From 65a0673d76bb86d6acca6dc3ab42dc91a04f56c2 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Thu, 20 Jul 2023 09:08:42 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../services/highlight_js_language_loader.js  |   4 +
 .../diffs/components/diff_inline_findings.vue |   6 +-
 ...item.vue => diff_inline_findings_item.vue} |   2 +-
 .../components/shared/findings_drawer.vue     |   2 +-
 .../repository/mixins/highlight_mixin.js      |   5 +-
 .../components/service_desk_list_app.vue      | 159 ++++++++++++++-
 .../javascripts/service_desk/constants.js     |   9 +
 app/assets/javascripts/service_desk/index.js  |  12 ++
 .../javascripts/service_desk/search_tokens.js |  97 ++++++++++
 .../components/source_viewer/constants.js     |   3 +
 .../source_viewer/languages/svelte.js         |  81 ++++++++
 .../source_viewer/source_viewer.vue           |  37 +++-
 app/models/namespace.rb                       |   4 +-
 .../nuget/v2/service_index_presenter.rb       |  48 +++++
 app/services/projects/participants_service.rb |  38 +---
 .../projects/pages/_pages_settings.html.haml  |   9 +-
 config/sidekiq_queues.yml                     |   2 +
 ...09_add_rule_idx_to_scan_result_policies.rb |  15 ++
 ..._idx_constraint_to_scan_result_policies.rb |  15 ++
 ...t_policies_on_position_in_configuration.rb |  16 ++
 db/schema_migrations/20230626142009           |   1 +
 db/schema_migrations/20230626142010           |   1 +
 db/schema_migrations/20230626143139           |   1 +
 db/structure.sql                              |   6 +-
 doc/api/packages/nuget.md                     |  71 ++++++-
 doc/development/changelog.md                  |   2 +-
 .../advanced_search_migration_styleguide.md   |  18 +-
 .../advanced_search/elasticsearch.md          |  26 ++-
 doc/user/analytics/analytics_dashboards.md    |   6 +-
 doc/user/group/saml_sso/index.md              |   3 +-
 doc/user/packages/nuget_repository/index.md   |  42 ++++
 doc/user/workspace/index.md                   |  19 +-
 .../packages/nuget/public_endpoints.rb        |  29 ++-
 lib/api/nuget_project_packages.rb             |  84 +++++---
 lib/gitlab/auth/auth_finders.rb               |   5 +
 locale/gitlab.pot                             |   6 +-
 qa/Gemfile                                    |   2 +-
 qa/Gemfile.lock                               |   4 +-
 scripts/elastic-migration                     | 168 ++++++++++++++++
 .../autocomplete_sources_controller_spec.rb   |  15 +-
 spec/factories/groups.rb                      |  10 +-
 spec/factories/namespaces.rb                  |   4 -
 ...c.js => diff_inline_findings_item_spec.js} |   6 +-
 .../components/diff_inline_findings_spec.js   |  10 +-
 .../findings_drawer_spec.js.snap              |   2 +-
 .../repository/mixins/highlight_mixin_spec.js |  26 +--
 .../components/service_desk_list_app_spec.js  | 162 +++++++++++++---
 .../source_viewer/source_viewer_spec.js       |  40 ++++
 spec/helpers/ci/runners_helper_spec.rb        |   6 +-
 spec/lib/gitlab/auth/auth_finders_spec.rb     |  28 ++-
 .../project/relation_tree_restorer_spec.rb    |   2 +-
 spec/models/namespace_spec.rb                 |  12 +-
 spec/models/project_spec.rb                   |   8 +-
 .../nuget/v2/service_index_presenter_spec.rb  |  54 ++++++
 .../requests/api/nuget_group_packages_spec.rb |   6 +
 .../api/nuget_project_packages_spec.rb        |  86 +++------
 .../update_shared_runners_service_spec.rb     |  21 +-
 .../projects/participants_service_spec.rb     | 182 ++++++++----------
 .../projects/transfer_service_spec.rb         |  12 +-
 .../api/nuget_endpoints_shared_examples.rb    |  14 +-
 .../api/nuget_packages_shared_examples.rb     |  65 ++++++-
 .../pages/_pages_settings.html.haml_spec.rb   |  31 +++
 workhorse/internal/upstream/routes.go         |   3 +
 workhorse/upload_test.go                      |   5 +
 64 files changed, 1472 insertions(+), 396 deletions(-)
 rename app/assets/javascripts/diffs/components/{diff_code_quality_item.vue => diff_inline_findings_item.vue} (96%)
 create mode 100644 app/assets/javascripts/service_desk/search_tokens.js
 create mode 100644 app/assets/javascripts/vue_shared/components/source_viewer/languages/svelte.js
 create mode 100644 app/presenters/packages/nuget/v2/service_index_presenter.rb
 create mode 100644 db/migrate/20230626142009_add_rule_idx_to_scan_result_policies.rb
 create mode 100644 db/migrate/20230626142010_add_rule_idx_constraint_to_scan_result_policies.rb
 create mode 100644 db/migrate/20230626143139_add_unique_index_to_scan_result_policies_on_position_in_configuration.rb
 create mode 100644 db/schema_migrations/20230626142009
 create mode 100644 db/schema_migrations/20230626142010
 create mode 100644 db/schema_migrations/20230626143139
 create mode 100755 scripts/elastic-migration
 rename spec/frontend/diffs/components/{diff_code_quality_item_spec.js => diff_inline_findings_item_spec.js} (91%)
 create mode 100644 spec/presenters/packages/nuget/v2/service_index_presenter_spec.rb
 create mode 100644 spec/views/projects/pages/_pages_settings.html.haml_spec.rb

diff --git a/app/assets/javascripts/content_editor/services/highlight_js_language_loader.js b/app/assets/javascripts/content_editor/services/highlight_js_language_loader.js
index 5e7c981ace3..964455a3922 100644
--- a/app/assets/javascripts/content_editor/services/highlight_js_language_loader.js
+++ b/app/assets/javascripts/content_editor/services/highlight_js_language_loader.js
@@ -222,6 +222,10 @@ export default {
   step21: () => import(/* webpackChunkName: 'hl-step21' */ 'highlight.js/lib/languages/step21'),
   stylus: () => import(/* webpackChunkName: 'hl-stylus' */ 'highlight.js/lib/languages/stylus'),
   subunit: () => import(/* webpackChunkName: 'hl-subunit' */ 'highlight.js/lib/languages/subunit'),
+  svelte: () =>
+    import(
+      /* webpackChunkName: 'hl-svelte' */ '~/vue_shared/components/source_viewer/languages/svelte'
+    ),
   swift: () => import(/* webpackChunkName: 'hl-swift' */ 'highlight.js/lib/languages/swift'),
   taggerscript: () =>
     import(/* webpackChunkName: 'hl-taggerscript' */ 'highlight.js/lib/languages/taggerscript'),
diff --git a/app/assets/javascripts/diffs/components/diff_inline_findings.vue b/app/assets/javascripts/diffs/components/diff_inline_findings.vue
index 1e9a1825d3e..59f92040776 100644
--- a/app/assets/javascripts/diffs/components/diff_inline_findings.vue
+++ b/app/assets/javascripts/diffs/components/diff_inline_findings.vue
@@ -1,8 +1,8 @@
 <script>
-import DiffCodeQualityItem from './diff_code_quality_item.vue';
+import DiffInlineFindingsItem from './diff_inline_findings_item.vue';
 
 export default {
-  components: { DiffCodeQualityItem },
+  components: { DiffInlineFindingsItem },
   props: {
     title: {
       type: String,
@@ -22,7 +22,7 @@ export default {
       {{ title }}
     </h4>
     <ul class="gl-list-style-none gl-mb-0 gl-p-0">
-      <diff-code-quality-item
+      <diff-inline-findings-item
         v-for="finding in findings"
         :key="finding.description"
         :finding="finding"
diff --git a/app/assets/javascripts/diffs/components/diff_code_quality_item.vue b/app/assets/javascripts/diffs/components/diff_inline_findings_item.vue
similarity index 96%
rename from app/assets/javascripts/diffs/components/diff_code_quality_item.vue
rename to app/assets/javascripts/diffs/components/diff_inline_findings_item.vue
index 727b2a0c099..7f4307d16ab 100644
--- a/app/assets/javascripts/diffs/components/diff_code_quality_item.vue
+++ b/app/assets/javascripts/diffs/components/diff_inline_findings_item.vue
@@ -42,7 +42,7 @@ export default {
         :size="12"
         :name="enhancedFinding.name"
         :class="enhancedFinding.class"
-        class="codequality-severity-icon"
+        class="inline-findings-severity-icon"
       />
     </span>
     <span
diff --git a/app/assets/javascripts/diffs/components/shared/findings_drawer.vue b/app/assets/javascripts/diffs/components/shared/findings_drawer.vue
index 2cffe928d7b..fddd455b17e 100644
--- a/app/assets/javascripts/diffs/components/shared/findings_drawer.vue
+++ b/app/assets/javascripts/diffs/components/shared/findings_drawer.vue
@@ -68,7 +68,7 @@ export default {
             :size="12"
             :name="severityIcon(drawer.severity)"
             :class="severityClass(drawer.severity)"
-            class="codequality-severity-icon"
+            class="inline-findings-severity-icon"
           />
 
           {{ drawer.severity }}
diff --git a/app/assets/javascripts/repository/mixins/highlight_mixin.js b/app/assets/javascripts/repository/mixins/highlight_mixin.js
index 822a8b4ee38..5b6f68681bb 100644
--- a/app/assets/javascripts/repository/mixins/highlight_mixin.js
+++ b/app/assets/javascripts/repository/mixins/highlight_mixin.js
@@ -8,7 +8,6 @@ import { splitIntoChunks } from '~/vue_shared/components/source_viewer/workers/h
 import LineHighlighter from '~/blob/line_highlighter';
 import languageLoader from '~/content_editor/services/highlight_js_language_loader';
 import Tracking from '~/tracking';
-import { TEXT_FILE_TYPE } from '../constants';
 
 /*
  * This mixin is intended to be used as an interface between our highlight worker and Vue components
@@ -37,8 +36,8 @@ export default {
       this.trackEvent(EVENT_LABEL_FALLBACK, language);
       this?.onError();
     },
-    initHighlightWorker({ rawTextBlob, language, simpleViewer, fileType }) {
-      if (simpleViewer?.fileType !== TEXT_FILE_TYPE || !this.glFeatures.highlightJsWorker) return;
+    initHighlightWorker({ rawTextBlob, language, fileType }) {
+      if (language !== 'json' || !this.glFeatures.highlightJsWorker) return;
 
       if (this.isUnsupportedLanguage(language)) {
         this.handleUnsupportedLanguage(language);
diff --git a/app/assets/javascripts/service_desk/components/service_desk_list_app.vue b/app/assets/javascripts/service_desk/components/service_desk_list_app.vue
index e8b05642e7d..9e77a1d44f4 100644
--- a/app/assets/javascripts/service_desk/components/service_desk_list_app.vue
+++ b/app/assets/javascripts/service_desk/components/service_desk_list_app.vue
@@ -1,10 +1,21 @@
 <script>
 import { GlEmptyState } from '@gitlab/ui';
 import * as Sentry from '@sentry/browser';
+import fuzzaldrinPlus from 'fuzzaldrin-plus';
 import { fetchPolicies } from '~/lib/graphql';
+import axios from '~/lib/utils/axios_utils';
+import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import IssuableList from '~/vue_shared/issuable/list/components/issuable_list_root.vue';
 import { issuableListTabs } from '~/vue_shared/issuable/list/constants';
-import { STATUS_OPEN, STATUS_CLOSED, STATUS_ALL } from '~/issues/constants';
+import {
+  OPERATORS_IS_NOT,
+  OPERATORS_IS_NOT_OR,
+} from '~/vue_shared/components/filtered_search_bar/constants';
+import { convertToGraphQLId } from '~/graphql_shared/utils';
+import { TYPENAME_USER } from '~/graphql_shared/constants';
+import searchUsersQuery from '~/issues/list/queries/search_users.query.graphql';
+import searchLabelsQuery from '~/issues/list/queries/search_labels.query.graphql';
+import searchMilestonesQuery from '~/issues/list/queries/search_milestones.query.graphql';
 import getServiceDeskIssuesQuery from '../queries/get_service_desk_issues.query.graphql';
 import getServiceDeskIssuesCounts from '../queries/get_service_desk_issues_counts.query.graphql';
 import {
@@ -13,7 +24,21 @@ import {
   noSearchNoFilterTitle,
   searchPlaceholder,
   SERVICE_DESK_BOT_USERNAME,
+  MAX_LIST_SIZE,
+  STATUS_OPEN,
+  STATUS_CLOSED,
+  STATUS_ALL,
+  WORKSPACE_PROJECT,
 } from '../constants';
+import {
+  searchWithinTokenBase,
+  assigneeTokenBase,
+  milestoneTokenBase,
+  labelTokenBase,
+  releaseTokenBase,
+  reactionTokenBase,
+  confidentialityTokenBase,
+} from '../search_tokens';
 import InfoBanner from './info_banner.vue';
 
