From 77ae95a49e9021f3e1f0c37430589874bbfee6bb Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 10 Jan 2025 15:30:13 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .gitlab/ci/global.gitlab-ci.yml               |   3 +-
 .gitlab/ci/rules.gitlab-ci.yml                |   2 +-
 .../boards/components/board_card.vue          |  14 +-
 .../boards/components/board_card_inner.vue    |   1 -
 .../components/commit_changes_modal.vue       |  11 +-
 .../components/header_area/breadcrumbs.vue    |   2 +-
 .../components/new_directory_modal.vue        | 142 +++++-----------
 .../javascripts/repository/constants.js       |   8 -
 .../components/sectioned_percentage_bar.vue   |  10 +-
 .../list/components/issuable_item.vue         |   6 +
 .../components/create_work_item.vue           |  41 ++++-
 .../shared/work_item_link_child_contents.vue  |   5 +
 .../components/work_item_drawer.vue           |  14 +-
 .../components/work_item_parent.vue           |  37 +++-
 .../graphql/group_work_items.query.graphql    |  10 ++
 .../work_items/graphql/resolvers.js           |   7 +
 app/graphql/types/work_item_type.rb           |  13 +-
 app/models/namespace/detail.rb                |   2 -
 app/models/pages_deployment.rb                |  10 +-
 app/presenters/work_item_presenter.rb         |  25 ++-
 config/click_house.yml.example                |   4 +-
 config/coverband.rb                           |   2 +-
 .../ops/workhorse_use_aws_sdk_v2.yml          |   9 -
 .../wip/merge_request_dashboard_new_lists.yml |   2 +-
 ...l_vulnerability_issue_links_project_id.yml |   2 +-
 .../delete_orphaned_groups.yml                |   4 +-
 ...45_queue_requeue_delete_orphaned_groups.rb |  18 +-
 ...ll_vulnerability_issue_links_project_id.rb |  21 +++
 ...add_sharding_key_id_index_to_ci_runners.rb |  17 ++
 ...ding_key_id_index_to_ci_runner_machines.rb |  17 ++
 ...queue_re_enqueue_delete_orphaned_groups.rb |  31 ++++
 db/schema_migrations/20250103122704           |   1 +
 db/schema_migrations/20250103133119           |   1 +
 db/schema_migrations/20250103134008           |   1 +
 db/schema_migrations/20250109105904           |   1 +
 db/structure.sql                              |   4 +
 doc/administration/settings/scim_setup.md     | 139 ++++++++++++++-
 doc/api/graphql/reference/index.md            |   3 +
 .../clickhouse/clickhouse_within_gitlab.md    |   1 +
 .../python_guide/getting_started.md           | 119 +++++++++++++
 doc/install/install_ai_gateway.md             |  23 +--
 doc/subscriptions/subscription-add-ons.md     |   2 -
 .../policies/pipeline_execution_policies.md   |  10 +-
 .../img/devops_adoption_v17_8.png             | Bin 0 -> 65507 bytes
 doc/user/group/devops_adoption/index.md       |  23 +--
 doc/user/group/ssh_certificates.md            |  72 +++++++-
 doc/user/project/quick_actions.md             |   1 +
 lib/object_storage/direct_upload.rb           |   2 +-
 locale/gitlab.pot                             |  11 +-
 qa/qa/page/group/runners/index.rb             |   4 +
 qa/qa/page/project/settings/runners.rb        |   4 +
 qa/qa/resource/runner_base.rb                 |  10 ++
 qa/qa/resource/user_runners.rb                |  10 ++
 qa/qa/service/docker_run/gitlab_runner.rb     |  17 ++
 .../deprecated_unregister_runner_spec.rb      |  37 ++++
 .../4_verify/runner/unregister_runner_spec.rb |  40 +++++
 .../service/docker_run/gitlab_runner_spec.rb  |  25 +++
 spec/db/schema_spec.rb                        |   2 +-
 .../files/user_creates_directory_spec.rb      |  40 +++--
 .../work_items/create_issue_work_item_spec.rb |   1 +
 .../boards/components/board_card_spec.js      |  10 +-
 .../components/new_directory_modal_spec.js    | 154 ++++++-----------
 .../sectioned_percentage_bar_spec.js          |  85 ++++++++++
 .../list/components/issuable_item_spec.js     |  22 +++
 .../components/create_work_item_spec.js       |   7 +
 .../work_item_link_child_contents_spec.js     |   9 +
 .../components/work_item_drawer_spec.js       |  24 ++-
 spec/graphql/types/work_item_type_spec.rb     |   4 +-
 spec/lib/object_storage/direct_upload_spec.rb |  10 --
 ...eue_requeue_delete_orphaned_groups_spec.rb |  38 +----
 ..._re_enqueue_delete_orphaned_groups_spec.rb |  49 ++++++
 spec/presenters/work_item_presenter_spec.rb   |  70 +++++++-
 workhorse/go.mod                              |   2 +-
 workhorse/internal/config/config.go           |   2 +-
 .../upload/destination/destination.go         |  21 +--
 .../upload/destination/destination_test.go    |   6 +-
 .../destination/objectstore/s3_client_test.go |   3 +-
 .../destination/objectstore/s3_object.go      | 125 --------------
 .../destination/objectstore/s3_object_test.go | 159 ------------------
 .../destination/objectstore/s3_session.go     | 104 ------------
 .../objectstore/s3_session_test.go            | 100 -----------
 .../destination/objectstore/s3v2_object.go    |   9 +-
 .../objectstore/s3v2_object_test.go           |  39 ++---
 .../destination/objectstore/test/s3_stub.go   |  82 +++++----
 84 files changed, 1271 insertions(+), 957 deletions(-)
 delete mode 100644 config/feature_flags/ops/workhorse_use_aws_sdk_v2.yml
 create mode 100644 db/post_migrate/20250103122704_finalize_backfill_vulnerability_issue_links_project_id.rb
 create mode 100644 db/post_migrate/20250103133119_add_sharding_key_id_index_to_ci_runners.rb
 create mode 100644 db/post_migrate/20250103134008_add_sharding_key_id_index_to_ci_runner_machines.rb
 create mode 100644 db/post_migrate/20250109105904_queue_re_enqueue_delete_orphaned_groups.rb
 create mode 100644 db/schema_migrations/20250103122704
 create mode 100644 db/schema_migrations/20250103133119
 create mode 100644 db/schema_migrations/20250103134008
 create mode 100644 db/schema_migrations/20250109105904
 create mode 100644 doc/development/python_guide/getting_started.md
 create mode 100644 doc/user/group/devops_adoption/img/devops_adoption_v17_8.png
 create mode 100644 qa/qa/specs/features/browser_ui/4_verify/runner/deprecated_unregister_runner_spec.rb
 create mode 100644 qa/qa/specs/features/browser_ui/4_verify/runner/unregister_runner_spec.rb
 create mode 100644 spec/migrations/20250109105904_queue_re_enqueue_delete_orphaned_groups_spec.rb
 delete mode 100644 workhorse/internal/upload/destination/objectstore/s3_object.go
 delete mode 100644 workhorse/internal/upload/destination/objectstore/s3_object_test.go
 delete mode 100644 workhorse/internal/upload/destination/objectstore/s3_session.go
 delete mode 100644 workhorse/internal/upload/destination/objectstore/s3_session_test.go

diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 85ccc58923e..33b544ad8fd 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -532,8 +532,7 @@
     - name: clickhouse/clickhouse-server:23.11.3.23-alpine
       alias: clickhouse
   variables:
-    CLICKHOUSE_USER: clickhouse
-    CLICKHOUSE_PASSWORD: clickhouse
+    CLICKHOUSE_USER: default
     CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
     CLICKHOUSE_DB: gitlab_clickhouse_test
 
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 42d78649cfd..ab82a1b31aa 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -2001,7 +2001,7 @@
       when: never
     - <<: *if-merge-request-targeting-stable-branch
       when: never
-    - <<: *if-default-refs
+    - <<: *if-not-merge-request
       when: never
     - !reference [".rails:rules:ee-and-foss-migration", rules]
 
diff --git a/app/assets/javascripts/boards/components/board_card.vue b/app/assets/javascripts/boards/components/board_card.vue
index 29a81a80d5f..5a6d5714e8c 100644
--- a/app/assets/javascripts/boards/components/board_card.vue
+++ b/app/assets/javascripts/boards/components/board_card.vue
@@ -1,5 +1,6 @@
 <script>
 import Tracking from '~/tracking';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import setSelectedBoardItemsMutation from '~/boards/graphql/client/set_selected_board_items.mutation.graphql';
 import unsetSelectedBoardItemsMutation from '~/boards/graphql/client/unset_selected_board_items.mutation.graphql';
 import selectedBoardItemsQuery from '~/boards/graphql/client/selected_board_items.query.graphql';
@@ -13,7 +14,7 @@ export default {
     BoardCardInner,
   },
   mixins: [Tracking.mixin()],
-  inject: ['disabled', 'isIssueBoard'],
+  inject: ['disabled', 'isIssueBoard', 'isEpicBoard'],
   props: {
     list: {
       type: Object,
@@ -98,6 +99,16 @@ export default {
     showFocusBackground() {
       return !this.isActive && !this.multiSelectVisible;
     },
+    itemPrefix() {
+      return this.isEpicBoard ? '&' : '#';
+    },
+    itemReferencePath() {
+      const { referencePath } = this.item;
+      return referencePath.split(this.itemPrefix)[0];
+    },
+    boardItemUniqueId() {
+      return `listItem-${this.itemReferencePath}/${getIdFromGraphQLId(this.item.id)}`;
+    },
   },
   methods: {
     toggleIssue(e) {
@@ -222,6 +233,7 @@ export default {
     class="board-card gl-border gl-relative gl-mb-3 gl-rounded-base gl-border-section gl-bg-section gl-leading-normal hover:gl-bg-subtle dark:hover:gl-bg-gray-200"
   >
     <button
+      :id="boardItemUniqueId"
       :class="[
         {
           'focus:gl-bg-subtle dark:focus:gl-bg-gray-200': showFocusBackground,
diff --git a/app/assets/javascripts/boards/components/board_card_inner.vue b/app/assets/javascripts/boards/components/board_card_inner.vue
index e3d285f759c..fc30b7888c0 100644
--- a/app/assets/javascripts/boards/components/board_card_inner.vue
+++ b/app/assets/javascripts/boards/components/board_card_inner.vue
@@ -125,7 +125,6 @@ export default {
     itemPrefix() {
       return this.isEpicBoard ? '&' : '#';
     },
-
     itemId() {
       if (this.item.iid) {
         return `${this.itemPrefix}${this.item.iid}`;
diff --git a/app/assets/javascripts/repository/components/commit_changes_modal.vue b/app/assets/javascripts/repository/components/commit_changes_modal.vue
index 05a2daea475..52aeeb8f2b6 100644
--- a/app/assets/javascripts/repository/components/commit_changes_modal.vue
+++ b/app/assets/javascripts/repository/components/commit_changes_modal.vue
@@ -16,12 +16,7 @@ import csrf from '~/lib/utils/csrf';
 import { __, s__ } from '~/locale';
 import validation, { initFormField } from '~/vue_shared/directives/validation';
 import { helpPagePath } from '~/helpers/help_page_helper';
-import {
-  SECONDARY_OPTIONS_TEXT,
-  COMMIT_LABEL,
-  COMMIT_MESSAGE_SUBJECT_MAX_LENGTH,
-  COMMIT_MESSAGE_BODY_MAX_LENGTH,
-} from '../constants';
+import { COMMIT_MESSAGE_SUBJECT_MAX_LENGTH, COMMIT_MESSAGE_BODY_MAX_LENGTH } from '../constants';
 
 export default {
   csrf,
@@ -51,7 +46,7 @@ export default {
     COMMIT_IN_DEFAULT_BRANCH: __(
       'GitLab will create a default branch, %{branchName}, and commit your changes.',
     ),
-    COMMIT_LABEL,
+    COMMIT_LABEL: __('Commit message'),
     COMMIT_MESSAGE_HINT: __(
       'Try to keep the first line under 52 characters and the others under 72.',
     ),
@@ -70,7 +65,7 @@ export default {
     NO_PERMISSION_TO_COMMIT_MESSAGE: __(
       "You don't have permission to commit to %{branchName}. %{linkStart}Learn more.%{linkEnd}",
     ),
-    SECONDARY_OPTIONS_TEXT,
+    SECONDARY_OPTIONS_TEXT: __('Cancel'),
   },
   directives: {
     validation: validation(),
diff --git a/app/assets/javascripts/repository/components/header_area/breadcrumbs.vue b/app/assets/javascripts/repository/components/header_area/breadcrumbs.vue
index 2675cbc458a..5c8ddb815bc 100644
--- a/app/assets/javascripts/repository/components/header_area/breadcrumbs.vue
+++ b/app/assets/javascripts/repository/components/header_area/breadcrumbs.vue
@@ -343,8 +343,8 @@ export default {
     <new-directory-modal
       v-if="showNewDirectoryModal"
       :can-push-code="canPushCode"
+      :can-push-to-branch="canPushToBranch"
       :modal-id="$options.newDirectoryModalId"
-      :commit-message="__('Add new directory')"
       :target-branch="selectedBranch"
       :original-branch="originalBranch"
       :path="newDirectoryPath"
diff --git a/app/assets/javascripts/repository/components/new_directory_modal.vue b/app/assets/javascripts/repository/components/new_directory_modal.vue
index 40ccc6854a3..573c1cca191 100644
--- a/app/assets/javascripts/repository/components/new_directory_modal.vue
+++ b/app/assets/javascripts/repository/components/new_directory_modal.vue
@@ -1,68 +1,32 @@
 <script>
-import {
-  GlAlert,
-  GlForm,
-  GlModal,
-  GlFormGroup,
-  GlFormInput,
-  GlFormTextarea,
-  GlFormCheckbox,
-} from '@gitlab/ui';
+import { GlFormGroup, GlFormInput } from '@gitlab/ui';
 import { createAlert } from '~/alert';
 import axios from '~/lib/utils/axios_utils';
 import { visitUrl } from '~/lib/utils/url_utility';
+import { logError } from '~/lib/logger';
 import { __ } from '~/locale';
-import {
-  SECONDARY_OPTIONS_TEXT,
-  COMMIT_LABEL,
-  TARGET_BRANCH_LABEL,
-  TOGGLE_CREATE_MR_LABEL,
-  NEW_BRANCH_IN_FORK,
-} from '../constants';
+import CommitChangesModal from './commit_changes_modal.vue';
 
