkb){vE5OSTu}ZBTKPKPf6IZkJM6Vij<ddotThZj)O}vt~pYszk#Z
zThrzjSGOa4L`_UC^Jr^p6Ot+_kMk|_Qc~7Kzir;I56y+*SNAtd$dxjno8O0reIPG+
zddD^x5d>J10O<2w6gwa7vH?Lbgyz%>)X?@};O{UqtB>`}Cw6-n-APK~M0Y7)%qhL=
z=j%(B<pbApm6Z5K!>$AJR?y2r-j-d#-+idA_Jmrp{s$yL5&NHeVC!!5JADUd%!hDT
zn7U5-s(1GMy<IG3-TNBL!<CRgIq7#TE-nV%zfTPeL`S^J&3$$u`5Yac%DHo!k(=F0
zOwG<dLj<fIwdPFf#cjk!FeQ{C74-d7T>V-PY=EIii;_6#8>He$u`fwgo>VT~-QBJ1
z?OO}B9%p5hdXbERdBkSuyp^3D7Xg=YUoky{;f))iOVS2x@#W>RS?SyNpWD%d<bVS4
zp}9F2T8|>|1UsB{!UzejKv6hL9Q3zX#9giktu}0W>~m&X8S2q60)ffE8ChG-#fTsL
z2t!-8xdYry(Dm!9>w0gBi%)7lt`XM%1%~6Ga_nzQu&8usj1<&*AgjE4E%>J#SoVH2
zG*#XZv;uj!?_|(W{v(paVc1L3NC(5|Nli)dCQCIqAnW17ho^r1ie0y9*Lm!>byQS=
z&`ge+G<$n{<B#MJ8caOTodS9~{by;S2}MelWnf^yXJ+i{>-)G1WDssc(p;FIuNUri
zkwN?~gsI=#`*gtGvjmw(LCxc|FZhz79Rn8?Ji(+ro5!pzQ_655kfI9Ov|&lfzPayj
zDWAYQLf3i>;rPUf6C=psF-y2<yc)A8UEvyuK5XdUZ+>EYddhb@!25ouzlG`CH1Ga~
zAbcjTBZax+UZbxtXo)ghAq{VaYAPAMvYF`m_T6?F&9QE5=!S|49lv&oFH(x{zI@pU
z6)K(<Q1H&vr_65iJ=Eef8Wg*B?K0{vIcZ;R+Al9Y$2l|JL681(1yby$oU;Ih^jjv6
z27^_TG#s&AOPYR$4_e!mrwXXa?9~66$eiv}O1zw=y&Ng{vCvbw30Vs5l-VL*F)^`6
zPo8{a{uipAq!e&LlFL8Sum{ijO1>p483=;oOCq+<pJ`ner|IZfUhl`=s(kt{It09B
z8Mlsz<`jQX%h1R0fx&qv!!7#1-s^t={(o~8|FaPP!~c*R|Nr{?a~esBi8|lQJdsM-
z1?L^!I%1A@l*Jd;&P{Z?vv!E#)WL|d8EeaG7DDs(RN}gG=gxb@EEduziBNj>Tj=P~
zdnf?#h3=ws{n|ge6VhC4*bR-6&03WV^VyD0PVvxh#YCpdhhUq=b#|*=!pR6eW>ne=
z86ev9CXPc&_M}RL?XCFaDr9--wr=$Z+OMn!WuWb~;g(|-UB2Gl>s?k?=8T%2(R!Z=
zo|~JiLQb96Y-ML^9nuBYa&Nvxcy+o~yTs-AMcyxp!j{kpvrJq0Ct(%82WH$#Pfv}K
z0;XQHP3kZ||K^#|*1=pMf6tIB+SeE0cnad0>Fr9t6+6=dNx)ihVjb1bpbiR)dkmrf
zFg_;Bb;%B*r1voD*1e#h?Kf(pd~lWTs;a1Qjzplj+-tph@#0$ILtS0Qc~_E80s3a@
zRcv&D_bXajMADOO+it_T+n9G;LW1SlvuAY%F|aZBiHKYgN=Jz!VL(HXqczOe^)arq
zUlms=j$3{&yO25uh=U-8z^QADRb?MjCXCBd&_+w@m&Os&fyebS+d<{(Ojc`+;w{+>
z^biO{F#SY-Q_(PZpfZ->8UcCkDI`e)6}_<;X5*2t=n`wr&}P92Boimla7p|txQd+Z
zJ@C7!ff|xZ0SxWryBw?@11Su+o@UVl(UP5HKDD+8(Vn+mU3=lF)JM#<YP*wJA3&M&
zsTYk<a!8F>J^}?&A4J6a!GqiC>6P$&pzR?Npq^(=i;qU-(1Vprrm|Uss-Xw^SfwWv
z0rk>=nUGcVnE)OHFd#V`fJRYY>};QylqCN#O59aFyAUOkM2v1r<HGWVNMV2lym+kz
z`>9%Bsk2kVcen6ngs=`_dqVp`C%Xq2>n$XE7p?exQ`2@(t7FHGt>3WWZHem=L7?u2
zi`w#neqvX9A&waG<{QB5Dez%k<W12G0e0oLWsm`5DEMF-_Yx8k`geG+y8ecg6py<n
zXD<|zZU+Qxaa*306D)m^%cSZK?C#>?5__Ke`;Q-9AaSEBMc}goKAuSxDOIlG*j&~~
zIgds$LM#G=TG!>i>PoyxHfK?@fTab}!eM(3iF!~y2*6=V_EuK!pusDC%dM&i0K55~
zp4YX8xN_~<LzYTxLsAX}P1}&9x`CRSnxyRj8T7WKtAGu0MoH;zMuxy1W@g3ox~*U@
z(1_{r|8)O>tG;B~KDhMpV>(cQ`*>nts_(GGWGD~0ngYEvR+{1aQ{~T$o1VReE)S^@
zr-mZeqWk5A+WOqxs;!Er5*oG=Ya~(YFYbkk3V5k&>4=tIx-z>vq!p}d1A#nY7|c1I
z6DO`&6hK{W#}TK9g$1N~;|3QU9qiZ#L_OflaDR1Ba8#5MSTqR=unwR|upGA$Q@?*F
zz<9U~ap#QvMAw&VF?JovN)f6z3h&b}O5@<g!6Dj8K<x1_aD#gP*Vdcts|qSEE)I_l
z4wkhlh(gL>7`Xz}HNlaNJb~%~t9DF5a1ZwN$za1Jn16etg5>xLvMC6{${~hEk|H#U
zWU$!A`z&r}@HMQ24didD^gb1!pS2$1E7KQ>e+RHgoFj}t{PfyE=N13*uQ-6B1`ys;
z;1B&{V@i;yWo1b_5$Q#Cq!!u>toMWCKLAvh##aT}LD0Jo(ch+Jw7*|=qGai%0}B(A
zf=SL3q!y(?8M5uh)nC1Soq*l?KuBU`dOIxOMx5DUSP(Y-ALt(V`f>pKfP2Ivi*x}~
zD6pl&z}|R-h1DjGbr(4X!JSLRE{Es18Fwy$+wnoN=IL>3FK=(u*3&S%$Piz9iEClF
z`I&BwB8SJ2M`wl_?rdfeR|3+C$7T*v;!41Mg?OhlW3R6wdsbauez!f>Oi|8%PaM0P
zKY}Q0$tZp0K#)^oUGZgXX#klZEe_-lTV85j`#FH7b4pIG^qAmzZC|1O-?$NQPf*Ih
zMJSjugsd+~S`BWBz3f6I+Dg2!8-H@;8Ipf6s--c!w6zJsj6A_DE?&}X=B%*{AtV9Y
zla6@fFv$iW8Q|@W;GGi69Qn*dt$)yre=7`w1}KX(?!}82VLO4ya1sb3%A$QG;+lii
zwT%UxAoha(V&n&ng$oE>;mny>B+=^OWmLDcgmyVkoUEP;!Ndjx+a?gpApra7;pCWY
z1j+V4?!1Pcca|6edrO*)VO`NNx~UGhK@kh|+kgth!^-OU<cP5}aufqhECZ>dS6zO7
z{`}b(z<5Bbw!K}w-xkXam>J-01T2cCAxpr-Cf!FlbWv8^g_`P5RD!i0I7}7UAO|W|
zR<9B@Fabpoi+toZIu)EJirCPD*Ti$hWsJ9<G%IsP3#}-^Ep8<g<mDUWr`z)^lu@{n
zqN4T)rpLy5V0MICOiV-R_wV2AIqGKt0qC1RG-L@Is!K@8ap(%!Fej~hjO36iEFlLd
z`{$wfkYE#g2TH}mwY3N(pi^+nBtCl<sKmA1(*;Chtt1D(I-F5{`}pLuFG`nwo{*0?
z^>7y*A-D_i|1+Rec+dwvA`0aJ(M~qT?q_ENvH~AF>yV4xkJA3}!-uU+U^2M4C=y4r
zu`vnit)+;?0zVY;nmr4;@l@p2ZA^;r@u;O;K3F|C(U8lezKYO*5*aQa6F9H1qoan3
z_xW_yFj3A_aLY)<pg%vudXAP;LYtW^F^D%jQ!H%W2@{Kba$o@<S(SUo5!03f&((9D
zU%7!DVE_dKY$?e+l66ua`*W>i;6501KDE&&`BD`ly-ky=Dl4%A$OzTI^q0AOvKxDo
z+#+x+(C2cF$rp}pHNvPS^kASBU<4;3-&W%%WVW4@S$tdHwqxs7N$j@JW?NLHHRoSW
z>KbVZT#KJ;?6mEG;-*pJ!bryMg|2UeHJs%zsdvPzeFqZvQqU$+Yt+@%$*_-6W8wyr
z<`fE)|Dwst-2{nlN28ovm`E%DvO-2Ih(CoJ5@2lnnw)IliNyE>l&3T1jfVsUr7SHE
z;qbBZTtg}tqTj>0_6t!M@Ozf1f!UjA2j)d`ybB59BCzs?MEULTKRGx!$oLCEVm8u%
zgAN#WV4|mo0t!eLzgZ#Wnl&5)aQ`p=EIFs3u!ew-t?X>n$_RY}1U>;9;Yy|s1zZM7
zU;^?=7N>7Pq}c+ux>{2QtpvUHOF`e8emB8v3zQ2WcXEcW?AteHe}8{VOG`<lq-*C7
zri!^v3=OS^L8VfO@DiwPul2J%lzd|i4A+MSU&DTBLy6C);lMSLh|z<BGJ4+H!qD(O
zu<Jh1OpOvfU0qKERKU?LbaIjtUfJf~n2?mhL=ow<kQ@FYx7)wAbBcDUIEpm%U=KXY
zlR1BdtD+(?#H*;HqoW~?F~Qd(^Nhul2{>hea}dvE)zz6$^=Z58y$&U^(D<E&s9C@8
zGes>Uy5H%tOo#ayO&7nerkgJw(*X$il0Y0i51Uk&oQDDpr`WXX0Jm)cnMXj3SPrE<
z6D6Eu|Ng#=(m##YTH4zeQ?rYaoy<oh3z2&dv{*7ifceYPu2FGx4N?rjfS|k<2v!wN
zB{J;iO`Ipb6(-v|ffL7Ik!kjbY{e&U%K$WzPQR>=AOD)0qaVn&zwfu_xT>Khy@1vZ
zd-m>PXEhhrOE&ICtzThpS1+2hzN97eo{}Oi@acJ^7f96wU<=#25@4{VSX}03)G-K`
z8s6qc-Q`tP38=mRpzlycZz1r3`$&NNMm2MX)pgaV)HLI*9#(LqVUcFV1^aS4FtfM6
zKNW#URV;8Wq^tD$L0sf4TSEt$D74_X%V`Zrdy$G1G}AL@&Pd`$2%_6<=^&XhRCK2N
z5LCW}O&Z&o#O6xjhbW+mqXt#N5{PauL6MaNOT9JKFMmKIe=9JfEUX30+9X_P!J{0!
z!I+~?OF%CX%nx9xs&_lYact*~9gut`vIc033*&5yZ)!a#G`Hv~+CXH!e%-XtyNujb
zCbH7Yz`05Mt2F|pu>j-1#DO%ihSk7V(0JZI*vS`rIqh*s$UV$~jRpr*8<4OZ5z<4p
zBNtard@fJ?q%Ge*&bP2hw&Q+C)@H)e#zq!uL&ef@>mNFBsK^){>Lw4r#uuvRWC+}P
zuvT=2J47K%fMOr8)~guB+-n_nt_oU8X_|xR3Wy%2T!0XJdFo*Sn$kYDJ;$xqqTb5Y
zMW5_}9P^9rAOh@w+KWD=1WT(h87l%-tXS8sZvV5h!C7Cyaa1ksi>PoNQ3iQO<aIB@
zm0>KC`n7B9M~>`hXlP&%Hs3=|$6=alMDv;0Os;9`X4HsEa4!t6Y%W^*Sx9)`!0W)l
zMI0e`&xQ#=u_wpO)OjY^j~?BLr&Iwij#Kz?u<eoDc+5^%LPF!<;!<$iGvYj}hpNAE
z(<aWzRa69^Tab@|2kF-Zvsq|-&cf8fUO~o)|8*3rnQ%70c)VIQHb3IYUiMv%a#K;<
z>3Bjtn3?Ros9UW~!+Cf?j<O&6z3s=7Kk3h$D*j!2q77S$Oy_52W~xf;fFwuCcq;Jn
z9h{sVgh|IqqQ-nITB^bZFLST^#%m0dB_!9sF%U572YFY4)V5B}&hL>q$AJlcA=h!v
zEWUSqoR$!=8G4l1g-WT|)zQ{A<RbM{!hJ8i*g!K%4~&+aX&L<SgQ`G-zmm+Eu<qRr
ze)N4}B7jpd)We%Y`$<5@9Q<|6Ns0bh7-SJV2(=m&qNN}xgF|MC3-t}TwLsTb$b*3K
z4rQnJFHKFmo<2>5KxV}&(1hNfQk8<4uk>^r#be6clPv=F9KTJvIIOG`6Ggwz-5aH)
zp}7lh3u8I~m<zb|TnN*i&~Ym9q)B}M_=%V=m6JEtMn3DH+A{Z7`}PC{&b+Mrd<GCV
zSCb{_Zc$7*`9p^pZH9m0yRtN=_>37cFM1%tO;-zMH61$=Gsp^v*(K3#W^^_%po4Ss
zhZ6ZAG(|wV1RTDN4<IMk$xtf}2FX#$iCmC`z^IPceTDD>|9LL}rcmiNyu-GF!$i4u
z-8yp66d3evl44kS#&NJWASj^>>qa#e0=b*y<^<iOVayT$wvha>IN2<R>s*vKX;DE8
zK{YsyI!&rhs7rm&CwZ)y5q|JQCIGWa0f~tm;Gw!0!Vs-iIn|=_1fqNbFh26wxARYF
z@rU)nba@+p>ftY>)_b8plcX1M<L~3+ek5eE!|<#Q=x*B^TfV@cAVJ-CYc=vMrS_+i
z{tb?%7mgpkpa*jw!5p9ALm0KbWIpY`#|Kr67PL*o;nzMytbO3tP1fA}v%Ek$ALQ}q
zdABYRdQM}aJOV(y^hJJtv<UA$3Jy-R?kH`EmAa#YZinZn4|7KZUO4XVesFNG5R0dd
zQ8%7i53IMh0JD!CKlTJx&<BkHL6*W4&`Yi2jckp^X>l{ARlOJlx&<wngOf836j^y(
zh-!ARvTVvloFW#xC`C1Cqxk%HN?4sF@!9#Z6|YGkJ-!kEKTNSdWD$pxMVga1`yA&w
zLM!U$DG2yK&`?AmmSPItk2F4T7SG7bOUcUK&F>t5&e1y+`D*rFZpjo!OSj8!S_D}$
zo#)KSF%=XFh%QyoF8t7cx6)x%(J}Aey}OoNCe&{7xH;Hda-7w?N;6I^qu+F5qUa75
zyBC4aN-#q*IfYpU4Xf(FI5XkImtnOvR;}ZptEt${7x7{P06~PvPNS_KK|H$HemhTy
z0>+k@l9G}d7Jd(sb5tZY1jHnbxR0MdCkd1;2LdDU9655a^VTf(!ALP}k%6nMEC3D0
zwM~9$=BdMpMQJ|qv96B3X>ajps5duQ0eV<9g7KurySUhhro>_IfJnoz*?ZI~o_+f~
z;8ntl_kr0U3n0l(#IJb0OehLaE3g{a_>bV5ntv+V+Xw?B7cqJaeU1|@CWu7>8Et(v
z_LyA`=_YT;!&k3eYr=yahJF#+X?qQ9h_okR7LjW9#Dp@8hj>ipgCJ+5@F6yfpp_z&
z>U{+o=U|mLW4uSybupVe2;*94MeG1<<a0u%6r;Pb=m`&m+*enGVekd2r$58jhPDfk
z#1X7D5K70@D_73r1~>y!83E>DTaIeZ-f~4)R0cI@^VhbvM_^YdI86gJVaE7H@`C|H
z$kh&MzbvyTE-Ly2fCHsI3Yp&__thm9KNg8-2u1TRJLvmgc7zF1h3-nAS#U8yDl6*m
zG=t5LlZy^JWk!LTc_?Dh+s-_rrlQ(L0GqVx&)sL8WJh8cz)K0*223z^Hns-=0sCQq
z<Hjz6SisfVyL0DG^nmdXSfpoXBe{OQIf>n6@N{v+xl=PwR+gNGJAUFskZNio&S!hE
zv#@4~O9XkL;Cj<|)Q#ADGAM)bC<Q^Kr4l?lHez@?nH=rbD`0iK`9U+!Yx+)HR%(8J
zIEu!Hw{JbkC9kUsfYNdfb-x)GYnAh@{>}U(uQJc~!|!2;jfxra@$x>vFQ#T@{z_`!
zHEx}e?X%Z;!7^U$IN~>B1Jgy@Pi_|%oHD^D-G>SUi|`i^$$KO~;7XF=#YvFbx3CaS
z_#nIDe0Eu4_U8%S2cs)2^UjZR#~M#bO1{0l-dk4o?Y68tl3V@a+Y}E7x*f<e)$?hP
z-EQj3S$=z62sf`?7CSF@Ja=qLTV{gCzNdq8_e-A&^xft+p&9xuYFOv_wa|K^GooN=
z>{F-n@%p85BNG!Oq1HgAyo-kcl6U^~jkCVYCw6V;Qu@A84>=l<di{_HlwR;kaUZi`
zOe8qX{rr3)guF^>6ODCb)JA{LKj|C6&HoNPQUCjL70Q2Jt}^Sh&Ix<;jx3vFpD6&>
z#M3$q?d*Gerb|S^*ccKsjgRbY2$G@4kI$f2sU#`vJj1b#tZ+iDg;`mGV8)ry6}B8(
z<y^9WpAx6a92pb&po_}QcU<`J;Xdor>u@CI0kms0OHmD0_AT(0Y{AIqa!iXew4HjS
zy0-)l;<WK~PO9w<F>wfiNF{kTeY&mr?b{v+0c~@0eu%4=M&xtxW&$Hj!2FiI3_Xl4
z-ZPX%!p#>E-06`on>K9N5Ps6xE@_qR^QTXD<KkFR-*t3!${w%lJC?a-_)A*YAwxd>
zvF)3uG0;zGJM-XLKj4=hPJa@W6Vg5q6FA{{{OVeOhc2b4IGSJv!kivFf~WBlp8vsJ
z2d;QPVCYE*9qitU3?<si#!F;~n)v=z=}M9@<!bt|=g?os4`LyFi|;7^WGse-hNp!d
zMuB9`JzNzHE$!qNHEj}JNxuR1iA5~-(2*l|@oF06>>&FGx3nS{fxuqK)a>NsTSQvO
z#@#Rlk+Tm;^ItPFmli((AJH)|tlz$UyOFUmDK?Y&7w*r{^GVVL?;Z?wQ&<8VwR>ju
zU%s3Irbl{a4OS9uKa?-PzTw5y!)W~9frsC{0`!ar=|*R)Z)lKuxa*)Ll(L3Fg_dGO
zi@}_c@#0h|xO4k9c7-Kgf6-uwN8*P-s&^<%skhbD8`|634+#lLLsko(CEs3xO@U`m
z6lnO9IcTs3N`g!+;IgR+1}3I=@82ghk0S))WBCxwO&5QA8xH`x9KGw1VeK9=48$LX
zfhbBc{O$V3%+?yA7d%PK{k+FpQ&dxTATLXJ;Gw>S;|_*T4w6E5xC7-5CpBNgk&uJ{
z1Ho-m>ct17o{rbCgiI+MP7^WHxoXzjQCkPKN0RNa4(eypAIq1ZtR9UP-%5;&AI$c_
zYLQ+{N#Vv9CUrQXuwbI6VRxSL7wa2{HyB}>1G%R}RUV+dyP&S#jsNC~;Lp)wI6W>Q
zfgGCO$IYG6*-iVL?9~B#PwJSPZ#FYCgCebukp>tk+o&l`OhjB4k3jBPlX`I@%u-UC
zht@q{Zqd!Pe?K))vkZ<TYls4bXfOCmz3AQ(7blP%^8^gc&dF&&DJC-l+k9ks>fo@K
zA+PY{$rDVkmSc7zxP^Z2-pvp^$X$X=BbHWGT`eggIeEX5TUthj_DdgYN=izeLx+B8
z$8@@2c4w^zDJCJBJsc7l$(KmGX%jm^mV4xtwvv+?c&4zg&*N1ive#Q%TAm@Qb{;Gc
zGZhhF{OgH>+9euigt3An4GC4dYv{LalO~1$7YvMy&R_~PZD<AEE)ZF6Y=r>gJd|WQ
zIt*z0!d^>-v}^<L1R;|N;5MMSxp@d-8hUXF00;EyBz#O0BBVo5`tV{GNJ7|k)A)@h
z&?aNd)hl$wn(VcBK1WVVcTWKL0T8Od)}f<=7yQ`Ei^|d2xe1tr%px_zp>3?MCxuJz
z5iQ;javYE6`0)t%$SKe);;mLO^s&|h81$6mEMDn>E_HBO0<TP1BZ<@U49>c!;}i!5
zS{`8?pzm#`Q$Ys*QmX1bz+h$6B7jF(+%TU!$F_F7USZ(JkH)Cu)^}a!@#U&{bGVGZ
z7C#v#3XX|Uh8Vq{Xogg<h#5NW6DK0gJM*OwvzW$ZY>K&*WF9T%C{2);b_8K_gomDC
z0EX<qwzjq-^>LJ7NzsryQ^7jOv2{GIgKB#r$dS+hW)AEIDe#CRSQxDDHs(l{#=_{i
zjVNu;5CYwJRKDOMZ&H1IeZa8-$5R%RH6{sNc5b`q=`VoCrGO2_&wML&k0DnCFM^`W
zE$z?xlRE>r97cF^-HkbJ&4nqg3)y?w*szD62whi*=y*1A+#30pz%v}p821x(|07mW
zRn_!&Mra*1^`=qNwoF#2{SDBXhCn+=F9Ew9<n}1uO5!wOSBOyqv~x8!HeP;yE=<o^
z+1Mn)Z)pJfHiqS4aPy`ThKuN!wVj-tNb3L(G6BQcPheG1#3BI~l2&}lg{88pD(q?{
zbUH5^TU$WRV8C?+yo;zA3f*&@c|ewsv@W%Db;Kd?wij~MQ1B9vUw({ZpYjcp5nKRu
zn8kSpy0?**mJ>C1YG!6<BgDN&Z{CPPk$g;=Hph;I;<W+Q5JHCY7Z?UnIkz*ve=Y>R
z-z$m_2;r^g8@+`7opjn9@bfy=dN?DAFJJPD*86zlH9RkxKcq_E(vg7BTe32H4VPB(
zOUuno{8GAl2zbx49YZVVpldyV`jV$BpqE}^EkpI$K@khBYm+hPtGuS>Qw$pNFTUvQ
zzj*V`bH}38E(}wp#>PrIBt3i92pA*J_L!Wgx;srO{K&6;tgYP@3XSFwvV`@I!Y<8i
zqUS$g9~*|XprWE8-@&C21fOY}4=IDf4?ve(D>*-<f-FrUX&Fwr<0TytGjZ#u!MS+U
zwEzR3t0Z{UOVZIHun-2k`SFtQgBf%M_3S@nxCJjh8bafH_X_0bF)YZGNfpij9RIBZ
zdU6o=78uc+r+KAf)l@pl8r!)q)zzUt1%-z0x^7_L-F}Dn()06(5UR!|k2o<iGaI9G
zyj#LMpAtce$n&jPV0CJqZoLOA?wZbHm+B%=F@iuue!W*imw1fngnb*Q(F?dX)&fj#
zAkwu<{}gwO2YPBDkip5x>C?XXRO}^ab4h)ssPpkQK<iuE1uu<ihDc7p`Lh{sKicpL
zdcrnBx8V8APZ(d26XK7cjdKvvg|`siS|bTVFOpjmleH9hmzoIlcnLQ#7*h>6YqC{Y
zsj0?ExWzB&9SB&FZtd`;_M(^g$XzQIIyxRm_YsmPicoKQkkD0V0#%;l@53P>U-JcC
zhLqmVZx1n=tLnT;Dv0IfYvGH<51^b@L85vb9?q@)^T!Xa<@7eMz#5{gyL+{GirX(Y
z_t+7Dj4+UkA9%47nxrnsaeNWf>2-LLx)IpPNQ971vvA8wp_qFRCaMu3#9XLPXe$y_
zki(>-wcQpt@%YHMe=S4E7jd3FfH!H>W2V-AL>>w-$6|MV{Z>?C`jZ?MMn>LnSi{oH
zcXWRHc51Z>iYAQHLl`1SCt;w%(xRCoxB0qNj1L2#88|17EPTzg&<6O@#R-&t0ziUd
zzd1##c=1Hc9QdV(-53J_R=6ACLQh~NG6X7CYYA<XL=?!Vpvq%FfL;qHYe3Wx&cj25
zuK7-0=s<9Qv<OfR-w9RdGjPt)61uA{-geh+oq*y>4|aSKn4c77q5kTk3`uKcNKh^=
z3Sw;VHXNXkQO%vAqN3zHF#H7=z7zmfz6^rW7pb4OIJ>wMsWL%Z9~v2X(0-awxUMGl
z>cT76Bf`S>(aIm4zHnhX1hUlT@zY5oz75&N7eZKMLlu$~YIewYf;z7ure|hCnBL8O
z$-kwKETSG7KA981-lc}S#=ywPlSHNivAS`9`sy!-c8~)<$a+EH39638<g-)B>B)QA
zs$foC#{*uW&73wWik5KqC#RKgy2|krS=&e`7uY3y1D6oh0BVJ=7kqUt!{R<KiU$P&
z6kdt3qEizCgM*tq$ru{l_U(6&#R7_1kCx{Js80$lc)elhQqOE_UdD^-5Bko2dBc;2
ziBSg?la=7k)`@GYolW5#WpgJtYgr^*JSj0gHio461GMu5Qh0|fN4_HuO=?bbq8PDb
zgrs`_w#dwYrzZtWf$u#%p173W!ikdi@M9YA78ATXYaJ?fJWCX;ezXkUFPG5NwMtyB
znw&rqU@aT0!qBaqA-NU`KV!Bum{XQv*tj0!QJA;Z11%;4Jk4LeOhVCML!Kn~GTfK!
zRbqYJjT?rBX&Mt2GP02H<)o$8pwLpmbOyyB$IkKo9gj!nLYxG+xh2ibU#dQ7ZQ}W;
z)$%$Vp2v<UmyS0g^=TYCs55%$Bi~_hBt9&ni3h;@g;c;u#&e)R#;7(iVspNGw+31}
z?~E%SUz+eAHeN>|?%*+o$r49ygj~E!G@dEPkdxoB&{W<DNcza4lThN-JXB-`VwgJe
zji`ap)l}P6r-B-%`JDbcuOECLOpbB89TU^NyL1SimM5$tT_mIPZAW*Jx-woyBFz;<
zz71e?Wb&EGw<2S03Ag1d#*WpZ7mfx5R+Zo#E7TIRjCr0DR&KMHks*%&d<k-#G4A(=
zr5AblK+pm5$YG+o2bLA60|Z}PJWog@Wl)ChZPr1;r3|ZgZ-(2g^SM<mcY7}CI#0;{
zg9m9%OibeWl%6+#TgvSyOY>hxYIBhK0NwT<a4%-}VhiUxa9~HyDM;#Io}L=~0<C{s