 export default {
@@ -29,7 +54,12 @@ export default {
     IssuableList,
     InfoBanner,
   },
+  mixins: [glFeatureFlagMixin()],
   inject: [
+    'releasesPath',
+    'autocompleteAwardEmojisPath',
+    'hasIterationsFeature',
+    'groupPath',
     'emptyStateSvgPath',
     'isProject',
     'isSignedIn',
@@ -41,7 +71,6 @@ export default {
     return {
       serviceDeskIssues: [],
       serviceDeskIssuesCounts: {},
-      searchTokens: [],
       sortOptions: [],
       state: STATUS_OPEN,
       issuesError: null,
@@ -112,8 +141,134 @@ export default {
     isInfoBannerVisible() {
       return this.isServiceDeskSupported && this.hasAnyIssues;
     },
+    hasOrFeature() {
+      return this.glFeatures.orIssuableQueries;
+    },
+    searchTokens() {
+      const preloadedUsers = [];
+
+      if (gon.current_user_id) {
+        preloadedUsers.push({
+          id: convertToGraphQLId(TYPENAME_USER, gon.current_user_id),
+          name: gon.current_user_fullname,
+          username: gon.current_username,
+          avatar_url: gon.current_user_avatar_url,
+        });
+      }
+
+      const tokens = [
+        {
+          ...searchWithinTokenBase,
+        },
+        {
+          ...assigneeTokenBase,
+          operators: this.hasOrFeature ? OPERATORS_IS_NOT_OR : OPERATORS_IS_NOT,
+          fetchUsers: this.fetchUsers,
+          recentSuggestionsStorageKey: `${this.fullPath}-issues-recent-tokens-assignee`,
+          preloadedUsers,
+        },
+        {
+          ...milestoneTokenBase,
+          fetchMilestones: this.fetchMilestones,
+          recentSuggestionsStorageKey: `${this.fullPath}-issues-recent-tokens-milestone`,
+        },
+        {
+          ...labelTokenBase,
+          operators: this.hasOrFeature ? OPERATORS_IS_NOT_OR : OPERATORS_IS_NOT,
+          fetchLabels: this.fetchLabels,
+          fetchLatestLabels: this.glFeatures.frontendCaching ? this.fetchLatestLabels : null,
+          recentSuggestionsStorageKey: `${this.fullPath}-issues-recent-tokens-label`,
+        },
+      ];
+
+      if (this.isProject) {
+        tokens.push({
+          ...releaseTokenBase,
+          fetchReleases: this.fetchReleases,
+          recentSuggestionsStorageKey: `${this.fullPath}-issues-recent-tokens-release`,
+        });
+      }
+
+      if (this.isSignedIn) {
+        tokens.push({
+          ...reactionTokenBase,
+          fetchEmojis: this.fetchEmojis,
+          recentSuggestionsStorageKey: `${this.fullPath}-issues-recent-tokens-my_reaction`,
+        });
+
+        tokens.push({
+          ...confidentialityTokenBase,
+        });
+      }
+
+      tokens.sort((a, b) => a.title.localeCompare(b.title));
+
+      return tokens;
+    },
+  },
+  created() {
+    this.cache = {};
   },
   methods: {
+    fetchWithCache(path, cacheName, searchKey, search) {
+      if (this.cache[cacheName]) {
+        const data = search
+          ? fuzzaldrinPlus.filter(this.cache[cacheName], search, { key: searchKey })
+          : this.cache[cacheName].slice(0, MAX_LIST_SIZE);
+        return Promise.resolve(data);
+      }
+
+      return axios.get(path).then(({ data }) => {
+        this.cache[cacheName] = data;
+        return data.slice(0, MAX_LIST_SIZE);
+      });
+    },
+    fetchUsers(search) {
+      return this.$apollo
+        .query({
+          query: searchUsersQuery,
+          variables: { fullPath: this.fullPath, search, isProject: this.isProject },
+        })
+        .then(({ data }) =>
+          data[WORKSPACE_PROJECT]?.[`${WORKSPACE_PROJECT}Members`].nodes.map(
+            (member) => member.user,
+          ),
+        );
+    },
+    fetchMilestones(search) {
+      return this.$apollo
+        .query({
+          query: searchMilestonesQuery,
+          variables: { fullPath: this.fullPath, search, isProject: this.isProject },
+        })
+        .then(({ data }) => data[WORKSPACE_PROJECT]?.milestones.nodes);
+    },
+    fetchEmojis(search) {
+      return this.fetchWithCache(this.autocompleteAwardEmojisPath, 'emojis', 'name', search);
+    },
+    fetchReleases(search) {
+      return this.fetchWithCache(this.releasesPath, 'releases', 'tag', search);
+    },
+    fetchLabelsWithFetchPolicy(search, fetchPolicy = fetchPolicies.CACHE_FIRST) {
+      return this.$apollo
+        .query({
+          query: searchLabelsQuery,
+          variables: { fullPath: this.fullPath, search, isProject: this.isProject },
+          fetchPolicy,
+        })
+        .then(({ data }) => data[WORKSPACE_PROJECT]?.labels.nodes)
+        .then((labels) =>
+          // TODO remove once we can search by title-only on the backend
+          // https://gitlab.com/gitlab-org/gitlab/-/issues/346353
+          labels.filter((label) => label.title.toLowerCase().includes(search.toLowerCase())),
+        );
+    },
+    fetchLabels(search) {
+      return this.fetchLabelsWithFetchPolicy(search);
+    },
+    fetchLatestLabels(search) {
+      return this.fetchLabelsWithFetchPolicy(search, fetchPolicies.NETWORK_ONLY);
+    },
     handleClickTab(state) {
       if (this.state === state) {
         return;
diff --git a/app/assets/javascripts/service_desk/constants.js b/app/assets/javascripts/service_desk/constants.js
index 685ad738792..e0473961699 100644
--- a/app/assets/javascripts/service_desk/constants.js
+++ b/app/assets/javascripts/service_desk/constants.js
@@ -1,6 +1,11 @@
 import { __, s__ } from '~/locale';
 
 export const SERVICE_DESK_BOT_USERNAME = 'support-bot';
+export const MAX_LIST_SIZE = 10;
+export const STATUS_ALL = 'all';
+export const STATUS_CLOSED = 'closed';
+export const STATUS_OPEN = 'opened';
+export const WORKSPACE_PROJECT = 'project';
 
 export const errorFetchingCounts = __('An error occurred while getting issue counts');
 export const errorFetchingIssues = __('An error occurred while loading issues');
@@ -15,3 +20,7 @@ export const infoBannerUserNote = s__(
 );
 export const enableServiceDesk = s__('ServiceDesk|Enable Service Desk');
 export const learnMore = __('Learn more');
+export const titles = __('Titles');
+export const descriptions = __('Descriptions');
+export const no = __('No');
+export const yes = __('Yes');
diff --git a/app/assets/javascripts/service_desk/index.js b/app/assets/javascripts/service_desk/index.js
index a9172f96540..bcb5093e401 100644
--- a/app/assets/javascripts/service_desk/index.js
+++ b/app/assets/javascripts/service_desk/index.js
@@ -12,6 +12,12 @@ export async function mountServiceDeskListApp() {
   }
 
   const {
+    projectDataReleasesPath,
+    projectDataAutocompleteAwardEmojisPath,
+    projectDataHasIterationsFeature,
+    projectDataHasIssueWeightsFeature,
+    projectDataHasIssuableHealthStatusFeature,
+    projectDataGroupPath,
     projectDataEmptyStateSvgPath,
     projectDataFullPath,
     projectDataIsProject,
@@ -36,6 +42,12 @@ export async function mountServiceDeskListApp() {
       defaultClient: await gqlClient(),
     }),
     provide: {
+      releasesPath: projectDataReleasesPath,
+      autocompleteAwardEmojisPath: projectDataAutocompleteAwardEmojisPath,
+      hasIterationsFeature: parseBoolean(projectDataHasIterationsFeature),
+      hasIssueWeightsFeature: parseBoolean(projectDataHasIssueWeightsFeature),
+      hasIssuableHealthStatusFeature: parseBoolean(projectDataHasIssuableHealthStatusFeature),
+      groupPath: projectDataGroupPath,
       emptyStateSvgPath: projectDataEmptyStateSvgPath,
       fullPath: projectDataFullPath,
       isProject: parseBoolean(projectDataIsProject),
diff --git a/app/assets/javascripts/service_desk/search_tokens.js b/app/assets/javascripts/service_desk/search_tokens.js
new file mode 100644
index 00000000000..72750f518e4
--- /dev/null
+++ b/app/assets/javascripts/service_desk/search_tokens.js
@@ -0,0 +1,97 @@
+import { GlFilteredSearchToken } from '@gitlab/ui';
+import {
+  OPERATORS_IS,
+  TOKEN_TITLE_ASSIGNEE,
+  TOKEN_TITLE_CONFIDENTIAL,
+  TOKEN_TITLE_LABEL,
+  TOKEN_TITLE_MILESTONE,
+  TOKEN_TITLE_MY_REACTION,
+  TOKEN_TITLE_RELEASE,
+  TOKEN_TITLE_SEARCH_WITHIN,
+  TOKEN_TYPE_ASSIGNEE,
+  TOKEN_TYPE_CONFIDENTIAL,
+  TOKEN_TYPE_LABEL,
+  TOKEN_TYPE_MILESTONE,
+  TOKEN_TYPE_RELEASE,
+  TOKEN_TYPE_MY_REACTION,
+  TOKEN_TYPE_SEARCH_WITHIN,
+} from '~/vue_shared/components/filtered_search_bar/constants';
+import { titles, descriptions, yes, no } from './constants';
+
+const UserToken = () => import('~/vue_shared/components/filtered_search_bar/tokens/user_token.vue');
+const EmojiToken = () =>
+  import('~/vue_shared/components/filtered_search_bar/tokens/emoji_token.vue');
+const LabelToken = () =>
+  import('~/vue_shared/components/filtered_search_bar/tokens/label_token.vue');
+const MilestoneToken = () =>
+  import('~/vue_shared/components/filtered_search_bar/tokens/milestone_token.vue');
+const ReleaseToken = () =>
+  import('~/vue_shared/components/filtered_search_bar/tokens/release_token.vue');
+
+export const searchWithinTokenBase = {
+  type: TOKEN_TYPE_SEARCH_WITHIN,
+  title: TOKEN_TITLE_SEARCH_WITHIN,
+  icon: 'search',
+  token: GlFilteredSearchToken,
+  unique: true,
+  operators: OPERATORS_IS,
+  options: [
+    { icon: 'title', value: 'TITLE', title: titles },
+    {
+      icon: 'text-description',
+      value: 'DESCRIPTION',
+      title: descriptions,
+    },
+  ],
+};
+
+export const assigneeTokenBase = {
+  type: TOKEN_TYPE_ASSIGNEE,
+  title: TOKEN_TITLE_ASSIGNEE,
+  icon: 'user',
+  token: UserToken,
+  dataType: 'user',
+};
+
+export const milestoneTokenBase = {
+  type: TOKEN_TYPE_MILESTONE,
+  title: TOKEN_TITLE_MILESTONE,
+  icon: 'clock',
+  token: MilestoneToken,
+  shouldSkipSort: true,
+};
+
+export const labelTokenBase = {
+  type: TOKEN_TYPE_LABEL,
+  title: TOKEN_TITLE_LABEL,
+  icon: 'labels',
+  token: LabelToken,
+};
+
+export const releaseTokenBase = {
+  type: TOKEN_TYPE_RELEASE,
+  title: TOKEN_TITLE_RELEASE,
+  icon: 'rocket',
+  token: ReleaseToken,
+};
+
+export const reactionTokenBase = {
+  type: TOKEN_TYPE_MY_REACTION,
+  title: TOKEN_TITLE_MY_REACTION,
+  icon: 'thumb-up',
+  token: EmojiToken,
+  unique: true,
+};
+
+export const confidentialityTokenBase = {
+  type: TOKEN_TYPE_CONFIDENTIAL,
+  title: TOKEN_TITLE_CONFIDENTIAL,
+  icon: 'eye-slash',
+  token: GlFilteredSearchToken,
+  unique: true,
+  operators: OPERATORS_IS,
+  options: [
+    { icon: 'eye-slash', value: 'yes', title: yes },
+    { icon: 'eye', value: 'no', title: no },
+  ],
+};
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/constants.js b/app/assets/javascripts/vue_shared/components/source_viewer/constants.js
index 6c49a601401..582093e5739 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer/constants.js
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/constants.js
@@ -97,6 +97,7 @@ export const ROUGE_TO_HLJS_LANGUAGE_MAP = {
   sql: 'sql',
   stan: 'stan',
   stata: 'stata',
+  svelte: 'svelte',
   swift: 'swift',
   tap: 'tap',
   tcl: 'tcl',
@@ -151,3 +152,5 @@ export const LEGACY_FALLBACKS = ['python', 'haml'];
 export const CODEOWNERS_FILE_NAME = 'CODEOWNERS';
 
 export const CODEOWNERS_LANGUAGE = 'codeowners';
+
+export const SVELTE_LANGUAGE = 'svelte';
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/languages/svelte.js b/app/assets/javascripts/vue_shared/components/source_viewer/languages/svelte.js
new file mode 100644
index 00000000000..df92bdf87db
--- /dev/null
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/languages/svelte.js
@@ -0,0 +1,81 @@
+/*
+Language: Svelte.js
+Requires: xml, javascript, typescript, css, scss
+Description: Components of Svelte Framework
+*/
+
+export default (hljs) => {
+  return {
+    subLanguage: 'xml',
+    contains: [
+      hljs.COMMENT('<!--', '-->', {
+        relevance: 11,
+      }),
+      {
+        begin: /^(\s*)(<script.*(lang="ts").*>)/gm,
+        end: /^(\s*)(<\/script>)/gm,
+        subLanguage: 'typescript',
+        excludeBegin: true,
+        excludeEnd: true,
+        relevance: 20,
+        contains: [
+          // special svelte $ syntax
+          {
+            begin: /^(\s*)(\$:)/gm,
+            end: /(\s*)/gm,
+            className: 'keyword',
+          },
+        ],
+      },
+      {
+        begin: /^(\s*)(<script(\s*context="module")?.*>)/gm,
+        end: /^(\s*)(<\/script>)/gm,
+        subLanguage: 'javascript',
+        excludeBegin: true,
+        excludeEnd: true,
+        relevance: 15,
+        contains: [
+          // special svelte $ syntax
+          {
+            begin: /^(\s*)(\$:)/gm,
+            end: /(\s*)/gm,
+            className: 'keyword',
+          },
+        ],
+      },
+      {
+        begin: /^(\s*)(<style.*(lang="scss"|type="text\/scss").*>)/gm,
+        end: /^(\s*)(<\/style>)/gm,
+        subLanguage: 'scss',
+        excludeBegin: true,
+        excludeEnd: true,
+        relevance: 20,
+      },
+      {
+        begin: /^(\s*)(<style.*>)/gm,
+        end: /^(\s*)(<\/style>)/gm,
+        subLanguage: 'css',
+        excludeBegin: true,
+        excludeEnd: true,
+        relevance: 15,
+      },
+      {
+        begin: /\{/gm,
+        end: /}/gm,
+        subLanguage: 'javascript',
+        contains: [
+          {
+            begin: /[{]/,
+            end: /[}]/,
+            skip: true,
+          },
+          {
+            begin: /([#:/@])(if|else|each|await|then|catch|debug|html)/gm,
+            className: 'keyword',
+            relevance: 10,
+          },
+        ],
+      },
+    ],
+  };
+};
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue b/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
index 9dc6dc1b93a..37df45a72a4 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
@@ -14,6 +14,7 @@ import {
   LEGACY_FALLBACKS,
   CODEOWNERS_FILE_NAME,
   CODEOWNERS_LANGUAGE,
+  SVELTE_LANGUAGE,
 } from './constants';
 import Chunk from './components/chunk.vue';
 import { registerPlugins } from './plugins/index';
@@ -56,9 +57,15 @@ export default {
       return this.content.split(/\r?\n/);
     },
     language() {
-      return this.blob.name === this.$options.codeownersFileName
-        ? this.$options.codeownersLanguage
-        : ROUGE_TO_HLJS_LANGUAGE_MAP[this.blob.language?.toLowerCase()];
+      if (this.blob.name && this.blob.name.endsWith(`.${SVELTE_LANGUAGE}`)) {
+        // override for svelte files until https://github.com/rouge-ruby/rouge/issues/1717 is resolved
+        return SVELTE_LANGUAGE;
+      } else if (this.blob.name === this.$options.codeownersFileName) {
+        // override for codeowners files
+        return this.$options.codeownersLanguage;
+      }
+
+      return ROUGE_TO_HLJS_LANGUAGE_MAP[this.blob.language?.toLowerCase()];
     },
     lineNumbers() {
       return this.splitContent.length;
@@ -168,12 +175,36 @@ export default {
       // If no language can be mapped to highlight.js we load all common languages else we load only the core (smallest footprint)
       return !this.language ? import('highlight.js/lib/common') : import('highlight.js/lib/core');
     },
+    async loadSubLanguages(languageDefinition) {
+      if (!languageDefinition?.contains) return;
+
+      // generate list of languages to load
+      const languages = new Set(
+        languageDefinition.contains
+          .filter((component) => Boolean(component.subLanguage))
+          .map((component) => component.subLanguage),
+      );
+
+      if (languageDefinition.subLanguage) {
+        languages.add(languageDefinition.subLanguage);
+      }
+
+      // load all sub-languages at once
+      await Promise.all(
+        [...languages].map(async (subLanguage) => {
+          const subLanguageDefinition = await languageLoader[subLanguage]();
+          this.hljs.registerLanguage(subLanguage, subLanguageDefinition.default);
+        }),
+      );
+    },
     async loadLanguage() {
       let languageDefinition;
 
       try {
         languageDefinition = await languageLoader[this.language]();
         this.hljs.registerLanguage(this.language, languageDefinition.default);
+
+        await this.loadSubLanguages(this.hljs.getLanguage(this.language));
       } catch (message) {
         this.$emit('error', message);
       }
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 5449f006a2e..c1f4c7f1b46 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -543,8 +543,8 @@ class Namespace < ApplicationRecord
   def changing_allow_descendants_override_disabled_shared_runners_is_allowed
     return unless new_record? || changes.has_key?(:allow_descendants_override_disabled_shared_runners)
 