-const MODAL_TITLE = __('Create new directory');
-const PRIMARY_OPTIONS_TEXT = __('Create directory');
 const DIR_LABEL = __('Directory name');
 const ERROR_MESSAGE = __('Error creating new directory. Please try again.');
+const COMMIT_MESSSAGE = __('Add new directory');
 
 export default {
   components: {
-    GlAlert,
-    GlModal,
-    GlForm,
     GlFormGroup,
     GlFormInput,
-    GlFormTextarea,
-    GlFormCheckbox,
+    CommitChangesModal,
   },
   i18n: {
     DIR_LABEL,
-    COMMIT_LABEL,
-    TARGET_BRANCH_LABEL,
-    TOGGLE_CREATE_MR_LABEL,
-    NEW_BRANCH_IN_FORK,
-    PRIMARY_OPTIONS_TEXT,
     ERROR_MESSAGE,
+    COMMIT_MESSSAGE,
   },
   props: {
-    modalTitle: {
-      type: String,
-      default: MODAL_TITLE,
-      required: false,
-    },
     modalId: {
       type: String,
       required: true,
     },
-    primaryBtnText: {
-      type: String,
-      default: PRIMARY_OPTIONS_TEXT,
-      required: false,
-    },
-    commitMessage: {
-      type: String,
-      required: true,
-    },
     targetBranch: {
       type: String,
       required: true,
@@ -79,54 +43,29 @@ export default {
       type: Boolean,
       required: true,
     },
+    canPushToBranch: {
+      type: Boolean,
+      required: true,
+    },
   },
   data() {
     return {
       dir: null,
-      commit: this.commitMessage,
-      target: this.targetBranch,
-      createNewMr: true,
       loading: false,
     };
   },
   computed: {
-    primaryOptions() {
-      return {
-        text: this.primaryBtnText,
-        attributes: {
-          variant: 'confirm',
-          loading: this.loading,
-          disabled: !this.formCompleted || this.loading,
-        },
-      };
-    },
-    cancelOptions() {
-      return {
-        text: SECONDARY_OPTIONS_TEXT,
-        attributes: {
-          disabled: this.loading,
-        },
-      };
-    },
-    showCreateNewMrToggle() {
-      return this.canPushCode;
-    },
-    formCompleted() {
-      return this.dir && this.commit && this.target;
+    isValid() {
+      return Boolean(this.dir);
     },
   },
   methods: {
-    submitForm() {
+    submitForm(formData) {
       this.loading = true;
 
-      const formData = new FormData();
       formData.append('dir_name', this.dir);
-      formData.append('commit_message', this.commit);
-      formData.append('branch_name', this.target);
-      formData.append('original_branch', this.originalBranch);
-
-      if (this.createNewMr) {
-        formData.append('create_merge_request', this.createNewMr);
+      if (!formData.has('branch_name')) {
+        formData.append('branch_name', this.targetBranch);
       }
 
       return axios
@@ -134,8 +73,12 @@ export default {
         .then((response) => {
           visitUrl(response.data.filePath);
         })
-        .catch(() => {
+        .catch((e) => {
           this.loading = false;
+          logError(
+            __('Failed to create a new directory. See exception details for more information.'),
+            e,
+          );
           createAlert({ message: ERROR_MESSAGE });
         });
     },
@@ -144,33 +87,24 @@ export default {
 </script>
 
 <template>
-  <gl-form>
-    <gl-modal
-      :modal-id="modalId"
-      :title="modalTitle"
-      :action-primary="primaryOptions"
-      :action-cancel="cancelOptions"
-      @primary.prevent="submitForm"
-    >
+  <commit-changes-modal
+    v-bind="$attrs"
+    :ref="modalId"
+    :loading="loading"
+    :valid="isValid"
+    :modal-id="modalId"
+    :can-push-code="canPushCode"
+    :can-push-to-branch="canPushToBranch"
+    :commit-message="$options.i18n.COMMIT_MESSSAGE"
+    :target-branch="targetBranch"
+    :original-branch="originalBranch"
+    v-on="$listeners"
+    @submit-form="submitForm"
+  >
+    <template #body>
       <gl-form-group :label="$options.i18n.DIR_LABEL" label-for="dir_name">
-        <gl-form-input v-model="dir" :disabled="loading" name="dir_name" />
+        <gl-form-input id="dir_name" v-model="dir" :disabled="loading" name="dir_name" />
       </gl-form-group>
-      <gl-form-group :label="$options.i18n.COMMIT_LABEL" label-for="commit_message">
-        <gl-form-textarea v-model="commit" name="commit_message" :disabled="loading" no-resize />
-      </gl-form-group>
-      <gl-form-group
-        v-if="canPushCode"
-        :label="$options.i18n.TARGET_BRANCH_LABEL"
-        label-for="branch_name"
-      >
-        <gl-form-input v-model="target" :disabled="loading" name="branch_name" />
-      </gl-form-group>
-      <gl-form-checkbox v-if="showCreateNewMrToggle" v-model="createNewMr" :disabled="loading">
-        {{ $options.i18n.TOGGLE_CREATE_MR_LABEL }}
-      </gl-form-checkbox>
-      <gl-alert v-if="!canPushCode" variant="info" :dismissible="false" class="gl-mt-3">
-        {{ $options.i18n.NEW_BRANCH_IN_FORK }}
-      </gl-alert>
-    </gl-modal>
-  </gl-form>
+    </template>
+  </commit-changes-modal>
 </template>
diff --git a/app/assets/javascripts/repository/constants.js b/app/assets/javascripts/repository/constants.js
index 003cf3a5475..4aa9de465e3 100644
--- a/app/assets/javascripts/repository/constants.js
+++ b/app/assets/javascripts/repository/constants.js
@@ -6,14 +6,6 @@ export const TREE_PAGE_SIZE = 100; // the amount of items to be fetched per (bat
 
 export const COMMIT_BATCH_SIZE = 25; // we request commit data in batches of 25
 
-export const SECONDARY_OPTIONS_TEXT = __('Cancel');
-export const COMMIT_LABEL = __('Commit message');
-export const TARGET_BRANCH_LABEL = __('Target branch');
-export const TOGGLE_CREATE_MR_LABEL = __('Create a merge request for this change');
-export const NEW_BRANCH_IN_FORK = __(
-  'GitLab will create a branch in your fork and start a merge request.',
-);
-
 export const COMMIT_MESSAGE_SUBJECT_MAX_LENGTH = 52;
 export const COMMIT_MESSAGE_BODY_MAX_LENGTH = 72;
 
diff --git a/app/assets/javascripts/usage_quotas/components/sectioned_percentage_bar.vue b/app/assets/javascripts/usage_quotas/components/sectioned_percentage_bar.vue
index c61adb3cc23..1d4bf214825 100644
--- a/app/assets/javascripts/usage_quotas/components/sectioned_percentage_bar.vue
+++ b/app/assets/javascripts/usage_quotas/components/sectioned_percentage_bar.vue
@@ -11,6 +11,8 @@ export default {
      *   label: string;
      *   value: number;
      *   formattedValue: number | string;
+     *   color: string;
+     *   hideLabel: boolean,
      * }[]
      */
     sections: {
@@ -27,10 +29,9 @@ export default {
     computedSections() {
       return this.sections.map((section, index) => {
         const percentage = section.value / this.sectionsCombinedValue;
-
         return {
           ...section,
-          backgroundColor: colorFromDefaultPalette(index),
+          backgroundColor: section.color ?? colorFromDefaultPalette(index),
           cssPercentage: `${roundOffFloat(percentage * 100, 4)}%`,
           srLabelPercentage: formatNumber(percentage, {
             style: 'percent',
@@ -39,6 +40,9 @@ export default {
         };
       });
     },
+    sectionLabels() {
+      return this.computedSections.filter((s) => !s.hideLabel);
+    },
   },
 };
 </script>
@@ -62,7 +66,7 @@ export default {
     <div class="gl-mt-5">
       <div class="-gl-mx-3 -gl-my-3 gl-flex gl-flex-wrap gl-items-center">
         <div
-          v-for="{ id, label, backgroundColor, formattedValue } in computedSections"
+          v-for="{ id, label, backgroundColor, formattedValue } in sectionLabels"
           :key="id"
           class="gl-flex gl-items-center gl-p-3"
           :data-testid="`percentage-bar-legend-section-${id}`"
diff --git a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
index 1d4a91f7153..c4758b8d1fa 100644
--- a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
+++ b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
@@ -272,6 +272,10 @@ export default {
 
       return __('This issue is hidden because its author has been banned.');
     },
+    listItemUniqueId() {
+      const availableFullPath = this.workItemFullPath || this.fullPath;
+      return `listItem-${availableFullPath}/${getIdFromGraphQLId(this.issuable.id)}`;
+    },
   },
   methods: {
     hasSlotContents(slotName) {
@@ -409,6 +413,7 @@ export default {
         >
           <template #default="{ prefetchWorkItem, clearPrefetching }">
             <gl-link
+              :id="listItemUniqueId"
               class="issue-title-text gl-text-base"
               dir="auto"
               :href="issuableLinkHref"
@@ -425,6 +430,7 @@ export default {
         </work-item-prefetch>
         <gl-link
           v-else
+          :id="listItemUniqueId"
           class="issue-title-text gl-text-base"
           dir="auto"
           :href="issuableLinkHref"
diff --git a/app/assets/javascripts/work_items/components/create_work_item.vue b/app/assets/javascripts/work_items/components/create_work_item.vue
index eddc814b0a2..199e8183cd4 100644
--- a/app/assets/javascripts/work_items/components/create_work_item.vue
+++ b/app/assets/javascripts/work_items/components/create_work_item.vue
@@ -37,6 +37,7 @@ import {
   WIDGET_TYPE_ITERATION,
   WIDGET_TYPE_MILESTONE,
   DEFAULT_EPIC_COLORS,
+  WIDGET_TYPE_HIERARCHY,
 } from '../constants';
 import createWorkItemMutation from '../graphql/create_work_item.mutation.graphql';
 import namespaceWorkItemTypesQuery from '../graphql/namespace_work_item_types.query.graphql';
@@ -49,6 +50,7 @@ import WorkItemDescription from './work_item_description.vue';
 import WorkItemAssignees from './work_item_assignees.vue';
 import WorkItemLabels from './work_item_labels.vue';
 import WorkItemMilestone from './work_item_milestone.vue';
+import WorkItemParent from './work_item_parent.vue';
 import WorkItemLoading from './work_item_loading.vue';
 import WorkItemCrmContacts from './work_item_crm_contacts.vue';
 
@@ -69,6 +71,7 @@ export default {
     WorkItemCrmContacts,
     WorkItemProjectsListbox,
     TitleSuggestions,
+    WorkItemParent,
     WorkItemWeight: () => import('ee_component/work_items/components/work_item_weight.vue'),
     WorkItemHealthStatus: () =>
       import('ee_component/work_items/components/work_item_health_status.vue'),
@@ -77,7 +80,7 @@ export default {
       import('ee_component/work_items/components/work_item_rolledup_dates.vue'),
     WorkItemIteration: () => import('ee_component/work_items/components/work_item_iteration.vue'),
   },
-  inject: ['fullPath'],
+  inject: ['fullPath', 'groupPath'],
   i18n: {
     suggestionTitle: s__('WorkItem|Similar items'),
     similarWorkItemHelpText: s__(
@@ -266,6 +269,9 @@ export default {
     workItemColor() {
       return findWidget(WIDGET_TYPE_COLOR, this.workItem);
     },
+    workItemHierarchy() {
+      return findWidget(WIDGET_TYPE_HIERARCHY, this.workItem);
+    },
     workItemCrmContacts() {
       return findWidget(WIDGET_TYPE_CRM_CONTACTS, this.workItem);
     },
@@ -336,6 +342,9 @@ export default {
     workItemCrmContactIds() {
       return this.workItemCrmContacts?.contacts?.nodes?.map((item) => item.id) || [];
     },
+    workItemParent() {
+      return this.workItemHierarchy?.parent || null;
+    },
     workItemColorValue() {
       const colorWidget = findWidget(WIDGET_TYPE_COLOR, this.workItem);
       return colorWidget?.color || '';
@@ -551,9 +560,12 @@ export default {
         };
       }
 