zg3w~|mL)yp65~&3W&}v3DHNL;8A$?E42!s(d>TInIiK(7zDqVHK{W%Iqo3W~dWq3B
z^sqkOb0c;3EG?3<@dIFnECwqmx2G>(-o>RHO@oJ-R8z4LTlziT#T1v8wh7Ww4_eAv
zeSLjaZeBmclj~o<ObpDE=n@WiMPhImudoebEw8IQRs-Y(ra$F~TOgy=kIryhZ&?|o
zebO6tt9pBWO3In+VyIj7t*uoMc4QauCNT;EaF(KIWJbek1%)&GsOc`$4b0tXjtGow
zIUDlEv1!r?f_+2!chuND5^hDEj*$N-%S!FW4x3ZfIJ>Qp#Dk$AoM*@0qK1L$UHS3r
z!1I@Cs3lNa-{SG(E?Jkk%^Kp@k#ZlR??n!iYfvTMg|K7Pp(iQ-P4dX`zMnt+(Pwn8
zaNL865R2Ig1+|*47OlUvk2B367D6pM;*)Zz>3nz}0Je>64G!qv*F&0`hMBsD<|)A|
z0<G~&p}m~bH9kHb(ulT$SvR?hF=c6jI*Oqk;1x_vOww18o0tSsg}uEo=5uv5=?Fl@
zxIzvZK{p6n1O{{|a61Uajuo0YDRjCl2w}Hsn$WKz%D&O>(Q}A24G5Wn<Ru^^a9t~%
z@rcn@@`p)^^mt5r@+`V5L5S-S6Gnn(+|QAGix9TK{Afn$Rwkwg7_QVoNJW97X{lf3
z$8{ZBTT;3OPW@lRy$Mv0`@8>rH=r^`nJJl)c^*qrhKNQPOYD$s%#?_tNST#c6OlqP
zMHE6PTeEo+cA}7>43&CbS9|}?InQtXf9pJJJ<nRtS!bQ)Z25M7@B4FK!~1%_-&aJ8
zi`~(&LWS$GD9;p)L>q|pLfV4>#SQMLz6j=0L_&QnE!*gF;rC3N)@tpq(k2WfcZ7s&
z#VN@@B_TT_;~LZ(Z8R;E@1g*KHguEsbo#=D-PO%*Z`0ct8mc$p#6%y;MT3C@n+e8;
z8hjn0JWw@_t{jV_ckA^oN9R~g5|kR1Y@KGk)Ul@%G`>ND21s&?+zT=>YJg8SU08k)
zP{0{_z+;YdsoRwIHM{2Sf(nG+4l&7auE*@|GK|25tfOk!gCeNV-08L^CQce9G^k*I
zJs`97!O-yC;yn+Kd)^<ruU8Gk(boW5#9>oZ%`*O@CJq3?36A+_Vt@Ih#v<;>M(Vpf
zv|?{DMiMJKqy^&R!GuKL0Bk~rgJkL9mX=yr0|)Ni+Z31Gi_c0cFX$;7Hf)#(+mLR~
zk2z}F9zCo*TKB{-q`T7<>r2mTF>GhD>4F8t#ij2W3ZDuZ&$x5W)22;($rm7=%mgox
zo_XogK3I!okTG8dOv8OuQ2>U_`LAGq+^kRIwl#Jz3^j|LqKMg*&9<{#M&!q;_VL}j
zcHJVD5eW$iM-Cqz&Tu7+F-Zeu@|oW@ZNCp(i0nEwae;I3&!cbu7;bKvxL}h%ooy6e
zBGOiHng!V|dr?){vCyX<@zpj>FqrVwP`ag?;VCv$38VE50!eA+<VriQ?hSUN-vx$$
zQ%okdkL}R*xV<Gq_;ZXmX<!;>4e=@qVu;Z#hvWL8Q?FjO$KzjcW23lDM^2u!64X-+
z(xiI?4UKR=G4;|;3RY8^`6I`Ujg%^vkfv1(l$>3BwQ3xn-EP-i)GAc6yXFi<@VX0!
z1-IXSw?kR~{87>Jm&tw+`9jYsC^(i=`*Z2nck`DWo>;}$F!&3-RbL``V4uEy8MB6n
zRT(+6ap?v7^OdhLVk7!9A3)YPqR(%48UUiSP?6lUIQFUKqoQwD2~l$o+YcP7D>F7#
z(|YylMJ}i+N^I>gX(0zfMIT#}%rBs}4Xf2QmZh<U1JAClS_5spBX<Q~N#G#{H`5}P
z^_}-<JA(}iYN5`-^QJsM|7W+yp#5(lh_yv0u+uU!hsQsN@yDN+mTV*p-@SItduz*q
zW^muaxP4hfLKJg;=gyt;b(w9swL_R?VoX-iHxBq;d3n$uCJWGyS;#;dy&b?FIQr~|
z!kt>`1c3=|XIm<{tel)95WBJ{H=}qBatJnU(lL;sz-)=<&3Y>5JCL`)C5-C09X`!O
z1mn*3b?erRo^-ZD*NLaS8IX<QUJbdDdV9{NeG{3!8k23$bulnlr)1E<bk4nCn38Bz
ze7as}AW^~&p-5InEoiMLKe-l|7XNCoI%Q)1ts60?S1?u_N-lHZjEJ-a__qfFj{$=R
zcdmOm*{Hk4o+?NfFL4l)$iw(dyIHeMlu1i!0Q7b)U)=fBy3`_0M+#x8C#;Aeo+TRK
z^=7eYsXg>M*jcTwSyv`QKygz%Os{bC9$j4AmhY9Si{;^FwZ!p|-f#2i7GIxGQ|;be
zHF?{^@jjfbjKSOa4R*RO5^%arY5LmqA0zIte~h>@s#Tr;32Odd5a<-2zg@ro^{M{=
z)BpaT7yt9iQiuJTIcowiG@SZFzaNTAKN)W0SYY|1s+6DrnxUMklX9_cMTu%6+5R;n
zk}J2HmEWV#TGU=aN??k%z)^kXvzlx6`#ABgcr5IlVlsthbgJg&xNQNU|9Fc3fAS6A
zzxZr(%=Gf&*EJzvrJcY3Xtp^SoI>PvKwiJ?Jr}4AEj5kh$c-8^=5-=}I}7tLJTA)K
z7hR{H!O$>YZCzaYJ%*?+KYaN0u9hc^K^pj)v~9Om@y*SNlsgU``a}0~)zfR_TXB%;
zygn}7m-dJP`DbW;m5rLQ!8+s`{oOZvjR3Or_wT&!scDMI7%H?Xw-$E}^{mz*o8+4A
zit(0l!RG(v_A_(%=Lr0#pC4~QA-oZ?FKudAc(@7xtY>MVNT)pLkRxAc!`s<lZlIk=
zjw*a`GEj~*CJj}d&3NNv+CUEYy6-xdvN-JfViDYeS4ct4TQ2>9OrC-3L{&~`3M7lR
z`NdFC&~2Ww<t00jWAX#T88`E@6A5;F@Md!MSM72iSog^Uk<Q{wU(2&980<hrA)>Dn
z|0$F^^dc5><`^paaN$XUI$2EXlWdEFz@A?6X&xnSwIyGYxDGSZXB1<KJ%rwQy*r#X
zin8mva^Y%;RXbmC6`M5MHQaQ%g7PGVg9wSG24++uglo7-9gtA*7I<9V&@!Td=r&~(
zKqtgBZ7Zof@Jj;2;6W=s*10sb9%Za(JqaL97987s#j2&QZu_a)gh(N_aXB3)JKvph
z23dUm^X1@WVh9XYR_p77iDm!d0tg5{rDP3MHo4O@{%_yCdx<w^GKG=v_u<2bx7jg@
zC+0(}59fmD0Jxr;+>{-=c708$*d!7x-@w4yf1}?3zS6*nA&7F?J>L?voRL*P;W6$D
z--$wbZ@>A?m9RCx%J{Qr!{W$>R5mCPuS2}2pcdy@>P7%_HFRgxBNp}{@wq?g0Da50
zB2b_L5el}KmluNPJisr-8yx96$_AQ!2ua@N1_G^Lv=EngpXaw9kS*GTi4}_&w=ktp
zQD`b@ld%+rXvLi0H(j(eQuQcel6D<_{ub(n5=6tCGU4NMaOrte6q<K2tAaYDX(0bm
zbdmsxBPJr7?x5rmVn1PRBIRh3*Q$!*wN=BZ#83q;#%aBN!Y_C><kXtg_Gj={6sJEU
zK0b`qL+j8J<;c=^Sv6>@WL5;StEyx?c+mL5A6R2cmjYpyw|WaGi3>b~h4)qg%s1^f
zuc^54^Pq2V?*Ma~0xZ!eswmV28#pssT3Ws_Cjti9syhYziZD#)u!@!Uxp|KpGHnyu
zS&!-0s_kg7Z(-1LopQecLnH&+OZRn)YIy_98z3fSBxmO2)EZ9NdZxgN0xZM<sHJ!V
z!-*^8kFqlNK+Fr?XGc(%V6FGAsK{=mdd-@)c-W-Ai?r=D|IdWr)XweO`vI!>x*Iux
zKldRSk*;@d?>BJZB#$cI_T(?2YsxmkWyRuRQt}xt7VRv$u1)@Lxu?mqb@N3748>L>
z4Ywt@4lr8`stY|AFM0=cZ%`#aSAaDgJhZrz_Hgyy^xNR;tFaQIhhgGXzWU2w@KHQJ
zzp6pjS2YF3*3Cj3en83K*<pbNpZCWzOc#BZ;&rU1qAx($0g7e~1=KsBT6ETN^>X@&
z$ldwS?#<2RTd10Xf<<m$aMNE~-5Zv0_bzsSi5ZdS&oAw@wSShE*De~&h6rq?o?Wz=
zxV-qead1%udaUFEv>jHQT61%$30-~y=K1@-g_`Jj>~%<RI&ggZZSMq(kGDeJnO}Ku
z>(+YnaqVK)gh|_C&*y2s^?Cx3b!q5qqSNXZ@baT|97|yCEk=ciRM!PG6zZGr{{79V
zWlysgVZgwF60sIey-klIT*wOCyrF}PWS}ZUScRPtHI#$!s}yU}>5uYqHHC1sDBn_E
zY4`}L3MQqms4qNzd}>26swe}XiG%j2D8O=qP;cbDeyz4_S?P*X>uC^PF6`R1t9%?S
zu;NWcrR9pBpo)^&J5Z~A?8Nf`8p@|H`C~BVJDW2^H~xHXZmwTv7ljFMeU~XZj#(o%
zHx--#v`NIg;!wwFS5biZZ6>dPSfC$lsd6RZRy_qUj(4v?S2b@k&7PS1y1WPBN52&|
zAc!>C-T72ayuN3KCRp~qf)vIfgLx``J1v<QdVKjybIq?(M;WcNZG$7>^|}BQz;E_t
zk_(?Nnq8&Ag1SZvHWd~X1+MD_+@G1i%*3}Kdscc#T@ZB{t;X-&q(L)U8TK?ZC`esl
za$?Fk`CRdH$;(7onwqXnd(Wz)<k9$97BSp3TG`(5M>(}><eQ%*@9Y$Bo^X^2S}#>%
zu2S{A;x`$D)5J6oqfZe5!}wM@bm)Ng)^2kAtFMZ$ckDS=#oFG!WZW_*(EpbUZ+-B(
zRYt0bOZV}#=sq1L(zt^Ie5AFaZ{&g+tlKS$TTCFTD!y)uQcEs^<R`5qmHl-_sGw9x
z)^1QvEW&}P%^`3^1%9_0Vb5&QS8##MGDap`sF*onudM?ic0y`)YHH#7++i^0D%mEY
zn9>A>^DniY2sw+gq*INQSPb)aG{_6C^U-qo#7<qUJu52)N^D91NNcccyG>I#Eh04s
zEdi)kQ!=iuUHfuL@#~on2U1yl>lF3Lu>_|lKo9?By=Mt!3;LVx^D(1GYpeFP2(vrm
zc<R*zCr}v%{EFa~BN+V%_Yk;ixW-gPTtKhIbT$E}O@4ti-dZaHj&;qvT-~l10YXqr
z#!r~qs)n|vN-jw@j*6I+JmsQ+Lu>e(!)Q!)?B2bBVT1f`#Tz(a(<$3dsbR6P+kk5_
zbqD+HeEJ!hv4%=c(Xa?JZULv#A<-?nL#C&W<E<ga#(wz{MTuAqTC@lR+*kFEYMWMW
zIQ~$K<>C`~#U*7Yxsb31WULx5+)2zt6$SRPH}wLqnKzL#f>U%6&Kq<AzvqV;1SSVx
zWccTD&0B@FBaIi-5b2XJLoQ#w{HZ0t?d=}GD|j<b@OTpgq5JLg#KFQBE$lsw5vMQk
zzS;2M(qHp7ABLpxHv3q8NHg8kwV_#iLwX@`QJzF*^;_lP5ymfvWV;TYBa)Unj2Okm
z1Q55@r|6C!gF4wM3a4inBa%$|m2;3+L75=~pULt>0-4Fw4l|hAjvAt8c>DHk(B!R*
zt!F|XG`seIcYXD*(uc{tS5PlCF&;xQ-M}@~j<+!$G6dl1&-%-|L`^P;ww<bSFD(u4
zp*>j{eWl>6<*9dF#CI5a@)&{qUs2)_!TbQl2^>BQTj-orJW5R^y@(Yw=Rpm!t&}jF
zP9a7h+@C>fCGN1?4#DC9;9pS&_)tecTi_En!Z2)U>{-oeMV8kt$YODeGi2fc?tf{>
zU&9JGfyD_(z+M<n6HZP2>GX6JSf2bcfMH+sfY9pJbJM58IEYvZ>@<vF5JgTL#xjUS
z)krSM5WO-05+Y0K!E`CvWT_CWxd1^waFATsWeoqO^2h7?LM&j~DRolwe)IehgUvwn
zV);(@&_tc<FE^Hi7hQn^@fLP4H5p0)yIIF{QjFH6&u@MwE2Q`GB}*DT7l~WvKQ08%
z_Pk5&D86KvRBvGP2z@{pg^<LxTGdSZf}*Q->Fd0_YaQ#VDWmYIi~6mj@0U7-PjNgU
zBxWaWAtMpdHge6!58mcaLnpiH=<14K_zsjCP79L^zg}WoLg>PNZm3aiy{%ie+#<<o
z<>lJDyG~0iw-$Lmp(L5f6_2A^>7?rc?<qkWZn<^)`HRa3(K>@iLo2}nZi(NMqdYeE
zTH@ydS~m<gkhIcE052Mj4}T|vQRWiOG?z>V(8ZH>@{cxUkjSS~G|6TXFxSpjVGqyF
z9{;im-A{n(VOBIm(2AH9T%wrM+7@QN!L%4aM7$K3aN5sGfMf%`WQs?(sXa#}M$9}&
zGHu*#s(;n5;<b@$Dg(PGHL&`H#bxJ&qU6dJl9cn^g}jbEkKw}t`~!XK9dN&N<<*K5
z!{VBi2dM09!&B{?04sh(Eh{ZM-6!}u0mo&*g8N+?#aLU8Q#*dKT)E=;-~zoza-Z$+
zeHEkceYR6POU7kvVD95Ycj2!ASkrmQ5%1J4jK9#dNE1SHbsFK;xrHxU)5=|>#}s=(
zUaFaZx)cIB8}8Ub@^7$i2*OVgPnm1Ad>a>__cr*wZh6lktG?BN-X!ihL^~MO^)TFm
zM>Xbc9qWAu2QAZ*k$|EP|IGbTg>!8KP$uD^FukSxJZ2lxp#8?*TuwxIJngd`h+B+w
z6IaF0xpGe$8u;aM{oan*reuj?unKi;@l&GAS|4SX3%gIObQvg{0<&@!QkZZ0_Ux9O
zmF4SHg&D2@=A7mAP*!EkB>{{$a5`zHV<BTL8lm;^H9a{JlqfQJ@mu1~E24M<Th>05
zuhSY%m?RE*X|u4uNaD0rnm;L}YM_df5Zi59g0FVl5qXrgT(>ORVJ6yrNZNb`u-K|e
ztP`rDqHk<Gt*NRJW#XLI-KJjj=0o!U%jK*?A5QxDrUkmt=&9*-=@6ZoW-sF*nav)M
zmwRG72}yW6l12zFlR9PCsehM14?n91*4CJ;O@Dr6WwJ*EjiT1*p5va}wm-8Y`aJ<V
zfJk0h^waQ7lUbX84K7&B(<jDkBJWV19i~@>*`s3|7`eBmZRX=>W@=)6?_G7d?AWPO
zTS*WvK>@@&k=m>Q*7Z<fHL^{C0-8}WEj(273|*bfZ=~xXTe}cTAe7z0(m7aF+W|L)
zaN6AJP7R5;Xk94f#NZ9SE@r=-EuA5(Q<J?0Bcik$hG7fqa{K|W#i)iVT&Y~>d6Ro6
zhK9hH6lu~O%Uo^d%-8WIXDbru{b7Hp(Gkhejcx}^DlHKPQ5q+2o9AFyGc^A6X~SiM
zM$q)pRm{L&48DQ+nl(wMyX(B(Q#~1xdBAF%+fec(eVW?4eD&hJ=}l+qRu}X2W(Rb(
z<9Ey0k3n49I*pw$?RC-Ukms<i0?h!mfy+_)j!(oV`Ea3e<A`BnZ{Kc6Z7+y#GAdT&
z)e=n+N6cv1=2UopD#Ro)*(Y&)rk|gITejGtQd;{imBBdQ3S*j6S*`rYAjn@4xlnQ|
z(ja30J*Du_I{E4hOL%`pTg^~bQnqr9#?05{f=+tvf`S5(UsG~DVt+-Cu*(LqUj!qk
zaoB>aYdWV2V}|fg{+kUx*-GW2a;5p|q%HwAb<q9#{k-SnczCe5!w?Q6{Y&W(b1vFs
zczQKt^G)yPv!g!q;LB6iEoNOE+}PUj^T&KEbd)t^%illpL7fx^(~@$_f@+qchPxAH
zX*AHtXNKp^75kbaGPqBvQHvUtO4JuAIV0A9LVJe*(>@(L9=q44{p}rHA7@(i91*>7
z<Hpk;0`BkRnpeFZ)U29wYUG{n)_fE_g4`W(2H;?Em}-IiOX1RK{^G?wA>R0LFg2g%
zBC&nxb?ZW~{gV>^;$D4U(G`fZDNa9TU}z8kVbFK&{i453ovCYum+|aP`}Q3=sCx9x
z@B&O%t|a81eCxHE-U#&c2AXX4XegiNz7opdXU&@eImQJTqNNde`@khfdj!`1v^Lvx
zO=+&9nYVT0TYa{RBN2qT1{eVmWH7<73i?>;rmvg2A6m4;T9EusiO*M9n%&C1%%EJj
zl+cA5hm7v*2Dt(+qCq@0U&Oh2bdMTZTAsyW%@y9oPF*^mJjSc*701}_ZBfxoqL<JB
zA^tpFk!rX2@*rd5#GJ*$7<>A)*}$9ZTdy$^lg1k?R#p7yDIfreQ)^h8Yw-&Q3K%yb
zTrDwuar03?ON_2%LsG=G;$@7?6{pf3t(l-v{&q;HJEhlv3Bj+v&9=7>I(_0?o8NU-
zA`x%JX2eCymfZp=deO-l{*8-a5Pix_06CG#K@E_O2r;-e(BpQ?NWN9Vr-8SU7Oz-Q
zOM8<O?M97Hb5GB|RXMvF<c%>kx$UO!<EWNs<QX{E%`JFfa{(U}iJKyNlBpM?3=Kye
zOo6vDy>rjK6tTWqJX260g@qt+$qr+0&7WlPoGDrguNRPCo2hjXxiu5`A^3KMoulJz
zYK~0Ua>5p&rb33)V9*2^XTe*-aB4W(cI8U*Q-Y@|`pxG}4hPZV>Lv6MjDGy~O5ojz
z7A2Rg)F$<^R;i3#GQthY`UVgW)A8f$lNiltl4W#BJRR=rtOv4}zs6}1tyNQ#)dLtw
zg7RpKuWFYrV-458ipD19cX2P0dXjQy9Slc+qfG?X;bX?s=8Q!=y}EFwtE(Rs#!MVb
zfv7h2s2K)qBf~b-o`ES3YuBx70p*Lf(6;bIZH8CL)?H(rgIz<nX$`H>eC7%F*PSvd
z(=U(pyU96C;zjkNwJ?LiN=cWT`(TAIa4Pht>(w9cL;HJT?2x+c+8TiPl_x&z&0d4d
z0fFzoUXz3GFnvhfzY4l?_&G=;@L|BjgQBGJ{*q>$Q>=db`$_71G#_=;W5SNO71#g4
zi2p%;{}amp@4)fD@y!1dod4f=ay9x4<l9{a!^ofg>4VHhj;uwkjh0nLuXHF5ZPJF!
zd(;E05g=;!zFCN<0T)@b5~EZ8l1766$FjSXm6g~&fxo3tZ2Y`eW-jB&td<98B#hj`
zR-gs~*)TxV1qzeGr0O(Vog~>1)WO=+{6~!{e)Vb{@o@F&iWjrJs5NLCggr3EYbe8O
zl4<bAYr?k|o9Zise!=t*+}yyukpb(EcH_3=w?*VxG6p#Kgsp9C9X~;VWq~B5reRP}
zCO*et6EHLn2CI-yz$v%y+O?j8nz$l_WT<$Pq`psf<|u#q@p<M6=c}!u`ZY=X4*7@O
z7!9Z|hEJXPY}FodOkql>=Nc;3S=dxXxN_mXY~4tz_%cQY;J7kGm2|vAsn>bxzAs<C
zghfW)I@yE(7%vbK6t1vSr|NAok0^11_M)w)SHD)RTJSLB-h&2+zBN+(W2mQvJR#ha
zIhm@|(v7iwt}<!YP!nYi1B$u;{gA)*Tr%NDz-yyQBA=0{#oqs2B1bj(Z|$+IXEBdb
z3~R7WSh{qn7>%N^G!IGv14a0Ajdz}HWuFm*s4AE?iPQ0@NLxfEbwS(3=NK9~R>#h#
zhNPw;bp}cYifP=H;r%+?XQZpaCy!XdjNc-N4NId9S5TVu<kZajGr_^0QH%%=Z96$L
zVdPv){4o@&H6QIw2g5`ZQ<F^${PO_p&6*n|!<%%OJ-Zg*AXKbyvWJ9fC5%7(fZwzD
z^D7I^A`{@lIrHn0am@{`bDsrg!5j#ZrLGvA<2S&FzCP-C`3%}~5%f9!Iq%6iO|G6A
zW8LAyZK<*RzSI1vAuc73i|Z0WQnsfsp__avL2;UvxOCAX!C_%m0`NuHrVp&vcX(N&
z+PTiKU0D6nVp3hX)@(*+uP9Q)q=yb|l4J-maS9`|R<y*TCu8zb8-AJet%`4F7l9uL
zT6F$?+~M5`CJMQ1!{y86Q_`Fuj4?454J7|I;yX_}lb%qgNt3|cY+P(kP3cE#DDV@d
zdKfezwgBo(b78J(j;#g$p5m{juC6YIlYs0p+2oa3%$8iRkQvZ!S$JG`i+jF}6M|!X
z0~qqP(?oo@8rL6`_``@$676svUHvnE53s-Tsc`OZ+%_}~>wq5g@z|u|v&^610Dy2B
zhfvvc$b4nuxjEWWppu6*+=Q4ReF4$Zf7`a(#0p~GRzA25d?lD8=6s-R9f7qt6W}NE
zO{C#ds-2!tD2A-9Y{|=io5&u3Xe5F<NLnyyWpV114lqBu#jUu3i(i?K4H+`&htC-i
zP-E&WxCmD-RSm19@~Czq%4{RM$*JbeK;<B2$d8h|1`90?pXLSao6S7YD?2;8t)lKt
zH+@_Xe(3qu`6Z0aWlmo_gY5AetIY(x-NFcF4&w$LNP?CU)l~5obxA(Mxv`x(^`PN2
zP(hV2&<i$jka#o|*0q(LEV9cb%O2;Enw!g%oNw0TdEk~U?UkjJOZx{bHo$8{s~EZ@
zC`vA5^eGc3SX-L{<BMgd%Ouo7qr2^)#@>B;9v!*5H?tN4qcKEcO@$H+dC5a#c+5%$
zNKur~k6mZawqtdvXuqa*JC>7UZ(xv`me!Uif$f|2$&T>u2_lef8P76z7_JZ;tRj|D
zC`Y)<K24UL1f{z2ota-77(@`WagsndXzm8pU&DJ*7dn;g{7@9ji${G0VaD!zuk|th
zeGbrC|BnSwZ&Xd0UFqx=8i7(RUvL9J7)EDq==i7MgP}{_jI~JsrLv<Hut>w_&|ERp
z*AJVztS9zWppl}j({v+tVxniibY4>6_koNmP+N7KH{Jq$2GsI%&qA}=jW?)&vzeh6
zRu~t%_G*SK;?lFw-v31cKl)JCnk;7X5hN;E!Y4Wn8tpBh4^VaW;6}NwnecbHA=cl5
z(nC;K{rOfCMYzF{G3%<N1sCD3uvv4jaLMS@hIN|H{iSYhUw9;(SS}1Ot-}%xVY+;}
z`l|7<0|yQm9=dw9YH)$gek9nY;LaXQMey*bLoySdAFCwlDdGx%PYUKr=Ap541&kN`
zuIS{m6;U_xcbdgZMS~a-DM4SDE*dKuD~(Q_<A`W+Yj09Pavw4QDr^o#r{29g`o~j1
zXoWY*&~hdti>b{foL`VSsNd_?uY<oWVRKN}v15)O6L=Lj;$z3tGk4s4ppRSf)eUSV
zTlnXiBgxUnuM^&>`(;s$<UrBB!LYf83@WYS8D^FKr0xj%02%A^nqhb|Y3}4(O-eRC
zK;H42tE(`HS)6*4(k=s}GIFW8FU_e;Mv;z0I5G$2lQ(dPdZm?%E@KahuMda58va4o
z2K}||6`(vdL`;&rZr!pNwI?K`o+8WdY@G-+4L#d-UU0jpsOakVO6$KKqmr>%10P(`
z|BI1Wpty@+b<9Z?Uq7fT*oKvjD<`;3iF6HU{VMu_mD@7hpS?jjBFk*->_ozuHmwP<
z+j3d`E1r!}@lDKk=;ZmQ$;vOR|AZAjx!bP0GI13aCSH_N_k}uNUfz`|X#*Sr&9qd{
z`^7J2%$=(RJ}Tt`6G))Nw~x;rvmNwroYKKoiSPeBdeLkT&ZdRoC!%iD-%(3puyL5_
zYH}5<vg?pxgeun(Uq}ysXKnuqRv%VRBer2Q@{I*4F!H}Gx$E9J)oK6ER<(6jeta4~
zo~8xy)x;l9d2S3D^$l*Oq|Cq_27F9*saKW8Op>py<7n$VbnB*3OM@rpCNN~SY&A#8
zqtJe4$=+OM@*zB=M~@y|11A7euyihw9U+99MKPaBV>$%HG>@&dDWKM?F-KQ5a>!1+
z3wk83%*?WxDv#7z6hs}=8-e0=>Ip~=D>C~6PJl@*e6Q(7CeO=#w7&hq8?5~Mx<22g
zIZ>z!>)xpo@x-a{VG63M$VeKrA5>1$)lRJGJu{xb&s2mPd2C#(Hh*w;%tL#^;?i1x
zP^V3yVK%=~xkiB|O@PZv2B=K1I<~A$*ziLkM4YB*$)l#^HL2E^ulRVd!CNnXFX!eC
zMMt~PZr=c+G*6Rya_K9>@zdagqOnzFz?r-l>}@?Q=vV7*G<%yIeoToM_?b0-GNdJe
zf&0`2Be_XR`wWVE80tI)@eNGNeN9cZ^>L`uW&&*f^-ad@g7^R80{p=Ostr6WK@7ww
ziyWzLY-|it*va_VchBjc%gU6nY8GbQ&VdXFDAve7lUaoBC+=$WJ1}JRAty=_29mu-
zk4*|#HM2E*J8#(HVjBQjF0y-S63gqEa58sGizkEw4CZ~G--BtlmtDEMfC7cEH$#^K
zKu7~TfW;L*7Kc9r3Kd%)nHK@@%f2`f1m+8LFN9b4FT+6%7<l#oQMAc;Usx!oe{*Z&