-    if shared_runners_enabled && !new_record?
-      errors.add(:allow_descendants_override_disabled_shared_runners, _('cannot be changed if shared runners are enabled'))
+    if shared_runners_enabled && allow_descendants_override_disabled_shared_runners
+      errors.add(:allow_descendants_override_disabled_shared_runners, _('can not be true if shared runners are enabled'))
     end
 
     if allow_descendants_override_disabled_shared_runners && has_parent? && parent.shared_runners_setting == SR_DISABLED_AND_UNOVERRIDABLE
diff --git a/app/presenters/packages/nuget/v2/service_index_presenter.rb b/app/presenters/packages/nuget/v2/service_index_presenter.rb
new file mode 100644
index 00000000000..a8fc9b673bf
--- /dev/null
+++ b/app/presenters/packages/nuget/v2/service_index_presenter.rb
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Packages
+  module Nuget
+    module V2
+      class ServiceIndexPresenter
+        include API::Helpers::RelatedResourcesHelpers
+
+        ROOT_ATTRIBUTES = {
+          xmlns: 'http://www.w3.org/2007/app',
+          'xmlns:atom' => 'http://www.w3.org/2005/Atom'
+        }.freeze
+
+        def initialize(project_or_group)
+          @project_or_group = project_or_group
+        end
+
+        def xml
+          Nokogiri::XML::Builder.new(encoding: 'UTF-8') do |xml|
+            xml.service(ROOT_ATTRIBUTES.merge('xml:base' => xml_base)) do
+              xml.workspace do
+                xml['atom'].title('Default', type: 'text')
+                xml.collection(href: 'Packages') do
+                  xml['atom'].title('Packages', type: 'text')
+                end
+              end
+            end
+          end
+        end
+
+        private
+
+        attr_reader :project_or_group
+
+        def xml_base
+          base_path = case project_or_group
+                      when Project
+                        api_v4_projects_packages_nuget_v2_path(id: project_or_group.id)
+                      when Group
+                        api_v4_groups___packages_nuget_v2_path(id: project_or_group.id)
+                      end
+
+          expose_url(base_path)
+        end
+      end
+    end
+  end
+end
diff --git a/app/services/projects/participants_service.rb b/app/services/projects/participants_service.rb
index 44cd6e9926f..458eaec4e2e 100644
--- a/app/services/projects/participants_service.rb
+++ b/app/services/projects/participants_service.rb
@@ -18,15 +18,7 @@ module Projects
     end
 
     def project_members
-      @project_members ||= sorted(get_project_members)
-    end
-
-    def get_project_members
-      members = Member.from_union([project_members_through_ancestral_groups,
-                                   project_members_through_invited_groups,
-                                   individual_project_members])
-
-      User.id_in(members.select(:user_id))
+      @project_members ||= sorted(project.authorized_users)
     end
 
     def all_members
@@ -34,33 +26,5 @@ module Projects
 
       [{ username: "all", name: "All Project and Group Members", count: project_members.count }]
     end
-
-    private
-
-    def project_members_through_invited_groups
-      GroupMember
-        .active_without_invites_and_requests
-        .with_source_id(visible_groups.self_and_ancestors.pluck_primary_key)
-        .select(*GroupMember.cached_column_list)
-    end
-
-    def visible_groups
-      visible_groups = project.invited_groups
-
-      unless project.team.member?(current_user)
-        visible_groups = visible_groups.public_or_visible_to_user(current_user)
-      end
-
-      visible_groups
-    end
-
-    def project_members_through_ancestral_groups
-      members = project.group.present? ? project.group.members_with_parents : Member.none
-      members.select(*GroupMember.cached_column_list)
-    end
-
-    def individual_project_members
-      project.project_members.select(*GroupMember.cached_column_list)
-    end
   end
 end
diff --git a/app/views/projects/pages/_pages_settings.html.haml b/app/views/projects/pages/_pages_settings.html.haml
index 4c8ec21db39..914292eea02 100644
--- a/app/views/projects/pages/_pages_settings.html.haml
+++ b/app/views/projects/pages/_pages_settings.html.haml
@@ -1,7 +1,8 @@
-- can_edit_max_page_size=can?(current_user, :update_max_pages_size)
-- can_enforce_https_only=Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+- can_edit_max_page_size = can?(current_user, :update_max_pages_size)
+- can_enforce_https_only = Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+- can_edit_unique_domain = Feature.enabled?(:pages_unique_domain, @project)
 
-- return unless can_edit_max_page_size || can_enforce_https_only
+- return unless can_edit_max_page_size || can_enforce_https_only || can_edit_unique_domain
 = gitlab_ui_form_for @project, url: project_pages_path(@project), html: { class: 'inline', title: pages_https_only_title } do |f|
   - if can_edit_max_page_size
     = render_if_exists 'shared/pages/max_pages_size_input', form: f
@@ -17,7 +18,7 @@
       %p.gl-pl-6
         = s_("GitLabPages|When enabled, all attempts to visit your website through HTTP are automatically redirected to HTTPS using a response with status code 301. Requires a valid certificate for all domains. %{docs_link_start}Learn more.%{link_end}").html_safe % { docs_link_start: docs_link_start, link_end: link_end }
 
-  - if Feature.enabled?(:pages_unique_domain, @project)
+  - if can_edit_unique_domain
     .form-group
       = f.fields_for :project_setting do |settings|
         = settings.gitlab_ui_checkbox_component :pages_unique_domain_enabled,
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 7f05b8af7bf..da7d3e8b1cd 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -273,6 +273,8 @@
   - 1
 - - groups_create_event
   - 1
+- - groups_enterprise_users_disassociate
+  - 1
 - - groups_export_memberships
   - 1
 - - groups_schedule_bulk_repository_shard_moves
diff --git a/db/migrate/20230626142009_add_rule_idx_to_scan_result_policies.rb b/db/migrate/20230626142009_add_rule_idx_to_scan_result_policies.rb
new file mode 100644
index 00000000000..8edad14546e
--- /dev/null
+++ b/db/migrate/20230626142009_add_rule_idx_to_scan_result_policies.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddRuleIdxToScanResultPolicies < Gitlab::Database::Migration[2.1]
+  enable_lock_retries!
+
+  CONSTRAINT_NAME = "check_scan_result_policies_rule_idx_positive"
+
+  def up
+    add_column :scan_result_policies, :rule_idx, :smallint
+  end
+
+  def down
+    remove_column :scan_result_policies, :rule_idx
+  end
+end
diff --git a/db/migrate/20230626142010_add_rule_idx_constraint_to_scan_result_policies.rb b/db/migrate/20230626142010_add_rule_idx_constraint_to_scan_result_policies.rb
new file mode 100644
index 00000000000..5fdeaf68137
--- /dev/null
+++ b/db/migrate/20230626142010_add_rule_idx_constraint_to_scan_result_policies.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddRuleIdxConstraintToScanResultPolicies < Gitlab::Database::Migration[2.1]
+  disable_ddl_transaction!
+
+  CONSTRAINT_NAME = "check_scan_result_policies_rule_idx_positive"
+
+  def up
+    add_check_constraint :scan_result_policies, "rule_idx IS NULL OR rule_idx >= 0", CONSTRAINT_NAME
+  end
+
+  def down
+    remove_check_constraint :scan_result_policies, CONSTRAINT_NAME
+  end
+end
diff --git a/db/migrate/20230626143139_add_unique_index_to_scan_result_policies_on_position_in_configuration.rb b/db/migrate/20230626143139_add_unique_index_to_scan_result_policies_on_position_in_configuration.rb
new file mode 100644
index 00000000000..d6935759cbf
--- /dev/null
+++ b/db/migrate/20230626143139_add_unique_index_to_scan_result_policies_on_position_in_configuration.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddUniqueIndexToScanResultPoliciesOnPositionInConfiguration < Gitlab::Database::Migration[2.1]
+  disable_ddl_transaction!
+
+  INDEX_NAME = 'index_scan_result_policies_on_position_in_configuration'
+  COLUMNS = %i[security_orchestration_policy_configuration_id project_id orchestration_policy_idx rule_idx]
+
+  def up
+    add_concurrent_index :scan_result_policies, COLUMNS, unique: true, name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :scan_result_policies, INDEX_NAME
+  end
+end
diff --git a/db/schema_migrations/20230626142009 b/db/schema_migrations/20230626142009
new file mode 100644
index 00000000000..ed9449a2067
--- /dev/null
+++ b/db/schema_migrations/20230626142009
@@ -0,0 +1 @@
+5a4aff0810f41646e25614ad26a826434eb28e85a8f1393e4e1799ce6ab61ff7
\ No newline at end of file
diff --git a/db/schema_migrations/20230626142010 b/db/schema_migrations/20230626142010
new file mode 100644
index 00000000000..3ec883ee28f
--- /dev/null
+++ b/db/schema_migrations/20230626142010
@@ -0,0 +1 @@
+ff621297609cbbcb09108981daacfacf341d1e39bbbbe71fe140c6a0b7af40eb
\ No newline at end of file
diff --git a/db/schema_migrations/20230626143139 b/db/schema_migrations/20230626143139
new file mode 100644
index 00000000000..bb9f03a4cbb
--- /dev/null
+++ b/db/schema_migrations/20230626143139
@@ -0,0 +1 @@
+20e8e9e72d25ed720d4aa8c3045a8cc99c6e34cc9ac4f0973e39627300866f30
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index b29b10d6919..204ebf0b589 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -22432,7 +22432,9 @@ CREATE TABLE scan_result_policies (
     age_interval smallint,
     vulnerability_attributes jsonb DEFAULT '{}'::jsonb,
     project_id bigint,
-    CONSTRAINT age_value_null_or_positive CHECK (((age_value IS NULL) OR (age_value >= 0)))
+    rule_idx smallint,
+    CONSTRAINT age_value_null_or_positive CHECK (((age_value IS NULL) OR (age_value >= 0))),
+    CONSTRAINT check_scan_result_policies_rule_idx_positive CHECK (((rule_idx IS NULL) OR (rule_idx >= 0)))
 );
 
 CREATE SEQUENCE scan_result_policies_id_seq
@@ -32933,6 +32935,8 @@ CREATE UNIQUE INDEX index_sbom_sources_on_source_type_and_source ON sbom_sources
 
 CREATE INDEX index_scan_result_policies_on_policy_configuration_id ON scan_result_policies USING btree (security_orchestration_policy_configuration_id);
 
+CREATE UNIQUE INDEX index_scan_result_policies_on_position_in_configuration ON scan_result_policies USING btree (security_orchestration_policy_configuration_id, project_id, orchestration_policy_idx, rule_idx);
+
 CREATE INDEX index_scan_result_policies_on_project_id ON scan_result_policies USING btree (project_id);
 
 CREATE INDEX index_schema_inconsistencies_on_issue_id ON schema_inconsistencies USING btree (issue_id);
diff --git a/doc/api/packages/nuget.md b/doc/api/packages/nuget.md
index afe384b5a29..cbfd12c7233 100644
--- a/doc/api/packages/nuget.md
+++ b/doc/api/packages/nuget.md
@@ -80,13 +80,22 @@ This writes the downloaded file to `MyNuGetPkg.1.3.0.17.nupkg` in the current di
 
 ## Upload a package file
 
-> Introduced in GitLab 12.8.
+> - Introduced in GitLab 12.8 for NuGet v3 feed.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/416404) in GitLab 16.2 for NuGet v2 feed.
 
 Upload a NuGet package file:
 
-```plaintext
-PUT projects/:id/packages/nuget
-```
+- For NuGet v3 feed:
+
+  ```plaintext
+  PUT projects/:id/packages/nuget
+  ```
+
+- For NuGet V2 feed:
+
+  ```plaintext
+  PUT projects/:id/packages/nuget/v2
+  ```
 
 | Attribute         | Type   | Required | Description |
 | ----------------- | ------ | -------- | ----------- |
@@ -95,12 +104,23 @@ PUT projects/:id/packages/nuget
 | `package_version` | string | yes      | The version of the package. |
 | `package_filename`| string | yes      | The name of the file. |
 
-```shell
-curl --request PUT \
-     --form 'package=@path/to/mynugetpkg.1.3.0.17.nupkg' \
-     --user <username>:<personal_access_token> \
-     "https://gitlab.example.com/api/v4/projects/1/packages/nuget/"
-```
+- For NuGet v3 feed:
+
+  ```shell
+  curl --request PUT \
+      --form 'package=@path/to/mynugetpkg.1.3.0.17.nupkg' \
+      --user <username>:<personal_access_token> \
+      "https://gitlab.example.com/api/v4/projects/1/packages/nuget/"
+  ```
+
+- For NuGet v2 feed:
+
+    ```shell
+  curl --request PUT \
+      --form 'package=@path/to/mynugetpkg.1.3.0.17.nupkg' \
+      --user <username>:<personal_access_token> \
+      "https://gitlab.example.com/api/v4/projects/1/packages/nuget/v2"
+  ```
 
 ## Upload a symbol package file
 
@@ -158,6 +178,37 @@ The examples in this document all use the project-level prefix.
 
 ## Service Index
 
+### V2 source feed/protocol
+
+Returns an XML document that represents the service index of the v2 NuGet source feed.
+Authentication is not required:
+
+```plaintext
+GET <route-prefix>/v2
+```
+
+Example Request:
+
+```shell
+curl "https://gitlab.example.com/api/v4/projects/1/packages/nuget/v2"
+```
+
+Example response:
+
+```xml
+<?xml version="1.0" encoding="utf-8"?>
+<service xmlns="http://www.w3.org/2007/app" xmlns:atom="http://www.w3.org/2005/Atom" xml:base="https://gitlab.example.com/api/v4/projects/1/packages/nuget/v2">
+  <workspace>
+    <atom:title type="text">Default</atom:title>
+    <collection href="Packages">
+      <atom:title type="text">Packages</atom:title>
+    </collection>
+  </workspace>
+</service>
+```
+
+### V3 source feed/protocol
+
 > - Introduced in GitLab 12.6.
 > - [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/214674) to be public in GitLab 16.1.
 
diff --git a/doc/development/changelog.md b/doc/development/changelog.md
index 56b5fa8c976..486808f25e7 100644
--- a/doc/development/changelog.md
+++ b/doc/development/changelog.md
@@ -94,7 +94,7 @@ EE: true
   uses system fonts for all text."
 - Any client-facing change to our REST and GraphQL APIs **must** have a changelog entry.
   See the [complete list what comprises a GraphQL breaking change](api_graphql_styleguide.md#breaking-changes).
-- Any change that introduces an [advanced search migration](search/advanced_search_migration_styleguide.md#creating-a-new-advanced-search-migration)
+- Any change that introduces an [advanced search migration](search/advanced_search_migration_styleguide.md#create-a-new-advanced-search-migration)
   **must** have a changelog entry.
 - A fix for a regression introduced and then fixed in the same release (such as
   fixing a bug introduced during a monthly release candidate) **should not**
diff --git a/doc/development/search/advanced_search_migration_styleguide.md b/doc/development/search/advanced_search_migration_styleguide.md
index d7c0dddee7b..d9ef0808c5a 100644
--- a/doc/development/search/advanced_search_migration_styleguide.md
+++ b/doc/development/search/advanced_search_migration_styleguide.md
@@ -6,13 +6,25 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 # Advanced search migration style guide
 
-## Creating a new advanced search migration
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/234046) in GitLab 13.6.
+## Create a new advanced search migration
 
 NOTE:
 This functionality is only supported for indices created in GitLab 13.0 and later.
 