-      if (this.parentId) {
+      if (
+        this.parentId ||
+        (this.isWidgetSupported(WIDGET_TYPE_HIERARCHY) && this.workItemParent?.id)
+      ) {
         workItemCreateInput.hierarchyWidget = {
-          parentId: this.parentId,
+          parentId: this.workItemParent?.id ?? this.parentId,
         };
       }
 
@@ -568,8 +580,15 @@ export default {
           update: (store, { data: { workItemCreate } }) => {
             const { workItem } = workItemCreate;
 
-            if (this.parentId) {
-              addHierarchyChild({ cache: store, id: this.parentId, workItem });
+            if (
+              this.parentId ||
+              (this.isWidgetSupported(WIDGET_TYPE_HIERARCHY) && this.workItemParent?.id)
+            ) {
+              addHierarchyChild({
+                cache: store,
+                id: this.workItemParent?.id ?? this.parentId,
+                workItem,
+              });
             }
           },
         });
@@ -796,6 +815,18 @@ export default {
               :can-update="canUpdate"
               @error="$emit('error', $event)"
             />
+            <work-item-parent
+              v-if="workItemHierarchy"
+              class="work-item-attributes-item"
+              :can-update="canUpdate"
+              :work-item-id="workItemId"
+              :work-item-type="selectedWorkItemTypeName"
+              :group-path="groupPath"
+              :full-path="fullPath"
+              :parent="workItemParent"
+              :is-group="isGroup"
+              @error="$emit('error', $event)"
+            />
             <work-item-crm-contacts
               v-if="workItemCrmContacts"
               class="work-item-attributes-item"
diff --git a/app/assets/javascripts/work_items/components/shared/work_item_link_child_contents.vue b/app/assets/javascripts/work_items/components/shared/work_item_link_child_contents.vue
index 8a624c5df77..6115169496c 100644
--- a/app/assets/javascripts/work_items/components/shared/work_item_link_child_contents.vue
+++ b/app/assets/javascripts/work_items/components/shared/work_item_link_child_contents.vue
@@ -13,6 +13,7 @@ import {
 import { __, s__, sprintf } from '~/locale';
 import { isScopedLabel } from '~/lib/utils/common_utils';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import WorkItemLinkChildMetadata from 'ee_else_ce/work_items/components/shared/work_item_link_child_metadata.vue';
 import RichTimestampTooltip from '../rich_timestamp_tooltip.vue';
 import WorkItemTypeIcon from '../work_item_type_icon.vue';
@@ -154,6 +155,9 @@ export default {
         gon.current_user_use_work_items_view
       );
     },
+    childItemUniqueId() {
+      return `listItem-${this.childItemFullPath}/${getIdFromGraphQLId(this.childItem.id)}`;
+    },
   },
   methods: {
     showScopedLabel(label) {
@@ -217,6 +221,7 @@ export default {
             />
           </span>
           <gl-link
+            :id="childItemUniqueId"
             :href="childItemWebUrl"
             :class="{ '!gl-text-subtle': !isChildItemOpen }"
             class="gl-hyphens-auto gl-break-words gl-font-semibold"
diff --git a/app/assets/javascripts/work_items/components/work_item_drawer.vue b/app/assets/javascripts/work_items/components/work_item_drawer.vue
index e7b9e0527fc..05d77b59655 100644
--- a/app/assets/javascripts/work_items/components/work_item_drawer.vue
+++ b/app/assets/javascripts/work_items/components/work_item_drawer.vue
@@ -7,6 +7,7 @@ import { TYPE_EPIC, TYPE_ISSUE } from '~/issues/constants';
 import { DETAIL_VIEW_QUERY_PARAM_NAME } from '~/work_items/constants';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import { visitUrl, setUrlParams, updateHistory, removeParams } from '~/lib/utils/url_utility';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import { makeDrawerItemFullPath, makeDrawerUrlParam, canRouterNav } from '../utils';
 
 export default {
@@ -151,8 +152,17 @@ export default {
         url: setUrlParams({ [DETAIL_VIEW_QUERY_PARAM_NAME]: params }),
       });
     },
-    handleClose() {
+    handleClose(isClickedOutside) {
       updateHistory({ url: removeParams([DETAIL_VIEW_QUERY_PARAM_NAME]) });
+
+      if (!isClickedOutside) {
+        document
+          .getElementById(
+            `listItem-${this.activeItemFullPath}/${getIdFromGraphQLId(this.activeItem.id)}`,
+          )
+          ?.focus();
+      }
+
       this.$emit('close');
     },
     handleClickOutside(event) {
@@ -172,7 +182,7 @@ export default {
           }
         }
       }
-      this.handleClose();
+      this.handleClose(true);
     },
     focusOnHeaderLink() {
       this.$refs?.workItemUrl?.$el?.focus();
diff --git a/app/assets/javascripts/work_items/components/work_item_parent.vue b/app/assets/javascripts/work_items/components/work_item_parent.vue
index 7eab522a08e..51e3c76d61d 100644
--- a/app/assets/javascripts/work_items/components/work_item_parent.vue
+++ b/app/assets/javascripts/work_items/components/work_item_parent.vue
@@ -7,6 +7,7 @@ import WorkItemSidebarDropdownWidget from '~/work_items/components/shared/work_i
 import updateParentMutation from '~/work_items/graphql/update_parent.mutation.graphql';
 import { isValidURL } from '~/lib/utils/url_utility';
 
+import updateNewWorkItemMutation from '~/work_items/graphql/update_new_work_item.mutation.graphql';
 import { updateParent } from '../graphql/cache_utils';
 import groupWorkItemsQuery from '../graphql/group_work_items.query.graphql';
 import projectWorkItemsQuery from '../graphql/project_work_items.query.graphql';
@@ -15,10 +16,11 @@ import workItemAllowedParentTypesQuery from '../graphql/work_item_allowed_parent
 import {
   I18N_WORK_ITEM_ERROR_UPDATING,
   sprintfWorkItem,
+  WORK_ITEM_TYPE_ENUM_EPIC,
   WORK_ITEM_TYPE_VALUE_ISSUE,
   WORK_ITEM_TYPE_VALUE_MAP,
 } from '../constants';
-import { isReference, findHierarchyWidgetDefinition } from '../utils';
+import { isReference, findHierarchyWidgetDefinition, newWorkItemId } from '../utils';
 
 export default {
   name: 'WorkItemParent',
@@ -120,6 +122,9 @@ export default {
     isSearchingByReference() {
       return isReference(this.searchTerm) || isValidURL(this.searchTerm);
     },
+    allowedParentTypesForNewWorkItem() {
+      return this.workItemId === newWorkItemId(this.workItemType) ? [WORK_ITEM_TYPE_ENUM_EPIC] : [];
+    },
   },
   watch: {
     parent: {
@@ -139,7 +144,7 @@ export default {
         return {
           fullPath: this.isIssue ? this.groupPath : this.fullPath,
           searchTerm: this.searchTerm,
-          types: this.allowedParentTypes,
+          types: [...this.allowedParentTypes, ...this.allowedParentTypesForNewWorkItem],
           in: this.searchTerm ? 'TITLE' : undefined,
           iid: null,
           isNumber: false,
@@ -182,7 +187,7 @@ export default {
         };
       },
       skip() {
-        return !this.searchStarted && !this.workItemId;
+        return this.workItemId === newWorkItemId(this.workItemType);
       },
       update(data) {
         return (
@@ -202,6 +207,32 @@ export default {
       if (this.parent?.id === this.localSelectedItem) return;
 
       this.updateInProgress = true;
+
+      if (this.workItemId === newWorkItemId(this.workItemType)) {
+        this.$apollo
+          .mutate({
+            mutation: updateNewWorkItemMutation,
+            variables: {
+              input: {
+                fullPath: this.fullPath,
+                parent: {
+                  ...this.availableWorkItems?.find(({ id }) => id === this.localSelectedItem),
+                  webUrl: this.parentWebUrl ?? null,
+                },
+                workItemType: this.workItemType,
+              },
+            },
+          })
+          .catch((error) => {
+            Sentry.captureException(error);
+          })
+          .finally(() => {
+            this.searchStarted = false;
+            this.updateInProgress = false;
+          });
+        return;
+      }
+
       try {
         const {
           data: {
diff --git a/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql b/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
index 827b60593b3..0028737aed6 100644
--- a/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/group_work_items.query.graphql
@@ -23,6 +23,11 @@ query groupWorkItems(
         iid
         title
         confidential
+        workItemType {
+          id
+          name
+          iconName
+        }
       }
     }
     workItemsByIid: workItems(
@@ -36,6 +41,11 @@ query groupWorkItems(
         iid
         title
         confidential
+        workItemType {
+          id
+          name
+          iconName
+        }
       }
     }
   }
diff --git a/app/assets/javascripts/work_items/graphql/resolvers.js b/app/assets/javascripts/work_items/graphql/resolvers.js
index b8ba457901c..1944d7eb367 100644
--- a/app/assets/javascripts/work_items/graphql/resolvers.js
+++ b/app/assets/javascripts/work_items/graphql/resolvers.js
@@ -16,6 +16,7 @@ import {
   WIDGET_TYPE_START_AND_DUE_DATE,
   NEW_WORK_ITEM_IID,
   WIDGET_TYPE_MILESTONE,
+  WIDGET_TYPE_HIERARCHY,
 } from '../constants';
 import workItemByIidQuery from './work_item_by_iid.query.graphql';
 
@@ -63,6 +64,7 @@ export const updateNewWorkItemCache = (input, cache) => {
     iteration,
     weight,
     milestone,
+    parent,
   } = input;
 
   const query = workItemByIidQuery;
@@ -119,6 +121,11 @@ export const updateNewWorkItemCache = (input, cache) => {
           newData: milestone,
           nodePath: 'milestone',
         },
+        {
+          widgetType: WIDGET_TYPE_HIERARCHY,
+          newData: parent,
+          nodePath: 'parent',
+        },
       ];
 
       widgetUpdates.forEach(({ widgetType, newData, nodePath }) => {
diff --git a/app/graphql/types/work_item_type.rb b/app/graphql/types/work_item_type.rb
index b58703c3e2b..d2f93ac98dc 100644
--- a/app/graphql/types/work_item_type.rb
+++ b/app/graphql/types/work_item_type.rb
@@ -9,6 +9,8 @@ module Types
 
     authorize :read_work_item
 
+    present_using WorkItemPresenter
+
     field :author, Types::UserType, null: true,
       description: 'User that created the work item.',
       experiment: { milestone: '15.9' }
@@ -63,6 +65,11 @@ module Types
       description: 'Whether the work item belongs to an archived project. Always false for group level work items.',
       experiment: { milestone: '16.5' }
 
+    field :duplicated_to_work_item_url, GraphQL::Types::String, null: true,
+      description: 'URL of the work item that the work item is marked as a duplicate of.'
+    field :moved_to_work_item_url, GraphQL::Types::String, null: true,
+      description: 'URL of the work item that the work item was moved to.'
+
     markdown_field :title_html, null: true
     markdown_field :description_html, null: true
 
@@ -74,10 +81,6 @@ module Types
       object.work_item_type
     end
 
-    def web_url
-      Gitlab::UrlBuilder.build(object)
-    end
-
     def create_note_email
       object.creatable_note_email_address(context[:current_user])
     end
@@ -89,3 +92,5 @@ module Types
     end
   end
 end
+
+Types::WorkItemType.prepend_mod_with('Types::WorkItemType')
diff --git a/app/models/namespace/detail.rb b/app/models/namespace/detail.rb
index dbaee0becac..e43b7d20c97 100644
--- a/app/models/namespace/detail.rb
+++ b/app/models/namespace/detail.rb
@@ -7,8 +7,6 @@ class Namespace::Detail < ApplicationRecord
   validates :namespace, presence: true
   validates :description, length: { maximum: 255 }
 
-  ignore_column :pending_delete, remove_with: '17.8', remove_after: '2024-12-13'
-
   self.primary_key = :namespace_id
 
   # This method should not be called directly. Instead, it is available on the namespace via delegation and should
diff --git a/app/models/pages_deployment.rb b/app/models/pages_deployment.rb
index 50baa6fb97e..3792a296753 100644
--- a/app/models/pages_deployment.rb
+++ b/app/models/pages_deployment.rb
@@ -74,12 +74,10 @@ class PagesDeployment < ApplicationRecord
     update(deleted_at: Time.now.utc)
   end
 
-  def self.count_versioned_deployments_for(projects, limit)
-    project_id_in(projects)
-      .active
-      .versioned
-      .limit(limit)
-      .count
+  def self.count_versioned_deployments_for(projects, limit, group_by_project: false)
+    query = project_id_in(projects).active.versioned
+    query = query.group(:project_id) if group_by_project
+    query.limit(limit).count
   end
 
   def active?
diff --git a/app/presenters/work_item_presenter.rb b/app/presenters/work_item_presenter.rb
index 995f2d02156..ddd966839a1 100644
--- a/app/presenters/work_item_presenter.rb
+++ b/app/presenters/work_item_presenter.rb
@@ -1,4 +1,27 @@
 # frozen_string_literal: true
 