z<~%$L*l3LM#Wj%#pyha+5<rC>mqPtDZI`qetR+x^$tCM-9#yfh4+22L3-5;85ULt7
zfRb(vBoa2_b#89Ym0y0#3?A%IWVUz+biW2vL;Sp%sp++=-wf5Lr?(wBQ<8vEYAADH
zkxs$u38Wsqd;k7cu^|=LsK{UVw2v|hw&js`Vn!}HFWDZkZ|n$;Xdl>K#LjR=^LRwH
zrK1mj_@SDzx5f*FJdgda4<Amt$4>Es%ew<CQ`q`xPQ}Z{n2TW>ev$fo5TycsByPe0
zY#o6<vCH{7XeQdwbWoDDgPpe@4iV$Gt%^pzW8ZCOJpZKZJD>BNZg~u9D%roqQnQA;
zWB-pF!~heJ;xSBv;CXjN;B-XPRh4B$-ECr@qAQRgzR2|98p*yVCK`8hbAt(_ZBKMY
z*G9q`DN1>6x@-WW*5u*s+}@#W+x1LwhH;SE$;Yybi#jrsT<6yZc%&`6YS>l80RC<N
zZwZNuUamX+o}s$BH|V^fCA*b|1A#T_x@ro!T#vwAHg(uAl`YMBZ;%bD+zwKs1uC5*
zs4}f#lBPN|F*nEQs13nbRDb{^S$Mn8LH<HqyP3G4vuW&8+^n1Tn6Bg=x7)~fA(HL@
z$pFRO!~p#Iv=*KB5(IX}#Vx*M(nwT}7_C(%esw&TO9%JM@j@~0zq<GC?#`7dODS7C
zi$ls~eNYoGy+yH8ay|c?u-|ms@os!;zN&c|$8!WdoIU;E@e7e>LLTW2cX0{N+IA3?
zA7jo4xDv<BYFM;<o9Mh=kGoI$5@IBTfZn%m-V~0Z8?gXqJK1AjqIQzgQQW7U{Uno;
zGLs8c5hepNUYo{7sCyQ!w)&dAGc>e5RtBIivbb6z1szM=(s#B(M#h2krDd7<iOJ`+
zgd_tpUZ4GU0&CEZZD5Yblf0o@qIvut;QqslCXWinZHdXtjyQgN6IP^fywtGr6Z6A0
zW$!vl!sZn!&?@tlg_y|8Zo-;ogQG78t_`yc7`GNAhD+;A+5|6ae&>Jaq5oTXOnU_+
zZ$D}UhzqS@O<YJ}ulTSl1t{mJ?VpgUH9@h&&JvjuJ7pz4g@uLX9e%LUNTq<uh&97u
zI!MGl;Q&^VCgtVy(BSFAfqH;h#3O|0*Us{5_|en$ksrr=9LYEYkyB)+E-JalZ0sZ7
z$By4LaP^Nxk!~&a1^jr>RSJ{|@2AB7mueHemYrvx!+(9KAnl`OW7(JS+RB6e{&XLs
zl(*cvqj+urvmE9`??P+IQD~%{No}K{2nQAc$T*@&5dJTPWjY_KfXiN#wW6MKqs<qu
zN188c+2NU8Wihj8-IhUqydOGrJOPv7Wq{7ovUmQKQ<$pJN8V+n90=J+EZf9wf>YYl
zYHyF1hacR2y5P?>bX7-UV#a_oi~Spph({O`SX21=73|ZEUw~$34(CFLW5&#_4dO-O
zllB7$v=+o`;*S*_(lL-DTbjR7!-uaYKpy^ba*9Kd343t}cVg8i*9_i`h`D3tnz5rs
z>5EPk^!!#ziY;3+!Rau%@Ix7F<eE+^Ktwqc7Z=V6Lj4&*fx4YJ>WhT@*?1PTeCy@u
z)7mEgK+RsfE+~22?rd)pk<Ve$siDDqf?Yo2DViddA}jJL`W`qV`ufi7`VA8cFGjqb
zSK^#|yU6D`!l!p+tcX4V-ga?QwclFdu^zMl(V@Ecf)`0v=FwIz$1TH-S^l}_ydH<J
z%ad)<;|@nzK2F=;F#E-eP_@Jr8YR`w-9a^&(JJy^u)m~blZOKfOuf3M71hH?#{DAk
zrd}uI`KRtiZ^hW=r322lgxrglFVCdc7Sfg^vpwCNli?|l1Y)d9MK8`wUYtX*V~lXQ
z?v#F(93D}nyFS|)Q1e>(c$Y~b3Eh7mYP2ED)_PfU3kQTqL3?8h?%LlFaPGuT>#=Ib
zHN?YAWKJ_sm`=Rp9@)eCXVDrASMMF@Umy6}lx8jb*s+bG9$X(@zwh#h=<MdLfs#NE
zhMAfw@By~+`iPK*Q`ac6H%>wHL9sO*S=H1NF7oN$?lzR-S+D|*AawSv;NJd6)hfCd
zt@jrjCJs41>U9<@SOB3dg|prh%2{Md?4Bvz_S7yv;B+AQ%n>BAOpOzlX{CM1@tRcr
zx%8d3!@dzVxo2YbcdVuWn`j0vZhmKHcJtjAy0%Z7MU&3W*wp&j+Hddo%~`&eb~SL;
zaT|448kfC&+!}IteL0bByL72T{dJq}5RUUlEgL<&V5BO-K&+Z!v~rT8i*qc09l~Oe
zk`j|UI=l0aud>+w({rCwXlt8bHywwrtL_dN)B5X>_OAz5n*L=poe{y9o^}7Cz_dKH
zH8x_Ln$(X-lrdTJ-+k5Oqzk<g3kfWIQW&C(M8GD5Q?QQV$EU2^+*^z`vBv1oW(&R#
zf@ea6WQlP?a*ix9vJHcRzF9;B38!dbHdSuhv<Vu54@i*mS!Xw%8Oh*NwaJy%m-?SJ
zTIT#<4Q9^`eo+%_gO{q`x39y*qkBihwc{+fTi)xRf7c}3bRi@#5YUCI*)#Di@#`fR
zBy`r4JvOJ(X-1oYHh~6o{o3RS<D>s%<*{~t>qh~FkSHXKLyMA0nXtf$m)`4fG&*%q
z-6I&`%7C$DMb#r5+zd|@ugxpY^>ck3d~}q9bpzc7qpyYew||ro7M7wl;#$LBP1`oM
z-`t`3l+7uP8@1?Xud`*wj3!&!M@=6#&%5jN8oEa&87BYy^>SfB+QqQIt`P;LL&}GI
z{B!V<*&pw9yS?vH!3KG>tYtBUp#fvaqEy(i#Ge^hH&9_w{I(D;I9W_8QW^qY>aRoc
z)gixaBon?Qn#$s{xD~}tf&lJ)`g2<8?LaE*8+51wfdiAsfR~3zn^!|Y2CK<rL9_f4
zBtpj2+-qI&MU>6mkhI$DU2A7Iac<Ukh7G_|+O2Lw%ZP3@((0H^&Tmg~m8>rUh@ibd
ziXN}Ct=IH1x)Jph=xD!^0rc336L9b0*WT(^w5)o24ISUt)-v2WXmG=Y@E{4xQ;v_Q
zbG*z8AXdB(Uh1-`gyh!!pw`JVoab;@NmqJIQ`NR1_TI_J*v``OaqwtM=#D2}@#r~?
zqWFBgP_4ynsr9n7!wb@^;%pxu^|^QFP8iLuh(t#@I_@DDjzldt_wWMxpS#$n@<!ab
zeS4#nqs*Ep$J+Ml-+%2(orN^qVZamHIl}-3c+S?VQL9$qh@DA+l^&0yo-zd6K`NHN
za*S==)#=J!vfSOYv_M>x{@B}d_}=JVNaN9Xu=98)&OdSuBSvhP^Q-%TWZP_;`28hb
zprg<-rwrIil$N~GP{9y3{Ip5+{Ve-~m_l9K;OH?>?;gU4R3P*fc;tN8xZBA>cag-B
z-1VOme4H>jVUjt{^}*sri^70#uIw=FK6Gf+p_-ogrI$tfk^g1I1>=QwD2P-%+`=A$
zE0?`LoBljCZZ3`<wLD2QpPWip?2bzf$d0+<@;6IeSh8ZTEgEA^ivX>>*1n$mXO(@!
z2B38vuVzB&W*a+?A>s>d+G~&mWK(CK^pds}yvJqUJbb%ru3ELKg4#G@5MzlA+%i;5
zY(wcV<Q~{e=lAQ4R(V=l226gi(&~waF3mGk#Z7Nt&b8_l^83!NLwN&ucWK9TyA~A}
z*Qai^!6m9GePtNjX`U9OkKrFCj<B!@2Mg%YqlY(p7CVNnmd;F3WVA(}sG0r)+s=f0
zzk)}#6J;5Qt?(@YyQ6q5jB{4Ang<1P^1XX?uASX@fGD$>!g&~MZIFA=wB$<$FeLe*
zE)!2HTn?JnS5NCQQ!&{(yTl%j-}cbZ*l$MA{0cD~QBfr3Q6vk?4-+$p^|wS}oF0m>
zXa@WT0h>rWLZmp~j~z3qbuv=3;8N4b%QE7KFI;;VQgv2zY6s7Db-fNA07h$ubF#dx
zct}Z6DYV`~bWbRG8j0Zs=E>EJ50&X)&uf0>H^Hbu)|2oSMXbp<x5W{SJPV#WsP~2q
zHBxY>n3zDkVD!m$R1khhCunNTy{;0u?}ZN4BVSm+b4V&H?3}s$_qh~1O&O_jpm!jV
z=NHzdYlOxf*~9WZAycU5vM`NIBx@{%W(R^R6hk3>z(-KLanW!eS?KEOD!%Z{UM-NR
z@_>#`7&&E13q_W`u=h^O&ZsV&OKL*#l);8Xls<G8nzuXiJ!#UK_WI3#(LLdRK6E&q
z6%(|=^$*Y{;DWi1YwRz17e0*L2HM=VU%v?#8(!e6Fb8U*udgVwJCGNA2K?oSQhw3g
zD>B_;y~A}%5x=lAc!$b5A)wowLO_F-;9SXQzI`{kLvLU7@!3Fe8I;a|o{0Ztm=Y*T
zeaaUlWXsK`Y}1x~2W&)=4OMjo9NE8UN_Ib|BTGLT<vmu*0ML=18R(7HOiK}Gd58*e
zk|vwI0oVg}TTi#62@NPB$<g=<jb9*T)aI50&zKd^6t$sLuE!hK##$|;?$)@oXK!%b
zJqdR3DQcos6;J}+ISfU-*})@RX3kXO<)fg_d%V6l|IloLHk05e4)&#=2kpHcbKrjb
z{Hd8QCyVtOzUEP~pa7I#EHxWw1HvPUKtV9TQKvkNHS%kguD{r{yt_kmXHNnslaz~3
z@E5Z@dCF*)$Gf3fx_^}XGUAc%2nuR9^*UizG^7@ncG-)6zUYk=J2yBObbXi)wliAz
z<lOO33v*3^x~X~73nxuz;mR}jL3{P-%<0qD$Xo(Ii)<t3K^mc8e^=*5l>FFtjsV-V
z$Omr}KIjwnJGU3v3%}(R(r~lChq|&d0m4L5@RHJ>^U8#!LO-Gb0>X4pDAvHw%n7IX
zbr>;QCZiFy(=s7AXAjUmQmAF+7F}hL^v8*(NTZ;WRX1)}gvvX~E0?^zB8zGhl0o?H
zHdl@uQCGI3lZ7g);<0<R{jw<yJiZ-l5f*Yjk<mx&vk@z?Nb!qVK55b<X|@CmNC^0r
z&@A1#efbrm{tlc5{%QNN6D%*f7&(tIIh|28aL6nl?3mQDl>+27t^nCT4o3SIe4kCW
zT;%R<2D?aZc4+7}a@2GXk2#d8RSg*>zcwwl%IuT<Jw}V&dGw7v0B_zuyVPhc1@Wcp
z-gF<6Rc(Sf2Ek7^6h=S(`uJIB`k<;o^BE#s^j{Y)j2{xXDd*pJ%8vcBhCJ*uWz9;*
zOO^#EY-`w&X8g8oORv5D7f*Pmusw#ZHDOE;hYUtUwm2ihkX_la;1G&n=D3Ixyb1fV
z)Il68`AG}MVc^_x{qqkWY&JZ5?2Fh`@PBbr=Ihp}QzvIZ*JxUXw#LS-0DBv`YV^lm
zi*CU$EUJr?hHqbGaYVnRJTYW<;LJQaYF@dQsS(j9_qfWXCKYPUdFOqafylY5f2-3+
z;+ztd$jhmC_wY*xZM7(hzi=T%RzA(1UC?A!`dT~28>d;C`Z806H-`RKCRl=589S$@
zcjK0p&rwSx-@BkqcTK{(`{ZX&-rc^bC3S_PXHH3CbnXz;Pm#?q;A1_O<HwWNRn%%;
zgY3!JN*o;);~ys35?<Uu(45c7{V1R_+5aaDeNry?P=65<o%epX?1>>@vju66q}4v5
z`O(oSORUc3uPu9bj5k;`#(+K|lmWBVia+QxyX{iO8UkyAX9z_N<Te?bc^4{Xng%sR
z$jmqv3fxPrkWAGkM#sRTHeFY(ffh5TN7?~20NO2EZl)A8fI2UTATlIeSf*ou4RuuW
zDGO6J(nJ^-8y{MGi1?eBlp56Ir$sCUM+0qGWLWZWcmp2Dyg9SdZU4KclvO%fej_w@
z3Bj>f?s5{6hAT06!kE1WckVPpzH^iqCN?*@r=}ec`yU`c?LrJjBJRznz-@G4yt8v?
z#jjto#6aB}T+AW7pHq96FX)8)nvF4HUGuJaKe6k7a3Y*b+`%kXR!Q(em;)P#Ib-H>
z5R@SNg3JMqs^!GkP%^>R4BZnHl!1263^_5&mDof@s@e5+0F+TXg5ju<BMbaAcRW4k
zHk_6&Vy3m{<+Q<7OfQdvLi{#kh8Y4|prH|rIgjAo5PqLt>ki^Nn6OTrMtA5qwsKLU
z4!?hCF|llLRnPXlFT};IEWW?3VD_yH-wwSeRWvE`JoNQ9QvJet{i6C`>K4-MwQ-%2
ziI3sUn$fE^3jXloYN(Piw5sC9<1cW?^d^RVPa3Co*Qd1<Yl&BVLV{x5COFZ`+@{rx
zW9~a(@Zi_X(<}%muoZH%PW4DJ8ajS_dVDX-gFU~!j82|rz4GM5I8{!u{ESelIi6Bv
zJi^hqs^|3gZA+c4)CRIw5o((dAnxD4kFWLyM&s4$ZFE<|fJsG^M(ZzLZj4_cyM~V_
zpOCNx!nmaDxot}bqo3L9EyHj+;SES6AOLjVzu%n(P1-6-3=y`ol9H**Op>ujS;_G^
zUi-(!{pdA5WXN@1>gi-I(iSW*ncAaDu!|{2JR;aO?-&r+FlI{@y=$xNx9WR*)77fV
z7T7<CE(d;}tPUkfTiK7y{@M;F0<q|26&#Rs4~Qx@yL|)ZT|QbgLn>bER7DXZJOCJu
zV$s4i*I2UTt7Uxm=y^X8-@H^yn>g_KLpOaui>-+D>w)lz_m4OUNtom%N&ePAo1x(%
z*bwucUDO7#y+JV)2XBGPEsHEaHTOn(dVNZ%TbKn&B(|B{#b8~0e1B@go|uwhT`jI3
zxY0HMlvxi%5WWrEvxi$&JJEj<7jLqDYXc*a83e)PvOfD}*fbKZ2u{vD*h6rTg{sn_
z(ff(oCsXOIh;=@&TpY`ZDj;g$w`WF*_q`Ine_Y?6Qksk3BC$u-VFUF-1ZgTGews<6
zr6Hg@GFKGbpNzVQk~fE)9P{^&vbr!Wds&=To&Zx7o1OAKM#Ns(!+tnx$G-Y=m~=%f
zqnOx1<pW>rufMi~^g#g&ETmx03l7Qr9i=9S)uvRc$l;3bOh-iMbaivn8`f*yM}Rx$
z<6DR=0Z)V)sS*aSHlXm==i7SKBX%?M^qLn{!njr&V;W4srnR-jy$cc<&US%?@ZbFC
z_WuYS>il|k366&2cwmilCtY1*tkNLWAw4&^^?Qf1OGTt`A{FJsagsBAL)-9i_+JUm
zjR>Ugni0id_Dga0!mL*}_+gCW_#c-~y;~{k<5h9?(vI*Xa_Aa69=m(t_k?b1Mr;d3
zGR>a2v12#)7-Qwea@>>er;Srv$tPrXova`>X#D4wlUN@Utz{t}-uA3^X@cJtD@hvt
zaqJgYKoh4~obQgU;-r1^(XGj1>Eu<p4sCJ|<{4EBPr4kNMJiT?j9FDuaiULT`KVo;
z8i$6qNE`xyyO#wTgkN9aSTwm4FKQiNta)Ujs(!ohwUq;a>$R_)J>G%F-1&|DuC+L2
zrraLu=-7mA%3{<g4WWZ~93SHC&zi?g3{xk(9WoHRIwfdQY>7_f{^}QHe>E^=wCOv*
z6f+Jy6=F`-ZZN*aUKrl6K(66q4j3_<90z9m89qo`SmROb%vq0Rg+?(4e+!KBpr<3=
z&7bh+IIlISqjSr%dTY`(L-vb&W|Flu;MSft1{jRV1ndXg28j-6XQq>DHR{x{k8#G4
zB6F3)=?d=FmSg*KZjzxg@EI2CQyF!ExeA^mMB1ps?^Z^PHun6(t=Eg2I+4|MzH-AW
zcir^aiw*b7;Z5(~BOk`|VhF5H$HKmbB<sow)6G<fHK@^&SAoaU!3~=-r95(e)H)wJ
zLH{?uCQOTr8FkuvN2kWle^IIXZ`yPn^`z)nY)((yUGV)gM_o~vAy!`>DNO_eK)RXU
zyZHc(vs!MRAwj2R&zm=Oma$d*v|Y>M0*;?s-;?BCgDw;Y_bZ>5;WaQEMk8KE#knR=
zpF9azV~Et$;mSKVeavTaAL!B^@US$B9USjiR((!F9xdMf`^#dPT+d<4<|o@fZcm%g
zg45mTywIVP2D5J23?!~7_J$vVj@ore8at_cnyu|RnlBaW&~Kmk{t@4!y%yv|X)Avm
z-Ji4cGSz0c=&Q7BqAhuP<lV{{_`5uL@TJi0%!mD_0=?9QL+Le7A|fYl8@wwq^pxe0
z!cwBf30yEd;qqlQWliPJ*?h)J)+xcVw?L?D4V8+x(q`z;tIzsTxK?X7S-DPPe}o^h
zw8ELemzhlp5gg`Nvh*QTOoF<S%SGu;nC<hit<|xKIqjz7OmP#mVaNXc0l?v5aEhx1
zmj?$dR)rp7wrCl~trZAyF1qIj^ss#bY~A$diM#f@_KSt75Q*X9>cf7Ljt|15Fztjy
z%Zs)S_rnndqhUQlDDpu_C<l>-{TgdLbFyyFslF2qrmn4)mG|p?@#=>Yuk>tddZd8L
ztQ}g|xaxDC?et=Ouy1F`*9O;9mX}75bWzHdn%`bP`1{SxZ8ZMWIDx#CZBwsP>e5aK
zC8&%EcG~>IM~?W4tp+nuu}7gOJo@(S99k(^K&4sAAKqa;--a}c0A38n$y4ES%9f=b
zn2?1rH29>sYxe^)Y<Ahi^DWxes#R;}-QUC;Q*bifCQWt`{xO)AQ7Gmzhm;JCv>TEw
zae(QyZ!_}Z+!3{|&Wj#xHS$k-#+_iEG6O^i{^!NT>k;-^jTkZFpS3s5Lp#DY`|IV)
zVf;(}XAW5KIebD?P057W9#1=;>DGE#3}~69_FJ4lZ9(_M$OMRt$COF=nxmQsuc#2T
zKnzEip&VzXUjo%*(*xb6O-GUQ4pU>n4{h}B?c43lec8F10oIiEYbQhp8;XOwfPrAO
z;wRGw8k$j;E-WTyE@(&l@Qwo&@eO=N5JNy2q&M62zS#^-{udWu=uwQn5V;yKdZq0Q
zgVdI}Xo*1tUBWIb0|`@Qf9)F2LQ1dSe*Znqr!~D*+d3sioh#Ej%{=I2(UzNk9X*(A
z-tqA8$OHJ8tJ&i0nKMwgRiMuh1Ef+y3n1ia5i8i(Q8{AZ)epYodg{AIC>&*-xUeJ%
zAhH7Y<S*KOA)1PCpAVOFC`ArJqKiuk>Is_<Otm>T;WkfBVs7oUkL)%fewi8MG0)56
zT*)F!Rto!oA&Nr(2A}l_?TgBft2e_0AV6gY#a-46tZ6E)*)w&&Jg?=6HbE{1T7q~o
z<vkAbrCJYgZ;H9?f8ims_3YE#{|6RA;uYZ$ckG6&43=RC3}9S*&fGIy2y;rdr$~mJ
zd;;E`sM9e0+zik$dT-V&9ub3#ou9ma2ils74-z~P=7=Kv+lyIEj}y;fvcSI=Y(s1f
z>5*ps{F2WSl^aw?iUR5OHen#w-K3gAop@)}(5Az)eYX$<*8{vY`0Kc6G_ggbAu7B2
zc7l;Z%tP2pGNu}_=s1jz>qLg2hKk3x9>2q;VAGT`<iOCLpxzX-O2{AD7g4gjockPY
zl49CbWj0c5MPY}8%BL<ae|;@4Up>Pb!|@l>;BT;^<FBpL-w(C#bn2~2_wgZnY0qHu
zoM&6vN_BXRelOo?`I&XSe8tG_JJQ{p3t}bKRi$HCh;KIV9@Vzc_jzGOEh%2#Z6Da*
zcn?1%yVv)=#>T(=?v5Pj(oP&mOrlK3^Br-U688V8qsHTd14rxbHTEjA51QBurYQiW
zWu&df9m`r1$@C6WW=|SDU}N1D;^9z}n<<<zr~tnDw!z*@=r&wuIpAuXkg`eo@}4P9
zZxXLAi*ZXHfux*{=`aOJg!yJ(d8x2z=dAbm=j^l%f&R+NX?NK`W5}4~mES*3V^2?D
zYW-G&)Cqc-x(Q@yGfE9~B*_SYe4k#3p0DoBcxuyyI7Z+Z)C~>i&fVEGNFLmYtXiJ?
zJA7+NVK;W{SV``%ubNV+-ezp@nHrWG);b~qYym0X4S-c)-T+Taqe_|4Wl0Mbx^0Hb
z@Ct^F8B^BEU*DZ&W2OixAVQjd9avacXwaia0}-Xt-l473Uwzc_Q8OA|Ks@n8gEMT(
zZD1v1hpBPd?Rpx@y_gtTzeLdof(Anstt3Ia0dOQ~11!M@5J>wU(>Q5VxE(jJUy@wX
zX8xuC423wO4Os6<Wi5kA5#K_FnKrAOLH-XW<I-7EWJkd66uz!t)eL~6a*H3I?Fctr
z8kY0vP)t>Yx#R0Ab|OMewl}&(o$A-+i&X7&`Ed*W9Ms1xOP#T{5VLLIX>I9vViuR*
zG)8A-iHI|=ojO-gpmFZPg>Gk^CZ#b6vHb8YDgey%NdiM}^m37z-vHqngTBpmZ0IxF
zu>#5e7Qlo(m#@I<CPVgQ&SbNaK=yO97$H5{sQcETCag`_qfV;cK=0X#(f&qy`4x5K
z*5MKPo{yBB=S&c008n*5q<*maHC0ROKkx3&_So3mZQ&ftKww)y^=Gb%)LNk;{}w8o
z{NMl8k;kX?-#`Co<GVv|GIxz?C+1KbkBbG(%0~@>Jcxns;B{-&nw1*{2L)9eyXsTi
zCj$dTp<d}NOEKxiD(1l|>2DH3U|O+SCi&3yM<c)eS!Jl2DEzR5Wr5oU%+%B7K!Zpv
z8L0?+e8KZ8ciA0WRddZ=pAZz-@Ed<dVWeaUOBlTV<<{w&6MGM7y8i#k_5Yi$<X=8d
z|Ms8b;)kbB!*`@Og&^*6Y6{n_mpe5c$AF$o0MT)ETA@BuZy$^^aVQb5D7`cEkszHB
zl;6*qZT4zMzNI6qI{WQsv+CUkarJfnxyAp%q3ZnykCQg>1QOyP#bw{`?Pk6|$qt-1
zFPegebyrP<WbvBZ^ehl9#ZeA$)uhT!{7sZvB2hk^u*2WTEhuh7pY$K^#iO(jkI&XZ
z{VN<6jt*2i!S6+*N=Y5Orb<xTP38uk)GIkLj`d+JU*o-hUe*s43j!e4<nA3mpju!P
zw?bBuiB3^`YuMMy)yYCT;kt>EnP!FcV56d{vd0e{#=mUSCfxR8EMyBL1!49^iy?%N
zvl@c=3coP4&ceNvN#Kze+g3l0Z_Yn?w^S4wo#6~kg<Pknw~Yo(O(AOtgFU<wM6`2h
zWou07`Tn<HM#%aANkDXbvV|3z!TpXmTkHfc2Dw=>a*;f%_g9Z3^!=Sd8DBGKEi8XY
zk*!Tu`-`5K5u_OXz<^cq*dOG>8*9CmerwT+6&q!xLY+Ez5HA5MADQ!jYk65zRGT%g
z)RJfpqzXv>kdqa^X<Mto9q>y^%m2a9Pi)XK%Pe2){Nw)pQ=gKa;<*Nw5O?BQ3VZyl
zN-*&oKqeNw3-yS&^++#m!hX=+WO@oM8HETN$uhDbDM;2^d`8vM<idFKiEL28MTW(;
zs91#SL^Kn2tKv;R&(ktxc$YJjn;}n|utMxoQHZ6!{2A}It%!WDV;D=A=R_bjzDfMR
zVX{6lNug^)Ptlp5o>o=?es8w6W4m_xkijXFF(BOtpu)sOMG^NASRSG_!oC;+74}94
zuFlf~v@}*VRYn0P3Uav@Ha_>u(PJQ=4G-wVCwFF>jn^DoRa$64CO-lm8=X65?ARlK
zWE#t^G6KWgT?=m;?EV!2H-!2J3EoPHf;fU8WTZL7c8kB>z8$5=lo{kZ3iY*A-7beH
zb<NFX2P?pifl`vc$2p5};OKB`YbjA-TqpOFb?g)SVUqjItIM?R$ag+`<&K0X*0{K^
zlwhO3Kf9$zE2E}NIe-Y|_}Z#Ub#JB~qe<Vaz-1UWX5vENL^pVReHfd#JRP~YX`6GD
zQxOyTp&bnmr7L)gLx9fi56tP<Jh1x5c1{m#3nra0pZE<`gt|A6SC-o%jlfi15ko*(
zUTRBH^!-qT8>V2iREAL?t?J&)U!#s3F@J56j+Od@0vZ4&w>nhp^Z|<O@Y&=)hhiot
z$!nFWDgRAapq#VU-M>%y6#ZhApV=^OGq;^1lsu64Z<Cm>tx8u*MC&p)Bh2U1l#`wU
z%<yeHLHLMTg=^=_uYm0u`LvPk0kg}1hy2cvTN^6PjXnElYs>!AiOYcoS<-52YX&Ab
z*9T|zlN!phw;97GIs>PxgaQ0$x}uso%E&#NIpOiBsJFptiOfGWL!oTpP}rJSqiV`;
z(kX<@+DO6rURSkwuDj5#3SmKx)|lf^Ua~rD1u7nw$3W@3FLk9nX>Slg^I)TIVcrM)
zTh)}OVOP5Y`&-|kDm6D3M}HSD`ZSsos@B@Bw3=BL)4zWC;+t=R*|B*28$|F1XyzlM
z(>I7fg!T1B<u?6{*Ha|ahn!_(0SYMEb_6wI^#WmW7(8DgDsts;h)ey7_M%~tbPTR5