+### With a script
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/414674) in GitLab 16.3.
+
+Execute `scripts/elastic-migration` and follow the prompts to create:
+
+- A migration file to define the migration: `ee/elastic/migrate/YYYYMMDDHHMMSS_migration_name.rb`
+- A spec file to test the migration: `ee/spec/elastic/migrate/YYYYMMDDHHMMSS_migration_name_spec.rb`
+- A dictionary file to identify the migration: `ee/elastic/docs/YYYYMMDDHHMMSS_migration_name.yml`
+
+### Manually
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/234046) in GitLab 13.6.
+
 In the [`ee/elastic/migrate/`](https://gitlab.com/gitlab-org/gitlab/-/tree/master/ee/elastic/migrate) folder, create a new file with the filename format `YYYYMMDDHHMMSS_migration_name.rb`. This format is the same for Rails database migrations.
 
 ```ruby
diff --git a/doc/integration/advanced_search/elasticsearch.md b/doc/integration/advanced_search/elasticsearch.md
index cdda85bb259..6a2ab683266 100644
--- a/doc/integration/advanced_search/elasticsearch.md
+++ b/doc/integration/advanced_search/elasticsearch.md
@@ -527,7 +527,29 @@ With reindex migrations running in the background, there's no need for a manual
 intervention. This usually happens in situations where new features are added to
 advanced search, which means adding or changing the way content is indexed.
 
-To confirm that the advanced search migrations ran, you can check with:
+### Migration dictionary files
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/414674) in GitLab 16.3.
+
+Every migration has a corresponding dictionary file in the `ee/elastic/docs/` folder with the following information:
+
+```yaml
+name:
+version:
+description:
+group:
+milestone:
+introduced_by_url:
+obsolete:
+marked_obsolete_by_url:
+marked_obsolete_in_milestone:
+```
+
+You can use this information, for example, to identify when a migration was introduced or was marked as obsolete.
+
+### Check for pending migrations
+
+To check for pending advanced search migrations, run this command:
 
