diff --git a/app/assets/javascripts/security_configuration/components/training_provider_list.vue b/app/assets/javascripts/security_configuration/components/training_provider_list.vue
index 4b40e5a1e1d..bfdabc10227 100644
--- a/app/assets/javascripts/security_configuration/components/training_provider_list.vue
+++ b/app/assets/javascripts/security_configuration/components/training_provider_list.vue
@@ -1,5 +1,13 @@
 <script>
-import { GlAlert, GlCard, GlToggle, GlLink, GlSkeletonLoader } from '@gitlab/ui';
+import {
+  GlAlert,
+  GlTooltipDirective,
+  GlCard,
+  GlToggle,
+  GlLink,
+  GlSkeletonLoader,
+  GlIcon,
+} from '@gitlab/ui';
 import * as Sentry from '@sentry/browser';
 import Tracking from '~/tracking';
 import { __, s__ } from '~/locale';
@@ -25,6 +33,9 @@ const i18n = {
     'Could not save configuration. Please refresh the page, or try again later.',
   ),
   primaryTraining: s__('SecurityTraining|Primary Training'),
+  primaryTrainingDescription: s__(
+    'SecurityTraining|Training from this partner takes precedence when more than one training partner is enabled.',
+  ),
 };
 
 // Fetch the svg path from the GraphQL query once this issue is resolved
@@ -45,6 +56,10 @@ export default {
     GlToggle,
     GlLink,
     GlSkeletonLoader,
+    GlIcon,
+  },
+  directives: {
+    GlTooltip: GlTooltipDirective,
   },
   mixins: [Tracking.mixin()],
   inject: ['projectFullPath'],
@@ -251,7 +266,6 @@ export default {
                   :id="`security-training-provider-${provider.id}`"
                   type="radio"
                   :checked="provider.isPrimary"
-                  name="radio-group-name"
                   class="custom-control-input"
                   :disabled="!provider.isEnabled"
                   @change="setPrimaryProvider(provider)"
@@ -262,6 +276,11 @@ export default {
                 >
                   {{ $options.i18n.primaryTraining }}
                 </label>
+                <gl-icon
+                  v-gl-tooltip="$options.i18n.primaryTrainingDescription"
+                  name="information-o"
+                  class="gl-ml-2 gl-cursor-help"
+                />
               </div>
             </div>
           </div>
diff --git a/app/graphql/mutations/work_items/create.rb b/app/graphql/mutations/work_items/create.rb
index 81454db62b1..48f0f470988 100644
--- a/app/graphql/mutations/work_items/create.rb
+++ b/app/graphql/mutations/work_items/create.rb
@@ -33,7 +33,7 @@ module Mutations
       def resolve(project_path:, **attributes)
         project = authorized_find!(project_path)
 
-        unless Feature.enabled?(:work_items, project)
+        unless Feature.enabled?(:work_items, project, default_enabled: :yaml)
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 
diff --git a/app/graphql/mutations/work_items/create_from_task.rb b/app/graphql/mutations/work_items/create_from_task.rb
index e55726fc0ac..16d1e646167 100644
--- a/app/graphql/mutations/work_items/create_from_task.rb
+++ b/app/graphql/mutations/work_items/create_from_task.rb
@@ -31,7 +31,7 @@ module Mutations
       def resolve(id:, work_item_data:)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project)
+        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 
diff --git a/app/graphql/mutations/work_items/delete.rb b/app/graphql/mutations/work_items/delete.rb
index 71792a802c0..f32354878ec 100644
--- a/app/graphql/mutations/work_items/delete.rb
+++ b/app/graphql/mutations/work_items/delete.rb
@@ -20,7 +20,7 @@ module Mutations
       def resolve(id:)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project)
+        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 
diff --git a/app/graphql/mutations/work_items/update.rb b/app/graphql/mutations/work_items/update.rb
index 3ab9ba2d502..2700cbdb709 100644
--- a/app/graphql/mutations/work_items/update.rb
+++ b/app/graphql/mutations/work_items/update.rb
@@ -28,7 +28,7 @@ module Mutations
       def resolve(id:, **attributes)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project)
+        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 
diff --git a/app/graphql/resolvers/work_item_resolver.rb b/app/graphql/resolvers/work_item_resolver.rb
index 6eb23916d83..7cf52339815 100644
--- a/app/graphql/resolvers/work_item_resolver.rb
+++ b/app/graphql/resolvers/work_item_resolver.rb
@@ -12,7 +12,7 @@ module Resolvers
 