zRz@Ufk;yBfzfrvD7}OLo+u*%Y_2_qOC2fsGk!M*+C&<@YiuBm@1Y-Lt<1B^A)s8)T
zYAM79dA}I^wh2xu`)w=(q~xn;JeY%Q;ft#%SgLiIw;p#i#Xn?{Jy`wOPYdB9E5Zu@
z%rV~m_-NsU3k)=*>ij}USG)WRtQ0kchgTB-1YoKb<Yx2HqctH~Ybi~Kc$|KcK&?@m
zb$8EZ)KYj!U7Th+G*dtej+uF#$^y``KmO%?`f8b5x`!l`yiTr`cdCMI_(9p076ba_
zYrt`_RG_Wg!QxUfN7AC7z=$s&cdMR^Ze;?Y>hY~*a|Jn8wH>*|uzmCmbEbj2>V%AE
zM&6ug0$D-av0c2VNY@@N4?TFWjzR&u4)uokBc;QwZ8uN6%TyE@Ls$DA{d%<XQ!(Xk
z@Z(un1}WEAhm)fxS4Y_Pu3EJwi^c}JxS~yps>`Hh_~gmW!DQK_clg4B+%IB#bfTAn
z6V#eWlUP;@d|K#d)@HI^xyPtWwMiPkmNBE1?TiHH6p#tPt@i3&Y3y#%`SN0{^{=Tv
zMBq$XS7VkuqoZ-24q(s5_@)Eh+sRPU6D(cfJ#L9XtG&hoS(H23nbMGt@&oA;uNqmo
z^ZQv)@r5VqgJa0dNRi!{VbncZPeiE3!Y{|JJ=Q!Y+4(84OBXqMUbCF!W6NNl0@gRF
zJ7ns*+ijX*;U<iIDYa1?Dm0h+UA_-`zAW@?{aVffqJAHeQG}HXrq!EyUD^&E>inY%
zQBWht-e=r9n@iDCR)Q9j64Vv3Nak}WwZzoe_gW1F#<$9l%dZ;Y3Rtm<{5*G95Qebc
zvmMWY80F>X`^hfXwr$nS+o{`Qb0oO77!<q=u(uHGUl@$AQRKbgSF0(qvpdtlD7PO1
z^|naBmfji{S+b^rn`)+%uHGJnTWT#OeSrfJ-~Ykk1fw_k`R#)U2AaeW3s#}vWLjT=
zDUs1)V11*kg8jCKI`bOFE}b{A{q^-w7T^DBy}2jmvY9t>nLPn3jNwIYqsX2ZW-KfL
z2j>LZQTIj)(23n{49qdRZKMbUL?617l@&b-vmh=B$Y#{3lUQ?WD`fYa!z1gvFJ2rD
zk{ew&MfTfejN@U=fix<ZlQIV%qS(HL4^mSDsCn*WW$ncCtjA;_h&Acjo8>AlIrDi#
z-_k=F@W!c{LK${wu^FcvEAHxHx;9PM=wU7Lw<Ofn(lSuM_biAx5oF`q<?K7NKL3l#
z>B8xc6kai2P7_*0yNb3+ZIOM^K)3=aUQV7pMu-GIi8nK*ZdNDbA4d^T_Mx$;bpIMP
zMT*5i8Fn@B;B%7E9dC#%Ai-)qjCUlHplPuTXKF_lZPWypk^N}+O;CPZm33&yY45Ou
zoBfQIw79&^q6IK1f8X1{Ai=ZL==}VryYUGUj0pn+qvk66LqoftTS88r`}9Ir-pehN
zo&yIA$iUsI%jS~Rxu)Ywc?kCKrzuGFFtv)lmya#YoyU*&@i~HrZQLkEwpKr`EDc)$
zZSG4+NjokV)}nw&pirw_8cZM!(EuATRLsiE6hbk!#OL6fxA`#IjT%w+$rNsQi@GI!
z-hB;F_XIdBVMEpqvvApN4-Q$8U#X}WZwd)%9lS>Q?$B^@uarl(&FQM)lKfx~Mdxz|
z&BCwYh@FAe&z3!pDa!^wjpeS$xdzLDAhChY^>ke(L_ScV8I0N=-|E02B@Ncddu;E{
z3}NB<L|`hJ6!qxWF9k6`>goxfydI#^1cm>!r=qTBaIvw%*4Pt_4|(9x8Sa1q$<y0M
z+TN``&t4NU^?t^`Bi0t@ezUiqK0R;nhnRxwEc=?gZ9e<<HCy}HL|^)hN2^YhL_J#Z
zlG0u_N{E7H-#$$?JQF~#rKgW?iUE%}P|@wzRNlY1s%IJb<z$T=P#Y<HJK>1Uvdn3n
z(&Mu_P5Qe-eBR3;<lKtmggrg`Dn@*TC*u$AcitQKz3wqbu^IdS*RJ>9+PMGF-TkNS
zbk$4iemM%?3xb0*KRhcbb?KMIiG}L^yZeESb()F$E8W<hDYF4b#1Wux-;+AG+rXb-
zHP(m7lPBv^c8jA8DfX{M-_&|8%DZN{WI=VK7@Q*{KQ;o%7?Sy;czua`1K^Dy7Lq*t
zM@5Mv07pGB?wj*$FRF7e!4VL#_Ju<C9q#BDpVg`n2n8fXYY$YOt(@2X>PxFr55sO^
zgja)t=Tsjr-@m`-oNPJv?@l(J>IR@&x=VIq@3;O4T*_omcB|0B`|=f;gs+2bleqi<
zZ-v6f>g0!$onh)P##a(uePd<<5$RMbadck7e+7k(P5gt>grW1Aj<;_@31cMMIGEB;
zg>+#-MJoIV>LQ1-CEdGq`<VFjDE59x)hk^x8vLDurUC)N>>?^YnazgP0nEbiCTP&8
zks9HUEU6>ozg$c?dop6TVU1AJrcFhvhhItqldC|pRM4<LB-fgD+cT32F#lBgwQCC9
zO!Hqh#Kjhv{-6Bz7<R79j2Y{gncIIjE5#3`s<lxt>+1XnDwWs^+O)#gt4@o4b;Rfn
zJ|jgG5>-n}Gb$2#E1Q4TArcOo@H<gMIEVK$!jxOAXBlKCL=6G6VwHo)MF6RwoA^*y
z+Z=+b;Bp!HuMZ{Ubdef=`1bw#MivE4z6|suiyuB!Qb0(viU5|aD|KOF!$51eO>b!9
z!UozjA)Cmiri373fb0f@hFedOKgcEzCb+bD;zH*75eC`;_+vsE;qea-w+<sui3or^
zhAvHkx!Dv;06H0rIb*F~h$)uAjy#4^aISojHGF!EIg&MrfG`wBGa}%N_(YL!9HY9E
z-n+M|Hn<gCB6P*8_ll>=ez$*&SsPJQGy&>4M@g;K{TQkb7+bnd3mE38dkY@~nqAPY
zU3Rk)k&I_Ch|o|tFI%bS{Qc)}&eXj{nZigiX!~|k4nw;=Y3~^9(Z{ilPt{b$GB5yq
zAd(Iv(7K-5<{!lnst<I7CJVj;v|Ev{umc{TYPxvw;)wJ^2M-#yYv(H(Fv>2opCodT
z$R+)FReKPw3WtnW?dDXBWHx~Mq;t-aMT_*Q=?gJ4YGv#h#CUx;H3Yg|3oOTUTD7vG
z>^sW5O+?#B&)c_mh}u%XW7Jm4*esq}QBlp8If{i-&>tbj2NY|#Rs2*Y1Bc<HASnl!
z#?vREZin<2P5{mTr8Vr-X_E-D#E1XGx36E@@=l&#-nC1YIoG^ZlFLCP)<K#$i8zks
z4rZcqf!9|^y>DGW5z!HxOsjtVV}P!<q!^l~U3l%WZ6pJr5+>z1>5dsvlmHj>`aY1=
zq{?;*H5OxUU_v7jG<9!~hfe$jV3ixKEh;xMR(R55zz3Bu4pcU^4RW&(f7u*1R*_qZ
z$-*3XDe~E10mR8ztx^jBlhKj3vL24zYj#|WY~_+_q~J}AM{aSVS$G&vaDvA`Xj5%Y
z*%<{_+ae_v__Wr}1V+A-oV>2O^=7C0CRU4$gYOvODM~_xd42mJzLT|?*}5oE*Jvt?
z6457cax@e#_5yUD7JAg)C&b9G#h|58pC<9kRl?{UqiT3!PI5#9cjPzUGnCjuDQBUt
zmMhoNfs8LrM=Ewy!<3w|OPt#X@6p-)QfrrV7`xY0Ou~wUo`BfVefe_vaq<389RS$#
z1@EPk1<Zol?HDx&N*+eL|4mt7y@zhS5__N0>Rm|0QEUUc!HM0$cneTeV;RGnv6P7o
z%W|M=(aKdMzdoT=LLp@oB=bH6YIA7R0)iQC45!V!4o|LvB5PjClaf(g#2KcOs`~1l
z`@adLK=uF%XDz3bp`m`GM!PKa-hMtwX&0j|G-4@B7|q<EPMMC^2nJCSK8dOp%(yP4
z;X5nqhXA)m^6Ol1)E;m06Mp5seaDv<eV&h&`WhW0j6x<;`gH)72Mibxm1~TIpBY8_
z=0{*4hzMCMRqP+Ko0EBqM{L3^$|5_PM0(yN_ZF`En0f+Y`Le3ro5S~yBN$X9aJ)v1
zgi}X*5U@M`{CU6g=g(*Co_iT-zCrXuh;UlpORMKVC;wpDt>T?=ltxon!1PBh*r|zO
z8AYUAN}-(<MW|*~zdn7`6?o+Vg+Sm2pgU$>cF!*fKji%D_wU|m;&!F={TBA@!m8q3
z3*U;4Pm0!R%=FRVvg@a8Yrt<1Ca9!k`bkkZJYp>c&u8*ScTjg@V#-Epa~JNMjH!9W
z?Pg8O)qC5YC2woQjZp9af*dj?RbWTQn33ijYnfW2zG~}9%6UyehNGL&idDc7sa;|x
zoqf|e-exyt$3c7?J&0uW0s92q4-5>n?v8p<Y0$Fei3bxPR`zH<uz!C?ja29F9#Kz3
zDsS<D$im&3#SBlZqH>}gYLmsxk%G#maZtCbSv?;};vd`BY-)B=r<m@viagY?2SWwX
zpo}wm)`XZk*Q@@JRgKS|d2LgTe_Y0JN4W+pZ-2_#P&TEC+zMWk(Tbla%Vj{ccfjHZ
z>!Vs-o<o&r#Qrv+(vwz&F$_U7r;vq|lCa?y0EBceufOM9#n5TdotN^vBD7PZO;$IW
zuXt0ga<ctoA)qW=0q>$*QhC{Cje~wKIu$YZIXMzZ*X@Q19kKcCOC`%=E+lq|tkpQ`
z$ulv6%v)#4AjofRe-KL^otkzV6O-0L5(P(_?&@0lAa<79lm4zY(?)w$4(VW!=`h!-
z-0Zl0blor&@nEbj`x1>gKH^O$26)7nm|x*nX<}NNtTudRw7N2SQ(<(<*I}>V9Oe`z
z`X4QIYR6~`nL<W(_WJnvc*8uyKky--V`fk~JlLpe#cKrDHAp<&TWUVWJWNS<ufIE~
z?ssNTNpbyBXJG#bv?S94nL`oq>M5t=<2NQH3A5L4zTN0?;~J0n+Xw)s2~FzB@Nr8S
zQ8y!rpU-;(?w$O>IyXt>8hFYl8j0HZLa4*_d{MXe45le9U@Wgg;sr(|rjA5RafUMs
z``%%z*Q7ol4t&Xpb=D)kY6rJMmB*LY{a72-i1Yvw<?bJV`65esf=z;J%O;Mv?|Zp8
z8JGdvMo^nhj9<`-QJg$0DI&4q@ug)TT69oXjaEbl<$;5o$fp>Sz{8UD2*SY6x*Kp#
zQJU=<Z9Yuwkp%LFq#A_}!0PFrE6NnwlGtZ4F8P33y-9rx5$xa0pArl$Bo9ko4J|Dk
z0aej)pPrj*Bos{U=o%N<_B)b8&=W;N%fZX*Koewm7&LiN$)Nc`$2h4%1!v#QHX3YA
z#}KOd|47}f{d7KI@PDvSxCsKO1w2`_WXW*AO4<Cob7w>G8W7jruuD|9EYc8}ftd7A
z^$912wrw3^n?=EMnY)Sarzjp-($oZTnb?bkM@H5V>y#hIjvUDYn@%=K?6m)z)ylGO
z9|Cz<WUm|Ggsfy{*_2U&`!P4?sQb4iK=9#2^x+)t=T8pTDc0Fm{dCsmd_e9L#rKmA
z8v2QBBa%*@);M8F!PcmcEF_Q>K0s)ZM~-BG<lI5I%b1ECyBXLwyrl~517(gK>m`)a
z8iyBfI8Q$K_O+<3LDs{E$0$Y22n<FrA@!+2Xt#AzL-fQ90Ds5146FcgfkdP#pb%}e
zrGeNK?|X_X^%x*r;pGV1gI|(OLe}s;{cHaPo6Hg;TBLRy0aRCEbkX6f3G2k$wgN@)
zpXai3jF>X!+&q$c--XW)f&?^c-aL!%G6z;dgiX9qe>_X(0JydNyV(~h+gxx}V(9pZ
z4~bH9AWX?Ukx_sYPgHpAJ9ezSj9@YchOCr$e=})t@tklDbGGpNlumb^JlW6jLw|O4
zQO*Z?Hs3Rtr>L6Bcgy9g^#s-QM;Y5cx-^uKeQqkW#w{%e?!-oC7+fQAk_Gp#JuhzI
zi>qt>%GUWC_Ug40wTKj<Cr+FY0w>$D27ooaDlwvS_IduaZpq#^Tvd*HU5eZtK&bB+
z<pj@lMrPDmtK?DDN_e|Z*18jv!2HJs-Trhn<(-4ba{3<uc?R10QSmihL@ktLGpJL4
zu+X<B9<W%01rL6w7B}y4FJS<~h=Qc0C15i1?O{g25u~kW!>aV^r?A@M+x36RX}LNf
z2~s18(=@$=AIaFgmY1m*QqsvuI)FE}4zPsoY%%v8lc~kEs=My@!?FCtz&fh_3}@Kn
zFN=%QYn^WipGKozy*FDuRFamZap8RH|NA<g|5L~QXyZ)qG}^50t533^^Ze6GY#yWs
z+udc7ZFv6Q<H~jP7h!NS?y<k**)V22^g-JX9-Ml-ocFL$R$P*cpFbILx;Tc!Aj|1+
z<Nbj`4(PqovY^hY6$28rFe_|GzPAWAa;>U*cAb6jFOpa_P{Cak=qJ|%?qe%ZFW*b<
zop+Jf0~>aIad}032yNadFQ{dD(u-KGT>$G!<a;z!XyXjypA!lf3w8{_f?h(F_d%e^
zgiZYL`3CAsS?wam1>FbBfS5h(L{j^*%F221jQkj;81>GmUBCWFP_5ILXg*wUEG$gv
zweS6*503n0PFW(yObqU1HyV*BG5f>H791ZRs`Nb%B!$yMZ6t1Mxx$=U+4eSLk9v$;
zD=gOD_#y5BUZ(vPK9@~6a%1@VSeVO3d)ZQhQJF?5LJeUiQMLm}i8&{+b#BpD+_!Cy
z=S0o_e<euVz+^(rW4W&7`T9Jw;S6Y?nFzW9pmE-8{uM0<F+wU3VMwYh0K-wA%q=Vz
zya#_UI<rU%{>W&{2THCG8zVl{t6iHVkJl+sEYix#%Wph*Fu@+7drf*fy4q`Z?r7l5
zZ2f;VcJ5I*r|TR4qA5~NF`6<V<Cq}^8I?ocw0F@i9i&LZRt-rEnWTdpdW$A|NK;Ly
z3@Md!p=7G9EyOz{Iy)ppCo1Hv{dromXRTT5w|{H<qvehF^!+~1bKm!MU)OaTAEX!+
z%Yu#^t+3|nV-LHLI!M7(y~1}-65sc~>lY*Ba+<`ya`PTNf8HAvz9i;=3cF>Id!cco
zF2cY_t9S@Dg&aWw*<k?-%6U+X@KHS-X@zMB?6eYB;<nl6aN(q@v?YbLBd#DqA4pRq
zas1WY8lQzQRZ*zw!COQ=ZdAQ3>Haa4R53lAmogMYaM*<Hq5T#2TRMW20xKf11uqZ5
zjw9s5J-RBoSUAj3zOLffF*D^b7Ia*S=6{k&Oo7xsQi8NnfI1@t`Wl(sucf6+?)8to
z&^&>4J#zo`oo>&FgJPYD{GB8dx1~hN4iWfpe@kvOBJ_z#g)DYB#05)M1dJ~8UUVzw
zD>c$k!M>+wFX(WB_(L)xV{n;N^S_E1?J@O9x_N<u?+%_{!cLRS{-(=)6eit6dPd@U
z1|%dkd0i64k)ZLDiU~nJZSb8>qQE@4N?4A_X1c%9RQzFi7Y0JQhv_C|!v8(`Zb`{6
zQ0LSqw~ImOxp!CRa8B>M#7a>KW_KAli;;^DA3T82&Zno^)uC&aTnv6oQ`a>+%d9*T
z4R_DELL;5qrHn-JF>afqlha=WLXAQqLJ&D6QSsATz7=aOp<S{|Z2jH8hqIDfC46Zl
z!BRDgXDS?c_%v38;tU?)@t(t{t$SjwJj4X|?$Q*DXBt*=xN%Iwk0>FKq~H&d{YhR7
z@4@*%(UV_wP}qiD@F!lX1cM?hZrCu9Qt|gHw&WtAfIK}GQQ5$OlqOnYK-G`Qt_v4x
z0B?kq-7YHH`slPbcb=@hPb0b_S$W#5F1S1T&grZGG2PzwAw`B5OOB(4TrOJve2?Z|
zm9E(@+g%fE?ocopWd96Xs;OKwo-;tEokoj5MY}RJrzp0x^}R<tTTy`10(28j>k2SZ
z+jyf5Lq?Nn)27KA!YcP2N$HbS>0Cx6a)ZGE;A!gzMQ|Sm7|h?X^?Om5XWwCSNkhWN
z@`Llb1LnwTfOzt5z;Xa9yT&4(;@{?F>ms}pI0kLT{87O^-4#$x&AH@K;!nTVq($r#
zdNE&~gHvfG3{Qa*3cwI|f-*rs5Ekh`zX1kyYiNqf8gsEg^+J(?WJN4Jx?I?M_Mwdl
zDWY>@u6Z{_X@dAggxV?wTb`flFkxRs#WE?F+vIHc?h<7X=ZT!NOBiyBAp}%(7>piu
zG@=58Qwg{@Fe+8`6G0LrhDj0~%8E}_4w=@en)n|(d5+AAin}%}B4WsbN_SMhsCbbD
zNBUg0E6F6se{gAYs<R98NX)@qsR4^#cht4d*P?usg2@xHn74ep6f+<ntB0VuQ~(8>
zsUlORmkP1sb3uRG!di4xeP@z8hc7K`|G;0x{1hUkV9<&x4pjX8jawqLpEfd|o@Lgm
z5pB6(!8P5bK}fJg2|*SpjHt!fh9XT>P@)0Mt9@2SD|AApW{JaB4mC#?Z*?oEzmP!3
zLSKD%;JZg^Vhkuvu^ou(gFSi;VYSpSVuS=KTB){V!Y;Ffac3J3S2whzZ;Z13Tax-Q
zpg8s6!w(Nt?I6{?hOgBWY`=~kJGQd6C`#CTk@=Eizp*Yh#&ZZEO#)#RvOobIK6j7^
z@;}4VL(UlOSzk#D$U+dVlF^k=jE$c_Lf56cG&eVQ4yl-&YeSKnT<L6&Q8jKGv*-@(
z2D0rvnOcpjw!C+E(Mk`Gv3n;?qHJ2X{$xap@Sq1PrkEL&J~5@t(%O1=e0+TJmvE>!
zj}avtC~v>5mY8C2<d<G~q{WI(Ea8MTG|leBw(jXj$Z1uYyzYJXqLmc$3GL^djF%<u
zk6hEf?u+2!8#nUVbh|9nNSNu#3eSp)+#vD%_2&b+D_#e6$RhdF3`N`GX9qYxX$3IJ
zW7-#uE@-jBAx=mmp|quxfESKIM{AexdfJpJ^FROw=;`%CR<LosW<PC1i7FR!9bFWU
zdqFH#0S$^gl;9XS^a6eadxdKphmRN)0ApyoFtGS!VaDABejxv#V?Oowzf_c*`tJo^
zS80{9P`12lgA{bAYI#NftHvh3O1-qc82p{e*XoYmZl^CQJU_~9cMoxN3(?eBa6V4?
zliAwGi#)5oUApvv+1f>g_f*3sPR-oE_*CAFh?Y$==ek#!`2}<})sLN{xAdo&J8w?E
zFU)CFc2;z}dDd%odtgx2VVBE}eSENoaE!>g`{J!`2b^Wk^Uh*(&pzCrlXKkU$xBS@
zt&iVLNJ&w*KCXpNix{gyzsP3!av|}8_}No(c5%T)dKdOJqQ@o%e=VCdR9q%5Zc0ck
z2e{(lL%-!2E@_T?&YYRblyutsntGAK0N7{du-;^S(71mKMPxY)ikoXjbZ%2=-z}Ac
z21Yb4&y=2SSJSh3z1760CitZ`SaV8lGoaH!Hew$QjloHZaioktvSs^9CsI@GgbP5}
z^}m0(aoIbgLRs&7IqHnTmdbGX_a=JRZ{LoFl&^TPX)0nwzlMu-fA{gRIdK-5oNb3N
zDETFb%zd$w(>PXXPmwR09J`%Wmer*wu4rl5*kc5o8_T8CH5C-NE2qX3xEcP7gQGSr
zvud&L!Eiac_P;XKd}<p<7=_)l%qQ<Fw^T<l3XhCtAGK9@{-b^2;p$;~_u98UL6CHi
zBt%i)I%x3VF9@bW4OXk9sp5y5)M^qK@fKb)ZXoZopHqh-jp*<XW^rEZXt><fmR@d<
zk&DN|UwnNp;5iU(eSANMgca|<Y0DOa&C4c5Bbqip=~zGg^^Dr|a>bU)H9$^JTjJ(V
zuB?Czko1*K!~>G^<Z5Zd^fCMUfVnTgpIxnaR@3`!?2(XL?si3O4VA(v;1xQrWu|-5
zGBbzL>qySX$bD(F=+3+E(sJ9~&wd7G1rKf28jthNit6f&VLPlcnd>$Q{+9|J3dVxv
z5ygZXxM=fI0kr$SQda~G5%*V-^>pJ!8wZD7EDI39L4dVI>7{Y+jkkwsza>rR-1*S!
z8i0yJ^;%<B#=Q9yj#rM#+GIsbr{D-Q37Jd-!`(kUcpH?HlXJ&&ny05{RzqRiR`GWh
znNi8tw_~UGrPuNCk=B&wXzm6M+@bfMpGsZWVojXW`72Lf^_n4kFZ3b{Gpe9%U?(cY
z-P-Nqeen~9ol!{dNGV1KJ&-9>&z`wg_|?T5YHJ9B{p!`DX{k1a20U+QSO9hQq@%&x
zt)||&O5g0azgcPP>8VN&Ui-4W-nO-+lrfiJ{VC_P?_ZucE=j})@pRlvj+EB(nYOdq
zKEgjp@kNd?i;|AYB$&O)NG)BRh}}bbDYTonUzf>@F5*j|gEKp~1TFdmVXlu0w?lkq
zXCMcAo|~Z?%s9Lu@&q#lE$_Q+vjr7ZI&$|#6SE_eusJ|4G2T0;)lrNX5~Ht?Z=|HA
zDrZ;Mw<2B96dqT0b|UzR=Hro*Cp8HFec9g_#qBP2_1C0tm<Rpu<T-4B$5M$zHLhn;
z`8+0@K#bqV7@W-V2#>=7pOTmglBguX&MRQ*kG!bJ5(V{O*NmamcV-;=lT{N>)2<mL
z^_&YgZ<k!2Ud#sL$TxZByCBI{M_0G-o;w@%oO2pkNorAPn#)+}=#?w3G8tIaDCsHc
zCEF4MjE%uHikg~E$>o&p3ndiSp((By<j5>6_Q?N*zpY9zUamatmG5O~UqgepLmXEv
z#>DRoLwYP_GU}Dl*iX=hJTQxF;zvv+^z}Kbdd^+5cCAC<hFKgA72cV0Il=@hFRzm+
z#W2HFg0VMh?s;@Wt#e?bxoqK>{oCFuELM4YoOU{}%wtB}F0m_&PSdv%<NQe5Q(BNG
zmDIPj`9AQPQL(vnc}fc?EoTS>+4}ZhhNa!la0LQ1(d$nSzOGc9j_mW5u$@v`{2Oxw
zz!qHoT2(r5;6M$_Adl{4k7dg?b`q1K9%l2h(p-1<V=IRDsNwdgNMg22V4X2%8m9a$
zAtQ7~O=1I97J!oUl0YjQqyENu(Yn>mO=3z66_`y_<lenfR@TSZefuQIFlHg#_A@Dm
z6rL*5&!+zOGx{@^j1?SM8(lQ1RR~+y+M#z}6p&lqxpz+`$2HPI&rkMZlmr9dhpp+{
z=luM9&K5pI+1FZP^C`02XT(LF+I-QVamiVyiNt{=?swBM-aeroiThZnV@F3&4+>Ov
zuwmRS%Mq7N+?4Fmz(P9a=T=At<HyhY_S^BQYHC8*V)Eg6lBN8d(?ltl{P`Q=cwk}Q
zK7F=ZAK&4c(QaI=D2|bL4vS_ix%WzrCE;?0-{_GE)n`2-U$&aISM<s#-Gl#)Fl+5%
z?*hNNO^rElNk0S#B(-cf=rO&zz^_6iArZljAo22L7l*3fe(Raznh~2|Fm7D1!gFW-
zqpQ^VQLD?X0#t%&OrH3l{rTsb@z!c_w^Sv3nfV}CN7zP3g~{hd$~`O2I88)FoyTUX
z*)*$}Xz>lbb5AcX`x5`hVPk<r!zqslvX4bo>g|1vN|L#;Nhxdbpw8<%8AjbF#L@NH
z&8pOhO$f?<C==7x;9F}(nzm_+)|kMF`-S#u%zo34vgJU`teVGzd_eJD`5FT+i+)FK
z4&8f`cQrf485rc#)2V6xzKPOs6oMaY>1^CzkwP~i21`mz>`7!~lFm>|D=Sc-X|4mh
z4`8i5-1qtYO?Q&>bhA6Wyb2hQ&|50{?iH7kk7h^(XTq#Z1g`VQ$)Q(76&_r+(op*p
z)x5pEea#QX4OeNw3bfmV;fhItS8loILlz+g`{Cxzg+fsE$fpJllli)JX)BbJ6B_;d
zKZ)@;)a>5~e|;V<HuRYcsd*;4W@|gAeTs~<kh-&ngqGA|^XBPQL0tjt*CY}dz+-co
z3>&Y=-j+7$nd&FT{amufA*8ZaCTqoud(FMAN$0Ue>G*iiVsf9pecu@SBK!f@?u`D>
zQRUw_QeQuB{g{DSGoLK6v)h5i=p3&Mh36>-&!9tdc7SqGyl1<(y>jnqhi``h8;bb>
zLJz7oe47++UATSZ$~$nYo70aU7ei-HIZaF^anU<r)_pNIiQ(u+5)vL=8oq_iSuw<F
zlh$K*4WfX)s;T%Xp8Wqkh&}Rd7+*?PmZYeGI*RD{k=p>J1;EGLB!wZNZ_y@E(o}kf
zR(jX*FQFB_<?BQo)rv2F{cOYlh2}r~Mevn(hhTa4Hz5>n&bEk@KiA1_DKa3Q4(qM|
z!Gd$()BR(V%J(yidD#dMgn?c&bk#!Sol|~S#+4T;=m=jY_mL!WD+-93=YxoF5%V2W
zhbWawNjm%R=4aw-C5DBIOZK0)`_p^>9}oWYtIo}3H&$r$>t~jv@Ua)KF-8&}h;M46
pBjtTFf|rl|erA$L7^clr_OIG;|Me=Pq)3TBe>Jz3rJK2h{2QYMU_Jl<