 ```shell
 curl "$CLUSTER_URL/gitlab-production-migrations/_search?q=*" | jq .
@@ -566,7 +588,7 @@ This should return something similar to:
 }
 ```
 
-To debug issues with the migrations you can check the [`elasticsearch.log` file](../../administration/logs/index.md#elasticsearchlog).
+To debug issues with the migrations, check the [`elasticsearch.log`](../../administration/logs/index.md#elasticsearchlog) file.
 
 ### Retry a halted migration
 
diff --git a/doc/user/analytics/analytics_dashboards.md b/doc/user/analytics/analytics_dashboards.md
index 7fcae501982..2f61f172b04 100644
--- a/doc/user/analytics/analytics_dashboards.md
+++ b/doc/user/analytics/analytics_dashboards.md
@@ -76,7 +76,7 @@ Prerequisite:
 To view a list of dashboards (both built-in and custom) for a project:
 
 1. On the left sidebar, at the top, select **Search GitLab** (**{search}**) to find your project.
-1. Select **Analyze > Dashboards**.
+1. Select **Analyze > Analytics dashboards**.
 1. From the list of available dashboards, select the dashboard you want to view.
 
 ## Change the location of dashboards
@@ -174,7 +174,7 @@ create a `line_chart.yaml` file with the following required fields:
 To create a custom dashboard:
 
 1. On the left sidebar, at the top, select **Search GitLab** (**{search}**) to find your project.
-1. Select **Analyze > Dashboards**.
+1. Select **Analyze > Analytics dashboards**.
 1. Select **New dashboard**.
 1. In the **New dashboard** input, enter the name of the dashboard.
 1. From the **Add visualizations** list on the right, select the visualizations to add to the dashboard.
@@ -188,7 +188,7 @@ You can edit your custom dashboard's title and add or resize visualizations in t
 To edit an existing custom dashboard:
 
 1. On the left sidebar, at the top, select **Search GitLab** (**{search}**) to find your project.
-1. Select **Analyze > Dashboards**.
+1. Select **Analyze > Analytics dashboards**.
 1. From the list of available dashboards, select a custom dashboard (one without the `By GitLab` label) you want to edit.
 1. Select **Edit**.
 1. Optional. Change the title of the dashboard.
diff --git a/doc/user/group/saml_sso/index.md b/doc/user/group/saml_sso/index.md
index 7795aed5fd0..62085b112b7 100644
--- a/doc/user/group/saml_sso/index.md
+++ b/doc/user/group/saml_sso/index.md
@@ -225,8 +225,7 @@ After you set up your identity provider to work with GitLab, you must configure
 1. In the **Default membership role** field, select the role to assign to new users.
    The default role is **Guest**. In [GitLab 13.3](https://gitlab.com/gitlab-org/gitlab/-/issues/214523)
    and later, group owners can set a default membership role other than **Guest**.
-   To do so, [configure the SAML SSO for the group](#configure-gitlab). That role
-   becomes the starting role of all users added to the group.
+   That role becomes the starting role of all users added to the group.
 1. Select the **Enable SAML authentication for this group** checkbox.
 1. Optional. Select:
    - **Enforce SSO-only authentication for web activity for this group**.
diff --git a/doc/user/packages/nuget_repository/index.md b/doc/user/packages/nuget_repository/index.md
index ea9bfd7defb..fb457bb98b5 100644
--- a/doc/user/packages/nuget_repository/index.md
+++ b/doc/user/packages/nuget_repository/index.md
@@ -70,6 +70,7 @@ You can now add a new source to NuGet with:
 - [Visual Studio](#add-a-source-with-visual-studio)
 - [.NET CLI](#add-a-source-with-the-net-cli)
 - [Configuration file](#add-a-source-with-a-configuration-file)
+- [Chocolatey CLI](#add-a-source-with-chocolatey-cli)
 
 ### Add a source with the NuGet CLI
 
@@ -281,6 +282,22 @@ To use the [group-level](#use-the-gitlab-endpoint-for-nuget-packages) Package Re
    export GITLAB_PACKAGE_REGISTRY_PASSWORD=<gitlab_personal_access_token or deploy_token>
    ```
 
+### Add a source with Chocolatey CLI
+
+You can add a source feed with the Chocolatey CLI. If you use Chocolatey CLI v1.x, you can add only a NuGet v2 source feed.
+
+#### Configure a project-level endpoint
+
+You need a project-level endpoint to publish NuGet packages to the Package Registry.
+
+To use the [project-level](#use-the-gitlab-endpoint-for-nuget-packages) Package Registry as a source for Chocolatey:
+
+- Add the Package Registry as a source with `choco`:
+
+  ```shell
+  choco source add -n=gitlab -s "'https://gitlab.example.com/api/v4/projects/<your_project_id>/packages/nuget/v2'" -u=<gitlab_username or deploy_token_username> -p=<gitlab_personal_access_token or deploy_token>
+  ```
+
 ## Publish a NuGet package
 
 Prerequisite:
@@ -385,6 +402,31 @@ updated:
 
 1. Commit the changes and push it to your GitLab repository to trigger a new CI/CD build.
 
+### Publish a NuGet package with Chocolatey CLI
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/416404) in GitLab 16.2.
+
+Prerequisite:
+
+- The project-level Package Registry is a source for Chocolatey.
+
+To publish a package with the Chocolatey CLI:
+
+```shell
+choco push <package_file> --source <source_url> --api-key <gitlab_personal_access_token, deploy_token or job token>
+```
+
+In this command:
+
+- `<package_file>` is your package filename and ends with `.nupkg`.
+- `<source_url>` is the URL of the NuGet v2 feed Package Registry.
+
+For example:
+
+```shell
+choco push MyPackage.1.0.0.nupkg --source "https://gitlab.example.com/api/v4/projects/<your_project_id>/packages/nuget/v2" --api-key <gitlab_personal_access_token, deploy_token or job token>
+```
+
 ### Publishing a package with the same name or version
 
 When you publish a package with the same name or version as an existing package,
diff --git a/doc/user/workspace/index.md b/doc/user/workspace/index.md
index 7d68982fa9c..277fd3b7d7a 100644
--- a/doc/user/workspace/index.md
+++ b/doc/user/workspace/index.md
@@ -64,14 +64,29 @@ You also have access to the terminal and can install any necessary dependencies.
 
 ## Workspaces and projects
 
-A workspace is scoped to a project. When you create a workspace, you must:
+Workspaces are scoped to a project. When you create a workspace, you must:
 
 - Assign the workspace to a specific project.
 - Select a project with a `.devfile.yaml` file.
 
 The workspace can then interact with the GitLab API based on the permissions granted to the current user.
 
-## Deleting data associated with a workspace
+### Open and manage workspaces from a project
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/125331) in GitLab 16.2.
+
+To open a workspace from a file or the repository file list:
+
+1. On the left sidebar, at the top, select **Search GitLab** (**{search}**) to find your project.
+1. In the upper right, select **Edit**.
+1. From the dropdown list, under **Your workspaces**, select the workspace.
+
+From the dropdown list, you can also:
+
+- Restart, stop, or terminate an existing workspace.
+- Create a new workspace.
+
+### Deleting data associated with a workspace
 
 When you delete a project, agent, user, or token associated with a workspace:
 
diff --git a/lib/api/concerns/packages/nuget/public_endpoints.rb b/lib/api/concerns/packages/nuget/public_endpoints.rb
index 37b503212d9..d5be136c7a2 100644
--- a/lib/api/concerns/packages/nuget/public_endpoints.rb
+++ b/lib/api/concerns/packages/nuget/public_endpoints.rb
@@ -16,7 +16,7 @@ module API
 
           included do
             # https://docs.microsoft.com/en-us/nuget/api/service-index
-            desc 'The NuGet Service Index' do
+            desc 'The NuGet V3 Feed Service Index' do
               detail 'This feature was introduced in GitLab 12.6'
               success code: 200, model: ::API::Entities::Nuget::ServiceIndex
               failure [
@@ -34,6 +34,33 @@ module API
               present ::Packages::Nuget::ServiceIndexPresenter.new(project_or_group_without_auth),
                 with: ::API::Entities::Nuget::ServiceIndex
             end
+
+            desc 'The NuGet V2 Feed Service Index' do
+              detail 'This feature was introduced in GitLab 16.2'
+              success code: 200
+              failure [
+                { code: 404, message: 'Not Found' }
+              ]
+              tags %w[nuget_packages]
+            end
+            namespace '/v2' do
+              get format: :xml, urgency: :low do
+                env['api.format'] = :xml
+                content_type 'application/xml; charset=utf-8'
+                # needed to allow browser default inline styles in xml response
+                header 'Content-Security-Policy', "nonce-#{SecureRandom.base64(16)}"
+
+                track_package_event(
+                  'cli_metadata',
+                  :nuget,
+                  **snowplow_gitlab_standard_context_without_auth.merge(category: 'API::NugetPackages', feed: 'v2')
+                )
+
+                present ::Packages::Nuget::V2::ServiceIndexPresenter
+                          .new(project_or_group_without_auth)
+                          .xml
+              end
+            end
           end
         end
       end
diff --git a/lib/api/nuget_project_packages.rb b/lib/api/nuget_project_packages.rb
index 2716d6f0b64..1631f7b2a9b 100644
--- a/lib/api/nuget_project_packages.rb
+++ b/lib/api/nuget_project_packages.rb
@@ -98,6 +98,22 @@ module API
         created!
       end
 
+      def publish_package(symbol_package: false)
+        upload_nuget_package_file(symbol_package: symbol_package) do |package|
+          track_package_event(
+            symbol_package ? 'push_symbol_package' : 'push_package',
+            :nuget,
+            **{ category: 'API::NugetPackages',
+                project: package.project,
+                namespace: package.project.namespace }.tap { |args| args[:feed] = 'v2' if request.path.include?('nuget/v2') }
+          )
+        end
+      rescue ObjectStorage::RemoteStoreError => e
+        Gitlab::ErrorTracking.track_exception(e, extra: { file_name: params[:file_name], project_id: project_or_group.id })
+
+        forbidden!
+      end
+
       def required_permission
         :read_package
       end
@@ -179,7 +195,7 @@ module API
           end
         end
 
-        # To support an additional authentication option for download endpoints,
+        # To support an additional authentication option for publish endpoints,
         # we redefine the `authenticate_with` method by combining the previous
         # authentication option with the new one.
         authenticate_with do |accept|
@@ -191,7 +207,7 @@ module API
 
         namespace '/nuget' do
           # https://docs.microsoft.com/en-us/nuget/api/package-publish-resource
-          desc 'The NuGet Package Publish endpoint' do
+          desc 'The NuGet V3 Feed Package Publish endpoint' do
             detail 'This feature was introduced in GitLab 12.6'
             success code: 201
             failure [
@@ -207,19 +223,7 @@ module API
             use :file_params
           end
           put urgency: :low do
-            upload_nuget_package_file do |package|
-              track_package_event(
-                'push_package',
-                :nuget,
-                category: 'API::NugetPackages',
-                project: package.project,
-                namespace: package.project.namespace
-              )
-            end
-          rescue ObjectStorage::RemoteStoreError => e
-            Gitlab::ErrorTracking.track_exception(e, extra: { file_name: params[:file_name], project_id: project_or_group.id })
-
-            forbidden!
+            publish_package
           end
 
           desc 'The NuGet Package Authorize endpoint' do
@@ -252,19 +256,7 @@ module API
             use :file_params
           end
           put 'symbolpackage', urgency: :low do
-            upload_nuget_package_file(symbol_package: true) do |package|
-              track_package_event(
-                'push_symbol_package',
-                :nuget,
-                category: 'API::NugetPackages',
-                project: package.project,
-                namespace: package.project.namespace
-              )
-            end
-          rescue ObjectStorage::RemoteStoreError => e
-            Gitlab::ErrorTracking.track_exception(e, extra: { file_name: params[:file_name], project_id: project_or_group.id })
-
-            forbidden!
+            publish_package(symbol_package: true)
           end
 
           desc 'The NuGet Symbol Package Authorize endpoint' do
@@ -280,6 +272,42 @@ module API
           put 'symbolpackage/authorize', urgency: :low do
             authorize_nuget_upload
           end
+
+          namespace '/v2' do
+            desc 'The NuGet V2 Feed Package Publish endpoint' do
+              detail 'This feature was introduced in GitLab 16.2'
+              success code: 201
+              failure [
+                { code: 400, message: 'Bad Request' },
+                { code: 401, message: 'Unauthorized' },
+                { code: 403, message: 'Forbidden' },
+                { code: 404, message: 'Not Found' }
+              ]
+              tags %w[nuget_packages]
+            end
+
+            params do
+              use :file_params
+            end
+            put do
+              publish_package
+            end
+
+            desc 'The NuGet V2 Feed Package Authorize endpoint' do
+              detail 'This feature was introduced in GitLab 16.2'
+              success code: 200
+              failure [
+                { code: 401, message: 'Unauthorized' },
+                { code: 403, message: 'Forbidden' },
+                { code: 404, message: 'Not Found' }
+              ]
+              tags %w[nuget_packages]
+            end
+
+            put 'authorize', urgency: :low do
+              authorize_nuget_upload
+            end
+          end
         end
       end
     end
diff --git a/lib/gitlab/auth/auth_finders.rb b/lib/gitlab/auth/auth_finders.rb
index 966520655a5..3568ff09cc4 100644
--- a/lib/gitlab/auth/auth_finders.rb
+++ b/lib/gitlab/auth/auth_finders.rb
@@ -404,9 +404,14 @@ module Gitlab
 
       def revoke_token_family(token)
         return unless Feature.enabled?(:pat_reuse_detection)
+        return unless access_token_rotation_request?
 
         PersonalAccessTokens::RevokeTokenFamilyService.new(token).execute
       end
+
+      def access_token_rotation_request?
+        current_request.path.match(%r{access_tokens/\d+/rotate$})
+      end
     end
   end
 end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 3d126720850..0b1099f4a1d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -53985,6 +53985,9 @@ msgstr ""
 msgid "can not be set for this type of note"
 msgstr ""
 
+msgid "can not be true if shared runners are enabled"
+msgstr ""
+
 msgid "can only be changed by a group admin."
 msgstr ""
 
@@ -54033,9 +54036,6 @@ msgstr ""
 msgid "cannot be changed if a personal project has container registry tags."
 msgstr ""
 
-msgid "cannot be changed if shared runners are enabled"
-msgstr ""
-
 msgid "cannot be changed since member is associated with a custom role"
 msgstr ""
 
diff --git a/qa/Gemfile b/qa/Gemfile
index 2a11f1e1f12..8119b714973 100644
--- a/qa/Gemfile
+++ b/qa/Gemfile
@@ -36,7 +36,7 @@ gem "warning", "~> 1.3"
 
 gem 'confiner', '~> 0.4'
 
-gem 'chemlab', '~> 0.10'
+gem 'chemlab', '~> 0.11', '>= 0.11.1'
 gem 'chemlab-library-www-gitlab-com', '~> 0.1', '>= 0.1.1'
 
 # dependencies for jenkins client
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index 52b66a53828..57c352ccd76 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -56,7 +56,7 @@ GEM
     capybara-screenshot (1.0.26)
       capybara (>= 1.0, < 4)
       launchy
-    chemlab (0.10.0)
+    chemlab (0.11.1)
       colorize (~> 0.8)
       i18n (~> 1.8)
       rake (>= 12, < 14)
@@ -340,7 +340,7 @@ DEPENDENCIES
   allure-rspec (~> 2.20.0)
   capybara (~> 3.39.2)
   capybara-screenshot (~> 1.0.26)
-  chemlab (~> 0.10)
+  chemlab (~> 0.11, >= 0.11.1)
   chemlab-library-www-gitlab-com (~> 0.1, >= 0.1.1)
   confiner (~> 0.4)
   deprecation_toolkit (~> 2.0.3)
diff --git a/scripts/elastic-migration b/scripts/elastic-migration
new file mode 100755
index 00000000000..8d7f614160b
--- /dev/null
+++ b/scripts/elastic-migration
@@ -0,0 +1,168 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Generate an Elastic migration file, spec and dictionary record with the current timestamp.
+
+require 'yaml'
+require 'fileutils'
+require 'uri'
+require 'readline'
+require 'active_support/core_ext/string'
+
+class ElasticMigrationCreator
+  attr_reader :options
+
+  Options = Struct.new(
+    :name,
+    :description,
+    :group,
+    :introduced_by_url,
+    :milestone,
+    :obsolete,
+    :marked_obsolete_by_url,
+    :marked_obsolete_in_milestone
+  )
+
+  def initialize
+    @options = Options.new
+  end
+
+  def execute
+    options.name = read_name
+    options.description = read_description
+    options.group = read_group
+    options.introduced_by_url = read_introduced_by_url
+    options.milestone = read_milestone
+
+    $stdout.puts "\e[32mcreated\e[0m #{file_path}"
+    $stdout.puts "\e[32mcreated\e[0m #{spec_file_path}"
+    $stdout.puts "\e[32mcreated\e[0m #{dictionary_file_path}"
+
+    write
+    $stdout.puts "\n=> Please consult the documentation for Advanced Search Migrations: #{documentation_reference}"
+  end
+
+  private
+
+  def read_name
+    read_variable('name', 'Name of the migration in CamelCase').camelize
+  end
+
+  def read_description
+    read_variable('description', 'Description of what the migration does')
+  end
+
+  def read_group
+    read_variable('group', 'The group introducing a feature flag, like: `global search`')
+  end
+
+  def read_milestone
+    milestone = File.read('VERSION')
+    milestone.gsub(/^(\d+\.\d+).*$/, '\1').chomp
+  end
+
+  def read_variable(name, description)
+    $stdout.puts "\n>> #{description}:"
+
+    loop do
+      variable = Readline.readline('?> ', false)&.strip
+      return variable unless variable.empty?
+
+      warn "Error: #{name} is required."
+    end
+  end
+
+  def read_introduced_by_url
+    $stdout.puts
+    $stdout.puts ">> URL of the MR introducing the migration (enter to skip):"
+
+    loop do
+      introduced_by_url = Readline.readline('?> ', false)&.strip
+      introduced_by_url = nil if introduced_by_url.empty?
+      return introduced_by_url if introduced_by_url.nil? || introduced_by_url.start_with?('https://')
+
+      warn 'Error: URL needs to start with https://'
+    end
+  end
+
+  def write
+    # create migration file
+    FileUtils.mkdir_p(File.dirname(file_path))
+    File.write(file_path, file_contents)
+
+    # create spec
+    FileUtils.mkdir_p(File.dirname(spec_file_path))
+    File.write(spec_file_path, spec_contents)
+
+    # create dictionary file
+    FileUtils.mkdir_p(File.dirname(dictionary_file_path))
+    File.write(dictionary_file_path, dictionary_contents)
+  end
+
+  def timestamp
+    @timestamp ||= Time.now.strftime('%Y%m%d%H%M%S')
+  end
+
+  def file_name
+    @file_name ||= "#{timestamp}_#{options.name.dup.underscore}"
+  end
+
+  def file_path
+    "ee/elastic/migrate/#{file_name}.rb"
+  end
+
+  def spec_file_path
+    "ee/spec/elastic/migrate/#{file_name}_spec.rb"
+  end
+
+  def dictionary_file_path
+    "ee/elastic/docs/#{file_name}.yml"
+  end
+
+  def file_contents
+    "# frozen_string_literal: true
+
+class #{options.name} < Elastic::Migration
+end
+"
+  end
+
+  def spec_contents
+    "# frozen_string_literal: true
+
+require 'spec_helper'
+require_relative 'migration_shared_examples'
+require File.expand_path('#{file_path}')
+
+RSpec.describe #{options.name}, feature_category: :#{options.group.parameterize.underscore} do
+  let(:version) { #{timestamp} }
+end
+"
+  end
+
+  def dictionary_contents
+    dictionary_config_hash.to_yaml