     def resolve(id:)
       work_item = authorized_find!(id: id)
-      return unless Feature.enabled?(:work_items, work_item.project)
+      return unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
 
       work_item
     end
diff --git a/app/graphql/resolvers/work_items/types_resolver.rb b/app/graphql/resolvers/work_items/types_resolver.rb
index acdcfe5ee70..67a9d57d42f 100644
--- a/app/graphql/resolvers/work_items/types_resolver.rb
+++ b/app/graphql/resolvers/work_items/types_resolver.rb
@@ -11,7 +11,7 @@ module Resolvers
                             ' Argument is experimental and can be removed in the future without notice.'
 
       def resolve(taskable: nil)
-        return unless Feature.enabled?(:work_items, object)
+        return unless Feature.enabled?(:work_items, object, default_enabled: :yaml)
 
         # This will require a finder in the future when groups/projects get their work item types
         # All groups/projects use the default types for now
diff --git a/app/graphql/types/query_type.rb b/app/graphql/types/query_type.rb
index 78e62d810f2..cc46c7e86e4 100644
--- a/app/graphql/types/query_type.rb
+++ b/app/graphql/types/query_type.rb
@@ -90,7 +90,8 @@ module Types
     field :work_item, Types::WorkItemType,
           null: true,
           resolver: Resolvers::WorkItemResolver,
-          description: 'Find a work item. Returns `null` if `work_items` feature flag is disabled.'
+          description: 'Find a work item. Returns `null` if `work_items` feature flag is disabled.' \
+                       ' The feature is experimental and is subject to change without notice.'
 
     field :merge_request, Types::MergeRequestType,
           null: true,
diff --git a/app/models/label.rb b/app/models/label.rb
index b08b5bd63d5..4c9f071f43a 100644
--- a/app/models/label.rb
+++ b/app/models/label.rb
@@ -217,11 +217,19 @@ class Label < ApplicationRecord
   end
 
   def title=(value)
-    write_attribute(:title, sanitize_value(value)) if value.present?
+    if value.blank?
+      super
+    else
+      write_attribute(:title, sanitize_value(value))
+    end
   end
 
   def description=(value)
-    write_attribute(:description, sanitize_value(value)) if value.present?
+    if value.blank?
+      super
+    else
+      write_attribute(:description, sanitize_value(value))
+    end
   end
 
   ##
diff --git a/config/feature_flags/development/vulnerability_finding_replace_metadata.yml b/config/feature_flags/development/vulnerability_finding_replace_metadata.yml
deleted file mode 100644
index 2774547668f..00000000000
--- a/config/feature_flags/development/vulnerability_finding_replace_metadata.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: vulnerability_finding_replace_metadata
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66868
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/337253
-milestone: '14.2'
-group: group::threat insights
-type: development
-default_enabled: false
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 6ffe145b54b..d75b743555a 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -568,7 +568,7 @@ Returns [`Vulnerability`](#vulnerability).
 
 ### `Query.workItem`
 
-Find a work item. Returns `null` if `work_items` feature flag is disabled.
+Find a work item. Returns `null` if `work_items` feature flag is disabled. The feature is experimental and is subject to change without notice.
 
 Returns [`WorkItem`](#workitem).
 