literal 0
HcmV?d00001

diff --git a/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
new file mode 100644
index 00000000000..aef85107cd9
--- /dev/null
+++ b/doc/development/value_stream_analytics/value_stream_analytics_aggregated_backend.md
@@ -0,0 +1,330 @@
+---
+stage: Manage
+group: Optimize
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
+---
+
+# Aggregated Value Stream Analytics
+
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/335391) in GitLab 14.7.
+
+DISCLAIMER:
+This page contains information related to upcoming products, features, and functionality.
+It is important to note that the information presented is for informational purposes only.
+Please do not rely on this information for purchasing or planning purposes.
+As with all projects, the items mentioned on this page are subject to change or delay.
+The development, release, and timing of any products, features, or functionality remain at the
+sole discretion of GitLab Inc.
+
+This page provides a high-level overview of the aggregated backend for
+Value Stream Analytics (VSA).
+
+## Current Status
+
+As of 14.8 the aggregated VSA backend is used only in the `gitlab-org` group, for testing purposes
+. We plan to gradually roll it out in the next major release (15.0) for the rest of the groups.
+
+## Motivation
+
+The aggregated backend aims to solve the performance limitations of the VSA feature and set it up
+for long-term growth.
+
+Our main database is not prepared for analytical workloads. Executing long-running queries can
+affect the reliability of the application. For large groups, the current
+implementation (old backend) is slow and, in some cases, doesn't even load due to the configured
+statement timeout (15s).
+
+The database queries in the old backend use the core domain models directly through
+`IssuableFinders` classes: ([MergeRequestsFinder](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/finders/merge_requests_finder.rb) and [IssuesFinder](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/finders/issues_finder.rb)).
+With the requested change of the [date range filters](https://gitlab.com/groups/gitlab-org/-/epics/6046),
+this approach was no longer viable from the performance point of view.
+
+Benefits of the aggregated VSA backend:
+
+- Simpler database queries (fewer JOINs).
+- Faster aggregations, only a single table is accessed.
+- Possibility to introduce further aggregations for improving the first page load time.
+- Better performance for large groups (with many sub-groups, projects, issues and, merge requests).
+- Ready for database decomposition. The VSA related database tables could live in a separate
+database with a minimal development effort.
+- Ready for keyset pagination which can be useful for exporting the data.
+- Possibility to implement more complex event definitions.
+  - For example, the start event can be two timestamp columns where the earliest value would be
+  used by the system.
+  - Example: `MIN(issues.created_at, issues.updated_at)`
+
+## How does Value Stream Analytics work?
+
+Value Stream Analytics calculates the duration between two timestamp columns or timestamp
+expressions and runs various aggregations on the data.
+
+Examples:
+
+- Duration between the Merge Request creation time and Merge Request merge time.
+- Duration between the Issue creation time and Issue close time.
+
+This duration is exposed in various ways:
+
+- Aggregation: median, average
+- Listing: list the duration for individual Merge Request and Issue records
+
+Apart from the durations, we expose the record count within a stage.
+
+### Stages
+
+A stage represents an event pair (start and end events) with additional metadata, such as the name
+of the stage. Stages are configurable by the user within the pairing rules defined in the backend.
+
+**Example stage: Code Review**
+
+- Start event identifier: Merge Request creation time
+- Start event column: uses the `merge_requests.created_at` timestamp column.
+- End event identifier: Merge Request merge time
+- End event column: uses the `merge_request_metrics.merged_at` timestamp column.
+- Stage event hash ID: a calculated hash for the pair of start and end event identifiers.
+  - If two stages have the same configuration of start and end events, then their stage event hash
+  IDs are identical.
+  - The stage event hash ID is later used to store the aggregated data in partitioned database tables.
+
+### Value streams
+
+Value streams are container objects for the stages. There can be multiple value streams per group
+or project focusing on different aspects of the Dev Ops lifecycle.
+
+### Example configuration
+
+![vsa object hierarchy example](img/object_hierarchy_example_V14_10.png)
+
+In this example, there are two independent value streams set up for two teams that are using
+different development workflows within the `Test Group` (top-level namespace).
+
+The first value stream uses standard timestamp-based events for defining the stages. The second
+value stream uses label events.
+
+Each value stream and stage item from the example will be persisted in the database. Notice that
+the `Deployment` stage is identical for both value streams; that means that the underlying
+`stage_event_hash_id` is the same for both stages. The `stage_event_hash_id` reduces
+the amount of data the backend collects and plays a vital role in database partitioning.
+
+We expect value streams and stages to be rarely changed. When stages (start and end events) are
+changed, the aggregated data gets stale. This is fixed by the periodical aggregation occurring
+every day.
+
+### Feature availability
+
+The aggregated VSA feature is available on the group and project level however, the aggregated
+backend is only available for Premium and Ultimate customers due to data storage and data
+computation costs. Storing de-normalized, aggregated data requires significant disk space.
+
+## Aggregated value stream analytics architecture
+
+The main idea behind the aggregated VSA backend is separation: VSA database tables and queries do
+not use the core domain models directly (Issue, MergeRequest). This allows us to scale and
+optimize VSA independently from the other parts of the application.
+
+The architecture consists of two main mechanisms:
+
+- Periodical data collection and loading (happens in the background).
+- Querying the collected data (invoked by the user).
+
+### Data loading
+
+The aggregated nature of VSA comes from the periodical data loading. The system queries the core
+domain models to collect the stage and timestamp data. This data is periodically inserted into the
+VSA database tables.
+
+High-level overview for each top-level namespace with Premium or Ultimate license:
+
+1. Load all stages in the group.
+1. Iterate over the issues and merge requests records.
+1. Based on the stage configurations (start and end event identifiers) collect the timestamp data.
+1. `INSERT` or `UPDATE` the data into the VSA database tables.
+
+The data loading is implemented within the [`Analytics::CycleAnalytics::DataLoaderService`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/analytics/cycle_analytics/data_loader_service.rb)
+class. There are groups containing a lot of data, so to avoid overloading the primary database,
+the service performs operations in batches and enforces strict application limits:
+
+- Load records in batches.
+- Insert records in batches.
+- Stop processing when a limit is reached, schedule a background job to continue the processing
+later.
+- Continue processing data from a specific point.
+
+As of GitLab 14.7, the data loading is done manually. Once the feature is ready, the service will
+be invoked periodically by the system via a cron job (this part is not implemented yet).
+
+#### Record iteration
+
+The batched iteration is implemented with the
+[efficient IN operator](../database/efficient_in_operator_queries.md). The background job scans
+all issues and merge request records in the group hierarchy ordered by the `updated_at` and the
+`id` columns. For already aggregated groups, the `DataLoaderService` continues the aggregation
+from a specific point which saves time.
+
+Collecting the timestamp data happens on every iteration. The `DataLoaderService` determines which
+stage events are configured within the group hierarchy and builds a query that selects the
+required timestamps. The stage record knows which events are configured and the events know how to
+select the timestamp columns.
+
+Example for collected stage events: merge request merged, merge request created, merge request
+closed
+
+Generated SQL query for loading the timestamps:
+
+```sql
+SELECT
+  -- the list of columns depends on the configured stages
+  "merge_request_metrics"."merged_at",
+  "merge_requests"."created_at",
+  "merge_request_metrics"."latest_closed_at"
+  FROM "merge_requests"
+  LEFT OUTER JOIN "merge_request_metrics" ON "merge_request_metrics"."merge_request_id" = "merge_requests"."id"
+  WHERE "merge_requests"."id" IN (1, 2, 3, 4) -- ids are coming from the batching query
+```
+
+The `merged_at` column is located in a separate table (`merge_request_metrics`). The
+`Gitlab::Analytics::CycleAnalytics::StagEvents::MergeRequestMerged` class adds itself to a scope
+for loading the timestamp data without affecting the number of rows (uses `LEFT JOIN`). This
+behavior is implemented for each `StageEvent` class with the `include_in` method.
+
+The data collection query works on the event level. It extracts the event timestamps from the
+stages and ensures that we don't collect the same data multiple times. The events mentioned above
+could come from the following stage configuration:
+
+- merge request created - merge request merged
+- merge request created - merge request closed
+
+Other combinations might be also possible, but we prevent the ones that make no sense, for example:
+
+- merge request merged - merge request created
+
+Creation time always happens first, so this stage always reports negative duration.
+
+#### Data scope
+
+The data collection scans and processes all issues and merge requests records in the group
+hierarchy, starting from the top-level group. This means that if a group only has one value stream
+in a sub-group, we nevertheless collect data of all issues and merge requests in the hierarchy of
+this group. This aims to simplify the data collection mechanism. Moreover, data research shows
+that most group hierarchies have their stages configured on the top level.
+
+During the data collection process, the collected timestamp data is transformed into rows. For
+each configured stage, if the start event timestamp is present, the system inserts or updates one
+event record. This allows us to determine the upper limit of the inserted rows per group by
+counting all issues and merge requests and multiplying the sum by the stage count.
+
+#### Data consistency concerns
+
+Due to the async nature of the data collection, data consistency issues are bound to happen. This
+is a trade-off that makes the query performance significantly faster. We think that for analytical
+workload a slight lag in the data is acceptable.
+
+Before the rollout we plan to implement some indicators on the VSA page that shows the most
+recent backend activities. For example, indicators that show the last data collection timestamp
+and the last consistency check timestamp.
+
+#### Database structure
+
+VSA collects data for the following domain models: `Issue` and `MergeRequest`. To keep the
+aggregated data separated, we use two additional database tables:
+
+- `analytics_cycle_analytics_issue_stage_events`
+- `analytics_cycle_analytics_merge_request_stage_events`
+
+Both tables are hash partitioned by the `stage_event_hash_id`. Each table uses 32 partitions. It's
+an arbitrary number and it could be changed. Important is to keep the partitions under 100GB in
+size (which gives the feature a lot of headroom).
+
+|Column|Description|
+|-|-|
+|`stage_event_hash_id`|partitioning key|
+|`merge_request_id` or `issue_id`|reference to the domain record (Issuable)|
+|`group_id`|reference to the group (de-normalization)|
+|`project_id`|reference to the project|
+|`milestone_id`|duplicated data from the domain record table|
+|`author_id`|duplicated data from the domain record table|
+|`state_id`|duplicated data from the domain record table|
+|`start_event_timestamp`|timestamp derived from the stage configuration|
+|`end_event_timestamp`|timestamp derived from the stage configuration|
+
+With accordance to the data separation requirements, the table doesn't have any foreign keys. The
+consistency is ensured by a background job (eventually consistent).
+
+### Data querying
+
+The base query always includes the following filters:
+
+- `stage_event_hash_id` - partition key
+- `project_id` or `group_id` - depending if it's a project or group level query
+- `end_event_timestamp` - date range filter (last 30 days)
+
+Example: Selecting review stage duration for the GitLab project
+
+```sql
+SELECT end_event_timestamp - start_event_timestamp
+FROM analytics_cycle_analytics_merge_request_stage_events
+WHERE
+stage_event_hash_id = 16 AND -- hits a specific partition
+project_id = 278964 AND
+end_event_timestamp > '2022-01-01' AND end_event_timestamp < '2022-01-30'
+```
+
+#### Query generation
+
+The query backend is hidden behind the same interface that the old backend implementation uses.
+Thanks to this, we can easily switch between the old and new query backends.
+
+- `DataCollector`: entrypoint for querying VSA data
+  - `BaseQueryBuilder`: provides the base `ActiveRecord` scope (filters are applied here).
+  - `average`: average aggregation.
+  - `median`: median aggregation.
+  - `count`: row counting.
+  - `records`: list of issue or merge request records.
+
+#### Filters
+
+VSA supports various filters on the base query. Most of the filters require no additional JOINs:
+
+|Filter name|Description|
+|-|-|
+|`milestone_title`|The backend translates it to `milestone_id` filter|
+|`author_username`|The backend translates it to `author_id` filter|
+|`project_ids`|Only used on the group-level|
+
+Exceptions: these filters are applied on other tables which means we `JOIN` them.
+
+|Filter name|Description|
+|-|-|
+|`label_name`|Array filter, using the `label_links` table|
+|`assignee_username`|Array filter, using the `*_assignees` table|
+
+To fully decompose the database, the required ID values would need to be replicated in the VSA
+database tables. This change could be implemented using array columns.
+
+### Endpoints
+
+The feature uses private JSON APIs for delivering the data to the frontend. On the first page load
+, the following requests are invoked:
+
+- Initial HTML page load which is mostly empty. Some configuration data is exposed via `data`
+attributes.
+- `value_streams` - Load the available value streams for the given group.
+- `stages` - Load the stages for the currently selected value stream.
+- `median` - For each stage, request the median duration.
+- `count` - For each stage, request the number of items in the stage (this is a
+[limit count](../merge_request_performance_guidelines.md#badge-counters), maximum 1000 rows).
+- `average_duration_chart` - Data for the duration chart.
+- `summary`, `time_summary` - Top-level aggregations, most of the metrics are using different APIs/
+finders and not invoking the aggregated backend.
+
+When clicking on a specific stage, the `records` endpoint is invoked, which returns the related
+records (paginated) for the chosen stage in a specific order.
+
+### Database decomposition
+
+By separating the query logic from the main application code, the feature is ready for database
+decomposition. If we decide that VSA requires a separate database instance, then moving the
+aggregated tables can be accomplished with little effort.
+
+A different database technology could also be used to further improve the performance of the
+feature, for example [Timescale DB](https://www.timescale.com).
diff --git a/doc/topics/git/lfs/index.md b/doc/topics/git/lfs/index.md
index a94caf2bf33..977f51a7211 100644
--- a/doc/topics/git/lfs/index.md
+++ b/doc/topics/git/lfs/index.md
@@ -31,7 +31,7 @@ Documentation for GitLab instance administrators is under [LFS administration do
 
 - Git LFS is supported in GitLab starting with version 8.2
 - Git LFS must be enabled under project settings
-- [Git LFS client](https://git-lfs.github.com) version 1.0.1 and up
+- [Git LFS client](https://git-lfs.github.com) version 1.0.1 and up must be installed
 
 ## Known limitations
 
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index c57d24986c6..64049134116 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -733,6 +733,24 @@ The `instanceStatisticsMeasurements` GraphQL node has been renamed to `usageTren
 
 **Planned removal milestone: 15.0 (2022-05-22)**
 
+### REST API Runner will not accept `status` filter values of `active` or `paused`
+
+WARNING:
+This feature will be changed or removed in 15.0
+as a [breaking change](https://docs.gitlab.com/ee/development/contributing/#breaking-changes).
+Before updating GitLab, review the details carefully to determine if you need to make any
+changes to your code, settings, or workflow.
+
+The GitLab Runner REST endpoints will stop accepting `paused` or `active` as a status value in GitLab 15.0.
+
+A runner's status will only relate to runner contact status, such as: `online`, `offline`.
+Status values `paused` or `active` will no longer be accepted and will be replaced by the `paused` query parameter.
+
+When checking for paused runners, API users are advised to specify `paused=true` as the query parameter.
+When checking for active runners, specify `paused=false`.
+
+**Planned removal milestone: 15.0 (2022-05-22)**
+
 ### REST and GraphQL API Runner usage of `active` replaced by `paused`
 
 WARNING:
diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md
index 5a2dd5eb54f..ef3052fe370 100644
--- a/doc/user/application_security/container_scanning/index.md
+++ b/doc/user/application_security/container_scanning/index.md
@@ -222,6 +222,7 @@ You can [configure](#customizing-the-container-scanning-settings) analyzers by u
 | `CS_DISABLE_DEPENDENCY_LIST`   | `"false"`      | Disable Dependency Scanning for packages installed in the scanned image. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/345434) in GitLab 14.6. | All |
 | `CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN` | `"true"` | Disable scanning for language-specific packages installed in the scanned image. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/345434) in GitLab 14.6. | All |
 | `CS_DOCKER_INSECURE`           | `"false"`     | Allow access to secure Docker registries using HTTPS without validating the certificates. | All |
+| `CS_IGNORE_UNFIXED`            | `"false"`     | Ignore vulnerabilities that are not fixed. | All |
 | `CS_REGISTRY_INSECURE`         | `"false"`     | Allow access to insecure registries (HTTP only). Should only be set to `true` when testing the image locally. Works with all scanners, but the registry must listen on port `80/tcp` for Trivy to work. | All |
 | `CS_SEVERITY_THRESHOLD`        | `UNKNOWN`     | Severity level threshold. The scanner outputs vulnerabilities with severity level higher than or equal to this threshold. Supported levels are Unknown, Low, Medium, High, and Critical. | Trivy |
 | `DOCKER_IMAGE`                 | `$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG` | The Docker image to be scanned. If set, this variable overrides the `$CI_APPLICATION_REPOSITORY` and `$CI_APPLICATION_TAG` variables. | All |
diff --git a/doc/user/application_security/coverage_fuzzing/index.md b/doc/user/application_security/coverage_fuzzing/index.md
index 89b4cdcc34d..225c2ec0a4d 100644
--- a/doc/user/application_security/coverage_fuzzing/index.md
+++ b/doc/user/application_security/coverage_fuzzing/index.md
@@ -2,7 +2,6 @@
 stage: Secure
 group: Dynamic Analysis
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
-type: reference, howto
 ---
 
 # Coverage-guided fuzz testing **(ULTIMATE)**
@@ -161,9 +160,9 @@ Example coverage-guided fuzzing report:
 
 ## Duration of coverage-guided fuzz testing
 
-The available durations for coverage-guided fuzz testing are: 10 minutes (default) and 60 minutes.
+The available durations for coverage-guided fuzz testing are:
 
-- 10-minute duration: Recommended for the default branch.
+- 10-minute duration (default): Recommended for the default branch.
 - 60-minute duration: Recommended for the development branch and merge requests. The longer duration provides greater coverage.
   In the `COVFUZZ_ADDITIONAL_ARGS` variable set the value `--regression=true`.
 
diff --git a/doc/user/packages/terraform_module_registry/index.md b/doc/user/packages/terraform_module_registry/index.md
index bb9f32d1144..6fc47a23373 100644
--- a/doc/user/packages/terraform_module_registry/index.md
+++ b/doc/user/packages/terraform_module_registry/index.md
@@ -41,7 +41,7 @@ PUT /projects/:id/packages/terraform/modules/:module-name/:module-system/:module
 
 Provide the file content in the request body.
 
-Note that, in the following example, the request must end with `/file`.
+As the following example shows, requests must end with `/file`.
 If you send a request ending with something else, it results in a 404
 error `{"error":"404 Not Found"}`.
 
diff --git a/lib/api/ci/runners.rb b/lib/api/ci/runners.rb
index 9b3b9ca3f48..51a83b1c415 100644
--- a/lib/api/ci/runners.rb
+++ b/lib/api/ci/runners.rb
@@ -18,6 +18,7 @@ module API
                           desc: 'The scope of specific runners to show'
           optional :type, type: String, values: ::Ci::Runner::AVAILABLE_TYPES,
                           desc: 'The type of the runners to show'
+          optional :paused, type: Boolean, desc: 'Whether to include only runners that are accepting or ignoring new jobs'
           optional :status, type: String, values: ::Ci::Runner::AVAILABLE_STATUSES,
                             desc: 'The status of the runners to show'
           optional :tag_list, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The tags of the runners to show'
@@ -26,9 +27,7 @@ module API
         get do
           runners = current_user.ci_owned_runners
           runners = filter_runners(runners, params[:scope], allowed_scopes: ::Ci::Runner::AVAILABLE_STATUSES)
-          runners = filter_runners(runners, params[:type], allowed_scopes: ::Ci::Runner::AVAILABLE_TYPES)
-          runners = filter_runners(runners, params[:status], allowed_scopes: ::Ci::Runner::AVAILABLE_STATUSES)
-          runners = runners.tagged_with(params[:tag_list]) if params[:tag_list]
+          runners = apply_filter(runners, params)
 
           present paginate(runners), with: Entities::Ci::Runner
         end
@@ -41,6 +40,7 @@ module API
                           desc: 'The scope of specific runners to show'
           optional :type, type: String, values: ::Ci::Runner::AVAILABLE_TYPES,
                           desc: 'The type of the runners to show'
+          optional :paused, type: Boolean, desc: 'Whether to include only runners that are accepting or ignoring new jobs'
           optional :status, type: String, values: ::Ci::Runner::AVAILABLE_STATUSES,
                             desc: 'The status of the runners to show'
           optional :tag_list, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The tags of the runners to show'
@@ -51,9 +51,7 @@ module API
 
           runners = ::Ci::Runner.all
           runners = filter_runners(runners, params[:scope])
-          runners = filter_runners(runners, params[:type], allowed_scopes: ::Ci::Runner::AVAILABLE_TYPES)
-          runners = filter_runners(runners, params[:status], allowed_scopes: ::Ci::Runner::AVAILABLE_STATUSES)
-          runners = runners.tagged_with(params[:tag_list]) if params[:tag_list]
+          runners = apply_filter(runners, params)
 
           present paginate(runners), with: Entities::Ci::Runner
         end
@@ -163,6 +161,7 @@ module API
                           desc: 'The scope of specific runners to show'
           optional :type, type: String, values: ::Ci::Runner::AVAILABLE_TYPES,
                           desc: 'The type of the runners to show'
+          optional :paused, type: Boolean, desc: 'Whether to include only runners that are accepting or ignoring new jobs'
           optional :status, type: String, values: ::Ci::Runner::AVAILABLE_STATUSES,
                             desc: 'The status of the runners to show'
           optional :tag_list, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The tags of the runners to show'
@@ -226,6 +225,7 @@ module API
         params do
           optional :type, type: String, values: ::Ci::Runner::AVAILABLE_TYPES,
                   desc: 'The type of the runners to show'
+          optional :paused, type: Boolean, desc: 'Whether to include only runners that are accepting or ignoring new jobs'
           optional :status, type: String, values: ::Ci::Runner::AVAILABLE_STATUSES,
                   desc: 'The status of the runners to show'
           optional :tag_list, type: Array[String], coerce_with: ::API::Validations::Types::CommaSeparatedToArray.coerce, desc: 'The tags of the runners to show'
@@ -313,6 +313,7 @@ module API
         def apply_filter(runners, params)
           runners = filter_runners(runners, params[:type], allowed_scopes: ::Ci::Runner::AVAILABLE_TYPES)
           runners = filter_runners(runners, params[:status], allowed_scopes: ::Ci::Runner::AVAILABLE_STATUSES)
+          runners = filter_runners(runners, params[:paused] ? 'paused' : 'active', allowed_scopes: %w[paused active]) if params.include?(:paused)
           runners = runners.tagged_with(params[:tag_list]) if params[:tag_list]
 
           runners
diff --git a/lib/gitlab/background_migration/backfill_integrations_type_new.rb b/lib/gitlab/background_migration/backfill_integrations_type_new.rb
index d1a939af58e..a234cebfce5 100644
--- a/lib/gitlab/background_migration/backfill_integrations_type_new.rb
+++ b/lib/gitlab/background_migration/backfill_integrations_type_new.rb
@@ -9,7 +9,7 @@ module Gitlab
       include Gitlab::Database::DynamicModelHelpers
 
       def perform(start_id, stop_id, batch_table, batch_column, sub_batch_size, pause_ms)
-        parent_batch_relation = define_batchable_model(batch_table)
+        parent_batch_relation = define_batchable_model(batch_table, connection: connection)
           .where(batch_column => start_id..stop_id)
 
         parent_batch_relation.each_batch(column: batch_column, of: sub_batch_size) do |sub_batch|
diff --git a/lib/gitlab/background_migration/backfill_user_namespace.rb b/lib/gitlab/background_migration/backfill_user_namespace.rb
index f55eaa3b14e..ab569e236fb 100644
--- a/lib/gitlab/background_migration/backfill_user_namespace.rb
+++ b/lib/gitlab/background_migration/backfill_user_namespace.rb
@@ -29,7 +29,7 @@ module Gitlab
       end
 
       def relation_scoped_to_range(source_table, source_key_column, start_id, stop_id)
-        define_batchable_model(source_table)
+        define_batchable_model(source_table, connection: connection)
           .where(source_key_column => start_id..stop_id)
           .where(type: nil)
       end
diff --git a/lib/gitlab/background_migration/batching_strategies/primary_key_batching_strategy.rb b/lib/gitlab/background_migration/batching_strategies/primary_key_batching_strategy.rb
index 8c2139c6207..09700438d47 100644
--- a/lib/gitlab/background_migration/batching_strategies/primary_key_batching_strategy.rb
+++ b/lib/gitlab/background_migration/batching_strategies/primary_key_batching_strategy.rb
@@ -19,7 +19,7 @@ module Gitlab
         # batch_size - The size of the next batch
         # job_arguments - The migration job arguments
         def next_batch(table_name, column_name, batch_min_value:, batch_size:, job_arguments:)
-          model_class = define_batchable_model(table_name)
+          model_class = define_batchable_model(table_name, connection: ActiveRecord::Base.connection)
 
           quoted_column_name = model_class.connection.quote_column_name(column_name)
           relation = model_class.where("#{quoted_column_name} >= ?", batch_min_value)
diff --git a/lib/gitlab/background_migration/copy_column_using_background_migration_job.rb b/lib/gitlab/background_migration/copy_column_using_background_migration_job.rb
index 529b8cdf8d4..415e3d869b3 100644
--- a/lib/gitlab/background_migration/copy_column_using_background_migration_job.rb
+++ b/lib/gitlab/background_migration/copy_column_using_background_migration_job.rb
@@ -57,7 +57,7 @@ module Gitlab
       end
 
       def relation_scoped_to_range(source_table, source_key_column, start_id, stop_id)
-        define_batchable_model(source_table).where(source_key_column => start_id..stop_id)
+        define_batchable_model(source_table, connection: connection).where(source_key_column => start_id..stop_id)
       end
 
       def column_assignment_clauses(copy_from, copy_to)
diff --git a/lib/gitlab/background_migration/delete_orphaned_deployments.rb b/lib/gitlab/background_migration/delete_orphaned_deployments.rb
index 9ac4111ff0f..5d41a46c8cd 100644
--- a/lib/gitlab/background_migration/delete_orphaned_deployments.rb
+++ b/lib/gitlab/background_migration/delete_orphaned_deployments.rb
@@ -15,7 +15,7 @@ module Gitlab
       end
 
       def orphaned_deployments
-        define_batchable_model('deployments')
+        define_batchable_model('deployments', connection: ActiveRecord::Base.connection)
           .where('NOT EXISTS (SELECT 1 FROM environments WHERE deployments.environment_id = environments.id)')
       end
 
diff --git a/lib/gitlab/background_migration/remove_vulnerability_finding_links.rb b/lib/gitlab/background_migration/remove_vulnerability_finding_links.rb
index 31fb5e97c5d..323f109449b 100644
--- a/lib/gitlab/background_migration/remove_vulnerability_finding_links.rb
+++ b/lib/gitlab/background_migration/remove_vulnerability_finding_links.rb
@@ -10,7 +10,9 @@ module Gitlab
       include Gitlab::Database::DynamicModelHelpers
 
       def perform(start_id, stop_id)
-        define_batchable_model('vulnerability_finding_links').where(id: start_id..stop_id).delete_all
+        define_batchable_model('vulnerability_finding_links', connection: ActiveRecord::Base.connection)
+          .where(id: start_id..stop_id)
+          .delete_all
       end
     end
   end
diff --git a/lib/gitlab/background_migration/update_timelogs_null_spent_at.rb b/lib/gitlab/background_migration/update_timelogs_null_spent_at.rb
index c95ef9f5515..f54bb8256d0 100644
--- a/lib/gitlab/background_migration/update_timelogs_null_spent_at.rb
+++ b/lib/gitlab/background_migration/update_timelogs_null_spent_at.rb
@@ -9,7 +9,9 @@ module Gitlab
       BATCH_SIZE = 100
 
       def perform(start_id, stop_id)
-        define_batchable_model('timelogs').where(spent_at: nil, id: start_id..stop_id).each_batch(of: 100) do |subbatch|
+        define_batchable_model('timelogs', connection: connection)
+            .where(spent_at: nil, id: start_id..stop_id)
+            .each_batch(of: 100) do |subbatch|
           batch_start, batch_end = subbatch.pluck('min(id), max(id)').first
 
           update_timelogs(batch_start, batch_end)
@@ -25,9 +27,12 @@ module Gitlab
         SQL
       end
 
-      def execute(sql)
+      def connection
         @connection ||= ::ActiveRecord::Base.connection
-        @connection.execute(sql)
+      end
+
+      def execute(sql)
+        connection.execute(sql)
       end
     end
   end
diff --git a/lib/gitlab/backtrace_cleaner.rb b/lib/gitlab/backtrace_cleaner.rb
index d2ca2057eb6..caea05c720d 100644
--- a/lib/gitlab/backtrace_cleaner.rb
+++ b/lib/gitlab/backtrace_cleaner.rb
@@ -17,6 +17,7 @@ module Gitlab
       lib/gitlab/profiler.rb
       lib/gitlab/query_limiting/
       lib/gitlab/request_context.rb
+      lib/gitlab/request_profiler/
       lib/gitlab/sidekiq_logging/
       lib/gitlab/sidekiq_middleware/
       lib/gitlab/sidekiq_status/
diff --git a/lib/gitlab/database/dynamic_model_helpers.rb b/lib/gitlab/database/dynamic_model_helpers.rb
index 220062f1bc6..ad7dea8f0d9 100644
--- a/lib/gitlab/database/dynamic_model_helpers.rb
+++ b/lib/gitlab/database/dynamic_model_helpers.rb
@@ -5,16 +5,19 @@ module Gitlab
     module DynamicModelHelpers
       BATCH_SIZE = 1_000
 
-      def define_batchable_model(table_name)
-        Class.new(ActiveRecord::Base) do
+      def define_batchable_model(table_name, connection:)
+        klass = Class.new(ActiveRecord::Base) do
           include EachBatch
 
           self.table_name = table_name
           self.inheritance_column = :_type_disabled
         end
+
+        klass.connection = connection
+        klass
       end
 
-      def each_batch(table_name, scope: ->(table) { table.all }, of: BATCH_SIZE)
+      def each_batch(table_name, connection:, scope: ->(table) { table.all }, of: BATCH_SIZE)
         if transaction_open?
           raise <<~MSG.squish
             each_batch should not run inside a transaction, you can disable
@@ -23,12 +26,12 @@ module Gitlab
           MSG
         end
 
-        scope.call(define_batchable_model(table_name))
+        scope.call(define_batchable_model(table_name, connection: connection))
           .each_batch(of: of) { |batch| yield batch }
       end
 
-      def each_batch_range(table_name, scope: ->(table) { table.all }, of: BATCH_SIZE)
-        each_batch(table_name, scope: scope, of: of) do |batch|
+      def each_batch_range(table_name, connection:, scope: ->(table) { table.all }, of: BATCH_SIZE)
+        each_batch(table_name, connection: connection, scope: scope, of: of) do |batch|
           yield batch.pluck('MIN(id), MAX(id)').first
         end
       end
diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index 23f8a44d2d2..63c031a6d0b 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -9,6 +9,18 @@ module Gitlab
       include RenameTableHelpers
       include AsyncIndexes::MigrationHelpers
 
+      def define_batchable_model(table_name, connection: self.connection)
+        super(table_name, connection: connection)
+      end
+
+      def each_batch(table_name, connection: self.connection, **kwargs)
+        super(table_name, connection: connection, **kwargs)
+      end
+
+      def each_batch_range(table_name, connection: self.connection, **kwargs)
+        super(table_name, connection: connection, **kwargs)
+      end
+
       # https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS
       MAX_IDENTIFIER_NAME_LENGTH = 63
       DEFAULT_TIMESTAMP_COLUMNS = %i[created_at updated_at].freeze
diff --git a/lib/gitlab/database/partitioning_migration_helpers/backfill_partitioned_table.rb b/lib/gitlab/database/partitioning_migration_helpers/backfill_partitioned_table.rb
index f551fa06cad..9cab2c51b3f 100644
--- a/lib/gitlab/database/partitioning_migration_helpers/backfill_partitioned_table.rb
+++ b/lib/gitlab/database/partitioning_migration_helpers/backfill_partitioned_table.rb
@@ -49,7 +49,7 @@ module Gitlab
         end
 
         def relation_scoped_to_range(source_table, source_key_column, start_id, stop_id)
-          define_batchable_model(source_table)
+          define_batchable_model(source_table, connection: connection)
             .where(source_key_column => start_id..stop_id)
         end
 
diff --git a/lib/gitlab/database/partitioning_migration_helpers/table_management_helpers.rb b/lib/gitlab/database/partitioning_migration_helpers/table_management_helpers.rb
index 984c708aa48..e56ffddac4f 100644
--- a/lib/gitlab/database/partitioning_migration_helpers/table_management_helpers.rb
+++ b/lib/gitlab/database/partitioning_migration_helpers/table_management_helpers.rb
@@ -5,7 +5,6 @@ module Gitlab
     module PartitioningMigrationHelpers
       module TableManagementHelpers
         include ::Gitlab::Database::SchemaHelpers
-        include ::Gitlab::Database::DynamicModelHelpers
         include ::Gitlab::Database::MigrationHelpers
         include ::Gitlab::Database::Migrations::BackgroundMigrationHelpers
 