+  end
+
+  def dictionary_config_hash
+    {
+      'name' => options.name,
+      'version' => timestamp,
+      'description' => options.description,
+      'group' => "group::#{options.group}",
+      'milestone' => options.milestone,
+      'introduced_by_url' => options.introduced_by_url,
+      'obsolete' => false,
+      'marked_obsolete_by_url' => nil,
+      'marked_obsolete_in_milestone' => nil
+    }
+  end
+
+  def documentation_reference
+    'https://docs.gitlab.com/ee/development/search/advanced_search_migration_styleguide.html'
+  end
+end
+
+ElasticMigrationCreator.new.execute if $PROGRAM_NAME == __FILE__
+
+# vim: ft=ruby
diff --git a/spec/controllers/projects/autocomplete_sources_controller_spec.rb b/spec/controllers/projects/autocomplete_sources_controller_spec.rb
index d0bfbeae78f..1745dfe3af0 100644
--- a/spec/controllers/projects/autocomplete_sources_controller_spec.rb
+++ b/spec/controllers/projects/autocomplete_sources_controller_spec.rb
@@ -196,23 +196,28 @@ RSpec.describe Projects::AutocompleteSourcesController do
         end
       end
 
-      shared_examples 'only public members are returned for public project' do
+      shared_examples 'returns all members of public project' do
         before do
           stub_feature_flags(disable_all_mention: false)
         end
 
-        it 'only returns public members' do
+        it 'returns members including those from invited private groups' do
           get :members, format: :json, params: { namespace_id: group.path, project_id: public_project.path, type: issuable_type }
 
           expect(members_by_username('all').symbolize_keys).to include(
             username: 'all',
             name: 'All Project and Group Members',
-            count: 1)
+            count: 2)
 
           expect(members_by_username(user.username).symbolize_keys).to include(
             type: user.class.name,
             name: user.name,
             avatar_url: user.avatar_url)
+
+          expect(members_by_username(invited_private_member.username).symbolize_keys).to include(
+            type: invited_private_member.class.name,
+            name: invited_private_member.name,
+            avatar_url: invited_private_member.avatar_url)
         end
 
         context 'when `disable_all_mention` FF is enabled' do
@@ -234,7 +239,7 @@ RSpec.describe Projects::AutocompleteSourcesController do
           let(:issuable_type) { private_issue.class.name }
         end
 
-        it_behaves_like 'only public members are returned for public project' do
+        it_behaves_like 'returns all members of public project' do
           let(:issuable_type) { issue.class.name }
         end
       end
@@ -244,7 +249,7 @@ RSpec.describe Projects::AutocompleteSourcesController do
           let(:issuable_type) { private_work_item.class.name }
         end
 
-        it_behaves_like 'only public members are returned for public project' do
+        it_behaves_like 'returns all members of public project' do
           let(:issuable_type) { work_item.class.name }
         end
       end
diff --git a/spec/factories/groups.rb b/spec/factories/groups.rb
index 5b4839df2d3..807df94e115 100644
--- a/spec/factories/groups.rb
+++ b/spec/factories/groups.rb
@@ -65,18 +65,14 @@ FactoryBot.define do
       end
     end
 
-    trait :allow_descendants_override_disabled_shared_runners do
-      allow_descendants_override_disabled_shared_runners { true }
-    end
-
-    trait :disabled_and_unoverridable do
+    trait :shared_runners_disabled_and_unoverridable do
       shared_runners_disabled
       allow_descendants_override_disabled_shared_runners { false }
     end
 
-    trait :disabled_and_overridable do
+    trait :shared_runners_disabled_and_overridable do
       shared_runners_disabled
-      allow_descendants_override_disabled_shared_runners
+      allow_descendants_override_disabled_shared_runners { true }
     end
 
     trait :shared_runners_enabled do
diff --git a/spec/factories/namespaces.rb b/spec/factories/namespaces.rb
index e88bb634898..ee994d32f10 100644
--- a/spec/factories/namespaces.rb
+++ b/spec/factories/namespaces.rb
@@ -40,9 +40,5 @@ FactoryBot.define do
     trait :shared_runners_disabled do
       shared_runners_enabled { false }
     end
-
-    trait :allow_descendants_override_disabled_shared_runners do
-      allow_descendants_override_disabled_shared_runners { true }
-    end
   end
 end
diff --git a/spec/frontend/diffs/components/diff_code_quality_item_spec.js b/spec/frontend/diffs/components/diff_inline_findings_item_spec.js
similarity index 91%
rename from spec/frontend/diffs/components/diff_code_quality_item_spec.js
rename to spec/frontend/diffs/components/diff_inline_findings_item_spec.js
index 085eb096239..5fe64b29f58 100644
--- a/spec/frontend/diffs/components/diff_code_quality_item_spec.js
+++ b/spec/frontend/diffs/components/diff_inline_findings_item_spec.js
@@ -1,6 +1,6 @@
 import { GlIcon, GlLink } from '@gitlab/ui';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
-import DiffCodeQualityItem from '~/diffs/components/diff_code_quality_item.vue';
+import DiffInlineFindingsItem from '~/diffs/components/diff_inline_findings_item.vue';
 import { SEVERITY_CLASSES, SEVERITY_ICONS } from '~/ci/reports/codequality_report/constants';
 import { multipleFindingsArrCodeQualityScale } from '../mock_data/diff_code_quality';
 
@@ -14,7 +14,7 @@ const findDescriptionLinkSection = () => wrapper.findByTestId('description-butto
 
 describe('DiffCodeQuality', () => {
   const createWrapper = ({ glFeatures = {}, link = true } = {}) => {
-    return shallowMountExtended(DiffCodeQualityItem, {
+    return shallowMountExtended(DiffInlineFindingsItem, {
       propsData: {
         finding: codeQualityFinding,
         link,
@@ -30,7 +30,7 @@ describe('DiffCodeQuality', () => {
     expect(findIcon().exists()).toBe(true);
 
     expect(findIcon().attributes()).toMatchObject({
-      class: `codequality-severity-icon ${SEVERITY_CLASSES[codeQualityFinding.severity]}`,
+      class: `inline-findings-severity-icon ${SEVERITY_CLASSES[codeQualityFinding.severity]}`,
       name: SEVERITY_ICONS[codeQualityFinding.severity],
       size: '12',
     });
diff --git a/spec/frontend/diffs/components/diff_inline_findings_spec.js b/spec/frontend/diffs/components/diff_inline_findings_spec.js
index 9ccfb2a613d..0a210d434be 100644
--- a/spec/frontend/diffs/components/diff_inline_findings_spec.js
+++ b/spec/frontend/diffs/components/diff_inline_findings_spec.js
@@ -1,12 +1,12 @@
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import DiffInlineFindings from '~/diffs/components/diff_inline_findings.vue';
-import DiffCodeQualityItem from '~/diffs/components/diff_code_quality_item.vue';
+import DiffInlineFindingsItem from '~/diffs/components/diff_inline_findings_item.vue';
 import { NEW_CODE_QUALITY_FINDINGS } from '~/diffs/i18n';
 import { multipleCodeQualityNoSast } from '../mock_data/diff_code_quality';
 
 let wrapper;
 const heading = () => wrapper.findByTestId('diff-inline-findings-heading');
-const diffCodeQualityItems = () => wrapper.findAllComponents(DiffCodeQualityItem);
+const diffInlineFindingsItems = () => wrapper.findAllComponents(DiffInlineFindingsItem);
 
 describe('DiffInlineFindings', () => {
   const createWrapper = () => {
@@ -23,10 +23,10 @@ describe('DiffInlineFindings', () => {
     expect(heading().text()).toBe(NEW_CODE_QUALITY_FINDINGS);
   });
 
-  it('renders the correct number of DiffCodeQualityItem components with correct props', () => {
+  it('renders the correct number of DiffInlineFindingsItem components with correct props', () => {
     wrapper = createWrapper();
-    expect(diffCodeQualityItems()).toHaveLength(multipleCodeQualityNoSast.codeQuality.length);
-    expect(diffCodeQualityItems().wrappers[0].props('finding')).toEqual(
+    expect(diffInlineFindingsItems()).toHaveLength(multipleCodeQualityNoSast.codeQuality.length);
+    expect(diffInlineFindingsItems().wrappers[0].props('finding')).toEqual(
       wrapper.props('findings')[0],
     );
   });
diff --git a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap b/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap
index e82687aa146..51bd8f380ee 100644
--- a/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap
+++ b/spec/frontend/diffs/components/shared/__snapshots__/findings_drawer_spec.js.snap
@@ -30,7 +30,7 @@ exports[`FindingsDrawer matches the snapshot 1`] = `
       </span>
        
       <gl-icon-stub
-        class="codequality-severity-icon gl-text-orange-300"
+        class="inline-findings-severity-icon gl-text-orange-300"
         data-testid="findings-drawer-severity-icon"
         name="severity-low"
         size="12"
diff --git a/spec/frontend/repository/mixins/highlight_mixin_spec.js b/spec/frontend/repository/mixins/highlight_mixin_spec.js
index fd14f01747a..50cfd71d686 100644
--- a/spec/frontend/repository/mixins/highlight_mixin_spec.js
+++ b/spec/frontend/repository/mixins/highlight_mixin_spec.js
@@ -2,13 +2,8 @@ import { shallowMount } from '@vue/test-utils';
 import { splitIntoChunks } from '~/vue_shared/components/source_viewer/workers/highlight_utils';
 import highlightMixin from '~/repository/mixins/highlight_mixin';
 import LineHighlighter from '~/blob/line_highlighter';
-import Tracking from '~/tracking';
 import { TEXT_FILE_TYPE } from '~/repository/constants';
-import {
-  EVENT_ACTION,
-  EVENT_LABEL_FALLBACK,
-  LINES_PER_CHUNK,
-} from '~/vue_shared/components/source_viewer/constants';
+import { LINES_PER_CHUNK } from '~/vue_shared/components/source_viewer/constants';
 
 const lineHighlighter = new LineHighlighter();
 jest.mock('~/blob/line_highlighter', () => jest.fn().mockReturnValue({ highlightHash: jest.fn() }));
@@ -24,7 +19,7 @@ describe('HighlightMixin', () => {
   const hash = '#L50';
   const contentArray = Array.from({ length: 140 }, () => 'newline'); // simulate 140 lines of code
   const rawTextBlob = contentArray.join('\n');
-  const languageMock = 'javascript';
+  const languageMock = 'json';
 
   const createComponent = ({ fileType = TEXT_FILE_TYPE, language = languageMock } = {}) => {
     const simpleViewer = { fileType };
@@ -50,26 +45,13 @@ describe('HighlightMixin', () => {
   describe('initHighlightWorker', () => {
     const firstSeventyLines = contentArray.slice(0, LINES_PER_CHUNK).join('\n');
 
-    it('does not instruct worker if file is not a text file', () => {
+    it('does not instruct worker if file is not a JSON file', () => {
       workerMock.postMessage.mockClear();
-      createComponent({ fileType: 'markdown' });
+      createComponent({ language: 'javascript' });
 
       expect(workerMock.postMessage).not.toHaveBeenCalled();
     });
 
-    it('tracks event if a language is not supported and does not instruct worker', () => {
-      const unsupportedLanguage = 'some_unsupported_language';
-      const eventData = { label: EVENT_LABEL_FALLBACK, property: unsupportedLanguage };
-
-      jest.spyOn(Tracking, 'event');
-      workerMock.postMessage.mockClear();
-      createComponent({ language: unsupportedLanguage });
-
-      expect(Tracking.event).toHaveBeenCalledWith(undefined, EVENT_ACTION, eventData);
-      expect(onErrorMock).toHaveBeenCalled();
-      expect(workerMock.postMessage).not.toHaveBeenCalled();
-    });
-
     it('generates a chunk for the first 70 lines of raw text', () => {
       expect(splitIntoChunks).toHaveBeenCalledWith(languageMock, firstSeventyLines);
     });
diff --git a/spec/frontend/service_desk/components/service_desk_list_app_spec.js b/spec/frontend/service_desk/components/service_desk_list_app_spec.js
index 2ac789745aa..ffee902e161 100644
--- a/spec/frontend/service_desk/components/service_desk_list_app_spec.js
+++ b/spec/frontend/service_desk/components/service_desk_list_app_spec.js
@@ -1,16 +1,28 @@
 import { shallowMount } from '@vue/test-utils';
-import Vue from 'vue';
+import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import * as Sentry from '@sentry/browser';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import IssuableList from '~/vue_shared/issuable/list/components/issuable_list_root.vue';
 import { issuableListTabs } from '~/vue_shared/issuable/list/constants';
-import { STATUS_CLOSED, STATUS_OPEN } from '~/issues/constants';
+import { TYPENAME_USER } from '~/graphql_shared/constants';
+import { convertToGraphQLId } from '~/graphql_shared/utils';
+import { STATUS_CLOSED, STATUS_OPEN } from '~/service_desk/constants';
 import getServiceDeskIssuesQuery from '~/service_desk/queries/get_service_desk_issues.query.graphql';
 import getServiceDeskIssuesCountsQuery from '~/service_desk/queries/get_service_desk_issues_counts.query.graphql';
 import ServiceDeskListApp from '~/service_desk/components/service_desk_list_app.vue';
 import InfoBanner from '~/service_desk/components/info_banner.vue';
+import {
+  TOKEN_TYPE_ASSIGNEE,
+  TOKEN_TYPE_AUTHOR,
+  TOKEN_TYPE_CONFIDENTIAL,
+  TOKEN_TYPE_LABEL,
+  TOKEN_TYPE_MILESTONE,
+  TOKEN_TYPE_MY_REACTION,
+  TOKEN_TYPE_RELEASE,
+  TOKEN_TYPE_SEARCH_WITHIN,
+} from '~/vue_shared/components/filtered_search_bar/constants';
 import {
   getServiceDeskIssuesQueryResponse,
   getServiceDeskIssuesCountsQueryResponse,
@@ -24,6 +36,10 @@ describe('ServiceDeskListApp', () => {
   Vue.use(VueApollo);
 
   const defaultProvide = {
+    releasesPath: 'releases/path',
+    autocompleteAwardEmojisPath: 'autocomplete/award/emojis/path',
+    hasIterationsFeature: true,
+    groupPath: 'group/path',
     emptyStateSvgPath: 'empty-state.svg',
     isProject: true,
     isSignedIn: true,
@@ -34,28 +50,31 @@ describe('ServiceDeskListApp', () => {
 
   const defaultQueryResponse = getServiceDeskIssuesQueryResponse;
 
-  const mockServiceDeskIssuesQueryResponse = jest.fn().mockResolvedValue(defaultQueryResponse);
-  const mockServiceDeskIssuesCountsQueryResponse = jest
+  const mockServiceDeskIssuesQueryResponseHandler = jest
+    .fn()
+    .mockResolvedValue(defaultQueryResponse);
+  const mockServiceDeskIssuesCountsQueryResponseHandler = jest
     .fn()
     .mockResolvedValue(getServiceDeskIssuesCountsQueryResponse);
 
   const findIssuableList = () => wrapper.findComponent(IssuableList);
   const findInfoBanner = () => wrapper.findComponent(InfoBanner);
+  const findLabelsToken = () =>
+    findIssuableList()
+      .props('searchTokens')
+      .find((token) => token.type === TOKEN_TYPE_LABEL);
 
-  const mountComponent = ({
+  const createComponent = ({
     provide = {},
-    data = {},
-    serviceDeskIssuesQueryResponse = mockServiceDeskIssuesQueryResponse,
-    serviceDeskIssuesCountsQueryResponse = mockServiceDeskIssuesCountsQueryResponse,
-    stubs = {},
-    mountFn = shallowMount,
+    serviceDeskIssuesQueryResponseHandler = mockServiceDeskIssuesQueryResponseHandler,
+    serviceDeskIssuesCountsQueryResponseHandler = mockServiceDeskIssuesCountsQueryResponseHandler,
   } = {}) => {
     const requestHandlers = [
-      [getServiceDeskIssuesQuery, serviceDeskIssuesQueryResponse],
-      [getServiceDeskIssuesCountsQuery, serviceDeskIssuesCountsQueryResponse],
+      [getServiceDeskIssuesQuery, serviceDeskIssuesQueryResponseHandler],
+      [getServiceDeskIssuesCountsQuery, serviceDeskIssuesCountsQueryResponseHandler],
     ];
 
-    return mountFn(ServiceDeskListApp, {
+    return shallowMount(ServiceDeskListApp, {
       apolloProvider: createMockApollo(
         requestHandlers,
         {},
@@ -75,15 +94,11 @@ describe('ServiceDeskListApp', () => {
         ...defaultProvide,
         ...provide,
       },
-      data() {
-        return data;
-      },
-      stubs,
     });
   };
 
   beforeEach(() => {
-    wrapper = mountComponent();
+    wrapper = createComponent();
     return waitForPromises();
   });
 
@@ -107,23 +122,82 @@ describe('ServiceDeskListApp', () => {
       expect(findInfoBanner().exists()).toBe(true);
     });
 
+    it('does not render when Service Desk is not supported and has any number of issues', async () => {
+      wrapper = createComponent({ provide: { isServiceDeskSupported: false } });
+      await waitForPromises();
+
+      expect(findInfoBanner().exists()).toBe(false);
+    });
+
     it('does not render, when there are no issues', async () => {
-      wrapper = mountComponent({ provide: { hasAnyIssues: false } });
+      wrapper = createComponent({ provide: { hasAnyIssues: false } });
       await waitForPromises();
 
       expect(findInfoBanner().exists()).toBe(false);
     });
   });
 
-  describe('Events', () => {
-    describe('when "click-tab" event is emitted by IssuableList', () => {
-      beforeEach(() => {
-        mountComponent();
+  describe('Tokens', () => {
+    const mockCurrentUser = {
+      id: 1,
+      name: 'Administrator',
+      username: 'root',
+      avatar_url: 'avatar/url',
+    };
 
-        findIssuableList().vm.$emit('click-tab', STATUS_CLOSED);
+    describe('when user is signed out', () => {
+      beforeEach(() => {
+        wrapper = createComponent({ provide: { isSignedIn: false } });
       });
 
-      it('updates ui to the new tab', () => {
+      it('does not render My-Reaction or Confidential tokens', () => {
+        expect(findIssuableList().props('searchTokens')).not.toMatchObject([
+          { type: TOKEN_TYPE_AUTHOR, preloadedUsers: [mockCurrentUser] },
+          { type: TOKEN_TYPE_ASSIGNEE, preloadedUsers: [mockCurrentUser] },
+          { type: TOKEN_TYPE_MY_REACTION },
+          { type: TOKEN_TYPE_CONFIDENTIAL },
+        ]);
+      });
+    });
+
+    describe('when all tokens are available', () => {
+      beforeEach(() => {
+        window.gon = {
+          current_user_id: mockCurrentUser.id,
+          current_user_fullname: mockCurrentUser.name,
+          current_username: mockCurrentUser.username,
+          current_user_avatar_url: mockCurrentUser.avatar_url,
+        };
+
+        wrapper = createComponent();
+      });
+
+      it('renders all tokens alphabetically', () => {
+        const preloadedUsers = [
+          { ...mockCurrentUser, id: convertToGraphQLId(TYPENAME_USER, mockCurrentUser.id) },
+        ];
+
+        expect(findIssuableList().props('searchTokens')).toMatchObject([
+          { type: TOKEN_TYPE_ASSIGNEE, preloadedUsers },
+          { type: TOKEN_TYPE_CONFIDENTIAL },
+          { type: TOKEN_TYPE_LABEL },
+          { type: TOKEN_TYPE_MILESTONE },
+          { type: TOKEN_TYPE_MY_REACTION },
+          { type: TOKEN_TYPE_RELEASE },
+          { type: TOKEN_TYPE_SEARCH_WITHIN },
+        ]);
+      });
+    });
+  });
+
+  describe('Events', () => {
+    describe('when "click-tab" event is emitted by IssuableList', () => {
+      it('updates ui to the new tab', async () => {
+        createComponent();
+
+        findIssuableList().vm.$emit('click-tab', STATUS_CLOSED);
+
+        await nextTick();
         expect(findIssuableList().props('currentTab')).toBe(STATUS_CLOSED);
       });
     });
@@ -131,13 +205,13 @@ describe('ServiceDeskListApp', () => {
 
   describe('Errors', () => {
     describe.each`
-      error                      | mountOption                               | message
-      ${'fetching issues'}       | ${'serviceDeskIssuesQueryResponse'}       | ${ServiceDeskListApp.i18n.errorFetchingIssues}
-      ${'fetching issue counts'} | ${'serviceDeskIssuesCountsQueryResponse'} | ${ServiceDeskListApp.i18n.errorFetchingCounts}
-    `('when there is an error $error', ({ mountOption, message }) => {
+      error                      | responseHandler                                  | message
+      ${'fetching issues'}       | ${'serviceDeskIssuesQueryResponseHandler'}       | ${ServiceDeskListApp.i18n.errorFetchingIssues}