-class WorkItemPresenter < IssuePresenter # rubocop:todo Gitlab/NamespacedClass
+class WorkItemPresenter < IssuePresenter # rubocop:todo Gitlab/NamespacedClass -- WorkItem is not namespaced
+  presents ::WorkItem, as: :work_item
+
+  def duplicated_to_work_item_url
+    return unless work_item.duplicated?
+    return unless allowed_to_read_work_item?(work_item.duplicated_to)
+
+    Gitlab::UrlBuilder.build(work_item.duplicated_to)
+  end
+
+  def moved_to_work_item_url
+    return unless work_item.moved?
+    return unless allowed_to_read_work_item?(work_item.moved_to)
+
+    Gitlab::UrlBuilder.build(work_item.moved_to)
+  end
+
+  private
+
+  def allowed_to_read_work_item?(item)
+    Ability.allowed?(current_user, :read_work_item, item)
+  end
 end
+
+WorkItemPresenter.prepend_mod_with('WorkItemPresenter')
diff --git a/config/click_house.yml.example b/config/click_house.yml.example
index 0c25d9b2e58..c244a6b7d6e 100644
--- a/config/click_house.yml.example
+++ b/config/click_house.yml.example
@@ -8,8 +8,8 @@ test:
   main:
     database: gitlab_clickhouse_test
     url: 'http://localhost:8123'
-    username: clickhouse
-    password: clickhouse
+    username: default
+    password:
     variables:
       # execute mutations (updates, deletes) synchronously to avoid flaky tests
       mutations_sync: 1
diff --git a/config/coverband.rb b/config/coverband.rb
index 8cf99014f56..f3ea97dd4bf 100644
--- a/config/coverband.rb
+++ b/config/coverband.rb
@@ -8,7 +8,7 @@ Coverband.configure do |config|
   config.reporting_wiggle = 0 # Since this is not run in production disable wiggle and report every second.
   config.ignore += %w[spec/.* lib/tasks/.*
     config/application.rb config/boot.rb config/initializers/.* db/post_migrate/.*
-    config/puma.rb bin/.* config/environments/.* db/migrate/.*]
+    config/puma.rb bin/.* config/environments/.* db/migrate/.* ee/app/workers/search/zoekt/.*]
 
   config.verbose = false # this spams logfile a lot, set to true for debugging locally
   config.logger = Gitlab::AppLogger.primary_logger
diff --git a/config/feature_flags/ops/workhorse_use_aws_sdk_v2.yml b/config/feature_flags/ops/workhorse_use_aws_sdk_v2.yml
deleted file mode 100644
index 7fba8480a85..00000000000
--- a/config/feature_flags/ops/workhorse_use_aws_sdk_v2.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: workhorse_use_aws_sdk_v2
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/482044
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/164597
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/483000
-milestone: '17.4'
-group: infrastructure
-type: ops
-default_enabled: true
diff --git a/config/feature_flags/wip/merge_request_dashboard_new_lists.yml b/config/feature_flags/wip/merge_request_dashboard_new_lists.yml
index b3d14be47e0..058528620cb 100644
--- a/config/feature_flags/wip/merge_request_dashboard_new_lists.yml
+++ b/config/feature_flags/wip/merge_request_dashboard_new_lists.yml
@@ -2,7 +2,7 @@
 name: merge_request_dashboard_new_lists
 feature_issue_url:
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173399
-rollout_issue_url:
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/512602
 milestone: '17.7'
 group: group::code review
 type: wip
diff --git a/db/docs/batched_background_migrations/backfill_vulnerability_issue_links_project_id.yml b/db/docs/batched_background_migrations/backfill_vulnerability_issue_links_project_id.yml
index fe391765261..b713c40e5c1 100644
--- a/db/docs/batched_background_migrations/backfill_vulnerability_issue_links_project_id.yml
+++ b/db/docs/batched_background_migrations/backfill_vulnerability_issue_links_project_id.yml
@@ -5,4 +5,4 @@ feature_category: vulnerability_management
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/156249
 milestone: '17.1'
 queued_migration_version: 20240613064362
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: '20241120232704'
diff --git a/db/docs/batched_background_migrations/delete_orphaned_groups.yml b/db/docs/batched_background_migrations/delete_orphaned_groups.yml
index b91d5698f15..125c64eb2e0 100644
--- a/db/docs/batched_background_migrations/delete_orphaned_groups.yml
+++ b/db/docs/batched_background_migrations/delete_orphaned_groups.yml
@@ -3,6 +3,6 @@ migration_job_name: DeleteOrphanedGroups
 description: Deletes orhpaned groups whose parent's does not exist
 feature_category: groups_and_projects
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172420
-milestone: '17.7'
-queued_migration_version: 20241206154945
+milestone: '17.8'
+queued_migration_version: 20250109105904
 finalized_by: # version of the migration that finalized this BBM
diff --git a/db/post_migrate/20241206154945_queue_requeue_delete_orphaned_groups.rb b/db/post_migrate/20241206154945_queue_requeue_delete_orphaned_groups.rb
index 1646b0cf7a9..af5f2bd6819 100644
--- a/db/post_migrate/20241206154945_queue_requeue_delete_orphaned_groups.rb
+++ b/db/post_migrate/20241206154945_queue_requeue_delete_orphaned_groups.rb
@@ -10,22 +10,12 @@ class QueueRequeueDeleteOrphanedGroups < Gitlab::Database::Migration[2.2]
   SUB_BATCH_SIZE = 100
 
   def up
-    return unless Gitlab.com_except_jh? && !Gitlab.staging?
-
-    # Clear previous background migration execution from QueueDeleteOrphanedGroups
-    delete_batched_background_migration(MIGRATION, :namespaces, :id, [])
-
-    queue_batched_background_migration(
-      MIGRATION,
-      :namespaces,
-      :id,
-      job_interval: DELAY_INTERVAL,
-      batch_size: BATCH_SIZE,
-      sub_batch_size: SUB_BATCH_SIZE
-    )
+    # no-op because there was a bug in the original migration, which has been
+    # fixed by https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176705
   end
 
   def down
-    delete_batched_background_migration(MIGRATION, :namespaces, :id, [])
+    # no-op because there was a bug in the original migration, which has been
+    # fixed by https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176705
   end
 end
diff --git a/db/post_migrate/20250103122704_finalize_backfill_vulnerability_issue_links_project_id.rb b/db/post_migrate/20250103122704_finalize_backfill_vulnerability_issue_links_project_id.rb
new file mode 100644
index 00000000000..b9b3601fc63
--- /dev/null
+++ b/db/post_migrate/20250103122704_finalize_backfill_vulnerability_issue_links_project_id.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillVulnerabilityIssueLinksProjectId < Gitlab::Database::Migration[2.2]
+  milestone '17.8'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_sec
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillVulnerabilityIssueLinksProjectId',
+      table_name: :vulnerability_issue_links,
+      column_name: :id,
+      job_arguments: [:project_id, :vulnerabilities, :project_id, :vulnerability_id],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250103133119_add_sharding_key_id_index_to_ci_runners.rb b/db/post_migrate/20250103133119_add_sharding_key_id_index_to_ci_runners.rb
new file mode 100644
index 00000000000..9c07720cce3
--- /dev/null
+++ b/db/post_migrate/20250103133119_add_sharding_key_id_index_to_ci_runners.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddShardingKeyIdIndexToCiRunners < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+
+  milestone '17.8'
+
+  INDEX_NAME = 'index_ci_runners_on_sharding_key_id_when_not_null'
+
+  def up
+    add_concurrent_index :ci_runners, :sharding_key_id, name: INDEX_NAME, where: 'sharding_key_id IS NOT NULL'
+  end
+
+  def down
+    remove_concurrent_index :ci_runners, :sharding_key_id, name: INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250103134008_add_sharding_key_id_index_to_ci_runner_machines.rb b/db/post_migrate/20250103134008_add_sharding_key_id_index_to_ci_runner_machines.rb
new file mode 100644
index 00000000000..3c6126353a8
--- /dev/null
+++ b/db/post_migrate/20250103134008_add_sharding_key_id_index_to_ci_runner_machines.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddShardingKeyIdIndexToCiRunnerMachines < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+
+  milestone '17.8'
+
+  INDEX_NAME = 'index_ci_runner_machines_on_sharding_key_id_when_not_null'
+
+  def up
+    add_concurrent_index :ci_runner_machines, :sharding_key_id, name: INDEX_NAME, where: 'sharding_key_id IS NOT NULL'
+  end
+
+  def down
+    remove_concurrent_index :ci_runner_machines, :sharding_key_id, name: INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250109105904_queue_re_enqueue_delete_orphaned_groups.rb b/db/post_migrate/20250109105904_queue_re_enqueue_delete_orphaned_groups.rb
new file mode 100644
index 00000000000..02c32554ade
--- /dev/null
+++ b/db/post_migrate/20250109105904_queue_re_enqueue_delete_orphaned_groups.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class QueueReEnqueueDeleteOrphanedGroups < Gitlab::Database::Migration[2.2]
+  milestone '17.8'
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "DeleteOrphanedGroups"
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 1000
+  SUB_BATCH_SIZE = 100
+
+  def up
+    return unless Gitlab.com_except_jh? && !Gitlab.staging?
+
+    # Clear previous background migration execution from QueueRequeueDeleteOrphanedGroups
+    delete_batched_background_migration(MIGRATION, :namespaces, :id, [])
+
+    queue_batched_background_migration(
+      MIGRATION,
+      :namespaces,
+      :id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :namespaces, :id, [])
+  end
+end
diff --git a/db/schema_migrations/20250103122704 b/db/schema_migrations/20250103122704
new file mode 100644
index 00000000000..962f54da1e7
--- /dev/null
+++ b/db/schema_migrations/20250103122704
@@ -0,0 +1 @@
+c1b75439237a239e424c1ea2e044d4336bcde8bacab45aa134d509f9634a1c9d
\ No newline at end of file
diff --git a/db/schema_migrations/20250103133119 b/db/schema_migrations/20250103133119
new file mode 100644
index 00000000000..bab1e20e6e9
--- /dev/null
+++ b/db/schema_migrations/20250103133119
@@ -0,0 +1 @@
+a875225031c1e4fa081b538be50c6aa118303bb8a6bfd36b4c96c315a5ac2006
\ No newline at end of file
diff --git a/db/schema_migrations/20250103134008 b/db/schema_migrations/20250103134008
new file mode 100644
index 00000000000..54b8cb2520c
--- /dev/null
+++ b/db/schema_migrations/20250103134008
@@ -0,0 +1 @@
+6b668dd08bbc97f3fddf904595e47bf286b13309d6eeddd55b2ece50f2c8066e
\ No newline at end of file
diff --git a/db/schema_migrations/20250109105904 b/db/schema_migrations/20250109105904
new file mode 100644
index 00000000000..4a51e791c9b
--- /dev/null
+++ b/db/schema_migrations/20250109105904
@@ -0,0 +1 @@
+e5fe54e6057e8f2f8c0de076f9b43f9dd33085ccc1aea3fb209a76d53f528fe4
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index f45ea06adad..56ea26db699 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -30358,6 +30358,8 @@ CREATE UNIQUE INDEX index_ci_runner_machines_on_runner_id_and_system_xid ON ci_r
 
 CREATE INDEX index_ci_runner_machines_on_runner_type ON ci_runner_machines USING btree (runner_type);
 
+CREATE INDEX index_ci_runner_machines_on_sharding_key_id_when_not_null ON ci_runner_machines USING btree (sharding_key_id) WHERE (sharding_key_id IS NOT NULL);
+
 CREATE INDEX index_ci_runner_machines_on_version ON ci_runner_machines USING btree (version);
 
 CREATE INDEX index_ci_runner_namespaces_on_namespace_id ON ci_runner_namespaces USING btree (namespace_id);
@@ -30390,6 +30392,8 @@ CREATE INDEX index_ci_runners_on_locked ON ci_runners USING btree (locked);
 
 CREATE INDEX index_ci_runners_on_runner_type_and_id ON ci_runners USING btree (runner_type, id);
 
+CREATE INDEX index_ci_runners_on_sharding_key_id_when_not_null ON ci_runners USING btree (sharding_key_id) WHERE (sharding_key_id IS NOT NULL);
+
 CREATE INDEX index_ci_runners_on_token_expires_at_and_id_desc ON ci_runners USING btree (token_expires_at, id DESC);
 
 CREATE INDEX index_ci_runners_on_token_expires_at_desc_and_id_desc ON ci_runners USING btree (token_expires_at DESC, id DESC);
diff --git a/doc/administration/settings/scim_setup.md b/doc/administration/settings/scim_setup.md
index 513390554ba..95d146764b0 100644
--- a/doc/administration/settings/scim_setup.md
+++ b/doc/administration/settings/scim_setup.md
@@ -42,13 +42,14 @@ To configure GitLab SCIM:
 You can configure the following as an identity provider:
 
 - [Okta](#configure-okta).
+- [Microsoft Entra ID (formerly Azure Active Directory)](#configure-microsoft-entra-id-formerly-azure-active-directory)
 
 NOTE:
 Other identity providers can work with GitLab but they have not been tested and are not supported. You should contact the provider for support. GitLab support can assist by reviewing related log entries.
 