diff --git a/lib/gitlab/profiler.rb b/lib/gitlab/profiler.rb
index bedcc07e196..b2179d80a18 100644
--- a/lib/gitlab/profiler.rb
+++ b/lib/gitlab/profiler.rb
@@ -16,6 +16,7 @@ module Gitlab
       lib/gitlab/middleware/
       ee/lib/gitlab/middleware/
       lib/gitlab/performance_bar/
+      lib/gitlab/request_profiler/
       lib/gitlab/query_limiting/
       lib/gitlab/tracing/
       lib/gitlab/profiler.rb
diff --git a/lib/gitlab/request_profiler.rb b/lib/gitlab/request_profiler.rb
new file mode 100644
index 00000000000..541d505e735
--- /dev/null
+++ b/lib/gitlab/request_profiler.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+
+module Gitlab
+  module RequestProfiler
+    PROFILES_DIR = "#{Gitlab.config.shared.path}/tmp/requests_profiles"
+
+    def all
+      Dir["#{PROFILES_DIR}/*.{html,txt}"].map do |path|
+        Profile.new(File.basename(path))
+      end.select(&:valid?)
+    end
+    module_function :all # rubocop: disable Style/AccessModifierDeclarations
+
+    def find(name)
+      file_path = File.join(PROFILES_DIR, name)
+      return unless File.exist?(file_path)
+
+      Profile.new(name)
+    end
+    module_function :find # rubocop: disable Style/AccessModifierDeclarations
+
+    def profile_token
+      Rails.cache.fetch('profile-token') do
+        Devise.friendly_token
+      end
+    end
+    module_function :profile_token # rubocop: disable Style/AccessModifierDeclarations
+
+    def remove_all_profiles
+      FileUtils.rm_rf(PROFILES_DIR)
+    end
+    module_function :remove_all_profiles # rubocop: disable Style/AccessModifierDeclarations
+  end
+end
diff --git a/lib/gitlab/request_profiler/middleware.rb b/lib/gitlab/request_profiler/middleware.rb
new file mode 100644
index 00000000000..acdf8d4541f
--- /dev/null
+++ b/lib/gitlab/request_profiler/middleware.rb
@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require 'ruby-prof'
+require 'memory_profiler'
+
+module Gitlab
+  module RequestProfiler
+    class Middleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        if profile?(env)
+          call_with_profiling(env)
+        else
+          @app.call(env)
+        end
+      end
+
+      def profile?(env)
+        header_token = env['HTTP_X_PROFILE_TOKEN']
+        return unless header_token.present?
+
+        profile_token = Gitlab::RequestProfiler.profile_token
+        return unless profile_token.present?
+
+        header_token == profile_token
+      end
+
+      def call_with_profiling(env)
+        case env['HTTP_X_PROFILE_MODE']
+        when 'execution', nil
+          call_with_call_stack_profiling(env)
+        when 'memory'
+          call_with_memory_profiling(env)
+        else
+          raise ActionController::BadRequest, invalid_profile_mode(env)
+        end
+      end
+
+      def invalid_profile_mode(env)
+        <<~HEREDOC
+          Invalid X-Profile-Mode: #{env['HTTP_X_PROFILE_MODE']}.
+          Supported profile mode request header:
+            - X-Profile-Mode: execution
+            - X-Profile-Mode: memory
+        HEREDOC
+      end
+
+      def call_with_call_stack_profiling(env)
+        ret = nil
+        report = RubyProf::Profile.profile do
+          ret = catch(:warden) do # rubocop:disable Cop/BanCatchThrow
+            @app.call(env)
+          end
+        end
+
+        generate_report(env, 'execution', 'html') do |file|
+          printer = RubyProf::CallStackPrinter.new(report)
+          printer.print(file)
+        end
+
+        handle_request_ret(ret)
+      end
+
+      def call_with_memory_profiling(env)
+        ret = nil
+        report = MemoryProfiler.report do
+          ret = catch(:warden) do # rubocop:disable Cop/BanCatchThrow
+            @app.call(env)
+          end
+        end
+
+        generate_report(env, 'memory', 'txt') do |file|
+          report.pretty_print(to_file: file)
+        end
+
+        handle_request_ret(ret)
+      end
+
+      def generate_report(env, report_type, extension)
+        file_name = "#{env['PATH_INFO'].tr('/', '|')}_#{Time.current.to_i}"\
+                    "_#{report_type}.#{extension}"
+        file_path = "#{PROFILES_DIR}/#{file_name}"
+
+        FileUtils.mkdir_p(PROFILES_DIR)
+
+        begin
+          File.open(file_path, 'wb') do |file|
+            yield(file)
+          end
+        rescue StandardError
+          FileUtils.rm(file_path)
+        end
+      end
+
+      def handle_request_ret(ret)
+        if ret.is_a?(Array)
+          ret
+        else
+          throw(:warden, ret) # rubocop:disable Cop/BanCatchThrow
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/request_profiler/profile.rb b/lib/gitlab/request_profiler/profile.rb
new file mode 100644
index 00000000000..76c675658b1
--- /dev/null
+++ b/lib/gitlab/request_profiler/profile.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module RequestProfiler
+    class Profile
+      attr_reader :name, :time, :file_path, :request_path, :profile_mode, :type
+
+      alias_method :to_param, :name
+
+      def initialize(name)
+        @name = name
+        @file_path = File.join(PROFILES_DIR, name)
+
+        set_attributes
+      end
+
+      def valid?
+        @request_path.present?
+      end
+
+      def content_type
+        case type
+        when 'html'
+          'text/html'
+        when 'txt'
+          'text/plain'
+        end
+      end
+
+      private
+
+      def set_attributes
+        matches = name.match(/^(?<path>.*)_(?<timestamp>\d+)(_(?<profile_mode>\w+))?\.(?<type>html|txt)$/)
+        return unless matches
+
+        @request_path      = matches[:path].tr('|', '/')
+        @time              = Time.at(matches[:timestamp].to_i).utc
+        @profile_mode      = matches[:profile_mode] || 'unknown'
+        @type              = matches[:type]
+      end
+    end
+  end
+end
diff --git a/lib/security/ci_configuration/base_build_action.rb b/lib/security/ci_configuration/base_build_action.rb
index 880bfa6d61d..6012067fb53 100644
--- a/lib/security/ci_configuration/base_build_action.rb
+++ b/lib/security/ci_configuration/base_build_action.rb
@@ -42,6 +42,7 @@ module Security
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
         YAML
diff --git a/lib/security/ci_configuration/container_scanning_build_action.rb b/lib/security/ci_configuration/container_scanning_build_action.rb
new file mode 100644
index 00000000000..82f9f7d0320
--- /dev/null
+++ b/lib/security/ci_configuration/container_scanning_build_action.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Security
+  module CiConfiguration
+    class ContainerScanningBuildAction < BaseBuildAction
+      private
+
+      def update_existing_content!
+        @existing_gitlab_ci_content['include'] = generate_includes
+      end
+
+      def template
+        return 'Auto-DevOps.gitlab-ci.yml' if @auto_devops_enabled
+
+        'Security/Container-Scanning.gitlab-ci.yml'
+      end
+
+      def comment
+        <<~YAML
+          #{super}
+          # container_scanning:
+          #   variables:
+          #     DOCKER_IMAGE: ...
+          #     DOCKER_USER: ...
+          #     DOCKER_PASSWORD: ...
+        YAML
+      end
+    end
+  end
+end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index d6d6251056c..dcd9dacc4a4 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -7587,7 +7587,7 @@ msgstr ""
 msgid "ClusterAgents|All"
 msgstr ""
 
-msgid "ClusterAgents|An error occurred while loading your GitLab Agents"
+msgid "ClusterAgents|An error occurred while loading your Agents"
 msgstr ""
 
 msgid "ClusterAgents|An error occurred while loading your agent"
@@ -7674,6 +7674,9 @@ msgstr ""
 msgid "ClusterAgents|GitLab Agent for Kubernetes"
 msgstr ""
 
+msgid "ClusterAgents|Give feedback"
+msgstr ""
+
 msgid "ClusterAgents|Go to the repository files"
 msgstr ""
 
@@ -7758,6 +7761,9 @@ msgstr ""
 msgid "ClusterAgents|Select an agent to register with GitLab"
 msgstr ""
 
+msgid "ClusterAgents|Tell us what you think"
+msgstr ""
+
 msgid "ClusterAgents|The GitLab Agent provides an increased level of security when connecting Kubernetes clusters to GitLab. %{linkStart}Learn more about the GitLab Agent.%{linkEnd}"
 msgstr ""
 
@@ -7799,6 +7805,9 @@ msgstr ""
 msgid "ClusterAgents|View all %{number} clusters"
 msgstr ""
 
+msgid "ClusterAgents|We would love to learn more about your experience with the GitLab Agent."
+msgstr ""
+
 msgid "ClusterAgents|What is GitLab Agent activity?"
 msgstr ""
 
@@ -9034,6 +9043,12 @@ msgstr ""
 msgid "Configure CAPTCHAs, IP address limits, and other anti-spam measures."
 msgstr ""
 
+msgid "Configure Container Scanning in `.gitlab-ci.yml` using the GitLab managed template. You can [add variable overrides](https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings) to customize Container Scanning settings."
+msgstr ""
+
+msgid "Configure Container Scanning in `.gitlab-ci.yml`, creating this file if it does not already exist"
+msgstr ""
+
 msgid "Configure Dependency Scanning in `.gitlab-ci.yml` using the GitLab managed template. You can [add variable overrides](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings) to customize Dependency Scanning settings."
 msgstr ""
 
@@ -10856,10 +10871,10 @@ msgstr ""
 msgid "DORA4Metrics|Deployment frequency"
 msgstr ""
 
-msgid "DORA4Metrics|Lead time"
+msgid "DORA4Metrics|Lead time for changes"
 msgstr ""
 
-msgid "DORA4Metrics|Median lead time"
+msgid "DORA4Metrics|Median (last %{days}d)"
 msgstr ""
 
 msgid "DORA4Metrics|No merge requests were deployed during this period"
@@ -24234,6 +24249,9 @@ msgstr ""
 msgid "No prioritized labels with such name or description"
 msgstr ""
 
+msgid "No profiles found"
+msgstr ""
+
 msgid "No project subscribes to the pipelines in this project."
 msgstr ""
 
@@ -25781,6 +25799,9 @@ msgstr ""
 msgid "Pass job variables"
 msgstr ""
 
+msgid "Pass the header %{codeOpen} X-Profile-Token: %{profile_token} %{codeClose} to profile the request"
+msgstr ""
+
 msgid "Passed"
 msgstr ""
 
@@ -28331,7 +28352,7 @@ msgstr ""
 msgid "ProjectSettings|View and edit files in this project."
 msgstr ""
 
-msgid "ProjectSettings|View and edit files in this project. Non-project members will only have read access."
+msgid "ProjectSettings|View and edit files in this project. Non-project members have only read access."
 msgstr ""
 
 msgid "ProjectSettings|View project analytics."
@@ -30382,6 +30403,9 @@ msgstr ""
 msgid "Requests"
 msgstr ""
 
+msgid "Requests Profiles"
+msgstr ""
+
 msgid "Requests for pages at %{code_start}%{help_text_url}%{code_end} redirect to the URL. The destination must meet certain requirements. %{docs_link_start}Learn more.%{docs_link_end}"
 msgstr ""
 
@@ -34786,9 +34810,6 @@ msgstr ""
 msgid "Sunday"
 msgstr ""
 
-msgid "SuperSonics|Activate cloud license"
-msgstr ""
-
 msgid "SuperSonics|Activate subscription"
 msgstr ""
 
@@ -34813,6 +34834,9 @@ msgstr ""
 msgid "SuperSonics|Cloud licensing is now available. It's an easier way to activate instances and manage subscriptions. Read more about it in our %{blogPostLinkStart}blog post%{blogPostLinkEnd}. Activation codes are available in the %{portalLinkStart}Customers Portal%{portalLinkEnd}."
 msgstr ""
 
+msgid "SuperSonics|Enter activation code"
+msgstr ""
+
 msgid "SuperSonics|Export license usage file"
 msgstr ""
 
diff --git a/qa/qa/specs/features/browser_ui/5_package/package_registry/maven_gradle_repository_spec.rb b/qa/qa/specs/features/browser_ui/5_package/package_registry/maven_gradle_repository_spec.rb
index e9520b3f834..908376ca2ca 100644
--- a/qa/qa/specs/features/browser_ui/5_package/package_registry/maven_gradle_repository_spec.rb
+++ b/qa/qa/specs/features/browser_ui/5_package/package_registry/maven_gradle_repository_spec.rb
@@ -13,10 +13,10 @@ module QA
       let(:package_version) { '1.3.7' }
       let(:package_type) { 'maven_gradle' }
 
-      where(:authentication_token_type, :maven_header_name) do
-        :personal_access_token | 'Private-Token'
-        :ci_job_token          | 'Job-Token'
-        :project_deploy_token  | 'Deploy-Token'
+      where(:authentication_token_type, :maven_header_name, :testcase) do
+        :personal_access_token | 'Private-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347601'
+        :ci_job_token          | 'Job-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347603'
+        :project_deploy_token  | 'Deploy-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347602'
       end
 
       with_them do
@@ -31,7 +31,7 @@ module QA
           end
         end
 
-        it "pushes and pulls a maven package via gradle using #{params[:authentication_token_type]}" do
+        it "pushes and pulls a maven package via gradle using #{params[:authentication_token_type]}", testcase: params[:testcase] do
           Support::Retrier.retry_on_exception(max_attempts: 3, sleep_interval: 2) do
             Resource::Repository::Commit.fabricate_via_api! do |commit|
               gradle_upload_yaml = ERB.new(read_fixture('package_managers/maven', 'gradle_upload_package.yaml.erb')).result(binding)
diff --git a/spec/controllers/admin/requests_profiles_controller_spec.rb b/spec/controllers/admin/requests_profiles_controller_spec.rb
new file mode 100644
index 00000000000..7ee46b5b28a
--- /dev/null
+++ b/spec/controllers/admin/requests_profiles_controller_spec.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Admin::RequestsProfilesController do
+  let_it_be(:admin) { create(:admin) }
+
+  before do
+    sign_in(admin)
+  end
+
+  describe '#show' do
+    let(:tmpdir) { Dir.mktmpdir('profiler-test') }
+    let(:test_file) { File.join(tmpdir, basename) }
+
+    subject do
+      get :show, params: { name: basename }
+    end
+
+    before do
+      stub_const('Gitlab::RequestProfiler::PROFILES_DIR', tmpdir)
+      File.write(test_file, sample_data)
+    end
+
+    after do
+      FileUtils.rm_rf(tmpdir)
+    end
+
+    context 'when loading HTML profile' do
+      let(:basename) { "profile_#{Time.current.to_i}_execution.html" }
+
+      let(:sample_data) do
+        '<html> <body> <h1>Heading</h1> <p>paragraph.</p> </body> </html>'
+      end
+
+      it 'renders the data' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.body).to eq(sample_data)
+      end
+    end
+
+    context 'when loading TXT profile' do
+      let(:basename) { "profile_#{Time.current.to_i}_memory.txt" }
+
+      let(:sample_data) do
+        <<~TXT
+          Total allocated: 112096396 bytes (1080431 objects)
+          Total retained:  10312598 bytes (53567 objects)
+        TXT
+      end
+
+      it 'renders the data' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.body).to eq(sample_data)
+      end
+    end
+
+    context 'when loading PDF profile' do
+      let(:basename) { "profile_#{Time.current.to_i}_anything.pdf" }
+
+      let(:sample_data) { 'mocked pdf content' }
+
+      it 'fails to render the data' do
+        expect { subject }.to raise_error(ActionController::UrlGenerationError, /No route matches.*unmatched constraints:/)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/commits_controller_spec.rb b/spec/controllers/projects/commits_controller_spec.rb
index fd840fafa61..d84717f1124 100644
--- a/spec/controllers/projects/commits_controller_spec.rb
+++ b/spec/controllers/projects/commits_controller_spec.rb
@@ -88,6 +88,26 @@ RSpec.describe Projects::CommitsController do
 
           expect(response).to be_successful
         end
+
+        context 'when limit is a hash' do
+          it 'uses the default limit' do
+            expect_any_instance_of(Repository).to receive(:commits).with(
+              "master",
+              path: "README.md",
+              limit: described_class::COMMITS_DEFAULT_LIMIT,
+              offset: 0
+            ).and_call_original
+
+            get(:show, params: {
+              namespace_id: project.namespace,
+              project_id: project,
+              id: id,
+              limit: { 'broken' => 'value' }
+            })
+
+            expect(response).to be_successful
+          end
+        end
       end
 
       context "when the ref name ends in .atom" do
diff --git a/spec/controllers/projects/settings/repository_controller_spec.rb b/spec/controllers/projects/settings/repository_controller_spec.rb
index 2bb93990c58..22287fea82c 100644
--- a/spec/controllers/projects/settings/repository_controller_spec.rb
+++ b/spec/controllers/projects/settings/repository_controller_spec.rb
@@ -33,6 +33,20 @@ RSpec.describe Projects::Settings::RepositoryController do
 
       expect(response).to redirect_to project_settings_repository_path(project)
     end
+
+    context 'when project cleanup returns an error', :aggregate_failures do
+      it 'shows an error' do
+        expect(Projects::CleanupService)
+          .to receive(:enqueue)
+          .with(project, user, anything)
+          .and_return(status: :error, message: 'error message')
+
+        put :cleanup, params: { namespace_id: project.namespace, project_id: project, project: { bfg_object_map: object_map } }
+
+        expect(controller).to set_flash[:alert].to('error message')
+        expect(response).to redirect_to project_settings_repository_path(project)
+      end
+    end
   end
 
   describe 'POST create_deploy_token' do
diff --git a/spec/features/admin/admin_requests_profiles_spec.rb b/spec/features/admin/admin_requests_profiles_spec.rb
new file mode 100644
index 00000000000..e92528d431d
--- /dev/null
+++ b/spec/features/admin/admin_requests_profiles_spec.rb
@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Admin::RequestsProfilesController' do
+  let(:tmpdir) { Dir.mktmpdir('profiler-test') }
+
+  before do
+    stub_const('Gitlab::RequestProfiler::PROFILES_DIR', tmpdir)
+    admin = create(:admin)
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+  end
+
+  after do
+    FileUtils.rm_rf(tmpdir)
+  end
+
+  describe 'GET /admin/requests_profiles' do
+    it 'shows the current profile token' do
+      allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new)
+
+      visit admin_requests_profiles_path
+
+      expect(page).to have_content("X-Profile-Token: #{Gitlab::RequestProfiler.profile_token}")
+    end
+
+    context 'when having multiple profiles' do
+      let(:time1) { 1.hour.ago }
+      let(:time2) { 2.hours.ago }
+
+      let(:profiles) do
+        [
+          {
+            request_path: '/gitlab-org/gitlab-foss',
+            name: "|gitlab-org|gitlab-foss_#{time1.to_i}_execution.html",
+            created: time1,
+            profile_mode: 'Execution'
+          },
+          {
+            request_path: '/gitlab-org/gitlab-foss',
+            name: "|gitlab-org|gitlab-foss_#{time2.to_i}_execution.html",
+            created: time2,
+            profile_mode: 'Execution'
+          },
+          {
+            request_path: '/gitlab-org/gitlab-foss',
+            name: "|gitlab-org|gitlab-foss_#{time1.to_i}_memory.html",
+            created: time1,
+            profile_mode: 'Memory'
+          },
+          {
+            request_path: '/gitlab-org/gitlab-foss',
+            name: "|gitlab-org|gitlab-foss_#{time2.to_i}_memory.html",
+            created: time2,
+            profile_mode: 'Memory'
+          },
+          {
+            request_path: '/gitlab-org/infrastructure',
+            name: "|gitlab-org|infrastructure_#{time1.to_i}_execution.html",
+            created: time1,
+            profile_mode: 'Execution'
+          },
+          {
+            request_path: '/gitlab-org/infrastructure',
+            name: "|gitlab-org|infrastructure_#{time2.to_i}_memory.html",
+            created: time2,
+            profile_mode: 'Memory'
+          },
+          {
+            request_path: '/gitlab-org/infrastructure',
+            name: "|gitlab-org|infrastructure_#{time2.to_i}.html",
+            created: time2,
+            profile_mode: 'Unknown'
+          }
+        ]
+      end
+
+      before do
+        profiles.each do |profile|
+          FileUtils.touch(File.join(Gitlab::RequestProfiler::PROFILES_DIR, profile[:name]))
+        end
+      end
+
+      it 'lists all available profiles' do
+        visit admin_requests_profiles_path
+
+        profiles.each do |profile|
+          within('.card', text: profile[:request_path]) do
+            expect(page).to have_selector(
+              "a[href='#{admin_requests_profile_path(profile[:name])}']",
+              text: "#{profile[:created].to_s(:long)} #{profile[:profile_mode]}")
+          end
+        end
+      end
+    end
+  end
+
+  describe 'GET /admin/requests_profiles/:profile' do
+    context 'when a profile exists' do
+      before do
+        File.write("#{Gitlab::RequestProfiler::PROFILES_DIR}/#{profile}", content)
+      end
+
+      context 'when is valid call stack profile' do
+        let(:content) { 'This is a call stack request profile' }
+        let(:profile) { "|gitlab-org|gitlab-ce_#{Time.now.to_i}_execution.html" }
+
+        it 'displays the content' do
+          visit admin_requests_profile_path(profile)
+
+          expect(page).to have_content(content)
+        end
+      end
+
+      context 'when is valid memory profile' do
+        let(:content) { 'This is a memory request profile' }
+        let(:profile) { "|gitlab-org|gitlab-ce_#{Time.now.to_i}_memory.txt" }
+
+        it 'displays the content' do
+          visit admin_requests_profile_path(profile)
+
+          expect(page).to have_content(content)
+        end
+      end
+    end
+
+    context 'when a profile does not exist' do
+      it 'shows an error message' do
+        visit admin_requests_profile_path('|non|existent_12345.html')
+
+        expect(page).to have_content('Profile not found')
+      end
+    end
+  end
+end
diff --git a/spec/features/groups/members/manage_groups_spec.rb b/spec/features/groups/members/manage_groups_spec.rb
index 2beecda23b5..61c6709f9cc 100644
--- a/spec/features/groups/members/manage_groups_spec.rb
+++ b/spec/features/groups/members/manage_groups_spec.rb
@@ -156,6 +156,26 @@ RSpec.describe 'Groups > Members > Manage groups', :js do
       group_outside_hierarchy.add_owner(user)
     end
 
+    context 'when the invite members group modal is enabled' do
+      it 'does not show self or ancestors', :aggregate_failures do
+        group_sibbling = create(:group, parent: group)
+        group_sibbling.add_owner(user)
+
+        visit group_group_members_path(group_within_hierarchy)
+
+        click_on 'Invite a group'
+        click_on 'Select a group'
+        wait_for_requests
+
+        page.within('[data-testid="group-select-dropdown"]') do
+          expect(page).to have_selector("[entity-id='#{group_outside_hierarchy.id}']")
+          expect(page).to have_selector("[entity-id='#{group_sibbling.id}']")
+          expect(page).not_to have_selector("[entity-id='#{group.id}']")
+          expect(page).not_to have_selector("[entity-id='#{group_within_hierarchy.id}']")
+        end
+      end
+    end
+
     context 'when sharing with groups outside the hierarchy is enabled' do
       context 'when the invite members group modal is disabled' do
         before do
diff --git a/spec/features/projects/members/invite_group_spec.rb b/spec/features/projects/members/invite_group_spec.rb
index 08ec2f54fba..066e0b0d20f 100644
--- a/spec/features/projects/members/invite_group_spec.rb
+++ b/spec/features/projects/members/invite_group_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'Project > Members > Invite group', :js do
   include Spec::Support::Helpers::Features::MembersHelpers
   include Spec::Support::Helpers::Features::InviteMembersModalHelper
 
-  let(:maintainer) { create(:user) }
+  let_it_be(:maintainer) { create(:user) }
 
   using RSpec::Parameterized::TableSyntax
 
@@ -190,17 +190,26 @@ RSpec.describe 'Project > Members > Invite group', :js do
   end
 
   describe 'the groups dropdown' do
-    context 'with multiple groups to choose from' do
-      let(:project) { create(:project) }
+    let_it_be(:parent_group) { create(:group, :public) }
+    let_it_be(:project_group) { create(:group, :public, parent: parent_group) }
+    let_it_be(:public_sub_subgroup) { create(:group, :public, parent: project_group) }
+    let_it_be(:public_sibbling_group) { create(:group, :public, parent: parent_group) }
+    let_it_be(:private_sibbling_group) { create(:group, :private, parent: parent_group) }
+    let_it_be(:private_membership_group) { create(:group, :private) }
+    let_it_be(:public_membership_group) { create(:group, :public) }
+    let_it_be(:project) { create(:project, group: project_group) }
 
-      it 'includes multiple groups' do
+    before do
+      private_membership_group.add_guest(maintainer)
+      public_membership_group.add_maintainer(maintainer)
+
+      sign_in(maintainer)
+    end
+
+    context 'for a project in a nested group' do
+      it 'does not show the groups inherited from projects' do
         project.add_maintainer(maintainer)
-        sign_in(maintainer)
-
-        group1 = create(:group)
-        group1.add_owner(maintainer)
-        group2 = create(:group)
-        group2.add_owner(maintainer)
+        public_sibbling_group.add_maintainer(maintainer)
 
         visit project_project_members_path(project)
 
@@ -208,57 +217,36 @@ RSpec.describe 'Project > Members > Invite group', :js do
         click_on 'Select a group'
         wait_for_requests
 
-        expect(page).to have_button(group1.name)
-        expect(page).to have_button(group2.name)
-      end
-    end
+        page.within('[data-testid="group-select-dropdown"]') do
+          expect_to_have_group(public_membership_group)
+          expect_to_have_group(public_sibbling_group)
+          expect_to_have_group(private_membership_group)
 
-    context 'for a project in a nested group' do
-      let!(:parent_group) { create(:group, :public) }
-      let!(:public_subgroup) { create(:group, :public, parent: parent_group) }
-      let!(:public_sub_subgroup) { create(:group, :public, parent: public_subgroup) }
-      let!(:private_subgroup) { create(:group, :private, parent: parent_group) }
-      let!(:project) { create(:project, :public, namespace: public_subgroup) }
-
-      let!(:membership_group) { create(:group, :public) }
-
-      before do
-        project.add_maintainer(maintainer)
-        membership_group.add_guest(maintainer)
-
-        sign_in(maintainer)
-      end
-
-      context 'when invite_members_group_modal feature enabled' do
-        it 'does not show the groups inherited from projects' do
-          visit project_project_members_path(project)
-
-          click_on 'Invite a group'
-          click_on 'Select a group'
-          wait_for_requests
-
-          expect(page).to have_button(membership_group.name)
-          expect(page).not_to have_button(parent_group.name)
-          expect(page).not_to have_button(public_subgroup.name)
-          expect(page).not_to have_button(public_sub_subgroup.name)
-          expect(page).not_to have_button(private_subgroup.name)
+          expect_not_to_have_group(public_sub_subgroup)
+          expect_not_to_have_group(private_sibbling_group)
+          expect_not_to_have_group(parent_group)
+          expect_not_to_have_group(project_group)
         end
+      end
 
-        # This behavior should be changed to exclude the ancestor and project
-        # group from the options once issue is fixed for the modal:
-        # https://gitlab.com/gitlab-org/gitlab/-/issues/329835
-        it 'does show ancestors and the project group' do
-          parent_group.add_maintainer(maintainer)
+      it 'does not show the ancestors or project group', :aggregate_failures do
+        parent_group.add_maintainer(maintainer)
 
-          visit project_project_members_path(project)
+        visit project_project_members_path(project)
 
-          click_on 'Invite a group'
-          click_on 'Select a group'
-          wait_for_requests
+        click_on 'Invite a group'
+        click_on 'Select a group'
+        wait_for_requests
 
-          expect(page).to have_button(membership_group.name)
-          expect(page).to have_button(parent_group.name)
-          expect(page).to have_button(public_subgroup.name)
+        page.within('[data-testid="group-select-dropdown"]') do
+          expect_to_have_group(public_membership_group)
+          expect_to_have_group(public_sibbling_group)
+          expect_to_have_group(private_membership_group)
+          expect_to_have_group(public_sub_subgroup)
+          expect_to_have_group(private_sibbling_group)
+
+          expect_not_to_have_group(parent_group)
+          expect_not_to_have_group(project_group)
         end
       end
 
@@ -269,21 +257,26 @@ RSpec.describe 'Project > Members > Invite group', :js do
           stub_feature_flags(invite_members_group_modal: false)
         end
 
-        it 'does not show the groups inherited from projects' do
+        it 'does not show the groups inherited from projects', :aggregate_failures do
+          project.add_maintainer(maintainer)
+          public_sibbling_group.add_maintainer(maintainer)
+
           visit project_project_members_path(project)
 
           click_on 'Invite group'
           click_on 'Search for a group'
           wait_for_requests
 
-          expect(group_invite_dropdown).to have_text(membership_group.name)
-          expect(group_invite_dropdown).not_to have_text(parent_group.name)
-          expect(group_invite_dropdown).not_to have_text(public_subgroup.name)
-          expect(group_invite_dropdown).not_to have_text(public_sub_subgroup.name)
-          expect(group_invite_dropdown).not_to have_text(private_subgroup.name)
+          expect(group_invite_dropdown).to have_text(public_membership_group.full_path)
+          expect(group_invite_dropdown).to have_text(public_sibbling_group.full_path)
+          expect(group_invite_dropdown).to have_text(private_membership_group.full_path)
+          expect(group_invite_dropdown).not_to have_text(public_sub_subgroup.full_path)
+          expect(group_invite_dropdown).not_to have_text(private_sibbling_group.full_path)
+          expect(group_invite_dropdown).not_to have_text(parent_group.full_path, exact: true)
+          expect(group_invite_dropdown).not_to have_text(project_group.full_path, exact: true)
         end
 
-        it 'does not show ancestors and the project group' do
+        it 'does not show the ancestors or project group', :aggregate_failures do
           parent_group.add_maintainer(maintainer)
 
           visit project_project_members_path(project)
@@ -292,11 +285,23 @@ RSpec.describe 'Project > Members > Invite group', :js do
           click_on 'Search for a group'
           wait_for_requests
 
-          expect(group_invite_dropdown).to have_text(membership_group.name)
-          expect(group_invite_dropdown).not_to have_text(parent_group.name, exact: true)
-          expect(group_invite_dropdown).not_to have_text(public_subgroup.name, exact: true)
+          expect(group_invite_dropdown).to have_text(public_membership_group.full_path)
+          expect(group_invite_dropdown).to have_text(public_sub_subgroup.full_path)
+          expect(group_invite_dropdown).to have_text(public_sibbling_group.full_path)
+          expect(group_invite_dropdown).to have_text(private_sibbling_group.full_path)
+          expect(group_invite_dropdown).to have_text(private_membership_group.full_path)
+          expect(group_invite_dropdown).not_to have_text(parent_group.full_path, exact: true)
+          expect(group_invite_dropdown).not_to have_text(project_group.full_path, exact: true)
         end
       end
+
+      def expect_to_have_group(group)
+        expect(page).to have_selector("[entity-id='#{group.id}']")
+      end
+
+      def expect_not_to_have_group(group)
+        expect(page).not_to have_selector("[entity-id='#{group.id}']")
+      end
     end
   end
 end
diff --git a/spec/frontend/clusters_list/components/agents_spec.js b/spec/frontend/clusters_list/components/agents_spec.js
index 5d7a6a251d2..c8b86fb49c1 100644
--- a/spec/frontend/clusters_list/components/agents_spec.js
+++ b/spec/frontend/clusters_list/components/agents_spec.js
@@ -1,13 +1,18 @@
-import { GlAlert, GlKeysetPagination, GlLoadingIcon } from '@gitlab/ui';
+import { GlAlert, GlKeysetPagination, GlLoadingIcon, GlBanner } from '@gitlab/ui';
 import { createLocalVue, shallowMount } from '@vue/test-utils';
 import VueApollo from 'vue-apollo';
 import { nextTick } from 'vue';
 import AgentEmptyState from '~/clusters_list/components/agent_empty_state.vue';
 import AgentTable from '~/clusters_list/components/agent_table.vue';
 import Agents from '~/clusters_list/components/agents.vue';
-import { ACTIVE_CONNECTION_TIME } from '~/clusters_list/constants';
+import {
+  ACTIVE_CONNECTION_TIME,
+  AGENT_FEEDBACK_KEY,
+  AGENT_FEEDBACK_ISSUE,
+} from '~/clusters_list/constants';
 import getAgentsQuery from '~/clusters_list/graphql/queries/get_agents.query.graphql';
 import createMockApollo from 'helpers/mock_apollo_helper';
+import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 
 const localVue = createLocalVue();
 localVue.use(VueApollo);
@@ -24,6 +29,7 @@ describe('Agents', () => {
 
   const createWrapper = async ({
     props = {},
+    glFeatures = {},
     agents = [],
     pageInfo = null,
     trees = [],
@@ -51,20 +57,29 @@ describe('Agents', () => {
         ...defaultProps,
         ...props,
       },
-      provide: provideData,
+      provide: {
+        ...provideData,
+        glFeatures,
+      },
+      stubs: {
+        GlBanner,
+        LocalStorageSync,
+      },
     });
 
     await nextTick();
   };
 