+      ${'fetching issue counts'} | ${'serviceDeskIssuesCountsQueryResponseHandler'} | ${ServiceDeskListApp.i18n.errorFetchingCounts}
+    `('when there is an error $error', ({ responseHandler, message }) => {
       beforeEach(() => {
-        wrapper = mountComponent({
-          [mountOption]: jest.fn().mockRejectedValue(new Error('ERROR')),
+        wrapper = createComponent({
+          [responseHandler]: jest.fn().mockRejectedValue(new Error('ERROR')),
         });
         return waitForPromises();
       });
@@ -148,4 +222,30 @@ describe('ServiceDeskListApp', () => {
       });
     });
   });
+
+  describe('When providing token for labels', () => {
+    it('passes function to fetchLatestLabels property if frontend caching is enabled', () => {
+      wrapper = createComponent({
+        provide: {
+          glFeatures: {
+            frontendCaching: true,
+          },
+        },
+      });
+
+      expect(typeof findLabelsToken().fetchLatestLabels).toBe('function');
+    });
+
+    it('passes null to fetchLatestLabels property if frontend caching is disabled', () => {
+      wrapper = createComponent({
+        provide: {
+          glFeatures: {
+            frontendCaching: false,
+          },
+        },
+      });
+
+      expect(findLabelsToken().fetchLatestLabels).toBe(null);
+    });
+  });
 });
diff --git a/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js b/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
index 6b1d65c5a6a..83d7d298e17 100644
--- a/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
+++ b/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
@@ -14,6 +14,7 @@ import {
   LEGACY_FALLBACKS,
   CODEOWNERS_FILE_NAME,
   CODEOWNERS_LANGUAGE,
+  SVELTE_LANGUAGE,
 } from '~/vue_shared/components/source_viewer/constants';
 import waitForPromises from 'helpers/wait_for_promises';
 import LineHighlighter from '~/blob/line_highlighter';
@@ -120,6 +121,33 @@ describe('Source Viewer component', () => {
       );
     });
 
+    describe('sub-languages', () => {
+      const languageDefinition = {
+        subLanguage: 'xml',
+        contains: [{ subLanguage: 'javascript' }, { subLanguage: 'typescript' }],
+      };
+
+      beforeEach(async () => {
+        jest.spyOn(hljs, 'getLanguage').mockReturnValue(languageDefinition);
+        createComponent();
+        await waitForPromises();
+      });
+
+      it('registers the primary sub-language', () => {
+        expect(hljs.registerLanguage).toHaveBeenCalledWith(
+          languageDefinition.subLanguage,
+          expect.any(Function),
+        );
+      });
+
+      it.each(languageDefinition.contains)(
+        'registers the rest of the sub-languages',
+        ({ subLanguage }) => {
+          expect(hljs.registerLanguage).toHaveBeenCalledWith(subLanguage, expect.any(Function));
+        },
+      );
+    });
+
     it('registers json language definition if fileType is package_json', async () => {
       await createComponent({ language: 'json', fileType: 'package_json' });
       const languageDefinition = await import(`highlight.js/lib/languages/json`);
@@ -146,6 +174,18 @@ describe('Source Viewer component', () => {
       );
     });
 
+    it('registers svelte language definition if file name ends with .svelte', async () => {
+      await createComponent({ name: `component.${SVELTE_LANGUAGE}` });
+      const languageDefinition = await import(
+        '~/vue_shared/components/source_viewer/languages/svelte'
+      );
+
+      expect(hljs.registerLanguage).toHaveBeenCalledWith(
+        SVELTE_LANGUAGE,
+        languageDefinition.default,
+      );
+    });
+
     it('highlights the first chunk', () => {
       expect(hljs.highlight).toHaveBeenCalledWith(chunk1.trim(), { language: mappedLanguage });
       expect(findChunks().at(0).props('isFirstChunk')).toBe(true);
diff --git a/spec/helpers/ci/runners_helper_spec.rb b/spec/helpers/ci/runners_helper_spec.rb
index c170d7fae67..dc593228388 100644
--- a/spec/helpers/ci/runners_helper_spec.rb
+++ b/spec/helpers/ci/runners_helper_spec.rb
@@ -218,9 +218,9 @@ RSpec.describe Ci::RunnersHelper, feature_category: :runner_fleet do
       using RSpec::Parameterized::TableSyntax
 
       where(:shared_runners_setting, :is_disabled_and_unoverridable) do
-        :shared_runners_enabled     | "false"
-        :disabled_and_overridable   | "false"
-        :disabled_and_unoverridable | "true"
+        :shared_runners_enabled                    | "false"
+        :shared_runners_disabled_and_overridable   | "false"
+        :shared_runners_disabled_and_unoverridable | "true"
       end
 
       with_them do
diff --git a/spec/lib/gitlab/auth/auth_finders_spec.rb b/spec/lib/gitlab/auth/auth_finders_spec.rb
index 1a1e165c50a..e5e93fa5cc1 100644
--- a/spec/lib/gitlab/auth/auth_finders_spec.rb
+++ b/spec/lib/gitlab/auth/auth_finders_spec.rb
@@ -516,12 +516,32 @@ RSpec.describe Gitlab::Auth::AuthFinders, feature_category: :system_access do
           set_bearer_token(token_3.token)
         end
 
-        it 'revokes the latest rotated token' do
-          expect(token_1).not_to be_revoked
+        context 'with url related to access tokens' do
+          before do
+            set_header('SCRIPT_NAME', "/personal_access_tokens/#{token_3.id}/rotate")
+          end
 
-          expect { find_user_from_access_token }.to raise_error(Gitlab::Auth::RevokedError)
+          it 'revokes the latest rotated token' do
+            expect(token_1).not_to be_revoked
 
-          expect(token_1.reload).to be_revoked
+            expect { find_user_from_access_token }.to raise_error(Gitlab::Auth::RevokedError)
+
+            expect(token_1.reload).to be_revoked
+          end
+        end
+
+        context 'with url not related to access tokens' do
+          before do
+            set_header('SCRIPT_NAME', '/epics/1')
+          end
+
+          it 'does not revoke the latest rotated token' do
+            expect(token_1).not_to be_revoked
+
+            expect { find_user_from_access_token }.to raise_error(Gitlab::Auth::RevokedError)
+
+            expect(token_1.reload).not_to be_revoked
+          end
         end
 
         context 'when the feature flag is disabled' do
diff --git a/spec/lib/gitlab/import_export/project/relation_tree_restorer_spec.rb b/spec/lib/gitlab/import_export/project/relation_tree_restorer_spec.rb
index 180a6b6ff0a..0f4f2eb573c 100644
--- a/spec/lib/gitlab/import_export/project/relation_tree_restorer_spec.rb
+++ b/spec/lib/gitlab/import_export/project/relation_tree_restorer_spec.rb
@@ -60,7 +60,7 @@ RSpec.describe Gitlab::ImportExport::Project::RelationTreeRestorer, feature_cate
     let(:relation_reader) { Gitlab::ImportExport::Json::NdjsonReader.new(path) }
 
     let_it_be(:group) do
-      create(:group, :disabled_and_unoverridable).tap { |g| g.add_maintainer(user) }
+      create(:group, :shared_runners_disabled_and_unoverridable).tap { |g| g.add_maintainer(user) }
     end
 
     before do
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index 1c02b4754fa..75bd8a47429 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -2389,7 +2389,7 @@ RSpec.describe Namespace, feature_category: :groups_and_projects do
         end
 
         context 'when parent has shared runners disabled but allows override' do
-          let(:parent) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners) }
+          let(:parent) { create(:group, :shared_runners_disabled_and_overridable) }
           let(:group) { build(:group, shared_runners_enabled: true, parent_id: parent.id) }
 
           it 'is valid' do
@@ -2415,7 +2415,7 @@ RSpec.describe Namespace, feature_category: :groups_and_projects do
     context 'when namespace is a group' do
       context 'without a parent' do
         context 'with shared runners disabled' do
-          let(:namespace) { build(:group, :allow_descendants_override_disabled_shared_runners, :shared_runners_disabled) }
+          let(:namespace) { build(:group, :shared_runners_disabled_and_overridable) }
 
           it 'is valid' do
             expect(namespace).to be_valid
@@ -2423,13 +2423,13 @@ RSpec.describe Namespace, feature_category: :groups_and_projects do
         end
 
         context 'with shared runners enabled' do
-          let(:namespace) { create(:namespace) }
+          let(:namespace) { build(:group) }
 
           it 'is invalid' do
             namespace.allow_descendants_override_disabled_shared_runners = true
 
             expect(namespace).to be_invalid
-            expect(namespace.errors[:allow_descendants_override_disabled_shared_runners]).to include('cannot be changed if shared runners are enabled')
+            expect(namespace.errors[:allow_descendants_override_disabled_shared_runners]).to include('can not be true if shared runners are enabled')
           end
         end
       end
@@ -2437,7 +2437,7 @@ RSpec.describe Namespace, feature_category: :groups_and_projects do
       context 'with a parent' do
         context 'when parent does not allow shared runners' do
           let(:parent) { create(:group, :shared_runners_disabled) }
-          let(:group) { build(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners, parent_id: parent.id) }
+          let(:group) { build(:group, :shared_runners_disabled_and_overridable, parent_id: parent.id) }
 
           it 'is invalid' do
             expect(group).to be_invalid
@@ -2447,7 +2447,7 @@ RSpec.describe Namespace, feature_category: :groups_and_projects do
 
         context 'when parent allows shared runners and setting to true' do
           let(:parent) { create(:group, shared_runners_enabled: true) }
-          let(:group) { build(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners, parent_id: parent.id) }
+          let(:group) { build(:group, :shared_runners_disabled_and_overridable, parent_id: parent.id) }
 
           it 'is valid' do
             expect(group).to be_valid
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 044408e86e9..83ae1c6e4ac 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -7026,10 +7026,10 @@ RSpec.describe Project, factory_default: :keep, feature_category: :groups_and_pr
     where(:shared_runners_setting, :project_shared_runners_enabled, :valid_record) do
       :shared_runners_enabled     | true  | true
       :shared_runners_enabled     | false | true
-      :disabled_and_overridable   | true  | true
-      :disabled_and_overridable   | false | true
-      :disabled_and_unoverridable | true  | false
-      :disabled_and_unoverridable | false | true
+      :shared_runners_disabled_and_overridable   | true  | true
+      :shared_runners_disabled_and_overridable   | false | true
+      :shared_runners_disabled_and_unoverridable | true  | false
+      :shared_runners_disabled_and_unoverridable | false | true
     end
 
     with_them do
diff --git a/spec/presenters/packages/nuget/v2/service_index_presenter_spec.rb b/spec/presenters/packages/nuget/v2/service_index_presenter_spec.rb
new file mode 100644
index 00000000000..09dd3ff7fe4
--- /dev/null
+++ b/spec/presenters/packages/nuget/v2/service_index_presenter_spec.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Packages::Nuget::V2::ServiceIndexPresenter, feature_category: :package_registry do
+  let_it_be(:project) { build_stubbed(:project) }
+  let_it_be(:group) { build_stubbed(:group) }
+
+  describe '#xml' do
+    let(:project_or_group) { project }
+    let(:presenter) { described_class.new(project_or_group) }
+    let(:xml_doc) { Nokogiri::XML::Document.parse(presenter.xml.to_xml) }
+    let(:service_node) { xml_doc.at_xpath('//xmlns:service') }
+
+    it { expect(xml_doc.root.name).to eq('service') }
+
+    it 'includes the workspace and collection nodes' do
+      workspace = xml_doc.at_xpath('//xmlns:service/xmlns:workspace')
+      collection = xml_doc.at_xpath('//xmlns:service/xmlns:workspace/xmlns:collection')
+
+      expect(workspace).to be_present
+      expect(workspace.children).to include(collection)
+      expect(collection).to be_present
+    end
+
+    it 'sets the appropriate XML namespaces on the root node' do
+      expect(service_node.namespaces['xmlns']).to eq('http://www.w3.org/2007/app')
+      expect(service_node.namespaces['xmlns:atom']).to eq('http://www.w3.org/2005/Atom')
+    end
+
+    context 'when the presenter is initialized with a project' do
+      it 'sets the XML base path correctly for a project scope' do
+        expect(service_node['xml:base']).to include(expected_xml_base(project))
+      end
+    end
+
+    context 'when the presenter is initialized with a group' do
+      let(:project_or_group) { group }
+
+      it 'sets the XML base path correctly for a group scope' do
+        expect(service_node['xml:base']).to include(expected_xml_base(group))
+      end
+    end
+  end
+
+  def expected_xml_base(project_or_group)
+    case project_or_group
+    when Project
+      api_v4_projects_packages_nuget_v2_path(id: project_or_group.id)
+    when Group
+      api_v4_groups___packages_nuget_v2_path(id: project_or_group.id)
+    end
+  end
+end
diff --git a/spec/requests/api/nuget_group_packages_spec.rb b/spec/requests/api/nuget_group_packages_spec.rb
index 07199119cb5..92eb869b871 100644
--- a/spec/requests/api/nuget_group_packages_spec.rb
+++ b/spec/requests/api/nuget_group_packages_spec.rb
@@ -31,6 +31,12 @@ RSpec.describe API::NugetGroupPackages, feature_category: :package_registry do
       end
     end
 
+    describe 'GET /api/v4/groups/:id/-/packages/nuget/v2' do
+      it_behaves_like 'handling nuget service requests', v2: true do
+        let(:url) { "/groups/#{target.id}/-/packages/nuget/v2" }
+      end
+    end
+
     describe 'GET /api/v4/groups/:id/-/packages/nuget/metadata/*package_name/index' do
       it_behaves_like 'handling nuget metadata requests with package name',
                       example_names_with_status:
diff --git a/spec/requests/api/nuget_project_packages_spec.rb b/spec/requests/api/nuget_project_packages_spec.rb
index 887dfd4beeb..40068f101f7 100644
--- a/spec/requests/api/nuget_project_packages_spec.rb
+++ b/spec/requests/api/nuget_project_packages_spec.rb
@@ -42,6 +42,14 @@ RSpec.describe API::NugetProjectPackages, feature_category: :package_registry do
     it_behaves_like 'accept get request on private project with access to package registry for everyone'
   end
 
+  describe 'GET /api/v4/projects/:id/packages/nuget/v2' do
+    let(:url) { "/projects/#{target.id}/packages/nuget/v2" }
+
+    it_behaves_like 'handling nuget service requests', v2: true
+
+    it_behaves_like 'accept get request on private project with access to package registry for everyone'
+  end
+
   describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/index' do
     let(:url) { "/projects/#{target.id}/packages/nuget/metadata/#{package_name}/index.json" }
 
@@ -183,75 +191,39 @@ RSpec.describe API::NugetProjectPackages, feature_category: :package_registry do
   end
 
   describe 'PUT /api/v4/projects/:id/packages/nuget/authorize' do
-    include_context 'workhorse headers'
-
-    let(:url) { "/projects/#{target.id}/packages/nuget/authorize" }
-    let(:headers) { {} }
-
-    subject { put api(url), headers: headers }
-
-    it_behaves_like 'nuget authorize upload endpoint'
+    it_behaves_like 'nuget authorize upload endpoint' do
+      let(:url) { "/projects/#{target.id}/packages/nuget/authorize" }
+    end
   end
 
   describe 'PUT /api/v4/projects/:id/packages/nuget' do
-    include_context 'workhorse headers'
-
-    let_it_be(:file_name) { 'package.nupkg' }
-
-    let(:url) { "/projects/#{target.id}/packages/nuget" }
-    let(:headers) { {} }
-    let(:params) { { package: temp_file(file_name) } }
-    let(:file_key) { :package }
-    let(:send_rewritten_field) { true }
-
-    subject do
-      workhorse_finalize(
-        api(url),
-        method: :put,
-        file_key: file_key,
-        params: params,
-        headers: headers,
-        send_rewritten_field: send_rewritten_field
-      )
+    it_behaves_like 'nuget upload endpoint' do
+      let(:url) { "/projects/#{target.id}/packages/nuget" }
     end
-
-    it_behaves_like 'nuget upload endpoint'
   end
 
   describe 'PUT /api/v4/projects/:id/packages/nuget/symbolpackage/authorize' do
-    include_context 'workhorse headers'
-
-    let(:url) { "/projects/#{target.id}/packages/nuget/symbolpackage/authorize" }
-    let(:headers) { {} }
-
-    subject { put api(url), headers: headers }
-
-    it_behaves_like 'nuget authorize upload endpoint'
+    it_behaves_like 'nuget authorize upload endpoint' do
+      let(:url) { "/projects/#{target.id}/packages/nuget/symbolpackage/authorize" }
+    end
   end
 
   describe 'PUT /api/v4/projects/:id/packages/nuget/symbolpackage' do
-    include_context 'workhorse headers'
-
-    let_it_be(:file_name) { 'package.snupkg' }
-
-    let(:url) { "/projects/#{target.id}/packages/nuget/symbolpackage" }
-    let(:headers) { {} }
-    let(:params) { { package: temp_file(file_name) } }
-    let(:file_key) { :package }
-    let(:send_rewritten_field) { true }
-
-    subject do
-      workhorse_finalize(
-        api(url),
-        method: :put,
-        file_key: file_key,
-        params: params,
-        headers: headers,
-        send_rewritten_field: send_rewritten_field
-      )
+    it_behaves_like 'nuget upload endpoint', symbol_package: true do
+      let(:url) { "/projects/#{target.id}/packages/nuget/symbolpackage" }
     end
+  end
 
-    it_behaves_like 'nuget upload endpoint', symbol_package: true
+  describe 'PUT /api/v4/projects/:id/packages/nuget/v2/authorize' do
+    it_behaves_like 'nuget authorize upload endpoint' do
+      let(:url) { "/projects/#{target.id}/packages/nuget/v2/authorize" }
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/nuget/v2' do
+    it_behaves_like 'nuget upload endpoint' do
+      let(:url) { "/projects/#{target.id}/packages/nuget/v2" }
+    end
   end
 
   def update_visibility_to(visibility)
diff --git a/spec/services/groups/update_shared_runners_service_spec.rb b/spec/services/groups/update_shared_runners_service_spec.rb
index 00eabb5c875..dc0d50bdab4 100644
--- a/spec/services/groups/update_shared_runners_service_spec.rb
+++ b/spec/services/groups/update_shared_runners_service_spec.rb
@@ -67,6 +67,21 @@ RSpec.describe Groups::UpdateSharedRunnersService, feature_category: :groups_and
               .and change { sub_group.shared_runners_enabled }.from(false).to(true)
               .and change { project.shared_runners_enabled }.from(false).to(true)
           end
+
+          context 'when already allowing descendants to override' do
+            let(:group) { create(:group, :shared_runners_disabled_and_overridable) }
+
+            it 'enables shared Runners for itself and descendants' do
+              expect do
+                expect(subject[:status]).to eq(:success)
+
+                reload_models(group, sub_group, project)
+              end.to change { group.shared_runners_enabled }.from(false).to(true)
+                .and change { group.allow_descendants_override_disabled_shared_runners }.from(true).to(false)
+                .and change { sub_group.shared_runners_enabled }.from(false).to(true)
+                .and change { project.shared_runners_enabled }.from(false).to(true)
+            end
+          end
         end
 
         context 'when group has pending builds' do
@@ -101,7 +116,7 @@ RSpec.describe Groups::UpdateSharedRunnersService, feature_category: :groups_and
 
       context 'disable shared Runners' do
         let!(:group) { create(:group) }
-        let!(:sub_group) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners, parent: group) }
+        let!(:sub_group) { create(:group, :shared_runners_disabled_and_overridable, parent: group) }
         let!(:sub_group2) { create(:group, parent: group) }