 ### Configure Okta
 
-The SAML application created during [single sign-on](index.md) set up for Okta must be set up for SCIM.
+The SAML application created during [single sign-on](../../integration/saml.md) set up for Okta must be set up for SCIM.
 
 Prerequisites:
 
@@ -82,6 +83,142 @@ To configure Okta for SCIM:
 1. Select **Save**.
 1. Assign users in the **Assignments** tab. Assigned users are created and managed in your GitLab group.
 
+### Configure Microsoft Entra ID (formerly Azure Active Directory)
+
+> - [Changed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/143146) to Microsoft Entra ID terminology in GitLab 16.10.
+
+Prerequisites:
+
+- [GitLab is configured](#configure-gitlab) for SCIM.
+- The [SAML application for Microsoft Entra ID is set up](../../integration/saml.md#set-up-microsoft-entra-id).
+
+The SAML application created during [single sign-on](../../integration/saml.md) set up for
+[Azure Active Directory](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/view-applications-portal)
+must be set up for SCIM. For an example, see [example configuration](../../user/group/saml_sso/example_saml_config.md#scim-mapping).
+
+NOTE:
+You must configure SCIM provisioning exactly as detailed in the following instructions. If misconfigured, you will encounter issues with user provisioning
+and sign in, which require a lot of effort to resolve. If you have any trouble or questions with any step, contact GitLab support.
+
+To configure Microsoft Entra ID, you configure:
+
+- Microsoft Entra ID for SCIM.
+- Settings.
+- Mappings, including attribute mappings.
+
+#### Configure Microsoft Entra ID for SCIM
+
+1. In your app, go to the **Provisioning** tab and select **Get started**.
+1. Set the **Provisioning Mode** to **Automatic**.
+1. Complete the **Admin Credentials** using the value of:
+   - **SCIM API endpoint URL** in GitLab for the **Tenant URL** field.
+   - **Your SCIM token** in GitLab for the **Secret Token** field.
+1. Select **Test Connection**.
+
+   If the test is successful, save your configuration.
+
+   If the test is unsuccessful, see
+   [troubleshooting](../../user/group/saml_sso/troubleshooting.md) to try to resolve this.
+1. Select **Save**.
+
+After saving, the **Mappings** and **Settings** sections appear.
+
+#### Configure mappings
+
+Under the **Mappings** section, first provision the groups:
+
+1. Select **Provision Microsoft Entra ID Groups**.
+1. On the Attribute Mapping page, turn off the **Enabled** toggle.
+
+   SCIM group provisioning is not supported in GitLab. Leaving group provisioning enabled does not break the SCIM user provisioning, but it causes errors in the
+   Entra ID SCIM provisioning log that might be confusing and misleading.
+
+   NOTE:
+   Even when **Provision Microsoft Entra ID Groups** is disabled, the mappings section may display "Enabled: Yes". This behavior is a display bug that you can safely ignore.
+
+1. Select **Save**.
+
+Next, provision the users:
+
+1. Select **Provision Microsoft Entra ID Users**.
+1. Ensure that the **Enabled** toggle is set to **Yes**.
+1. Ensure that all **Target Object Actions** are enabled.
+1. Under **Attribute Mappings**, configure mappings to match
+   the [configured attribute mappings](#configure-attribute-mappings):
+   1. Optional. In the **customappsso Attribute** column, find `externalId` and delete it.
+   1. Edit the first attribute to have a:
+      - **source attribute** of `objectId`.
+      - **target attribute** of `externalId`.
+      - **matching precedence** of `1`.
+   1. Update the existing **customappsso** attributes to match the
+      [configured attribute mappings](#configure-attribute-mappings).
+   1. Delete any additional attributes that are not present in the [attribute mappings table](#configure-attribute-mappings). They do not cause problems if they are
+      not deleted, but GitLab does not consume the attributes.
+1. Under the mapping list, select the **Show advanced options** checkbox.
+1. Select the **Edit attribute list for customappsso** link.
+1. Ensure the `id` is the primary and required field, and `externalId` is also required.
+1. Select **Save**, which returns you to the Attribute Mapping configuration page.
+1. Close the **Attribute Mapping** configuration page by clicking the `X` in the top right corner.
+
+##### Configure attribute mappings
+
+NOTE:
+While Microsoft transitions from Azure Active Directory to Entra ID naming schemes, you might notice inconsistencies in
+your user interface. If you're having trouble, you can view an older version of this document or contact GitLab Support.
+
+While [configuring Entra ID for SCIM](#configure-microsoft-entra-id-formerly-azure-active-directory), you configure
+attribute mappings. For an example, see [example configuration](../../user/group/saml_sso/example_saml_config.md#scim-mapping).
+
+The following table provides attribute mappings that are required for GitLab.
+
+| Source attribute                                                           | Target attribute               | Matching precedence |
+|:---------------------------------------------------------------------------|:-------------------------------|:--------------------|
+| `objectId`                                                                 | `externalId`                   | 1                   |
+| `userPrincipalName` OR `mail` <sup>1</sup>                                 | `emails[type eq "work"].value` |                     |
+| `mailNickname`                                                    | `userName`                     |                     |
+| `displayName` OR `Join(" ", [givenName], [surname])` <sup>2</sup>          | `name.formatted`               |                     |
+| `Switch([IsSoftDeleted], , "False", "True", "True", "False")` <sup>3</sup> | `active`                       |                     |
+
+**Footnotes:**
+
+1. Use `mail` as a source attribute when the `userPrincipalName` is not an email address or is not deliverable.
+1. Use the `Join` expression if your `displayName` does not match the format of `Firstname Lastname`.
+1. This is an expression mapping type, not a direct mapping. Select **Expression** in the **Mapping type** dropdown list.
+
+Each attribute mapping has:
+
+- A **customappsso Attribute**, which corresponds to **target attribute**.
+- A **Microsoft Entra ID Attribute**, which corresponds to **source attribute**.
+- A matching precedence.
+
+For each attribute:
+
+1. Edit the existing attribute or add a new attribute.
+1. Select the required source and target attribute mappings from the dropdown lists.
+1. Select **Ok**.
+1. Select **Save**.
+
+If your SAML configuration differs from [the recommended SAML settings](../../integration/saml.md), select the mapping
+attributes and modify them accordingly. The source attribute that you map to the `externalId`
+target attribute must match the attribute used for the SAML `NameID`.
+
+If a mapping is not listed in the table, use the Microsoft Entra ID defaults. For a list of required attributes,
+refer to the [internal instance SCIM API](../../development/internal_api/index.md#instance-scim-api) documentation.
+
+#### Configure settings
+
+Under the **Settings** section:
+
+1. Optional. If desired, select the **Send an email notification when a failure occurs** checkbox.
+1. Optional. If desired, select the **Prevent accidental deletion** checkbox.
+1. If necessary, select **Save** to ensure all changes have been saved.
+
+After you have configured the mappings and the settings, return to the app overview page and select **Start provisioning** to start automatic SCIM provisioning of users in GitLab.
+
+WARNING:
+Once synchronized, changing the field mapped to `id` and `externalId` might cause errors. These include
+provisioning errors, duplicate users, and might prevent existing users from accessing the GitLab group.
+
 ## Remove access
 
 Removing or deactivating a user on the identity provider blocks the user on
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 161c7c1d07a..fc0d51e957a 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -37740,12 +37740,15 @@ four standard [pagination arguments](#pagination-arguments):
 | <a id="workitemcreatedat"></a>`createdAt` | [`Time!`](#time) | Timestamp of when the work item was created. |
 | <a id="workitemdescription"></a>`description` | [`String`](#string) | Description of the work item. |
 | <a id="workitemdescriptionhtml"></a>`descriptionHtml` | [`String`](#string) | GitLab Flavored Markdown rendering of `description`. |
+| <a id="workitemduplicatedtoworkitemurl"></a>`duplicatedToWorkItemUrl` | [`String`](#string) | URL of the work item that the work item is marked as a duplicate of. |
 | <a id="workitemid"></a>`id` | [`WorkItemID!`](#workitemid) | Global ID of the work item. |
 | <a id="workitemiid"></a>`iid` | [`String!`](#string) | Internal ID of the work item. |
 | <a id="workitemlockversion"></a>`lockVersion` | [`Int!`](#int) | Lock version of the work item. Incremented each time the work item is updated. |
+| <a id="workitemmovedtoworkitemurl"></a>`movedToWorkItemUrl` | [`String`](#string) | URL of the work item that the work item was moved to. |
 | <a id="workitemname"></a>`name` | [`String`](#string) | Name or title of this object. |
 | <a id="workitemnamespace"></a>`namespace` **{warning-solid}** | [`Namespace`](#namespace) | **Introduced** in GitLab 15.10. **Status**: Experiment. Namespace the work item belongs to. |
 | <a id="workitemproject"></a>`project` **{warning-solid}** | [`Project`](#project) | **Introduced** in GitLab 15.3. **Status**: Experiment. Project the work item belongs to. |
+| <a id="workitempromotedtoepicurl"></a>`promotedToEpicUrl` | [`String`](#string) | URL of the epic that the work item has been promoted to. |
 | <a id="workitemstate"></a>`state` | [`WorkItemState!`](#workitemstate) | State of the work item. |
 | <a id="workitemtitle"></a>`title` | [`String!`](#string) | Title of the work item. |
 | <a id="workitemtitlehtml"></a>`titleHtml` | [`String`](#string) | GitLab Flavored Markdown rendering of `title`. |
diff --git a/doc/development/database/clickhouse/clickhouse_within_gitlab.md b/doc/development/database/clickhouse/clickhouse_within_gitlab.md
index 8fd799d4642..1e3184e1922 100644
--- a/doc/development/database/clickhouse/clickhouse_within_gitlab.md
+++ b/doc/development/database/clickhouse/clickhouse_within_gitlab.md
@@ -49,6 +49,7 @@ Most of the tooling and APIs are considered unstable.
 
    ```sql
    create database gitlab_clickhouse_development;
+   create database gitlab_clickhouse_test;
    ```
 
 ### Validate your setup
diff --git a/doc/development/python_guide/getting_started.md b/doc/development/python_guide/getting_started.md
new file mode 100644
index 00000000000..fe1cb5b0416
--- /dev/null
+++ b/doc/development/python_guide/getting_started.md
@@ -0,0 +1,119 @@
+---
+stage: none
+group: unassigned
+info: Any user with at least the Maintainer role can merge updates to this content. For details, see https://docs.gitlab.com/ee/development/development_processes.html#development-guidelines-review.
+---
+
+# Getting Started with Python in GitLab
+
+## Onboarding Guide
+
+This guide helps non-Python developers get started with Python quickly and efficiently.
+
+1. **Set up Python**:
+   - Install Python from the official [Python website](https://www.python.org/downloads/).
+
+1. **Install Poetry** for package management:
+   - Poetry is a modern, Python-specific dependency manager that simplifies packaging and dependency handling. To install it, run:
+
+     ```shell
+      curl --silent --show-error --location "https://install.python-poetry.org" | python3 -
+     ```
+
+   - Once installed, create a new Python project with Poetry:
+
+     ```shell
+     poetry new my_project
+     cd my_project
+     poetry install
+     ```
+
+1. **Run and Debug Existing Code**
+   - Familiarize yourself with the project's structure by following the `README.md`.
+   - Use tools like `pdb` or IDE debugging features to debug code. Example:
+
+     ```shell
+     poetry shell
+     python -m pdb <file_name>.py
+     ```
+
+---
+
+## Learning resources
+
+If you are new to Python or looking to refresh your knowledge, this section provides variours materials for
+learning the language.
+
+1. **[Python Cheatsheet](https://www.pythoncheatsheet.org)**
+A comprehensive reference covering essential Python syntax, built-in functions, and useful libraries.
+This is ideal for both beginners and experienced users who want a quick, organized summary of Python's key features.
+
+1. **[A Whirlwind Tour of Python (Jupyter Notebook)](https://github.com/jakevdp/WhirlwindTourOfPython)**
+A fast-paced introduction to Python fundamentals, tailored especially for data science practitioners but works well for everyone who wants to get just the basic understanding of the language.
+This is a Jupiter Notebook which makes this guide an interactive resource as well as a good introduction to Jupiter Notebook itself.
+
+1. **[100-page Python Intro](https://learnbyexample.github.io/100_page_python_intro)**
+Brief guide provides a straightforward introduction to Python, covering all the essentials needed to start programming effectively. It’s a beginner-friendly option that covers everything from syntax to debugging and testing.
+1. **[Learn X in Y Minutes: Python](https://learnxinyminutes.com/docs/python)**
+A very brief, high-level introduction cuts directly to the core syntax and features of Python, making it a valuable quick start for developers transitioning to Python.
+
+1. **[Exercism Python Track](https://exercism.io/tracks/python)**
+   Use Exercism's Python track as a foundation for learning Python concepts and best practices. Exercism provides hands-on practice with mentoring support, making it an excellent resource for mastering Python through coding exercises and feedback.
+
+When building Python APIs, we use FastAPI and Pydantic. To get started with building and reviewing these technologies, refer to the following resources:
+
+1. **[FastAPI Documentation](https://fastapi.tiangolo.com/)**
+   FastAPI is a modern web framework for building APIs with Python. This resource will help you learn how to create fast and efficient web applications and APIs. FastAPI is especially useful for building Python applications with high performance and scalability.
+
+1. **[Pydantic Documentation](https://pydantic-docs.helpmanual.io/)**
+   Pydantic is a Python library for data validation and settings management using Python type annotations. Learn how to integrate Pydantic into your Python projects for easier data validation and management, particularly when working with FastAPI.
+
+We use pytest for testing Python code. To learn more about writing and running tests with pytest, refer to the following resources:
+
+1. **[pytest Documentation](https://docs.pytest.org/en/stable/)**
+   pytest is a popular testing framework for Python that makes it easy to write simple and scalable tests. This resource provides comprehensive documentation on how to write and run tests using pytest, including fixtures, plugins, and test discovery.
+
+1. **[Python Testing with pytest (Book)](https://pragprog.com/titles/bopytest2/python-testing-with-pytest-second-edition/)**
+   This book is a comprehensive guide to testing Python code with pytest. It covers everything from the basics of writing tests to advanced topics like fixtures, plugins, and test organization.
+
+---
+
+### Learning Group
+
+A collaborative space for developers to study Python, FastAPI, and Pydantic, focusing on building real-world apps.
+
+Refer to [Track and Propose Sessions for Python Learning Group](https://gitlab.com/gitlab-org/gitlab/-/issues/512600) issue for ongoing updates and discussions.
+
+**Core Topics for Group Learning**:
+
+1. **Basic Python Syntax**:
+   - Learn Python concepts such as variables, functions, loops, and conditionals.
+   - Practice at [Exercism Python Track](https://exercism.io/tracks/python).
+
+1. **FastAPI and Pydantic**:
+   - Learn how to build APIs using FastAPI and validate data with Pydantic.
+   - Key resources:
+     - [FastAPI Documentation](https://fastapi.tiangolo.com/)
+     - [Pydantic Documentation](https://pydantic-docs.helpmanual.io/)
+
+---
+
+### Python Review Office Hours
+
+- **Bi-weekly sessions** for code review and discussion, led by experienced Python developers.
+- These sessions are designed to help you improve your Python skills through practical feedback.
+- Please feel free to add the office hours to your calendar.
+
+---
+
+### Encourage Recorded Group Meetings
+
+All review and study group meetings will be recorded and shared, covering key concepts in Python, FastAPI, and Pydantic. These recordings are great for revisiting topics or catching up if you miss a session.
+
+Add any uploaded videos to the [Python Resources](https://www.youtube.com/playlist?list=PL05JrBw4t0Kq4i9FD276WtOL1dSSm9a1G) playlist.
+
+---
+
+### Mentorship Process
+
+1:1 mentorship for Python is possible and encouraged. For more information on how to get started with a mentor, please refer to the [GitLab Mentoring Handbook](https://handbook.gitlab.com/handbook/engineering/careers/mentoring/#mentoring).
diff --git a/doc/install/install_ai_gateway.md b/doc/install/install_ai_gateway.md
index 8710e9cedf0..6fd782d4912 100644
--- a/doc/install/install_ai_gateway.md
+++ b/doc/install/install_ai_gateway.md
@@ -21,28 +21,31 @@ in a single container.
 