-  const findAgentTable = () => wrapper.find(AgentTable);
-  const findEmptyState = () => wrapper.find(AgentEmptyState);
-  const findPaginationButtons = () => wrapper.find(GlKeysetPagination);
+  const findAgentTable = () => wrapper.findComponent(AgentTable);
+  const findEmptyState = () => wrapper.findComponent(AgentEmptyState);
+  const findPaginationButtons = () => wrapper.findComponent(GlKeysetPagination);
+  const findAlert = () => wrapper.findComponent(GlAlert);
+  const findBanner = () => wrapper.findComponent(GlBanner);
 
   afterEach(() => {
-    if (wrapper) {
-      wrapper.destroy();
-    }
+    wrapper.destroy();
+
+    localStorage.removeItem(AGENT_FEEDBACK_KEY);
   });
 
   describe('when there is a list of agents', () => {
@@ -150,6 +165,49 @@ describe('Agents', () => {
       expect(wrapper.emitted().onAgentsLoad).toEqual([[count]]);
     });
 
+    describe.each`
+      featureFlagEnabled | localStorageItemExists | bannerShown
+      ${true}            | ${false}               | ${true}
+      ${true}            | ${true}                | ${false}
+      ${false}           | ${true}                | ${false}
+      ${false}           | ${false}               | ${false}
+    `(
+      'when the feature flag enabled is $featureFlagEnabled and dismissed localStorage item exists is $localStorageItemExists',
+      ({ featureFlagEnabled, localStorageItemExists, bannerShown }) => {
+        const glFeatures = {
+          showGitlabAgentFeedback: featureFlagEnabled,
+        };
+        beforeEach(() => {
+          if (localStorageItemExists) {
+            localStorage.setItem(AGENT_FEEDBACK_KEY, true);
+          }
+
+          return createWrapper({ glFeatures, agents, count, trees });
+        });
+
+        it(`should ${bannerShown ? 'show' : 'hide'} the feedback banner`, () => {
+          expect(findBanner().exists()).toBe(bannerShown);
+        });
+      },
+    );
+
+    describe('when the agent feedback banner is present', () => {
+      const glFeatures = {
+        showGitlabAgentFeedback: true,
+      };
+      beforeEach(() => {
+        return createWrapper({ glFeatures, agents, count, trees });
+      });
+
+      it('should render the correct title', () => {
+        expect(findBanner().props('title')).toBe('Tell us what you think');
+      });
+
+      it('should render the correct issue link', () => {
+        expect(findBanner().props('buttonLink')).toBe(AGENT_FEEDBACK_ISSUE);
+      });
+    });
+
     describe('when the agent has recently connected tokens', () => {
       it('should set agent status to active', () => {
         expect(findAgentTable().props('agents')).toMatchObject(expectedAgentsList);
@@ -223,6 +281,10 @@ describe('Agents', () => {
       expect(findAgentTable().exists()).toBe(false);
       expect(findEmptyState().exists()).toBe(true);
     });
+
+    it('should not show agent feedback alert', () => {
+      expect(findAlert().exists()).toBe(false);
+    });
   });
 
   describe('when agents query has errored', () => {
@@ -231,7 +293,7 @@ describe('Agents', () => {
     });
 
     it('displays an alert message', () => {
-      expect(wrapper.find(GlAlert).exists()).toBe(true);
+      expect(findAlert().text()).toBe('An error occurred while loading your Agents');
     });
   });
 
diff --git a/spec/frontend/invite_members/components/group_select_spec.js b/spec/frontend/invite_members/components/group_select_spec.js
index 6face6a785c..192f3fdd381 100644
--- a/spec/frontend/invite_members/components/group_select_spec.js
+++ b/spec/frontend/invite_members/components/group_select_spec.js
@@ -5,19 +5,20 @@ import * as groupsApi from '~/api/groups_api';
 import GroupSelect from '~/invite_members/components/group_select.vue';
 
 const accessLevels = { Guest: 10, Reporter: 20, Developer: 30, Maintainer: 40, Owner: 50 };
-
-const createComponent = () => {
-  return mount(GroupSelect, {
-    propsData: {
-      accessLevels,
-    },
-  });
-};
-
 const group1 = { id: 1, full_name: 'Group One', avatar_url: 'test' };
 const group2 = { id: 2, full_name: 'Group Two', avatar_url: 'test' };
 const allGroups = [group1, group2];
 
+const createComponent = (props = {}) => {
+  return mount(GroupSelect, {
+    propsData: {
+      invalidGroups: [],
+      accessLevels,
+      ...props,
+    },
+  });
+};
+
 describe('GroupSelect', () => {
   let wrapper;
 
@@ -90,6 +91,20 @@ describe('GroupSelect', () => {
         size: '32',
       });
     });
+
+    describe('when filtering out the group from results', () => {
+      beforeEach(() => {
+        wrapper = createComponent({ invalidGroups: [group1.id] });
+      });
+
+      it('does not find an invalid group', () => {
+        expect(findAvatarByLabel(group1.full_name)).toBe(undefined);
+      });
+
+      it('finds a group that is valid', () => {
+        expect(findAvatarByLabel(group2.full_name).exists()).toBe(true);
+      });
+    });
   });
 
   describe('when group is selected from the dropdown', () => {
diff --git a/spec/frontend/invite_members/components/invite_members_modal_spec.js b/spec/frontend/invite_members/components/invite_members_modal_spec.js
index 8b02d916045..72db6904c31 100644
--- a/spec/frontend/invite_members/components/invite_members_modal_spec.js
+++ b/spec/frontend/invite_members/components/invite_members_modal_spec.js
@@ -46,6 +46,7 @@ jest.mock('~/lib/utils/url_utility', () => ({
 const id = '1';
 const name = 'test name';
 const isProject = false;
+const invalidGroups = [];
 const inviteeType = 'members';
 const accessLevels = { Guest: 10, Reporter: 20, Developer: 30, Maintainer: 40, Owner: 50 };
 const defaultAccessLevel = 10;
@@ -93,6 +94,7 @@ const createComponent = (data = {}, props = {}) => {
       tasksToBeDoneOptions,
       projects,
       helpLink,
+      invalidGroups,
       ...props,
     },
     data() {
diff --git a/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js b/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
index 8a9bb025d55..305dce51971 100644
--- a/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
+++ b/spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js
@@ -244,7 +244,7 @@ describe('Settings Panel', () => {
       wrapper = mountComponent({ currentSettings: { visibilityLevel: visibilityOptions.PUBLIC } });
 
       expect(findRepositoryFeatureProjectRow().props('helpText')).toBe(
-        'View and edit files in this project. Non-project members will only have read access.',
+        'View and edit files in this project. Non-project members have only read access.',
       );
     });
   });
diff --git a/spec/helpers/invite_members_helper_spec.rb b/spec/helpers/invite_members_helper_spec.rb
index d8a97b93bc9..c032c7875a9 100644
--- a/spec/helpers/invite_members_helper_spec.rb
+++ b/spec/helpers/invite_members_helper_spec.rb
@@ -20,7 +20,8 @@ RSpec.describe InviteMembersHelper do
       attributes = {
         id: project.id,
         name: project.name,
-        default_access_level: Gitlab::Access::GUEST
+        default_access_level: Gitlab::Access::GUEST,
+        invalid_groups: project.related_group_ids
       }
 
       expect(helper.common_invite_modal_dataset(project)).to include(attributes)
@@ -155,4 +156,28 @@ RSpec.describe InviteMembersHelper do
       end
     end
   end
+
+  describe '#group_select_data' do
+    let_it_be(:group) { create(:group) }
+
+    context 'when sharing with groups outside the hierarchy is disabled' do
+      before do
+        group.namespace_settings.update!(prevent_sharing_groups_outside_hierarchy: true)
+      end
+
+      it 'provides the correct attributes' do
+        expect(helper.group_select_data(group)).to eq({ groups_filter: 'descendant_groups', parent_id: group.id })
+      end
+    end
+
+    context 'when sharing with groups outside the hierarchy is enabled' do
+      before do
+        group.namespace_settings.update!(prevent_sharing_groups_outside_hierarchy: false)
+      end
+
+      it 'returns an empty hash' do
+        expect(helper.group_select_data(project.group)).to eq({})
+      end
+    end
+  end
 end
diff --git a/spec/lib/backup/manager_spec.rb b/spec/lib/backup/manager_spec.rb
index 31cc3012eb1..9c186205067 100644
--- a/spec/lib/backup/manager_spec.rb
+++ b/spec/lib/backup/manager_spec.rb
@@ -409,7 +409,7 @@ RSpec.describe Backup::Manager do
 
       # the Fog mock only knows about directories we create explicitly
       connection = ::Fog::Storage.new(Gitlab.config.backup.upload.connection.symbolize_keys)
-      connection.directories.create(key: Gitlab.config.backup.upload.remote_directory)
+      connection.directories.create(key: Gitlab.config.backup.upload.remote_directory) # rubocop:disable Rails/SaveBang
     end
 
     context 'target path' do
@@ -455,7 +455,7 @@ RSpec.describe Backup::Manager do
           }
         )
 
-        connection.directories.create(key: Gitlab.config.backup.upload.remote_directory)
+        connection.directories.create(key: Gitlab.config.backup.upload.remote_directory) # rubocop:disable Rails/SaveBang
       end
 
       context 'with SSE-S3 without using storage_options' do
@@ -521,7 +521,7 @@ RSpec.describe Backup::Manager do
         )
 
         connection = ::Fog::Storage.new(Gitlab.config.backup.upload.connection.symbolize_keys)
-        connection.directories.create(key: Gitlab.config.backup.upload.remote_directory)
+        connection.directories.create(key: Gitlab.config.backup.upload.remote_directory) # rubocop:disable Rails/SaveBang
       end
 
       it 'does not attempt to set ACL' do
diff --git a/spec/lib/gitlab/analytics/cycle_analytics/records_fetcher_spec.rb b/spec/lib/gitlab/analytics/cycle_analytics/records_fetcher_spec.rb
index 4fe55ba0c0c..dc46dade87e 100644
--- a/spec/lib/gitlab/analytics/cycle_analytics/records_fetcher_spec.rb
+++ b/spec/lib/gitlab/analytics/cycle_analytics/records_fetcher_spec.rb
@@ -43,8 +43,8 @@ RSpec.describe Gitlab::Analytics::CycleAnalytics::RecordsFetcher do
       end
 
       before do
-        issue1.metrics.update(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
-        issue2.metrics.update(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
+        issue1.metrics.update!(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
+        issue2.metrics.update!(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
       end
 
       context 'when records are loaded by guest' do
@@ -73,8 +73,8 @@ RSpec.describe Gitlab::Analytics::CycleAnalytics::RecordsFetcher do
       end
 
       before do
-        mr1.metrics.update(merged_at: 3.days.ago)
-        mr2.metrics.update(merged_at: 3.days.ago)
+        mr1.metrics.update!(merged_at: 3.days.ago)
+        mr2.metrics.update!(merged_at: 3.days.ago)
       end
 
       include_context 'when records are loaded by maintainer'
@@ -95,9 +95,9 @@ RSpec.describe Gitlab::Analytics::CycleAnalytics::RecordsFetcher do
     end
 
     before(:all) do
-      issue1.metrics.update(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
-      issue2.metrics.update(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
-      issue3.metrics.update(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
+      issue1.metrics.update!(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
+      issue2.metrics.update!(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
+      issue3.metrics.update!(first_added_to_board_at: 3.days.ago, first_mentioned_in_commit_at: 2.days.ago)
     end
 
     before do
diff --git a/spec/lib/gitlab/auth/ldap/user_spec.rb b/spec/lib/gitlab/auth/ldap/user_spec.rb
index e910ac09448..da0bb5fe675 100644
--- a/spec/lib/gitlab/auth/ldap/user_spec.rb
+++ b/spec/lib/gitlab/auth/ldap/user_spec.rb
@@ -53,12 +53,12 @@ RSpec.describe Gitlab::Auth::Ldap::User do
     it "finds the user if already existing" do
       create(:omniauth_user, extern_uid: 'uid=john smith,ou=people,dc=example,dc=com', provider: 'ldapmain')
 
-      expect { ldap_user.save }.not_to change { User.count }
+      expect { ldap_user.save }.not_to change { User.count } # rubocop:disable Rails/SaveBang
     end
 
     it "connects to existing non-ldap user if the email matches" do
       existing_user = create(:omniauth_user, email: 'john@example.com', provider: "twitter")
-      expect { ldap_user.save }.not_to change { User.count }
+      expect { ldap_user.save }.not_to change { User.count } # rubocop:disable Rails/SaveBang
 
       existing_user.reload
       expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
@@ -67,7 +67,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
 
     it 'connects to existing ldap user if the extern_uid changes' do
       existing_user = create(:omniauth_user, email: 'john@example.com', extern_uid: 'old-uid', provider: 'ldapmain')
-      expect { ldap_user.save }.not_to change { User.count }
+      expect { ldap_user.save }.not_to change { User.count } # rubocop:disable Rails/SaveBang
 
       existing_user.reload
       expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
@@ -77,7 +77,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
 
     it 'connects to existing ldap user if the extern_uid changes and email address has upper case characters' do
       existing_user = create(:omniauth_user, email: 'john@example.com', extern_uid: 'old-uid', provider: 'ldapmain')
-      expect { ldap_user_upper_case.save }.not_to change { User.count }
+      expect { ldap_user_upper_case.save }.not_to change { User.count } # rubocop:disable Rails/SaveBang
 
       existing_user.reload
       expect(existing_user.ldap_identity.extern_uid).to eql 'uid=john smith,ou=people,dc=example,dc=com'
@@ -89,7 +89,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
       existing_user = create(:omniauth_user, email: 'john@example.com', provider: 'twitter')
       expect(existing_user.identities.count).to be(1)
 
-      ldap_user.save
+      ldap_user.save # rubocop:disable Rails/SaveBang
       expect(ldap_user.gl_user.identities.count).to be(2)
 
       # Expect that find_by provider only returns a single instance of an identity and not an Enumerable
@@ -98,7 +98,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
     end
 
     it "creates a new user if not found" do
-      expect { ldap_user.save }.to change { User.count }.by(1)
+      expect { ldap_user.save }.to change { User.count }.by(1) # rubocop:disable Rails/SaveBang
     end
 
     context 'when signup is disabled' do
@@ -107,7 +107,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
       end
 
       it 'creates the user' do
-        ldap_user.save
+        ldap_user.save # rubocop:disable Rails/SaveBang
 
         expect(gl_user).to be_persisted
       end
@@ -119,7 +119,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
       end
 
       it 'creates and confirms the user anyway' do
-        ldap_user.save
+        ldap_user.save # rubocop:disable Rails/SaveBang
 
         expect(gl_user).to be_persisted
         expect(gl_user).to be_confirmed
@@ -132,7 +132,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
       end
 
       it 'creates the user' do
-        ldap_user.save
+        ldap_user.save # rubocop:disable Rails/SaveBang
 
         expect(gl_user).to be_persisted
       end
@@ -189,7 +189,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
         end
 
         it do
-          ldap_user.save
+          ldap_user.save # rubocop:disable Rails/SaveBang
           expect(gl_user).to be_valid
           expect(gl_user).not_to be_blocked
         end
@@ -201,7 +201,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
         end
 
         it do
-          ldap_user.save
+          ldap_user.save # rubocop:disable Rails/SaveBang
           expect(gl_user).to be_valid
           expect(gl_user).to be_blocked
         end
@@ -210,7 +210,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
 
     context 'sign-in' do
       before do
-        ldap_user.save
+        ldap_user.save # rubocop:disable Rails/SaveBang
         ldap_user.gl_user.activate
       end
 
@@ -220,7 +220,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
         end
 
         it do
-          ldap_user.save
+          ldap_user.save # rubocop:disable Rails/SaveBang
           expect(gl_user).to be_valid
           expect(gl_user).not_to be_blocked
         end
@@ -232,7 +232,7 @@ RSpec.describe Gitlab::Auth::Ldap::User do
         end
 
         it do
-          ldap_user.save
+          ldap_user.save # rubocop:disable Rails/SaveBang
           expect(gl_user).to be_valid
           expect(gl_user).not_to be_blocked
         end
diff --git a/spec/lib/gitlab/auth/o_auth/user_spec.rb b/spec/lib/gitlab/auth/o_auth/user_spec.rb
index 7a8e6e77d52..8d36507ec7a 100644
--- a/spec/lib/gitlab/auth/o_auth/user_spec.rb
+++ b/spec/lib/gitlab/auth/o_auth/user_spec.rb
@@ -67,7 +67,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
         create(:omniauth_user, extern_uid: 'my-uid', provider: provider)
         stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
 
-        oauth_user.save
+        oauth_user.save # rubocop:disable Rails/SaveBang
 
         expect(gl_user).to be_valid
         expect(gl_user.external).to be_falsey
@@ -83,7 +83,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
         it 'creates the user' do
           stub_omniauth_config(allow_single_sign_on: [provider])
 
-          oauth_user.save
+          oauth_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
         end
@@ -97,7 +97,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
         it 'creates and confirms the user anyway' do
           stub_omniauth_config(allow_single_sign_on: [provider])
 
-          oauth_user.save
+          oauth_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
           expect(gl_user).to be_confirmed
@@ -112,7 +112,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
         it 'creates the user' do
           stub_omniauth_config(allow_single_sign_on: [provider])
 
-          oauth_user.save
+          oauth_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
         end
@@ -121,7 +121,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
       it 'marks user as having password_automatically_set' do
         stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
 
-        oauth_user.save
+        oauth_user.save # rubocop:disable Rails/SaveBang
 
         expect(gl_user).to be_persisted
         expect(gl_user).to be_password_automatically_set
@@ -131,7 +131,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
         context 'provider is marked as external' do
           it 'marks user as external' do
             stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_truthy
           end
@@ -141,7 +141,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           it 'does not mark external user as internal' do
             create(:omniauth_user, extern_uid: 'my-uid', provider: provider, external: true)
             stub_omniauth_config(allow_single_sign_on: [provider], external_providers: ['facebook'])
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_truthy
           end
@@ -151,9 +151,9 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           context 'when adding a new OAuth identity' do
             it 'does not promote an external user to internal' do
               user = create(:user, email: 'john@mail.com', external: true)
-              user.identities.create(provider: provider, extern_uid: uid)
+              user.identities.create!(provider: provider, extern_uid: uid)
 
-              oauth_user.save
+              oauth_user.save # rubocop:disable Rails/SaveBang
               expect(gl_user).to be_valid
               expect(gl_user.external).to be_truthy
             end
@@ -166,7 +166,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it "creates a user from Omniauth" do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).to be_valid
             identity = gl_user.identities.first
@@ -181,7 +181,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it "creates a user from Omniauth" do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).to be_valid
             identity = gl_user.identities.first
@@ -196,7 +196,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it 'throws an error' do
-            expect { oauth_user.save }.to raise_error StandardError
+            expect { oauth_user.save }.to raise_error StandardError # rubocop:disable Rails/SaveBang
           end
         end
 
@@ -206,7 +206,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it 'throws an error' do
-            expect { oauth_user.save }.to raise_error StandardError
+            expect { oauth_user.save }.to raise_error StandardError # rubocop:disable Rails/SaveBang
           end
         end
       end
@@ -228,7 +228,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           let!(:existing_user) { create(:user, email: 'john@mail.com', username: 'john') }
 
           it "adds the OmniAuth identity to the GitLab user account" do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).not_to be_valid
           end
@@ -248,7 +248,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           let!(:existing_user) { create(:user, email: 'john@mail.com', username: 'john') }
 
           it "adds the OmniAuth identity to the GitLab user account" do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).to be_valid
             expect(gl_user.username).to eql 'john'
@@ -277,7 +277,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           let!(:existing_user) { create(:user, email: 'john@mail.com', username: 'john') }
 
           it "adds the OmniAuth identity to the GitLab user account" do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).to be_valid
             expect(gl_user.username).to eql 'john'
@@ -337,7 +337,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
                 before do
                   allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(ldap_user)
 
-                  oauth_user.save
+                  oauth_user.save # rubocop:disable Rails/SaveBang
                 end
 
                 it "creates a user with dual LDAP and omniauth identities" do
@@ -376,7 +376,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
                   allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_email).with(uid, any_args).and_return(nil)
                   allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_email).with(info_hash[:email], any_args).and_return(ldap_user)
 
-                  oauth_user.save
+                  oauth_user.save # rubocop:disable Rails/SaveBang
                 end
 
                 it 'creates the LDAP identity' do
@@ -392,7 +392,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
               it "adds the omniauth identity to the LDAP account" do
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(ldap_user)
 
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql 'john'
@@ -414,7 +414,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(nil)
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_email).and_return(ldap_user)
 
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
 
                 identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
                 expect(identities_as_hash).to match_array(result_identities(dn, uid))
@@ -426,7 +426,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
                   allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_email).and_return(nil)
                   allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_dn).and_return(ldap_user)
 
-                  oauth_user.save
+                  oauth_user.save # rubocop:disable Rails/SaveBang
 
                   identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
                   expect(identities_as_hash).to match_array(result_identities(dn, uid))
@@ -447,7 +447,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
               end
 
               it 'does not save the identity' do
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
 
                 identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
                 expect(identities_as_hash).to match_array([{ provider: 'twitter', extern_uid: uid }])
@@ -467,7 +467,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
               it 'creates a user favoring the LDAP username and strips email domain' do
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(ldap_user)
 
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql 'johndoe'
@@ -510,7 +510,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
               before do
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(ldap_user)
 
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
               end
 
               it "creates a user with dual LDAP and omniauth identities" do
@@ -549,7 +549,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
               it "adds the omniauth identity to the LDAP account" do
                 allow(Gitlab::Auth::Ldap::Person).to receive(:find_by_uid).and_return(ldap_user)
 
-                oauth_user.save
+                oauth_user.save # rubocop:disable Rails/SaveBang
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql 'john'
@@ -584,7 +584,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -596,7 +596,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).to be_blocked
           end
@@ -622,7 +622,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
             end
 
             it do
-              oauth_user.save
+              oauth_user.save # rubocop:disable Rails/SaveBang
               expect(gl_user).to be_valid
               expect(gl_user).not_to be_blocked
             end
@@ -636,7 +636,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
             end
 
             it do
-              oauth_user.save
+              oauth_user.save # rubocop:disable Rails/SaveBang
               expect(gl_user).to be_valid
               expect(gl_user).to be_blocked
             end
@@ -654,7 +654,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
             end
 
             it do
-              oauth_user.save
+              oauth_user.save # rubocop:disable Rails/SaveBang
               expect(gl_user).to be_valid
               expect(gl_user).not_to be_blocked
             end
@@ -668,7 +668,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
             end
 
             it do
-              oauth_user.save
+              oauth_user.save # rubocop:disable Rails/SaveBang
               expect(gl_user).to be_valid
               expect(gl_user).not_to be_blocked
             end
@@ -678,7 +678,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
 
       context 'sign-in' do
         before do
-          oauth_user.save
+          oauth_user.save # rubocop:disable Rails/SaveBang
           oauth_user.gl_user.activate
         end
 
@@ -688,7 +688,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -700,7 +700,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -714,7 +714,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -728,7 +728,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
           end
 
           it do
-            oauth_user.save
+            oauth_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -791,7 +791,7 @@ RSpec.describe Gitlab::Auth::OAuth::User do
 
     context 'when collision with existing user' do
       it 'generates the username with a counter' do
-        oauth_user.save
+        oauth_user.save # rubocop:disable Rails/SaveBang
         oauth_user2 = described_class.new(OmniAuth::AuthHash.new(uid: 'my-uid2', provider: provider, info: { nickname: 'johngitlab-ETC@othermail.com', email: 'john@othermail.com' }))
 
         expect(oauth_user2.gl_user.username).to eq('johngitlab-ETC1')
diff --git a/spec/lib/gitlab/auth/saml/user_spec.rb b/spec/lib/gitlab/auth/saml/user_spec.rb
index fd48492f18d..796512bc52b 100644
--- a/spec/lib/gitlab/auth/saml/user_spec.rb
+++ b/spec/lib/gitlab/auth/saml/user_spec.rb
@@ -36,7 +36,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
 
       context 'and should bind with SAML' do
         it 'adds the SAML identity to the existing user' do
-          saml_user.save
+          saml_user.save # rubocop:disable Rails/SaveBang
           expect(gl_user).to be_valid
           expect(gl_user).to eq existing_user
           identity = gl_user.identities.first
@@ -49,7 +49,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         context 'are defined' do
           it 'marks the user as external' do
             stub_saml_group_config(%w(Freelancers))
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_truthy
           end
@@ -61,7 +61,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
 
         context 'are defined but the user does not belong there' do
           it 'does not mark the user as external' do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_falsey
           end
@@ -70,7 +70,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         context 'user was external, now should not be' do
           it 'makes user internal' do
             existing_user.update_attribute('external', true)
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_falsey
           end
@@ -86,7 +86,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it 'creates a user from SAML' do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
 
             expect(gl_user).to be_valid
             identity = gl_user.identities.first
@@ -101,7 +101,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it 'does not throw an error' do
-            expect { saml_user.save }.not_to raise_error
+            expect { saml_user.save }.not_to raise_error # rubocop:disable Rails/SaveBang
           end
         end
 
@@ -111,7 +111,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it 'throws an error' do
-            expect { saml_user.save }.to raise_error StandardError
+            expect { saml_user.save }.to raise_error StandardError # rubocop:disable Rails/SaveBang
           end
         end
       end
@@ -120,7 +120,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         context 'are defined' do
           it 'marks the user as external' do
             stub_saml_group_config(%w(Freelancers))
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_truthy
           end
@@ -129,7 +129,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         context 'are defined but the user does not belong there' do
           it 'does not mark the user as external' do
             stub_saml_group_config(%w(Interns))
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user.external).to be_falsey
           end
@@ -170,7 +170,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
 
             context 'and no account for the LDAP user' do
               it 'creates a user with dual LDAP and SAML identities' do
-                saml_user.save
+                saml_user.save # rubocop:disable Rails/SaveBang
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql uid
@@ -230,7 +230,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
                     { provider: id.provider, extern_uid: id.extern_uid }
                   end
 
-                  saml_user.save
+                  saml_user.save # rubocop:disable Rails/SaveBang
 
                   expect(gl_user).to be_valid
                   expect(gl_user.username).to eql 'john'
@@ -259,7 +259,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
               end
 
               it 'adds the omniauth identity to the LDAP account' do
-                saml_user.save
+                saml_user.save # rubocop:disable Rails/SaveBang
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql 'john'
@@ -271,9 +271,9 @@ RSpec.describe Gitlab::Auth::Saml::User do
               end
 
               it 'saves successfully on subsequent tries, when both identities are present' do
-                saml_user.save
+                saml_user.save # rubocop:disable Rails/SaveBang
                 local_saml_user = described_class.new(auth_hash)
-                local_saml_user.save
+                local_saml_user.save # rubocop:disable Rails/SaveBang
 
                 expect(local_saml_user.gl_user).to be_valid
                 expect(local_saml_user.gl_user).to be_persisted
@@ -289,7 +289,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
                 local_hash = OmniAuth::AuthHash.new(uid: dn, provider: provider, info: info_hash)
                 local_saml_user = described_class.new(local_hash)
 
-                local_saml_user.save
+                local_saml_user.save # rubocop:disable Rails/SaveBang
                 local_gl_user = local_saml_user.gl_user
 
                 expect(local_gl_user).to be_valid
@@ -309,7 +309,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         end
 
         it 'creates the user' do
-          saml_user.save
+          saml_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
         end
@@ -321,7 +321,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         end
 
         it 'creates and confirms the user anyway' do
-          saml_user.save
+          saml_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
           expect(gl_user).to be_confirmed
@@ -334,7 +334,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
         end
 
         it 'creates the user' do
-          saml_user.save
+          saml_user.save # rubocop:disable Rails/SaveBang
 
           expect(gl_user).to be_persisted
         end
@@ -353,7 +353,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it 'does not block the user' do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -365,7 +365,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it 'blocks user' do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).to be_blocked
           end
@@ -374,7 +374,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
 
       context 'sign-in' do
         before do
-          saml_user.save
+          saml_user.save # rubocop:disable Rails/SaveBang
           saml_user.gl_user.activate
         end
 
@@ -384,7 +384,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
@@ -396,7 +396,7 @@ RSpec.describe Gitlab::Auth::Saml::User do
           end
 
           it do
-            saml_user.save
+            saml_user.save # rubocop:disable Rails/SaveBang
             expect(gl_user).to be_valid
             expect(gl_user).not_to be_blocked
           end
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index 1541334192e..fc93910344c 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -165,27 +165,27 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching do
         end
 
         it 'recognises user token' do
-          build.update(user: create(:user))
+          build.update!(user: create(:user))
 
           expect(subject).to have_attributes(actor: build.user, project: build.project, type: :build, authentication_abilities: described_class.build_authentication_abilities)
         end
 
         it 'recognises project level bot access token' do
-          build.update(user: create(:user, :project_bot))
+          build.update!(user: create(:user, :project_bot))
           project.add_maintainer(build.user)
 
           expect(subject).to have_attributes(actor: build.user, project: build.project, type: :build, authentication_abilities: described_class.build_authentication_abilities)
         end
 
         it 'recognises group level bot access token' do
-          build.update(user: create(:user, :project_bot))
+          build.update!(user: create(:user, :project_bot))
           group.add_maintainer(build.user)
 
           expect(subject).to have_attributes(actor: build.user, project: build.project, type: :build, authentication_abilities: described_class.build_authentication_abilities)
         end
 
         it 'fails with blocked user token' do
-          build.update(user: create(:user, :blocked))
+          build.update!(user: create(:user, :blocked))
 
           expect(subject).to have_attributes(auth_failure)
         end
@@ -213,7 +213,7 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching do
 
     it 'recognizes other ci services' do
       project.create_drone_ci_integration(active: true)
-      project.drone_ci_integration.update(token: 'token')
+      project.drone_ci_integration.update!(token: 'token', drone_url: generate(:url))
 
       expect(gl_auth.find_for_git_client('drone-ci-token', 'token', project: project, ip: 'ip')).to have_attributes(actor: nil, project: project, type: :ci, authentication_abilities: described_class.build_authentication_abilities)
     end
@@ -326,7 +326,7 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching do
 
       context 'orphaned token' do
         before do
-          user.destroy
+          user.destroy!
         end
 
         it_behaves_like 'an oauth failure'
@@ -903,7 +903,7 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching do
 
       it 'resets failed_attempts when true and password is correct' do
         user.failed_attempts = 2
-        user.save
+        user.save!
 