         let!(:project) { create(:project, group: group, shared_runners_enabled: true) }
         let!(:project2) { create(:project, group: sub_group2, shared_runners_enabled: true) }
@@ -124,7 +139,7 @@ RSpec.describe Groups::UpdateSharedRunnersService, feature_category: :groups_and
         end
 
         context 'with override on self' do
-          let(:group) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners) }
+          let(:group) { create(:group, :shared_runners_disabled_and_overridable) }
 
           it 'disables it' do
             expect do
@@ -172,7 +187,7 @@ RSpec.describe Groups::UpdateSharedRunnersService, feature_category: :groups_and
         end
 
         context 'when ancestor disables shared Runners but allows to override' do
-          let!(:parent) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners) }
+          let!(:parent) { create(:group, :shared_runners_disabled_and_overridable) }
           let!(:group) { create(:group, :shared_runners_disabled, parent: parent) }
           let!(:project) { create(:project, shared_runners_enabled: false, group: group) }
 
diff --git a/spec/services/projects/participants_service_spec.rb b/spec/services/projects/participants_service_spec.rb
index 04c43dff2dc..b01e64439ec 100644
--- a/spec/services/projects/participants_service_spec.rb
+++ b/spec/services/projects/participants_service_spec.rb
@@ -120,120 +120,88 @@ RSpec.describe Projects::ParticipantsService, feature_category: :groups_and_proj
   describe '#project_members' do
     subject(:usernames) { service.project_members.map { |member| member[:username] } }
 
-    shared_examples 'return project members' do
-      context 'when there is a project in group namespace' do
-        let_it_be(:public_group) { create(:group, :public) }
-        let_it_be(:public_project) { create(:project, :public, namespace: public_group) }
+    context 'when there is a project in group namespace' do
+      let_it_be(:public_group) { create(:group, :public) }
+      let_it_be(:public_project, reload: true) { create(:project, :public, namespace: public_group) }
 
-        let_it_be(:public_group_owner) { create(:user) }
+      let_it_be(:public_group_owner) { create(:user) }
 
-        let(:service) { described_class.new(public_project, create(:user)) }
+      let(:service) { described_class.new(public_project, create(:user)) }
 
-        before do
-          public_group.add_owner(public_group_owner)
-        end
-
-        it 'returns members of a group' do
-          expect(usernames).to include(public_group_owner.username)
-        end
+      before do
+        public_group.add_owner(public_group_owner)
       end
 
-      context 'when there is a private group and a public project' do
-        let_it_be(:public_group) { create(:group, :public) }
-        let_it_be(:private_group) { create(:group, :private, :nested) }
-        let_it_be(:public_project) { create(:project, :public, namespace: public_group) }
-
-        let_it_be(:project_issue) { create(:issue, project: public_project) }
-
-        let_it_be(:public_group_owner) { create(:user) }
-        let_it_be(:private_group_member) { create(:user) }
-        let_it_be(:public_project_maintainer) { create(:user) }
-        let_it_be(:private_group_owner) { create(:user) }
-
-        let_it_be(:group_ancestor_owner) { create(:user) }
-
-        before_all do
-          public_group.add_owner public_group_owner
-          private_group.add_developer private_group_member
-          public_project.add_maintainer public_project_maintainer
-
-          private_group.add_owner private_group_owner
-          private_group.parent.add_owner group_ancestor_owner
-        end
-
-        context 'when the private group is invited to the public project' do
-          before_all do
-            create(:project_group_link, group: private_group, project: public_project)
-          end
-
-          context 'when a user who is outside the public project and the private group is signed in' do
-            let(:service) { described_class.new(public_project, create(:user)) }
-
-            it 'does not return the private group' do
-              expect(usernames).not_to include(private_group.name)
-            end
-
-            it 'does not return private group members' do
-              expect(usernames).not_to include(private_group_member.username)
-            end
-
-            it 'returns the project maintainer' do
-              expect(usernames).to include(public_project_maintainer.username)
-            end
-
-            it 'returns project members from an invited public group' do
-              invited_public_group = create(:group, :public)
-              invited_public_group.add_owner create(:user)
-
-              create(:project_group_link, group: invited_public_group, project: public_project)
-
-              expect(usernames).to include(invited_public_group.users.first.username)
-            end
-
-            it 'does not return ancestors of the private group' do
-              expect(usernames).not_to include(group_ancestor_owner.username)
-            end
-          end
-
-          context 'when public project maintainer is signed in' do
-            let(:service) { described_class.new(public_project, public_project_maintainer) }
-
-            it 'returns private group members' do
-              expect(usernames).to include(private_group_member.username)
-            end
-
-            it 'returns members of the ancestral groups of the private group' do
-              expect(usernames).to include(group_ancestor_owner.username)
-            end
-          end
-
-          context 'when private group owner is signed in' do
-            let(:service) { described_class.new(public_project, private_group_owner) }
-
-            it 'returns private group members' do
-              expect(usernames).to include(private_group_member.username)
-            end
-
-            it 'returns ancestors of the the private group' do
-              expect(usernames).to include(group_ancestor_owner.username)
-            end
-          end
-
-          context 'when the namespace owner of the public project is signed in' do
-            let(:service) { described_class.new(public_project, public_group_owner) }
-
-            it 'returns private group members' do
-              expect(usernames).to include(private_group_member.username)
-            end
-
-            it 'does not return members of the ancestral groups of the private group' do
-              expect(usernames).to include(group_ancestor_owner.username)
-            end
-          end
-        end
+      it 'returns members of a group' do
+        expect(usernames).to include(public_group_owner.username)
       end
     end
 
-    it_behaves_like 'return project members'
+    context 'when there is a private group and a public project' do
+      let_it_be(:public_group) { create(:group, :public) }
+      let_it_be(:private_group) { create(:group, :private, :nested) }
+      let_it_be(:public_project, reload: true) { create(:project, :public, namespace: public_group) }
+
+      let_it_be(:project_issue) { create(:issue, project: public_project) }
+
+      let_it_be(:public_group_owner) { create(:user) }
+      let_it_be(:private_group_member) { create(:user) }
+      let_it_be(:public_project_maintainer) { create(:user) }
+      let_it_be(:private_group_owner) { create(:user) }
+
+      let_it_be(:group_ancestor_owner) { create(:user) }
+
+      before_all do
+        public_group.add_owner public_group_owner
+        private_group.add_developer private_group_member
+        public_project.add_maintainer public_project_maintainer
+
+        private_group.add_owner private_group_owner
+        private_group.parent.add_owner group_ancestor_owner
+      end
+
+      context 'when the private group is invited to the public project' do
+        before_all do
+          create(:project_group_link, group: private_group, project: public_project)
+        end
+
+        let(:service) { described_class.new(public_project, create(:user)) }
+
+        it 'does not return the private group' do
+          expect(usernames).not_to include(private_group.name)
+        end
+
+        it 'returns private group members' do
+          expect(usernames).to include(private_group_member.username)
+        end
+
+        it 'returns the project maintainer' do
+          expect(usernames).to include(public_project_maintainer.username)
+        end
+
+        it 'returns project members from an invited public group' do
+          invited_public_group = create(:group, :public)
+          invited_public_group.add_owner create(:user)
+
+          create(:project_group_link, group: invited_public_group, project: public_project)
+
+          expect(usernames).to include(invited_public_group.users.first.username)
+        end
+
+        it 'returns members of the ancestral groups of the private group' do
+          expect(usernames).to include(group_ancestor_owner.username)
+        end
+
+        it 'returns invited group members of the private group' do
+          invited_group = create(:group, :public)
+          create(:group_group_link, shared_group: private_group, shared_with_group: invited_group)
+
+          other_user = create(:user)
+          invited_group.add_guest(other_user)
+
+          expect(usernames).to include(other_user.username)
+        end
+      end
+    end
   end
 end
diff --git a/spec/services/projects/transfer_service_spec.rb b/spec/services/projects/transfer_service_spec.rb
index 46fe7d7bbbe..1ddf6168c07 100644
--- a/spec/services/projects/transfer_service_spec.rb
+++ b/spec/services/projects/transfer_service_spec.rb
@@ -570,12 +570,12 @@ RSpec.describe Projects::TransferService, feature_category: :groups_and_projects
     using RSpec::Parameterized::TableSyntax
 
     where(:project_shared_runners_enabled, :shared_runners_setting, :expected_shared_runners_enabled) do
-      true  | :disabled_and_unoverridable | false
-      false | :disabled_and_unoverridable | false
-      true  | :disabled_and_overridable   | true
-      false | :disabled_and_overridable   | false
-      true  | :shared_runners_enabled     | true
-      false | :shared_runners_enabled     | false
+      true  | :shared_runners_disabled_and_unoverridable | false
+      false | :shared_runners_disabled_and_unoverridable | false
+      true  | :shared_runners_disabled_and_overridable   | true
+      false | :shared_runners_disabled_and_overridable   | false
+      true  | :shared_runners_enabled                    | true
+      false | :shared_runners_enabled                    | false
     end
 
     with_them do
diff --git a/spec/support/shared_examples/requests/api/nuget_endpoints_shared_examples.rb b/spec/support/shared_examples/requests/api/nuget_endpoints_shared_examples.rb
index 432e67ee21e..150e9a4e004 100644
--- a/spec/support/shared_examples/requests/api/nuget_endpoints_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/nuget_endpoints_shared_examples.rb
@@ -1,8 +1,10 @@
 # frozen_string_literal: true
 
-RSpec.shared_examples 'handling nuget service requests' do
+RSpec.shared_examples 'handling nuget service requests' do |v2: false|
   subject { get api(url) }
 
+  it { is_expected.to have_request_urgency(v2 ? :low : :default) }
+
   context 'with valid target' do
     using RSpec::Parameterized::TableSyntax
 
@@ -20,15 +22,17 @@ RSpec.shared_examples 'handling nuget service requests' do
     end
 
     with_them do
-      let(:snowplow_gitlab_standard_context) { snowplow_context(user_role: :anonymous) }
-
-      subject { get api(url) }
+      let(:snowplow_gitlab_standard_context) do
+        snowplow_context(user_role: :anonymous).tap do |ctx|
+          ctx[:feed] = 'v2' if v2
+        end
+      end
 
       before do
         update_visibility_to(Gitlab::VisibilityLevel.const_get(visibility_level, false))
       end
 
-      it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member], v2
     end
   end
 
diff --git a/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb b/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
index d6a0055700d..0f1ec14a0b6 100644
--- a/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
@@ -18,7 +18,7 @@ RSpec.shared_examples 'rejects nuget packages access' do |user_type, status, add
   end
 end
 
-RSpec.shared_examples 'process nuget service index request' do |user_type, status, add_member = true|
+RSpec.shared_examples 'process nuget service index request' do |user_type, status, add_member = true, v2 = false|
   context "for user type #{user_type}" do
     before do
       target.send("add_#{user_type}", user) if add_member && user_type != :anonymous
@@ -28,15 +28,22 @@ RSpec.shared_examples 'process nuget service index request' do |user_type, statu
 
     it_behaves_like 'a package tracking event', 'API::NugetPackages', 'cli_metadata'
 
-    it 'returns a valid json response' do
+    it 'returns a valid json or xml response' do
       subject
 
-      expect(response.media_type).to eq('application/json')
-      expect(json_response).to match_schema('public_api/v4/packages/nuget/service_index')
-      expect(json_response).to be_a(Hash)
+      if v2
+        expect(response.media_type).to eq('application/xml')
+        expect(body).to have_xpath('//service')
+          .and have_xpath('//service/workspace')
+          .and have_xpath('//service/workspace/collection[@href]')
+      else
+        expect(response.media_type).to eq('application/json')
+        expect(json_response).to match_schema('public_api/v4/packages/nuget/service_index')
+        expect(json_response).to be_a(Hash)
+      end
     end
 
-    context 'with invalid format' do
+    context 'with invalid format', unless: v2 do
       let(:url) { "/#{target_type}/#{target.id}/packages/nuget/index.xls" }
 
       it_behaves_like 'rejects nuget packages access', :anonymous, :not_found
@@ -439,6 +446,13 @@ end
 
 RSpec.shared_examples 'nuget authorize upload endpoint' do
   using RSpec::Parameterized::TableSyntax
+  include_context 'workhorse headers'
+
+  let(:headers) { {} }
+
+  subject { put api(url), headers: headers }
+
+  it { is_expected.to have_request_urgency(:low) }
 
   context 'with valid project' do
     where(:visibility_level, :user_role, :member, :user_token, :sent_through, :shared_examples_name, :expected_status) do
@@ -517,6 +531,26 @@ end
 
 RSpec.shared_examples 'nuget upload endpoint' do |symbol_package: false|
   using RSpec::Parameterized::TableSyntax
+  include_context 'workhorse headers'
+
+  let(:headers) { {} }
+  let(:file_name) { symbol_package ? 'package.snupkg' : 'package.nupkg' }
+  let(:params) { { package: temp_file(file_name) } }
+  let(:file_key) { :package }
+  let(:send_rewritten_field) { true }
+
+  subject do
+    workhorse_finalize(
+      api(url),
+      method: :put,
+      file_key: file_key,
+      params: params,
+      headers: headers,
+      send_rewritten_field: send_rewritten_field
+    )
+  end
+
+  it { is_expected.to have_request_urgency(:low) }
 
   context 'with valid project' do
     where(:visibility_level, :user_role, :member, :user_token, :sent_through, :shared_examples_name, :expected_status) do
@@ -573,7 +607,12 @@ RSpec.shared_examples 'nuget upload endpoint' do |symbol_package: false|
       end
 
       let(:headers) { user_headers.merge(workhorse_headers) }
-      let(:snowplow_gitlab_standard_context) { { project: project, user: user, namespace: project.namespace, property: 'i_package_nuget_user' } }
+
+      let(:snowplow_gitlab_standard_context) do
+        { project: project, user: user, namespace: project.namespace, property: 'i_package_nuget_user' }.tap do |ctx|
+          ctx[:feed] = 'v2' if url.include?('nuget/v2')
+        end
+      end
 
       before do
         update_visibility_to(Gitlab::VisibilityLevel.const_get(visibility_level, false))
@@ -604,4 +643,16 @@ RSpec.shared_examples 'nuget upload endpoint' do |symbol_package: false|
 
     it_behaves_like 'returning response status', :bad_request
   end
+
+  context 'when ObjectStorage::RemoteStoreError is raised' do
+    let(:headers) { basic_auth_header(deploy_token.username, deploy_token.token).merge(workhorse_headers) }
+
+    before do
+      allow_next_instance_of(::Packages::CreatePackageFileService) do |instance|
+        allow(instance).to receive(:execute).and_raise(ObjectStorage::RemoteStoreError)
+      end
+    end
+
+    it_behaves_like 'returning response status', :forbidden
+  end
 end
diff --git a/spec/views/projects/pages/_pages_settings.html.haml_spec.rb b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
new file mode 100644
index 00000000000..36dd918cfa3
--- /dev/null
+++ b/spec/views/projects/pages/_pages_settings.html.haml_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'projects/pages/_pages_settings', feature_category: :pages do
+  let_it_be(:project) { build_stubbed(:project, :repository) }
+  let_it_be(:user) { build_stubbed(:user) }
+
+  before do
+    assign(:project, project)
+    allow(view).to receive(:current_user).and_return(user)
+  end
+
+  context 'for pages unique domain' do
+    it 'shows the unique domain toggle' do
+      render
+
+      expect(rendered).to have_content('Use unique domain')
+    end
+
+    context 'when pages_unique_domain feature flag is disabled' do
+      it 'does not show the unique domain toggle' do
+        stub_feature_flags(pages_unique_domain: false)
+
+        # We have to use `view.render` because `render` causes issues
+        # https://github.com/rails/rails/issues/41320
+        expect(view.render('projects/pages/pages_settings')).to be_nil
+      end
+    end
+  end
+end
diff --git a/workhorse/internal/upstream/routes.go b/workhorse/internal/upstream/routes.go
index dd1725a723e..e634f0ca66c 100644
--- a/workhorse/internal/upstream/routes.go
+++ b/workhorse/internal/upstream/routes.go
@@ -285,6 +285,9 @@ func configureRoutes(u *upstream) {
 		// NuGet Artifact Repository
 		u.route("PUT", apiProjectPattern+`/packages/nuget/`, mimeMultipartUploader),
 
+		// NuGet v2 Artifact Repository
+		u.route("PUT", apiProjectPattern+`/packages/nuget/v2`, mimeMultipartUploader),
+
 		// PyPI Artifact Repository
 		u.route("POST", apiProjectPattern+`/packages/pypi`, mimeMultipartUploader),
 
diff --git a/workhorse/upload_test.go b/workhorse/upload_test.go
index 8effe291979..62a78dd9464 100644
--- a/workhorse/upload_test.go
+++ b/workhorse/upload_test.go
@@ -159,6 +159,9 @@ func TestAcceleratedUpload(t *testing.T) {
 		{"PUT", "/api/v4/projects/9001/packages/nuget/v1/files", true},
 		{"PUT", "/api/v4/projects/group%2Fproject/packages/nuget/v1/files", true},
 		{"PUT", "/api/v4/projects/group%2Fsubgroup%2Fproject/packages/nuget/v1/files", true},
+		{"PUT", "/api/v4/projects/9001/packages/nuget/v2/files", true},
+		{"PUT", "/api/v4/projects/group%2Fproject/packages/nuget/v2/files", true},
+		{"PUT", "/api/v4/projects/group%2Fsubgroup%2Fproject/packages/nuget/v2/files", true},
 		{"POST", `/api/v4/groups/import`, true},
 		{"POST", `/api/v4/groups/import/`, true},
 		{"POST", `/api/v4/projects/import`, true},
@@ -289,6 +292,8 @@ func TestUnacceleratedUploads(t *testing.T) {
 		{"POST", `/api/v4/projects/group/project/wikis/attachments`},
 		{"PUT", "/api/v4/projects/group/subgroup/project/packages/nuget/v1/files"},
 		{"PUT", "/api/v4/projects/group/project/packages/nuget/v1/files"},
+		{"POST", "/api/v4/projects/group/subgroup/project/packages/nuget/v2/files"},
+		{"POST", "/api/v4/projects/group/project/packages/nuget/v2/files"},
 		{"POST", `/api/v4/projects/group/subgroup/project/packages/pypi`},
 		{"POST", `/api/v4/projects/group/project/packages/pypi`},
 		{"POST", `/api/v4/projects/group/subgroup/project/packages/pypi`},