diff --git a/doc/api/secure_files.md b/doc/api/secure_files.md
new file mode 100644
index 00000000000..96190920a33
--- /dev/null
+++ b/doc/api/secure_files.md
@@ -0,0 +1,171 @@
+---
+stage: Verify
+group: Pipeline Authoring
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
+type: reference, api
+---
+
+# Project-level Secure Files API **(FREE)**
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78227) in GitLab 14.8. [Deployed behind the `ci_secure_files` flag](../administration/feature_flags.md), disabled by default.
+
+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available,
+ask an administrator to [enable the feature flag](../administration/feature_flags.md) named `ci_secure_files`.
+The feature is not ready for production use.
+
+## List project secure files
+
+Get list of secure files in a project.
+
+```plaintext
+GET /projects/:project_id/secure_files
+```
+
+Supported attributes:
+
+| Attribute    | Type           | Required               | Description |
+|--------------|----------------|------------------------|-------------|
+| `project_id` | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user. |
+
+Example request:
+
+```shell
+curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/secure_files"
+```
+
+Example response:
+
+```json
+[
+    {
+        "id": 1,
+        "name": "myfile.jks",
+        "checksum": "16630b189ab34b2e3504f4758e1054d2e478deda510b2b08cc0ef38d12e80aac",
+        "checksum_algorithm": "sha256",
+        "permissions": "read_only",
+        "created_at": "2022-02-22T22:22:22.222Z"
+    },
+    {
+        "id": 2,
+        "name": "myotherfile.jks",
+        "checksum": "16630b189ab34b2e3504f4758e1054d2e478deda510b2b08cc0ef38d12e80aa2",
+        "checksum_algorithm": "sha256",
+        "permissions": "execute",
+        "created_at": "2022-02-22T22:22:22.222Z"
+    }
+]
+```
+
+## Show secure file details
+
+Get the details of a specific secure file in a project.
+
+```plaintext
+GET /projects/:project_id/secure_files/:id
+```
+
+Supported attributes:
+
+| Attribute    | Type           | Required               | Description |
+|--------------|----------------|------------------------|-------------|
+| `project_id` | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user. |
+| `id`         | integer        | **{check-circle}** Yes | The `id` of a secure file. |
+
+Example request:
+
+```shell
+curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/secure_files/1"
+```
+
+Example response:
+
+```json
+{
+    "id": 1,
+    "name": "myfile.jks",
+    "checksum": "16630b189ab34b2e3504f4758e1054d2e478deda510b2b08cc0ef38d12e80aac",
+    "checksum_algorithm": "sha256",
+    "permissions": "read_only",
+    "created_at": "2022-02-22T22:22:22.222Z"
+}
+```
+
+## Create secure file
+
+Create a new secure file.
+
+```plaintext
+POST /projects/:project_id/secure_files
+```
+
+Supported attributes:
+
+| Attribute     | Type           | Required               | Description |
+|---------------|----------------|------------------------|-------------|
+| `project_id`  | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user. |
+| `name`        | string         | **{check-circle}** Yes | The `name` of the file being uploaded. |
+| `file`        | file           | **{check-circle}** Yes | The `file` being uploaded. |
+| `permissions` | string         | **{dotted-circle}** No | The file is created with the specified permissions when created in the CI/CD job. Available types are: `read_only` (default), `read_write`, and `execute`. |
+
+Example request:
+
+```shell
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
+     "https://gitlab.example.com/api/v4/projects/1/secure_files"  --form "name=myfile.jks" --form "file=@/path/to/file/myfile.jks"
+```
+
+Example response:
+
+```json
+{
+    "id": 1,
+    "name": "myfile.jks",
+    "checksum": "16630b189ab34b2e3504f4758e1054d2e478deda510b2b08cc0ef38d12e80aac",
+    "checksum_algorithm": "sha256",
+    "permissions": "read_only",
+    "created_at": "2022-02-22T22:22:22.222Z"
+}
+```
+
+## Download secure file
+
+Download the contents of a project's secure file.
+
+```plaintext
+GET /projects/:project_id/download/:id
+```
+
+Supported attributes:
+
+| Attribute    | Type           | Required               | Description |
+|--------------|----------------|------------------------|-------------|
+| `project_id` | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user. |
+| `id`         | integer        | **{check-circle}** Yes | The `id` of a secure file. |
+
+Example request:
+
+```shell
+curl --request GET --header "PRIVATE-TOKEN: <your_access_token>" https://gitlab.example.com/api/v4/projects/1/secure_files/1/download --output myfile.jks
+```
+
+## Remove secure file
+
+Remove a project's secure file.
+
+```plaintext
+DELETE /projects/:project_id/secure_files/:id
+```
+
+Supported attributes:
+
+| Attribute    | Type           | Required               | Description |
+|--------------|----------------|------------------------|-------------|
+| `project_id` | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](index.md#namespaced-path-encoding) owned by the authenticated user. |
+| `id`         | integer        | **{check-circle}** Yes | The `id` of a secure file. |
+
+Example request:
+
+```shell
+curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/1/secure_files/1"
+```
diff --git a/doc/development/background_migrations.md b/doc/development/background_migrations.md
index 49835085f96..9fffbd25518 100644
--- a/doc/development/background_migrations.md
+++ b/doc/development/background_migrations.md
@@ -489,7 +489,8 @@ View the production Sidekiq log and filter for:
 