 The Docker image for the AI gateway is around 340 MB (compressed) for the `linux/amd64` architecture and requires a minimum of 512 MB of RAM to operate. A GPU is not needed for the GitLab AI gateway. To ensure better performance, especially under heavy usage, consider allocating more disk space, memory, and resources than the minimum requirements. Higher RAM and disk capacity can enhance the AI gateway's efficiency during peak loads.
 
-### Find the AI gateway release
+### Find the AI Gateway Release
 
 Find the GitLab official Docker image at:
 
-- [AI gateway Docker image on Container Registry](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/container_registry/).
-- [AI gateway Docker image on DockerHub](https://hub.docker.com/repository/docker/gitlab/model-gateway/tags).
-- [Release process for self-hosted AI gateway](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/blob/main/docs/release.md).
+- [AI Gateway Docker image on Container Registry](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/container_registry/).
+- [AI Gateway Docker image on DockerHub](https://hub.docker.com/repository/docker/gitlab/model-gateway/tags).
+- [Release process for self-hosted AI Gateway](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/blob/main/docs/release.md).
 
-Use the image tag that corresponds to your GitLab version. For example, if the
-GitLab version is `v17.6.0`, use `self-hosted-v17.6.0-ee` tag.
+Use the image tag that corresponds to your GitLab version. For example, if your GitLab version is `v17.6.0`, use the `self-hosted-17.6.0-ee` tag. It is critical to ensure that the image version matches your GitLab version to avoid compatibility issues.
 
-### Start a container from the image
+NOTE:
+Using the `:latest` tag is **not recommended** as it can cause incompatibility if your GitLab version lags behind or jumps ahead of the AI Gateway release. Always use an explicit version tag.
 
-1. For Docker images with version `self-hosted-17.6.0-ee` and later, run the following:
+### Start a Container from the Image
+
+1. For Docker images with version `self-hosted-17.6.0-ee` and later, run the following command, replacing `<your_gitlab_instance>` and `<your_gitlab_domain>` with your GitLab instance's URL and domain:
 
    ```shell
    docker run -p 5052:5052 \
     -e AIGW_GITLAB_URL=<your_gitlab_instance> \
     -e AIGW_GITLAB_API_URL=https://<your_gitlab_domain>/api/v4/ \
-    <image>
-   ```
+    registry.gitlab.com/gitlab-org/ai-gateway/self-hosted-17.6.0-ee:latest
+    ```
 
+   Replace `self-hosted-17.6.0-ee` with the version that matches your GitLab instance. For example, if your GitLab version is `v17.8.0`, use `self-hosted-17.8.0-ee`.
    From the container host, accessing `http://localhost:5052/docs` should open the AI gateway API documentation.
 
 1. Ensure that port `5052` is forwarded to the container from the host and is included in the `AI_GATEWAY_URL` environment variable.
diff --git a/doc/subscriptions/subscription-add-ons.md b/doc/subscriptions/subscription-add-ons.md
index 6abeba5c419..0bd0bac32dd 100644
--- a/doc/subscriptions/subscription-add-ons.md
+++ b/doc/subscriptions/subscription-add-ons.md
@@ -108,8 +108,6 @@ Prerequisites:
 
 The user is sent a confirmation email.
 
-To turn off these emails, an administrator can [disable the `duo_seat_assignment_email_for_sm` feature flag](../administration/feature_flags.md#how-to-enable-and-disable-features-behind-flags).
-
 #### Configure network and proxy settings
 
 For self-managed instances, to enable GitLab Duo features,
diff --git a/doc/user/application_security/policies/pipeline_execution_policies.md b/doc/user/application_security/policies/pipeline_execution_policies.md
index 47217aabf40..afc3e4f9c84 100644
--- a/doc/user/application_security/policies/pipeline_execution_policies.md
+++ b/doc/user/application_security/policies/pipeline_execution_policies.md
@@ -169,8 +169,10 @@ Prerequisites:
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173480) in GitLab 17.7.
 
-Use the `skip_ci` keyword to specify whether users are allowed to apply the `skip-ci` directive to skip the pipelines.
-When the keyword is not specified, the `skip-ci` directive is ignored, preventing all users
+Pipeline execution policies offer control over who can use the `[skip ci]` directive. You can specify certain users or service accounts that are allowed to use `[skip ci]` while still ensuring critical security and compliance checks are performed.
+
+Use the `skip_ci` keyword to specify whether users are allowed to apply the `skip_ci` directive to skip the pipelines.
+When the keyword is not specified, the `skip_ci` directive is ignored, preventing all users
 from bypassing the pipeline execution policies.
 
 | Field                   | Type     | Possible values          | Description |
@@ -351,7 +353,9 @@ You can [define project or group variables in the UI](../../../ci/variables/inde
 
 ## Behavior with `[skip ci]`
 
-To prevent a regular pipeline from triggering, users can push a commit to a protected branch with `[skip ci]` in the commit message. However, jobs defined with a pipeline execution policy are always triggered, as the policy ignores the `[skip ci]` directive. This prevents developers from skipping the execution of jobs defined in the policy, which ensures that critical security and compliance checks are always performed.
+By default, to prevent a regular pipeline from triggering, users can push a commit to a protected branch with `[skip ci]` in the commit message. However, jobs defined with a pipeline execution policy are always triggered, as the policy ignores the `[skip ci]` directive. This prevents developers from skipping the execution of jobs defined in the policy, which ensures that critical security and compliance checks are always performed.
+
+For more flexible control over `[skip ci]` behavior, see the [`skip_ci` type](#skip_ci-type) section.
 