         expect do
           gl_auth.find_with_user_password(username, password, increment_failed_attempts: true)
@@ -932,7 +932,7 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching do
 
         it 'does not reset failed_attempts when true and password is correct' do
           user.failed_attempts = 2
-          user.save
+          user.save!
 
           expect do
             gl_auth.find_with_user_password(username, password, increment_failed_attempts: true)
diff --git a/spec/lib/gitlab/authorized_keys_spec.rb b/spec/lib/gitlab/authorized_keys_spec.rb
index 1053ae2e325..073cee96ede 100644
--- a/spec/lib/gitlab/authorized_keys_spec.rb
+++ b/spec/lib/gitlab/authorized_keys_spec.rb
@@ -38,7 +38,7 @@ RSpec.describe Gitlab::AuthorizedKeys do
   end
 
   describe '#create' do
-    subject { authorized_keys.create }
+    subject { authorized_keys.create } # rubocop:disable Rails/SaveBang
 
     context 'authorized_keys file exists' do
       before do
diff --git a/spec/lib/gitlab/backtrace_cleaner_spec.rb b/spec/lib/gitlab/backtrace_cleaner_spec.rb
index cdde5a02d3b..e46a90e8606 100644
--- a/spec/lib/gitlab/backtrace_cleaner_spec.rb
+++ b/spec/lib/gitlab/backtrace_cleaner_spec.rb
@@ -25,6 +25,7 @@ RSpec.describe Gitlab::BacktraceCleaner do
         "app/models/repository.rb:113:in `commit'",
         "lib/gitlab/i18n.rb:50:in `with_locale'",
         "lib/gitlab/middleware/multipart.rb:95:in `call'",
+        "lib/gitlab/request_profiler/middleware.rb:14:in `call'",
         "ee/lib/gitlab/database/load_balancing/rack_middleware.rb:37:in `call'",
         "ee/lib/gitlab/jira/middleware.rb:15:in `call'"
       ]
diff --git a/spec/lib/gitlab/bitbucket_server_import/importer_spec.rb b/spec/lib/gitlab/bitbucket_server_import/importer_spec.rb
index 0380ddd9a2e..d2abdb740f8 100644
--- a/spec/lib/gitlab/bitbucket_server_import/importer_spec.rb
+++ b/spec/lib/gitlab/bitbucket_server_import/importer_spec.rb
@@ -22,8 +22,8 @@ RSpec.describe Gitlab::BitbucketServerImport::Importer do
       data: { project_key: project_key, repo_slug: repo_slug },
       credentials: { base_uri: import_url, user: bitbucket_user, password: password }
     )
-    data.save
-    project.save
+    data.save!
+    project.save!
   end
 
   describe '#import_repository' do
diff --git a/spec/lib/gitlab/database/dynamic_model_helpers_spec.rb b/spec/lib/gitlab/database/dynamic_model_helpers_spec.rb
index 0844616ee1c..31486240bfa 100644
--- a/spec/lib/gitlab/database/dynamic_model_helpers_spec.rb
+++ b/spec/lib/gitlab/database/dynamic_model_helpers_spec.rb
@@ -4,10 +4,11 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::Database::DynamicModelHelpers do
   let(:including_class) { Class.new.include(described_class) }
-  let(:table_name) { 'projects' }
+  let(:table_name) { Project.table_name }
+  let(:connection) { Project.connection }
 
   describe '#define_batchable_model' do
-    subject { including_class.new.define_batchable_model(table_name) }
+    subject { including_class.new.define_batchable_model(table_name, connection: connection) }
 
     it 'is an ActiveRecord model' do
       expect(subject.ancestors).to include(ActiveRecord::Base)
@@ -40,7 +41,7 @@ RSpec.describe Gitlab::Database::DynamicModelHelpers do
 
       it 'iterates table in batches' do
         each_batch_size = ->(&block) do
-          subject.each_batch(table_name, of: 1) do |batch|
+          subject.each_batch(table_name, connection: connection, of: 1) do |batch|
             block.call(batch.size)
           end
         end
@@ -56,7 +57,7 @@ RSpec.describe Gitlab::Database::DynamicModelHelpers do
       end
 
       it 'raises an error' do
-        expect { subject.each_batch(table_name, of: 1) { |batch| batch.size } }
+        expect { subject.each_batch(table_name, connection: connection, of: 1) { |batch| batch.size } }
           .to raise_error(RuntimeError, /each_batch should not run inside a transaction/)
       end
     end
@@ -74,7 +75,7 @@ RSpec.describe Gitlab::Database::DynamicModelHelpers do
       end
 
       it 'iterates table in batch ranges' do
-        expect { |b| subject.each_batch_range(table_name, of: 1, &b) }
+        expect { |b| subject.each_batch_range(table_name, connection: connection, of: 1, &b) }
           .to yield_successive_args(
             [first_project.id, first_project.id],
             [second_project.id, second_project.id]
@@ -82,13 +83,13 @@ RSpec.describe Gitlab::Database::DynamicModelHelpers do
       end
 
       it 'yields only one batch if bigger than the table size' do
-        expect { |b| subject.each_batch_range(table_name, of: 2, &b) }
+        expect { |b| subject.each_batch_range(table_name, connection: connection, of: 2, &b) }
           .to yield_successive_args([first_project.id, second_project.id])
       end
 
       it 'makes it possible to apply a scope' do
         each_batch_limited = ->(&b) do
-          subject.each_batch_range(table_name, scope: ->(table) { table.limit(1) }, of: 1, &b)
+          subject.each_batch_range(table_name, connection: connection, scope: ->(table) { table.limit(1) }, of: 1, &b)
         end
 
         expect { |b| each_batch_limited.call(&b) }
@@ -102,7 +103,7 @@ RSpec.describe Gitlab::Database::DynamicModelHelpers do
       end
 
       it 'raises an error' do
-        expect { subject.each_batch_range(table_name, of: 1) { 1 } }
+        expect { subject.each_batch_range(table_name, connection: connection, of: 1) { 1 } }
           .to raise_error(RuntimeError, /each_batch should not run inside a transaction/)
       end
     end
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index d6f0d7bffe8..d71a4f81901 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -14,6 +14,54 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     allow(model).to receive(:puts)
   end
 
+  describe 'overridden dynamic model helpers' do
+    let(:test_table) { '__test_batching_table' }
+
+    before do
+      model.connection.execute(<<~SQL)
+        CREATE TABLE #{test_table} (
+          id integer NOT NULL PRIMARY KEY,
+          name text NOT NULL
+        );
+
+        INSERT INTO #{test_table} (id, name)
+        VALUES (1, 'bob'), (2, 'mary'), (3, 'amy');
+      SQL
+    end
+
+    describe '#define_batchable_model' do
+      it 'defines a batchable model with the migration connection' do
+        expect(model.define_batchable_model(test_table).count).to eq(3)
+      end
+    end
+
+    describe '#each_batch' do
+      before do
+        allow(model).to receive(:transaction_open?).and_return(false)
+      end
+
+      it 'calls each_batch with the migration connection' do
+        each_batch_name = ->(&block) do
+          model.each_batch(test_table, of: 2) do |batch|
+            block.call(batch.pluck(:name))
+          end
+        end
+
+        expect { |b| each_batch_name.call(&b) }.to yield_successive_args(%w[bob mary], %w[amy])
+      end
+    end
+
+    describe '#each_batch_range' do
+      before do
+        allow(model).to receive(:transaction_open?).and_return(false)
+      end
+
+      it 'calls each_batch with the migration connection' do
+        expect { |b| model.each_batch_range(test_table, of: 2, &b) }.to yield_successive_args([1, 2], [3, 3])
+      end
+    end
+  end
+
   describe '#remove_timestamps' do
     it 'can remove the default timestamps' do
       Gitlab::Database::MigrationHelpers::DEFAULT_TIMESTAMP_COLUMNS.each do |column_name|
diff --git a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
index f5ea660ee1e..6601b6658d5 100644
--- a/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
+++ b/spec/lib/gitlab/database_importers/self_monitoring/project/create_service_spec.rb
@@ -60,7 +60,7 @@ RSpec.describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService
       before do
         stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
 
-        application_setting.update(allow_local_requests_from_web_hooks_and_services: true)
+        application_setting.update!(allow_local_requests_from_web_hooks_and_services: true)
       end
 
       shared_examples 'has prometheus integration' do |server_address|
@@ -181,7 +181,7 @@ RSpec.describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService
         let(:existing_project) { create(:project, namespace: existing_group) }
 
         before do
-          application_setting.update(instance_administrators_group_id: existing_group.id,
+          application_setting.update!(instance_administrators_group_id: existing_group.id,
                                      self_monitoring_project_id: existing_project.id)
         end
 
@@ -195,7 +195,7 @@ RSpec.describe Gitlab::DatabaseImporters::SelfMonitoring::Project::CreateService
 
       context 'when local requests from hooks and integrations are not allowed' do
         before do
-          application_setting.update(allow_local_requests_from_web_hooks_and_services: false)
+          application_setting.update!(allow_local_requests_from_web_hooks_and_services: false)
         end
 
         it_behaves_like 'has prometheus integration', 'http://localhost:9090'
diff --git a/spec/lib/gitlab/request_profiler/profile_spec.rb b/spec/lib/gitlab/request_profiler/profile_spec.rb
new file mode 100644
index 00000000000..30e23a99b22
--- /dev/null
+++ b/spec/lib/gitlab/request_profiler/profile_spec.rb
@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::RequestProfiler::Profile do
+  let(:profile) { described_class.new(filename) }
+
+  describe '.new' do
+    context 'using old filename' do
+      let(:filename) { '|api|v4|version.txt_1562854738.html' }
+
+      it 'returns valid data' do
+        expect(profile).to be_valid
+        expect(profile.request_path).to eq('/api/v4/version.txt')
+        expect(profile.time).to eq(Time.at(1562854738).utc)
+        expect(profile.type).to eq('html')
+      end
+    end
+
+    context 'using new filename' do
+      let(:filename) { '|api|v4|version.txt_1563547949_execution.html' }
+
+      it 'returns valid data' do
+        expect(profile).to be_valid
+        expect(profile.request_path).to eq('/api/v4/version.txt')
+        expect(profile.profile_mode).to eq('execution')
+        expect(profile.time).to eq(Time.at(1563547949).utc)
+        expect(profile.type).to eq('html')
+      end
+    end
+  end
+
+  describe '#content_type' do
+    context 'when using html file' do
+      let(:filename) { '|api|v4|version.txt_1562854738_memory.html' }
+
+      it 'returns valid data' do
+        expect(profile).to be_valid
+        expect(profile.content_type).to eq('text/html')
+      end
+    end
+
+    context 'when using text file' do
+      let(:filename) { '|api|v4|version.txt_1562854738_memory.txt' }
+
+      it 'returns valid data' do
+        expect(profile).to be_valid
+        expect(profile.content_type).to eq('text/plain')
+      end
+    end
+
+    context 'when file is unknown' do
+      let(:filename) { '|api|v4|version.txt_1562854738_memory.xxx' }
+
+      it 'returns valid data' do
+        expect(profile).not_to be_valid
+        expect(profile.content_type).to be_nil
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/request_profiler_spec.rb b/spec/lib/gitlab/request_profiler_spec.rb
new file mode 100644
index 00000000000..4d3b361efcb
--- /dev/null
+++ b/spec/lib/gitlab/request_profiler_spec.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::RequestProfiler do
+  describe '.profile_token' do
+    it 'returns a token' do
+      expect(described_class.profile_token).to be_present
+    end
+
+    it 'caches the token' do
+      expect(Rails.cache).to receive(:fetch).with('profile-token')
+
+      described_class.profile_token
+    end
+  end
+
+  context 'with temporary PROFILES_DIR' do
+    let(:tmpdir) { Dir.mktmpdir('profiler-test') }
+    let(:profile_name) { '|api|v4|version.txt_1562854738_memory.html' }
+    let(:profile_path) { File.join(tmpdir, profile_name) }
+
+    before do
+      stub_const('Gitlab::RequestProfiler::PROFILES_DIR', tmpdir)
+      FileUtils.touch(profile_path)
+    end
+
+    after do
+      FileUtils.rm_rf(tmpdir)
+    end
+
+    describe '.remove_all_profiles' do
+      it 'removes Gitlab::RequestProfiler::PROFILES_DIR directory' do
+        described_class.remove_all_profiles
+
+        expect(Dir.exist?(tmpdir)).to be false
+      end
+    end
+
+    describe '.all' do
+      subject { described_class.all }
+
+      it 'returns all profiles' do
+        expect(subject.map(&:name)).to contain_exactly(profile_name)
+      end
+    end
+
+    describe '.find' do
+      subject { described_class.find(profile_name) }
+
+      it 'returns all profiles' do
+        expect(subject.name).to eq(profile_name)
+      end
+    end
+  end
+end
diff --git a/spec/lib/security/ci_configuration/container_scanning_build_action_spec.rb b/spec/lib/security/ci_configuration/container_scanning_build_action_spec.rb
new file mode 100644
index 00000000000..38066e41c53
--- /dev/null
+++ b/spec/lib/security/ci_configuration/container_scanning_build_action_spec.rb
@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::CiConfiguration::ContainerScanningBuildAction do
+  subject(:result) { described_class.new(auto_devops_enabled, gitlab_ci_content).generate }
+
+  let(:params) { {} }
+
+  context 'with existing .gitlab-ci.yml' do
+    let(:auto_devops_enabled) { false }
+
+    context 'container_scanning has not been included' do
+      let(:expected_yml) do
+        <<-CI_YML.strip_heredoc
+          # You can override the included template(s) by including variable overrides
+          # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+          # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+          # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
+          # Note that environment variables can be set in several places
+          # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
+
+          # container_scanning:
+          #   variables:
+          #     DOCKER_IMAGE: ...
+          #     DOCKER_USER: ...
+          #     DOCKER_PASSWORD: ...
+          stages:
+          - test
+          - security
+          variables:
+            RANDOM: make sure this persists
+          include:
+          - template: existing.yml
+          - template: Security/Container-Scanning.gitlab-ci.yml
+        CI_YML
+      end
+
+      context 'template includes are an array' do
+        let(:gitlab_ci_content) do
+          { "stages" => %w(test security),
+            "variables" => { "RANDOM" => "make sure this persists" },
+            "include" => [{ "template" => "existing.yml" }] }
+        end
+
+        it 'generates the correct YML' do
+          expect(result[:action]).to eq('update')
+          expect(result[:content]).to eq(expected_yml)
+        end
+      end
+
+      context 'template include is not an array' do
+        let(:gitlab_ci_content) do
+          { "stages" => %w(test security),
+            "variables" => { "RANDOM" => "make sure this persists" },
+            "include" => { "template" => "existing.yml" } }
+        end
+
+        it 'generates the correct YML' do
+          expect(result[:action]).to eq('update')
+          expect(result[:content]).to eq(expected_yml)
+        end
+      end
+    end
+
+    context 'container_scanning has been included' do
+      let(:expected_yml) do
+        <<-CI_YML.strip_heredoc
+          # You can override the included template(s) by including variable overrides
+          # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+          # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+          # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
+          # Note that environment variables can be set in several places
+          # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
+
+          # container_scanning:
+          #   variables:
+          #     DOCKER_IMAGE: ...
+          #     DOCKER_USER: ...
+          #     DOCKER_PASSWORD: ...
+          stages:
+          - test
+          variables:
+            RANDOM: make sure this persists
+          include:
+          - template: Security/Container-Scanning.gitlab-ci.yml
+        CI_YML
+      end
+
+      context 'container_scanning template include are an array' do
+        let(:gitlab_ci_content) do
+          { "stages" => %w(test),
+            "variables" => { "RANDOM" => "make sure this persists" },
+            "include" => [{ "template" => "Security/Container-Scanning.gitlab-ci.yml" }] }
+        end
+
+        it 'generates the correct YML' do
+          expect(result[:action]).to eq('update')
+          expect(result[:content]).to eq(expected_yml)
+        end
+      end
+
+      context 'container_scanning template include is not an array' do
+        let(:gitlab_ci_content) do
+          { "stages" => %w(test),
+            "variables" => { "RANDOM" => "make sure this persists" },
+            "include" => { "template" => "Security/Container-Scanning.gitlab-ci.yml" } }
+        end
+
+        it 'generates the correct YML' do
+          expect(result[:action]).to eq('update')
+          expect(result[:content]).to eq(expected_yml)
+        end
+      end
+    end
+  end
+
+  context 'with no .gitlab-ci.yml' do
+    let(:gitlab_ci_content) { nil }
+
+    context 'autodevops disabled' do
+      let(:auto_devops_enabled) { false }
+      let(:expected_yml) do
+        <<-CI_YML.strip_heredoc
+          # You can override the included template(s) by including variable overrides
+          # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+          # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+          # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
+          # Note that environment variables can be set in several places
+          # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
+
+          # container_scanning:
+          #   variables:
+          #     DOCKER_IMAGE: ...
+          #     DOCKER_USER: ...
+          #     DOCKER_PASSWORD: ...
+          include:
+          - template: Security/Container-Scanning.gitlab-ci.yml
+        CI_YML
+      end
+
+      it 'generates the correct YML' do
+        expect(result[:action]).to eq('create')
+        expect(result[:content]).to eq(expected_yml)
+      end
+    end
+
+    context 'with autodevops enabled' do
+      let(:auto_devops_enabled) { true }
+      let(:expected_yml) do
+        <<-CI_YML.strip_heredoc
+          # You can override the included template(s) by including variable overrides
+          # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+          # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+          # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
+          # Note that environment variables can be set in several places
+          # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
+
+          # container_scanning:
+          #   variables:
+          #     DOCKER_IMAGE: ...
+          #     DOCKER_USER: ...
+          #     DOCKER_PASSWORD: ...
+          include:
+          - template: Auto-DevOps.gitlab-ci.yml
+        CI_YML
+      end
+
+      before do
+        allow_next_instance_of(described_class) do |secret_detection_build_actions|
+          allow(secret_detection_build_actions).to receive(:auto_devops_stages).and_return(fast_auto_devops_stages)
+        end
+      end
+
+      it 'generates the correct YML' do
+        expect(result[:action]).to eq('create')
+        expect(result[:content]).to eq(expected_yml)
+      end
+    end
+  end
+
+  # stubbing this method allows this spec file to use fast_spec_helper
+  def fast_auto_devops_stages
+    auto_devops_template = YAML.safe_load( File.read('lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml') )
+    auto_devops_template['stages']
+  end
+end
diff --git a/spec/lib/security/ci_configuration/sast_build_action_spec.rb b/spec/lib/security/ci_configuration/sast_build_action_spec.rb
index d93175249f5..6f702e51b73 100644
--- a/spec/lib/security/ci_configuration/sast_build_action_spec.rb
+++ b/spec/lib/security/ci_configuration/sast_build_action_spec.rb
@@ -324,6 +324,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
     # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
     # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
     # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+    # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
     # Note that environment variables can be set in several places
     # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
     stages:
@@ -344,6 +345,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
     # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
     # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
     # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+    # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
     # Note that environment variables can be set in several places
     # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
     stages:
@@ -361,6 +363,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -384,6 +387,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -420,6 +424,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -445,6 +450,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -468,6 +474,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -492,6 +499,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
@@ -516,6 +524,7 @@ RSpec.describe Security::CiConfiguration::SastBuildAction do
       # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
       # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
       # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+      # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
       # Note that environment variables can be set in several places
       # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
       stages:
diff --git a/spec/lib/security/ci_configuration/sast_iac_build_action_spec.rb b/spec/lib/security/ci_configuration/sast_iac_build_action_spec.rb
index ecd1602dd9e..4c459058368 100644
--- a/spec/lib/security/ci_configuration/sast_iac_build_action_spec.rb
+++ b/spec/lib/security/ci_configuration/sast_iac_build_action_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe Security::CiConfiguration::SastIacBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           stages:
@@ -64,6 +65,7 @@ RSpec.describe Security::CiConfiguration::SastIacBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           stages:
@@ -114,6 +116,7 @@ RSpec.describe Security::CiConfiguration::SastIacBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           include:
@@ -135,6 +138,7 @@ RSpec.describe Security::CiConfiguration::SastIacBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           include:
diff --git a/spec/lib/security/ci_configuration/secret_detection_build_action_spec.rb b/spec/lib/security/ci_configuration/secret_detection_build_action_spec.rb
index 146c60ffb6e..4d9860ca4a5 100644
--- a/spec/lib/security/ci_configuration/secret_detection_build_action_spec.rb
+++ b/spec/lib/security/ci_configuration/secret_detection_build_action_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe Security::CiConfiguration::SecretDetectionBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           stages:
@@ -64,6 +65,7 @@ RSpec.describe Security::CiConfiguration::SecretDetectionBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           stages:
@@ -114,6 +116,7 @@ RSpec.describe Security::CiConfiguration::SecretDetectionBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           include:
@@ -135,6 +138,7 @@ RSpec.describe Security::CiConfiguration::SecretDetectionBuildAction do
           # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
           # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
           # Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+          # Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
           # Note that environment variables can be set in several places
           # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
           include:
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index d78d0a56f10..35d0566d9b4 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -7118,6 +7118,29 @@ RSpec.describe Project, factory_default: :keep do
     it { is_expected.to be true }
   end
 
+  describe '#related_group_ids' do
+    let_it_be(:group) { create(:group) }
+    let_it_be(:sub_group) { create(:group, parent: group) }
+
+    context 'when associated with a namespace' do
+      let(:project) { create(:project, namespace: create(:namespace)) }
+      let!(:linked_group) { create(:project_group_link, project: project).group }
+
+      it 'only includes linked groups' do
+        expect(project.related_group_ids).to contain_exactly(linked_group.id)
+      end
+    end
+
+    context 'when associated with a group' do
+      let(:project) { create(:project, group: sub_group) }
+      let!(:linked_group) { create(:project_group_link, project: project).group }
+
+      it 'includes self, ancestors and linked groups' do
+        expect(project.related_group_ids).to contain_exactly(group.id, sub_group.id, linked_group.id)
+      end
+    end
+  end
+
   describe '#package_already_taken?' do
     let_it_be(:namespace) { create(:namespace, path: 'test') }
     let_it_be(:project) { create(:project, :public, namespace: namespace) }
diff --git a/spec/requests/api/ci/runners_spec.rb b/spec/requests/api/ci/runners_spec.rb
index 7cf436969db..7ba67f7f29b 100644
--- a/spec/requests/api/ci/runners_spec.rb
+++ b/spec/requests/api/ci/runners_spec.rb
@@ -86,14 +86,24 @@ RSpec.describe API::Ci::Runners do
         expect(response).to have_gitlab_http_status(:bad_request)
       end
 
-      it 'filters runners by status' do
-        create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project])
+      context 'with an inactive runner' do
+        let_it_be(:runner) { create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project]) }
 
-        get api('/runners?status=paused', user)
+        it 'filters runners by paused state' do
+          get api('/runners?paused=true', user)
 
-        expect(json_response).to match_array [
-          a_hash_including('description' => 'Inactive project runner')
-        ]
+          expect(json_response).to match_array [
+            a_hash_including('description' => 'Inactive project runner')
+          ]
+        end
+
+        it 'filters runners by status' do
+          get api('/runners?status=paused', user)
+
+          expect(json_response).to match_array [
+            a_hash_including('description' => 'Inactive project runner')
+          ]
+        end
       end
 
       it 'does not filter by invalid status' do
@@ -199,14 +209,24 @@ RSpec.describe API::Ci::Runners do
           expect(response).to have_gitlab_http_status(:bad_request)
         end
 
-        it 'filters runners by status' do
-          create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project])
+        context 'with an inactive runner' do
+          let_it_be(:runner) { create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project]) }
 
-          get api('/runners/all?status=paused', admin)
+          it 'filters runners by status' do
+            get api('/runners/all?paused=true', admin)
 
-          expect(json_response).to match_array [
-            a_hash_including('description' => 'Inactive project runner')
-          ]
+            expect(json_response).to match_array [
+              a_hash_including('description' => 'Inactive project runner')
+            ]
+          end
+
+          it 'filters runners by status' do
+            get api('/runners/all?status=paused', admin)
+
+            expect(json_response).to match_array [
+              a_hash_including('description' => 'Inactive project runner')
+            ]
+          end
         end
 
         it 'does not filter by invalid status' do
@@ -956,14 +976,24 @@ RSpec.describe API::Ci::Runners do
         expect(response).to have_gitlab_http_status(:bad_request)
       end
 
-      it 'filters runners by status' do
-        create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project])
+      context 'with an inactive runner' do
+        let_it_be(:runner) { create(:ci_runner, :project, :inactive, description: 'Inactive project runner', projects: [project]) }
 
-        get api("/projects/#{project.id}/runners?status=paused", user)
+        it 'filters runners by status' do
+          get api("/projects/#{project.id}/runners?paused=true", user)
 
-        expect(json_response).to match_array [
-          a_hash_including('description' => 'Inactive project runner')
-        ]
+          expect(json_response).to match_array [
+            a_hash_including('description' => 'Inactive project runner')
+          ]
+        end
+
+        it 'filters runners by status' do
+          get api("/projects/#{project.id}/runners?status=paused", user)
+
+          expect(json_response).to match_array [
+            a_hash_including('description' => 'Inactive project runner')
+          ]
+        end
       end
 
       it 'does not filter by invalid status' do
@@ -1022,21 +1052,31 @@ RSpec.describe API::Ci::Runners do
         end
       end
 
-      context 'filter runners by status' do
-        it 'returns runners by valid status' do
-          create(:ci_runner, :group, :inactive, description: 'Inactive group runner', groups: [group])
+      context 'with an inactive runner' do
+        let_it_be(:runner) { create(:ci_runner, :group, :inactive, description: 'Inactive group runner', groups: [group]) }
 
-          get api("/groups/#{group.id}/runners?status=paused", user)
+        it 'returns runners by paused state' do
+          get api("/groups/#{group.id}/runners?paused=true", user)
 
           expect(json_response).to match_array([
             a_hash_including('description' => 'Inactive group runner')
           ])
         end
 
-        it 'does not filter by invalid status' do
-          get api("/groups/#{group.id}/runners?status=bogus", user)
+        context 'filter runners by status' do
+          it 'returns runners by valid status' do
+            get api("/groups/#{group.id}/runners?status=paused", user)
 
-          expect(response).to have_gitlab_http_status(:bad_request)
+            expect(json_response).to match_array([
+              a_hash_including('description' => 'Inactive group runner')
+            ])
+          end
+
+          it 'does not filter by invalid status' do
+            get api("/groups/#{group.id}/runners?status=bogus", user)
+
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
         end
       end
 
diff --git a/spec/requests/request_profiler_spec.rb b/spec/requests/request_profiler_spec.rb
new file mode 100644
index 00000000000..72689595480
--- /dev/null
+++ b/spec/requests/request_profiler_spec.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Request Profiler' do
+  let(:user) { create(:user) }
+
+  shared_examples 'profiling a request' do |profile_type, extension|
+    before do
+      allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new)
+      allow(RubyProf::Profile).to receive(:profile) do |&blk|
+        blk.call
+        RubyProf::Profile.new
+      end
+      allow(MemoryProfiler).to receive(:report) do |&blk|
+        blk.call
+        MemoryProfiler.start
+        MemoryProfiler.stop
+      end
+    end
+
+    it 'creates a profile of the request' do
+      project = create(:project, namespace: user.namespace)
+      time    = Time.now
+      path    = "/#{project.full_path}"
+
+      travel_to(time) do
+        get path, params: {}, headers: { 'X-Profile-Token' => Gitlab::RequestProfiler.profile_token, 'X-Profile-Mode' => profile_type }
+      end
+
+      profile_type = 'execution' if profile_type.nil?
+      profile_path = "#{Gitlab.config.shared.path}/tmp/requests_profiles/#{path.tr('/', '|')}_#{time.to_i}_#{profile_type}.#{extension}"
+      expect(File.exist?(profile_path)).to be true
+    end
+
+    after do
+      Gitlab::RequestProfiler.remove_all_profiles
+    end
+  end
+
+  context "when user is logged-in" do
+    before do
+      login_as(user)
+    end
+
+    include_examples 'profiling a request', 'execution', 'html'
+    include_examples 'profiling a request', nil, 'html'
+    include_examples 'profiling a request', 'memory', 'txt'
+  end
+
+  context "when user is not logged-in" do
+    include_examples 'profiling a request', 'execution', 'html'
+    include_examples 'profiling a request', nil, 'html'
+    include_examples 'profiling a request', 'memory', 'txt'
+  end
+end
diff --git a/spec/services/security/ci_configuration/container_scanning_create_service_spec.rb b/spec/services/security/ci_configuration/container_scanning_create_service_spec.rb
new file mode 100644
index 00000000000..df76750efc8
--- /dev/null
+++ b/spec/services/security/ci_configuration/container_scanning_create_service_spec.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::CiConfiguration::ContainerScanningCreateService, :snowplow do
+  subject(:result) { described_class.new(project, user).execute }
+
+  let(:branch_name) { 'set-container-scanning-config-1' }
+
+  let(:snowplow_event) do
+    {
+      category: 'Security::CiConfiguration::ContainerScanningCreateService',
+      action: 'create',
+      label: ''
+    }
+  end
+
+  include_examples 'services security ci configuration create service', true
+end