 - `json.class: BackgroundMigrationWorker`
 - `json.job_status: fail`
-- `json.meta.caller_id: <MyBackgroundMigrationClassName>`
+- `json.meta.caller_id: <MyBackgroundMigrationSchedulingMigrationClassName>`
+- `json.args: <MyBackgroundMigrationClassName>`
 
 Looking at the `json.error_class`, `json.error_message` and `json.error_backtrace` values may be helpful in understanding why the jobs failed.
 
diff --git a/lib/gitlab/import_export/group/object_builder.rb b/lib/gitlab/import_export/group/object_builder.rb
index 43cc7a78a61..e26f37c3347 100644
--- a/lib/gitlab/import_export/group/object_builder.rb
+++ b/lib/gitlab/import_export/group/object_builder.rb
@@ -13,21 +13,12 @@ module Gitlab
           super
 
           @group = @attributes['group']
-
-          update_description
         end
 
         private
 
         attr_reader :group
 
-        # Convert description empty string to nil
-        # due to existing object being saved with description: nil
-        # Which makes object lookup to fail since nil != ''
-        def update_description
-          attributes['description'] = nil if attributes['description'] == ''
-        end
-
         def where_clauses
           [
             where_clause_base,
diff --git a/lib/gitlab/usage/metrics/instrumentations/database_metric.rb b/lib/gitlab/usage/metrics/instrumentations/database_metric.rb
index d7fc798ebe2..34a8bfd08b5 100644
--- a/lib/gitlab/usage/metrics/instrumentations/database_metric.rb
+++ b/lib/gitlab/usage/metrics/instrumentations/database_metric.rb
@@ -33,6 +33,12 @@ module Gitlab
               @metric_relation = block
             end
 
+            def metric_options(&block)
+              return @metric_options&.call.to_h unless block_given?
+
+              @metric_options = block
+            end
+
             def operation(symbol, column: nil, &block)
               @metric_operation = symbol
               @column = column
@@ -54,6 +60,7 @@ module Gitlab
                     self.class.column,
                     start: start,
                     finish: finish,
+                    **self.class.metric_options,
                     &self.class.metric_operation_block)
           end
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 055106483be..2b14ec51057 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -9050,9 +9050,6 @@ msgstr ""
 msgid "ComplianceFrameworks|Configuration not found"
 msgstr ""
 
-msgid "ComplianceFrameworks|Configured compliance frameworks appear here."
-msgstr ""
-
 msgid "ComplianceFrameworks|Delete compliance framework %{framework}"
 msgstr ""
 
@@ -9077,6 +9074,9 @@ msgstr ""
 msgid "ComplianceFrameworks|Error fetching compliance frameworks data. Please refresh the page or try a different framework"
 msgstr ""
 
+msgid "ComplianceFrameworks|Frameworks that have been added will appear here."
+msgstr ""
+
 msgid "ComplianceFrameworks|Invalid format"
 msgstr ""
 
@@ -9086,7 +9086,7 @@ msgstr ""
 msgid "ComplianceFrameworks|Name is required"
 msgstr ""
 
-msgid "ComplianceFrameworks|No compliance frameworks are configured"
+msgid "ComplianceFrameworks|No compliance frameworks are set up yet"
 msgstr ""
 
 msgid "ComplianceFrameworks|Required format: %{codeStart}path/file.y[a]ml@group-name/project-name%{codeEnd}. %{linkStart}Learn more.%{linkEnd}"
@@ -33121,6 +33121,9 @@ msgstr ""
 msgid "SecurityTraining|Primary Training"
 msgstr ""
 
+msgid "SecurityTraining|Training from this partner takes precedence when more than one training partner is enabled."
+msgstr ""
+
 msgid "See example DevOps Score page in our documentation."
 msgstr ""
 
diff --git a/spec/frontend/security_configuration/components/training_provider_list_spec.js b/spec/frontend/security_configuration/components/training_provider_list_spec.js
index 08b79930067..08ba4bcbf69 100644
--- a/spec/frontend/security_configuration/components/training_provider_list_spec.js
+++ b/spec/frontend/security_configuration/components/training_provider_list_spec.js
@@ -1,10 +1,11 @@
 import * as Sentry from '@sentry/browser';
-import { GlAlert, GlLink, GlToggle, GlCard, GlSkeletonLoader } from '@gitlab/ui';
+import { GlAlert, GlLink, GlToggle, GlCard, GlSkeletonLoader, GlIcon } from '@gitlab/ui';
 import Vue from 'vue';
 import VueApollo from 'vue-apollo';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import { mockTracking, unmockTracking } from 'helpers/tracking_helper';
+import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
 import {
   TRACK_TOGGLE_TRAINING_PROVIDER_ACTION,
   TRACK_TOGGLE_TRAINING_PROVIDER_LABEL,
@@ -70,6 +71,9 @@ describe('TrainingProviderList component', () => {
       provide: {
         projectFullPath: testProjectPath,
       },
+      directives: {
+        GlTooltip: createMockDirective(),
+      },
       apolloProvider,
     });
   };
@@ -174,6 +178,16 @@ describe('TrainingProviderList component', () => {
             );
           });
 