 ## Interaction with scan execution policies
 
diff --git a/doc/user/group/devops_adoption/img/devops_adoption_v17_8.png b/doc/user/group/devops_adoption/img/devops_adoption_v17_8.png
new file mode 100644
index 0000000000000000000000000000000000000000..3656b6e9052fc466d905deda4ec3eb940e6c897e
GIT binary patch
literal 65507
zcmbSxbyytDx8|S$0t5-}8r<C>1PBc7?lQPTaCZsr4uiWx(BK{hw*bL{yAyWu{jTgj
zyZ7!sTYt>-OjlP|o%5b^-g>(ul@z4WPzX@~007!&8A%lY02vGbAnYN*LH`l=CVLA2
zz`iH})jqwxzMii^=6|2B?aq?Ajhh%-)hprwzSb%Dqv7L`_Vj$GbeCFN+o1cvBETow
zRbEus()(loRI75}>)_(c^Ydm)!9rfhu)kh;Ly>=>_NSum%lpS~RzfHV^%SX1^$Wl9
zC)aG7##l02r{f(@=0*-i+Se*mR?8E<yD9X$$PH~Bwyo?|LALTH*4)~rc6)0lqd?D(
z58G!qJUQ*YT{FQwv(_L-nc{9UQ)^Vc>YqP1U7S6fGh{3ic$I^2Tr=h7evXVRw6=^D
zRQ4y9_r~Y82PM`z_0H5pm0RB3-C5L+SX$V5eervEcxZ3y^l<mCD6eieWNXo(Z%`#}
z)}(IJXKqv@dpJAn`+0D8ymz&=e6g``^kZOeplPeUWIj7!G}x%qg70);;`c<?Y>MZP
zB=;_B(S?P@i0~MDJEwqvkkF8bwA9R-n;RFGFP)uTzkeS#HZ&(Erx`{uf)WL_!>NLb
z_0>a3bR$1JKHZ;Q9UfooZT?=~*q{5cJ}>}jY?~;~YVnJ$vNen6TG$#NU;frKlAGTV
zn$qA=Qc^ZNJi5HRIyX08SKHw08#p@)xw^W(IKMDTcXf1dt*WXG4hrx3*0Z~_o7z$6
z<mi!^kux<l6C3ljxv90kf8g}=Y<z5DfB#@_cdx9pqW9-PbadRw$;sfrP{P+_f4^WU
zN!gj1*@A-N^Yio7)wQFe<LvCbrKRQK;?mxYgVxq|oyviUiK+OwL@`lGi~3P&D*Bn3
zAGx^&KslwYt!+aClV96AmzP(+e(j8ojHRb%sj6sRTwE3vfpv8Z^7D%l6H+W1Mmah7
z&CRT8Yw9#LblKT>#zx0$YU(pGa&mJD6ctp**Js@GX7h3jsVy61{d;0-76%s&J7T>8
z{DXL$+pJ64H}<b4S5G5rx;69LzGcN~Mvb(2>Xh|wEo@zc<=Hon?Ft7?P`ZzsejUlJ
zN^B3Za?YGgY3T8;=#<WG?kdho0tdD_0CU>c=u;X!)3m?M?AHzNSf`AQj*ex9_!IyD
z&jp_)#nn7lj@Q@ivBdF*F7`u$Tb=GAh_*t4Z&4yXeT$CjQ2rKe{V7HrvZ7-1OWIn;
zTEewaV#fMK7K014y^C}_#WC*JBw5xh(nBS~L%{cBY2l72`CqgS>#jfB&kt9FH;=vH
z+HWCToi|NOTmyVeHTr7<kt1`yxN*rnN@PpJbH)C??C%zsFfcJOX%a9j1-+SrK{C@#
zl4-s%*ynma<9xGnPQrstW&*R8ez4F^%CM1Uddq_YzC7m1`u%g0k+m*_9Mu#xU;Y{4
zE8mG?I$b5R@)!XyZFgj5kA9>nuC0Tdl9E!EynccPIMdDiLx3o~!tDo_f(XQ7@y+2E
zPvAwdICLHF6|roMO-Kc?hSvtUN+cV7FEiXf>-k-`444N+L`2X9QZIiGnIn$0+-DOe
z!g4%4vs_7SI}QHll&1ir@SRQzRR;}FN-ivOw=0iq-;RL6)T@PhbMogjmsv^eC^rA!
zt_hws->*QG^dgXcYNjaGC)}ESoep(&?l)LQxk12><>}V`lL63<2W=T(rlrF7Y%q=6
zS$#7NbVG<>GsD>Ym8%o_5iaO@3Y|FR%bPxQ9BX65JH6?spyOqu(NwqJz*sc5AcPv~
zg@}?9?RV9Hz3a5_a-WuSoTmYmmGBp44t?<|ALek=x<NNP@e~tUzp@?R>hi=dq=z-n
z44ywo1gBP1l$4JSl9q(I{0Z7u9gbEqimh6gx^|%X8$d^f`XZAO-n7qiC4$F{hn-vg
zoMI}GowuXYya}Bz4{M9OC5A_NwLG;BMtrFKu}IrWw3>gJg%dw^5=hXyTKtS4oN>C~
zv%fyc!T$d7ODeyo3F27MJn2RDnLlVJaHYb=V-3^VhF*1`K3YAuO-fSoS~Oymi%E{o
zX0|n}P`eVIRrC;CpscP2yHas~I%G$pYLg((-Kz1h7h$5;oc|>aNB?QdNrPBbOk0l;
z$x8({&zFJ$lBywTdaAAD?B{<v{b?=0O<SVoU7DBXFj1dZf$#+!)cdY`gXV-WKdS0g
zu*`hK4CRI5*{^l<;zH3b^u)Cm@|qx=)h5yQorpgRW30(FbOyISogliu?MRC|U<u`{
zrl2}rR+8*;mgG(2R{+OyOPG7_C}Lw`{?NwD0$nlWW7&H%AWS{5ek8z^h4Ext%fQvZ
znr38%bQn^P_`I3k&<a2QgE7rXes&<LQ$7~aF9X*8gzRJ?MOiVQlCO4(pTRSQ6dDI#
z{TFRhZRtSBAwzIC$wx|5>+K-xXw>8;c3>m(yf-MM>s?hf4^3Fc_g<<<m2j-2%r^)0
z6(RjI%#lSL%rwfml@U>@LQ>$DA4pTQe^F)|J;@~}WdF|Wmnp?rNK3u%%*Lh<RZYsk
zFUvG_FpUNT?;>OB+?3Gx@tqAk?I}-w@w<4!^F~PycQwhua?%`-KaT{#U-PvLS`ZSy
z&`hjuvoF}6Zanyr=O&BTaJ?}%5PT<ZD22*c@j;q%lBsIaA^J>XGkfiXA>VG5m136r
z;`j~iDQ=N{;^CUVj;lmQOQo>mu5KSj2}xX;#TUCNq={GVV^Zbg+><*UaIA0;-=n30
zsTlN*Lk}6a{yXU+tn*D$djYrrrgG<zz7(gXj5dw!n!Bg%%y$-<^|?}t&5XH)-555S
zZ0C#*H6c||9h+)v;#MFHfzE?+J(9_$<ex@w4@UiQcZX#pxyjH-wceYvKdx~xLxzY8
ze2uX)beWYa$SDhd9<NU-U@JpYrzK?2=D4aY!Cr5U(W-b`Ki?$yn&nv{MyrT&2_ujT
zMHUE>VvM?^Kvt0l>V09B+ROg!Z7~HLY*TuCc3&uPSe+MjvDm}Nv0Bb(VNP&!GhomP
zU@yJ;jF-cbApDZ2+P(_^J{x$Hf(b%2QJZ5<IEtLUM-ve=IsP@$fq#byidHV8oOR^1
zlaJ{lq#Q3CucIu7s~N6EooM<cUq;pN(?1aES%s!!;HnzGlR{jGZbVLsjQTEwKyt`6
zV|m89cRxcCJqPFwU&(wpO-6fmQnhbq!p1mM@mYkuhI(oT$HSF-1*rOyQBT68Foc^#
zdGPKK@arKTD7X+Jk57};B?>ja<cCaAh%2Wr;;ARk0FzvC^)&J%U)pIn_lrp5xpsYM
z={w&|?RH|-51swyk``mqHU0ZalqC48k$7H*JK4%;uHa@hWrCDk*_o)~9^HA;b2lY0
ziA}$Ag~;^Z^!IoAZyy6^Qb&B$k>^%)`?QyA%Nh<HB+fBKAYNxPHT&Z2`!ur%j)qlJ
z+gONJV2wATk?f}%;~m9~%H}H(`0~?(u8MAw>N6hNBww>Y!x<Q<M(e2~6n{Z4IX=bZ
z7Qbsc%2T0R5ny;KTbzT$p69}#GovnVGAUDR3HfoD)7jwjW_cq*Ss`@wlVxcIOLA64
z!UFYdP(#(!z54Z{g2mFZc!qm6GRXigbpskSAq)KA;IxyA*>CZDMnC2#6~@Q8itp`O
zv%w}kMMKm#47jE?sZn!jCgn*epcx8J=Ua^znH4rqQ3J07tNSV%1k^B_VRmyKyW9Vc
zDnOF~f*Scd1t-LP5Wq&U+>(>h{RxnCYVu2y-CD-`!w_By$nsmeoAjr6_nDCCiXBhb
z8~zXZp)Ww2B{&}vyt0UuP!7|#&QPmb_S164MnqU0m|3jk>ev&d*y>wWpDPL1w`447
zU8!%3?WB%1b<TA2=Q;8u7oQ6W?NJYxZKN8Z>-;d&*@MBNuZZXXlvFS<@<I?5jKI*^
zg4SFG)SbcGbl9=XH29_$fhTsCINi|&KWSHos|L37axgF3mbpqSUK7(H=kKrRK(u|I
zsdN49bTzFUEaF7N!m?X2R<;Ht;tR}xW_Yf-29A>|e200kEMqk2>J(JJ%=Zy&q=&1{
zP@`({Z6;&kqFN%Xjv=;D*r`cY#*4b0(E8^M9Gx5kWUL%+E*b$xSu{UJZf7n3KS$)?
zu+xrl0L;vkZ?)pK4!S<iaQ$k*uf}Y%7WVMbq?A{@ab0t|x(T{&PT*p0pDK$dK8)us
z;jkO>=tYQ(sfa+y_emSM{+|YX&d@*~&{`~aMOe1w?qUVsE~8TaIxEE%WOSQXs;ohG
z>M}fwa6&_#SGt@8P<4+87IB~z><7R#<LhCX&bufZ`YM6ZvU`Eh+Dd4>0n|kwM9PEf
zm0^AHtW9W-q$<UZFUXMzAI7QI$WN9U%yj0g)(lo>ye%rZ<|5=rE;3895^&*ezU#+~
zy3j^YhpEph<UCOkNVJb|Qng%xF=<tQ-nCrmMV^3CgTjKn(WZHCEWxvuq2_BiLBc;*
znlO(HB=u9Ly*i8$ZhYGona=@kiaB*F31-Y93r{3gX#-lpzj8$UJ>+8$V`LXco4&9=
z8Xp{ssVny+DL0=f5j**J9CZW7^ZsoC_F(4N=`+8iZe__K8Umt9W1s0_C+#MIWT)Sq
ztvD|)=>z?=wqWfv`5jxnWjt!$q!mp_6M?#EP3mL6{AbsdsTRHr4TdPEG0COCgOLiE
zOCKXU&IgEa%1G1)$mIt%2sBK?vUYyY84bLs_@e{nec4INZX~LaPYURaE9X%@Wdx0J
zQKkE8+I1gBxoEG#J)yTc6(`)tw9vD&kZ%>?|AaY?bUQaLXz3u6JuV*=JDNRVNVR}t
z@2})3tm;zLtlT~8n$t&%HUawQW($>Y+RecKWlcXElZXe?>NYA!+r4LIKlGcBkT5&O
z*vhrY&1CH1sljYEYlYqn?KC<Zq6jR4@uw4%7N)%gnMnm870ee;C^*VG42G+P`sx`x
zR<QrXT-)cClgb0#_qCrqqyv}U>v1BCa%jB70(D!`vcH^sZ>H_A*JJLYdRhwre&lat
zy5eNk3#$K`1A4$t{~P}w6*z>M#fh-vk$K}xjM0#(v_D;=%9!g&W3f=pq7D>sCN-1&
zwk(E1Y;cWZ)4Dw)Y<T;J*O`=>a-snRPiD%$kMmuD!*xI5TtbDkUm3#&Rn{ObWN~Y>
z$(b$=O=~i)*cI>V436m=dUJMI@6jIIH5oHPgFEWq;s}uuUNkj`kJjQ+;9bRkg}&eg
zy@B4R6(2?7b!o>Oyh^nAJw3V_1K++ZO;4-{XEfjGQkty|phYA}ZxPLq-PJiyiLN~@
zCz?%U;#-eEHOcDmN1Nt?F6MhqW{-c_=peK(wCgm(n{`j_oI##cw(1-uBmU33P0g2;
z#P07`G`)GCvTh_hj)k*cWm4t}%FK;1eg|HJc(1}g8$(-oLWsCR@%L>PRPQUBwSrj-
zQ@7WSe3&T;y6QD!96(lbW-lJJYV&&<8bZlXRFyf{_&M2|xZ2;Tq51Dk-S1?1V`F#5
z5^=KmWFV>yk=4$T<@RWQT8SM@`CVU6_7q)tPjo8O(QN3yM3?rpWFfbML)giwwE*!D
z7`<WcUi9a9j^Pq5_ishKo{r=^5mnxbWQJA)Li7o)!o1@Jaby4mRE>E0{&H%E#Ha;i
z8${uxM+78tp#jK0LjeEn!CpuAMU=n3H&o8}e`t<N!Ei8t`;oscN-3%Te>WWWlO;qG
z{4kh&oBpiM5ujAS^~Qnp{X)>GhLLz61_0pia}*MtbAtxRFTkm3MFh-DB~1voE#;1K
z0s<^F45U|XZfz9d0_?j7QZ#xMo=aiGSQ%ZEdbywnoWtoF-=_!wVjo8H;XgxvkM*GZ
zpTGLz*B?hg3@G2({;&kx#dKhPKy^ikZ4EJhABpWjVQr;aks$dVo2Gog3mZ}4JuPqf
zXvW5iXZ0&NkbD<jVd`qNFU{lJ2cU$%o%c2s7Ld<2Ad1I?01z{d@MqCN0R;48yz14x
z2LM7T{<Is>0{|!=pI!Q(64Lvy`~9F20DunlV)_%UobR9WofH5-jQ>KqqlEO#u9=+)
z+}QzBWHs$2d+2DQC;)kh?Vc4_^PU?RJfGA8Rii2P3|TlkD*^y|RDaGYDjv(m4b<ib
z-A^>;KbRl3Rd{v$Qt1MTK5M!dGOjvV%732!^T9qoWk&qkp-~4pw)I(>4+{X$jDJ1C
z=m)b9g`FGh+l4q50_7#}58~vmz&B*~J)XttXhG`?)hq5XKja!MW%r^5PrQCj$<es*
z=#tK|uzE2705ycKUk<V_!Ry^z4l6S~1B1M*zKa!m!&#;!>Z?bGF}V(_aV|6}tGTx{
zIl@i9WFk>@R-YV7HpET6r2*$jT`sGisgdE%{eMjkJ=Q*c`gS3a7XaXJD9EoG(M3HB