+          it('shows a info-tooltip that describes the purpose of a primary provider', () => {
+            const infoIcon = findPrimaryProviderRadios().at(index).find(GlIcon);
+            const tooltip = getBinding(infoIcon.element, 'gl-tooltip');
+
+            expect(infoIcon.props()).toMatchObject({
+              name: 'information-o',
+            });
+            expect(tooltip.value).toBe(TrainingProviderList.i18n.primaryTrainingDescription);
+          });
+
           it('does not show loader when query is populated', () => {
             expect(findLoader().exists()).toBe(false);
           });
diff --git a/spec/lib/gitlab/import_export/group/object_builder_spec.rb b/spec/lib/gitlab/import_export/group/object_builder_spec.rb
index 028bd5463a1..09f40199b31 100644
--- a/spec/lib/gitlab/import_export/group/object_builder_spec.rb
+++ b/spec/lib/gitlab/import_export/group/object_builder_spec.rb
@@ -51,16 +51,4 @@ RSpec.describe Gitlab::ImportExport::Group::ObjectBuilder do
       expect(milestone.persisted?).to be true
     end
   end
-
-  describe '#initialize' do
-    context 'when attributes contain description as empty string' do
-      let(:attributes) { base_attributes.merge('description' => '') }
-
-      it 'converts empty string to nil' do
-        builder = described_class.new(Label, attributes)
-
-        expect(builder.send(:attributes)).to include({ 'description' => nil })
-      end
-    end
-  end
 end
diff --git a/spec/lib/gitlab/usage/metrics/instrumentations/database_metric_spec.rb b/spec/lib/gitlab/usage/metrics/instrumentations/database_metric_spec.rb
index 4d84423cde4..ea5ae1970de 100644
--- a/spec/lib/gitlab/usage/metrics/instrumentations/database_metric_spec.rb
+++ b/spec/lib/gitlab/usage/metrics/instrumentations/database_metric_spec.rb
@@ -36,6 +36,28 @@ RSpec.describe Gitlab::Usage::Metrics::Instrumentations::DatabaseMetric do
       expect(Rails.cache.read('metric_instrumentation/special_issue_count_maximum_id')).to eq(nil)
     end
 
+    context 'with metric options specified with custom batch_size' do
+      subject do
+        described_class.tap do |metric_class|
+          metric_class.relation { Issue }
+          metric_class.operation :count
+          metric_class.start { metric_class.relation.minimum(:id) }
+          metric_class.finish { metric_class.relation.maximum(:id) }
+          metric_class.metric_options { { batch_size: 12345 } }
+        end.new(time_frame: 'all')
+      end
+
+      it 'calls metric with customized batch_size' do
+        expect(subject).to receive(:count).with(any_args, hash_including(batch_size: 12345, start: issues.min_by(&:id).id, finish: issues.max_by(&:id).id)).and_call_original
+
+        subject.value
+      end
+
+      it 'calculates a correct result' do
+        expect(subject.value).to eq(3)
+      end
+    end
+
     context 'with start and finish not called' do
       subject do
         described_class.tap do |metric_class|
diff --git a/spec/models/label_spec.rb b/spec/models/label_spec.rb
index 635c3596ff8..ff7ac0ebd2a 100644
--- a/spec/models/label_spec.rb
+++ b/spec/models/label_spec.rb
@@ -104,6 +104,12 @@ RSpec.describe Label do
       label = described_class.new(description: '<b>foo & bar?</b>')
       expect(label.description).to eq('foo & bar?')
     end
+
+    it 'accepts an empty string' do
+      label = described_class.new(title: 'foo', description: 'bar')
+      label.update!(description: '')
+      expect(label.description).to eq('')
+    end
   end
 
   describe 'priorization' do