zP^NZP`auU4-o*c&&Nsp*ST!;5(Vc_Zd$-8;wzj9D6Qpc`XR-ddij|<lw&Q3<__OcB
zQ9$4MJHc1Y2#*M9Daap>KiKk>b;U0xFlwejR)4NdduqV!-+4-3iJ~NcHc6EJnW3){
z)LnrHtSw(sVS@XN*zo^o@Bb77QqabNU(TLCWG-My%8SB_SA7(cqYlt6rtX<5SuBvM
z(^7c{ikYg>NwMX8n@87<JRw43X=Eml<@;u0MDiHS{!)Q5kaukk6G2GRMgi*fQIZdS
zTX7}AMo?jTEf)phT(%{6UvBFT`$)+!K$g#E$K^`<yZpz{%P1D#fMF;hFQoD1$SzxF
zvwH;q+GiBlYgi_HpV(Kh)RA?yBwK~aukg=Y4bXr7eh$YxleVqW-88CJ_#}OGMUvT4
z$4k0aE>sAL41O}A=0}d|+9ocJ5B})nxWt588D8o@$S7uJ-&mCJjVG+yq#m*H&f^CT
z!#yRLoqUc?{O)777BHYtgQ>>(#cx^L;Lq&3onQJYL2M2a-*V|%CrcC9e9t|oAXvZl
z_NPQ2Z#2x2{)O6l16j>`B6gM{6+NPyKZG7x7ntd_gC54~vun36R_-i-%<s!)T+ZMA
zG=g*#Fc{-lNBUZk0_4LPziP>hV$oQH_V3*_DwO9?`mTv<w2i$l*b$Z+ZpJF(?9+n?
z?i@9UeJhZhA+RGM(}R$Ic2lms)L~QpZOKj%C(ceSnU{%cY<_9Xd?dvjMCmJhKp2ed
zM;_zVf+p}j#4`tPVx5JpHl)x>BbX2s@%#9eV9qP*HiH?aKiuR335QD@7(rs>IGNOX
zg_+@+QdYK#+zA<7GoqQcLTkM{78ugZ80(3ny4+9CakoI#eoCGjK*?Z(QdfDjC=(pd
zuQm}=cH9Hw5|plz$+O3WieI`kBt4McVNO$A`kT4=YyI82McX*@c11~61^>-wy9PJ2
zAznWgdGAS;-8xF7w{hCN)cZk5Uty5bq86H3HY;xt`W(2(BZ5jn^PF3CrS|oKn~k_M
zW{56uHiU~OG1ccfxP4?WUvDblRKbt%j|SpK)1n+HwJZ^z9OVXEY+ZYDagDLv@e5FS
zwIG=d^tJ&`anfTP_FqLr1OLL?0HsUNzcMa85G4zxalD&iy`q|HGK$h^_`^$P%c)+Z
zpbo?~`IRFlQzNbP5<q5`@zy`2<o!hs8nqeEM;U6eQ8$=+1Ypo*fgl{OO5BQ!p4gk!
zhHP%_m3?XM*es((VMRgdc`4gA==Iuf%45h6ZBFVxa8=W=nyU)J*3hyukf~f_67-t>
zB%3Y=2?ho8W;T&mQ1ieudM02w0QO3vx$fMHxv~dKT-X;+@=>}{+Ps)dYQXv}yMxPS
zau^ON12lX-(o6tbB$K;0Rx4++Pw3^8gB)7>JT??F#<R-~W+;!Qa0u(!i1FCg5HjO3
z+MBUZeFj>I-5vXT{@Xzk?~HLi&2Qup8SrMbHRbyGgiY3g>RZDWZ1|{QcoJt*JpuSI
zNaO;}I3KGtVe6X12U6oynC*M9NPIJgtew@vCag&=#6W~JSiNnTVbx7@4JEWD954&8
zBv-Og=N8DY*vFQ*W-X&dq~r7Y8)A6JFj^D?+yYLR;;1_L%8S*yMlWFzMDaF+Ew{{k
z9nwve`AzknFk3oA`tl#WZ?Mz|K4uy7WlGp;lFf5ba-mX%A~s7bY?Gu&8~RvP)D@FS
z3f(fHUGQ_;>3L#(j~a|~{1xMsTOMii(G>|sEPu3~xCCUGB(PnaLqG7dJ@Ym)?go_x
zOwSIF@m}b*jgC4mWxm-+Oy1P?wnw;zlKnFQtJ8ToQX&s;IqNkaLzo3zF4mNbwYJ4{
z3D0*gg=IJN#{ja+V7Iq83ta2Di6~YEd>@Ne3qCat_5Q^YYM0<EXh7SIF0eRC=W~^L
zHOM3G!pAQk#Ct3sqCu7ao%z0v@~&e?jnpX<`^s94>m-8Wx6up%MDK7c<%H=slUw?J
zV=Ny=2JKVYM|7ubY{SOViw|6Os1agvzki~e%xxR=e1ycUCAJ3C1*v6x;5uOe3?P)u
zx>ix?Fl8j9ID2r#3Qx+3l!Cdxm4o6^)sqR<ejjAoi3g#NaBxg0fVocK*vy3w2~wq!
zuDB+_zY-b~GV44o=DEg+G1Z*D{UR#_DYJ~Ea(p)n<$F_x(l-sAyxp4nPo%+(Go1{J
zfC5YBBGM&HHc;a89}HNsm?jnm`Di$o?~JHpv{8Q{!<vwr;}1yjuoY<F3g<%rN{o)-
z6GS3l9Zi*j%m>_i^|1v?cW7oxKr5-4ryidM5K;@dzh(=hQDfdgLkVyGGR$}&tf3N?
ztuo@nW};EK%kKrQy8&2Bv*ie6qwcm$T-UdMP$qEk{*-}nTyMuHeW&iBd1b)GT1TzU
z(~7AeRUYxW%u?A`7juA_s!M)a9!@HBMfOk+PES7i=@ip^Aw~dzf@x}JbJ#n#nTeac
zOg6@sA2eaD%*{+A?B9!K%Ic673eP$>(e#Zabk{mk^v#Zrp6F7psrsZm+$V#FD*0(Q
z2D{XE_<u8Jq4fTA&DBswVGF`QZmG%PoIrSAdb%RSQzR>E9DRHo<G$T_2#|*1WWYYy
zUW|D~p5eCb>EH0^x=*Mamn^NP%-;O+CCq*zNE-Xc9}fQ6kB}y5?TC@veb14qO3*Q<
z-q0Hdy5`3=u=!fhLh`clL93^OA|!l&j>{l`03qC1eCOJEf)PjW3CWSs2VQG5Ra|u&
zi70#&S6IFiLqx@Tw0G;xBYu)pN<lp5Jw@h1F@w{*aMa~%I0i+th8r9rl^*iwiVDxK
z!lW3c8$`qs=A$#GX|Uer3TLIYo|h^cZ>z-!<S(u<gau!nR0=Y86y&?YF}A7c3adbd
zn62VYn~)~{0Y(Sac%*ST3?ENF&aj*by7)_*74L<nQ$5DxNDcki$d!Zb)_zzHo019D
z%v89={#4h!2~3j-kLYSCwwqt+{%VlJd@U96?)8?68TG>O(u+4jwP4@N<=K!1w&sQ_
zbX?bfW667&dv0cy2szTL3D3-1jr;UXx&*B}?EX}Pn@3h*dV5EC!JSK7$q(#ZW*p?Y
z9O%KEpvDlymv<7Wgn@mVK;FLZ7OE_s@%yavr1;TDh;O0GLJdoksGai16SRW8sB8`3
z7|3inIWcltEdX`1Rz&>R$h^fBT>hd1>2M*b$AojN`R=!*ZW{iM-R$r;H1aUsiw`hN
zP=yJRT-#)RFjkUW^Y<zFK-b@an_)(hF<2@b%Y2f-eWJ%qI3t-2dP$WpUsn_mb7zQ9
zO{+76@Ljhs46?xIf@z-br~_J0@10psOylS1YwvFH^&q(Io7veY`zpI>R3~ghgQyCh
zBY4;5uxsDTrLKgC^KX9kMweDG(}vjhuCp?i$F?QfjtzIhAVN8iC&l&Qvu0fqLUU?9
zY!t4|N_lSo8Crxj?Kjquf>UoB9Rkd7efPY--l2$WLlN}4Z;Ivny_W<>b}{MjF~W+>
zU0~5t6N1}|mKsX2^?9Sh5YiSCgQrY<G}lzNz{R`4v&XZdv-AfiQsSMWVA%cw7wMwV
zD#BiK>*5J&i7Yb-Ib#{foYYS~DGXO`cG!?4)57hf)mT62%Ur0|e$G^?`Wn<#<K)wI
z@6JPb$)wGKaZ#G`6^A4W%!UnU(BhE%5Z~z^1|<86mJrfps817%v!AS*wFb=Qph1^+
zE^#pbz>5)09|~m1YIEL}tO9Wlm``gf_!h<3<ljf}L3AOoOgt=#HaZ?P&w|JrBuA;}
zp<SV*#YcLhUkDmZC2GJaYe<FFIv&WtKLy~}$7Gi8qTT|PzyWvelOn&4<3w~_<pGfA
zEF^C0f%~M3TqiBNhrA|D?KmM({DT;e^GQfI58-mkLwKe|!l7}}-1sF|tlP)qa%tlB
z3hhg}biNRTK7Q01kQ2i&dgaYmoa)$UbE8bNIO52|Bvi#oRq6-rY)IqmTZ=zcv1Ksh
za7GR8>_1-1EE&<Ga87Iy?(mASuCIpysS8Q!!}*qfiwY`h2x-nMexY3;rSxw$8x=vg
z#7`w47}tRVB;QQjmK>06px}UnqWrHP{qjarirB(j)r^`Z5m<4*vdQ-X>1$Dghs_T?
z7quhLb8XfEqY)?8E0Yn22q`IDPEx|*7X{!hshGB_GpRuJn`l4y8ZbS7U67CrkwRXv
z`mg)2Vg8!F*L;wMoXm!gY{fv8=|Rxv-__qDW+_m|8-Mx9n}!-E&Xj|Wd>Gyku?yrP
ztdV7RBq(O7MhDxhj96#!j?>U)|AblkM1c}_*`)3D7<|NEoP3s&X=pj$+%A#ZJ!_Zw
zX8YYnb+zaiwTb)`4GWn$X%krg1D)~uOxhudWMG{qLgha^4M|wwRcM=(4<6HBS@ot-
zXG;sRX>f*#YxTetJ1mw3L+(yz>?;k?z&xQM=P3)ghGZ_}FpjHyM>e!8=-wcd76POZ
z*y(G?Jdm%mmA=kpf?w?OuyDF!Pt)FEh&Z@|bO`1r&tcT@?LIq{w|MVcXSPhiHNTS?
zOIXF39nCu&E(D0=Mxuki5g1}MiB$$l*T_Lw;5qjoT%N2#v|1_rUtp(Ze;kr$(wfw3
z6}wITL7EU`;MI^N8L3xy;MDmM^rsw&vQvM>2AM=^oPs7!75g$U`|8!1z9#xewW|Du
zgCb&R%0Q-Ne@G=$YV#V@pfH?CN~qs0?`y5XIax#e7yTxl9apVO>BP90RAZ%eP8@>f
zjbISF^#@JM%zH6Ne^JEE_Tdv^;R~jh4WV~(7pLwj*k>_69Q@#7&Jkg-Krh>)EhL)q
z)AIQV94gy9{n1s&-TCvwon3ce4H)yss)`KhwIfZRsKM?c7v<n$?$FGSr7+iy+ChPi
zOsTarjlwd$AJ!Bbws`hb9M|_rAi`swknt#o-f7PG-mf!yY58)H{1Ts$TG06?zGHyP
zuMs_M3=g&d@Rzv{;@DV(PldlGC{e`@b@)R1E3EE-Sm_bofe5~;S7W0(`P|HVNY~z7
zbeb;u|7<(Iz0W;<{t^Iz4gc6BZi|HzE4;vUOE9!?YeT5l@@?>qFn4T*)TDmR-^I<F
z2_n>o5DFrY5Vw{3n}+K_AGOKb5NhVN%kdeE!S8o+q3tOZb?!M6W$b!OLxM2X$~Jtl
zNoxFR@(j|nj>IYY%+Q4>$I7`bs2eC^K4jBD_&nF#=?nt6W3@qVKaV@TV3#XpCmQY)
zIK+i)SK%-QjLR6zU+4q4{4dnn#Ob7Mr>-oBxZV~?%(@cdC^VQXN8_UQZh7yTCHMlQ
zA&H&G&360Ei-&qCM(C*j?#B=BvS8vPaKRATBWc=rEe#UQ<mM9-RWukcwNfQ4c{qqL
z>ru$O9J{lUWppO8V{XJ*&W{<@;l`;>7jqQi0cR~cI?;-t_$yq?*Q3;yNDq$)e8%aD
ztx@i#0y8RQJy`h%@>?5cZoQK6HA0Yuy2Y@ul22PLB=4aY-9!wuGD3=VV<)%Y9F|x>
z`0SG@6|;l8K`NnGrDxoO@|rjxaZ-dZ9p-i+O#vgCKJkTSU$bI#&Iezp-!!ZFa<f{`
ztFyP=GgE3`r96HUGw=C3UnVq0zcKys-FNU6%0qqf{`GQABP8`))>8L0eZ^c{xmjAP
zhy6A*8$lm_@2zgPA3G)@*~0mr4<aeY>%rkf^;LiR*{yX@^!0YwR_ITGTKsl8R0xh}
zDVV^IM+@?g)wbDlUVqv8A_K1ZPYmCkW%8P{W&Wj{h>(X@M?dixjhk~udqR0mpEpII
zzoqbN`qV3bTOH=fOsj*<x2QR*%q>BDc~0mB!2_;;ru+S{xdma0Kw*{^OoYM+fAxcJ
zp1}QA_^lKf>=UDU*w;)Y>USYuRR4~}h7Uc1#pW<(bf2X!*aCwOA4D$mT<8M37{bI~
zO4ZtTWTDe$^y6&++xE}U5&(J3y@xS90Ez04K2-MVkMPG!h5c_&mEPtD>RSQ;pEV}M
z;Tjj93Z>6(_CjCHBO(C9eEulMz3W8)3?r6XYVB2~Z#P{5?dqiAB;3jch`6p+)jMW-
zo&7Jw%7DCe0qA_gi~-<2)7PF>MQSmoubNOn@!#51RxB()$$<w2Al9`^2LRky6afHp
zPXIuhEL14Xg^G3m*XDP-DfUmNk=JHSwf|NE{cqG#;~sR4Rm31R!1QiUGU*LvSHvd=
zjG&Wmg9??K0)B5-nPWf8l$U=Tp>T3sO;$Rmf!C3J$A6u{pj*CBz+K5rSU7M+GH8{a
z;x`~eUy`gM`=1}>!$-qhC^bJNzb7$QL<>w_N_Ksg`I7h{d&aD`^U01=lt-2x*<m?j
z2JT@{2uv;w(A4btPOR>kNXU=SLZl{<_Yk(zrakb@QUuH<`XwzS#L^blaj)g>F=k;N
z;dbQX@sBn^^PhRq)}EI;*j^Dak?<x=d3|zwA1^EHdRyY8$$*bf{5VtHEx>2%=l+~J
z{^(!YSBa;3P80>Ne2S)!ZvCj$^o%!08r`OQR5}L}>9rv3{!qm`9lAkB)CZc|x9T-;
zz_OT;71hiqB=SP%=Nmk+qW+{g8SH?P`P=Fjpo?H{^4}S1<x3lz3{Y2@+7;;yp`!er
zJiLGM(o>=_8R&+2_V5yDdrNUP{fS%X%O$e#u%0I6&?NydfUC|S7M91BYSC46zy01}
zI<PN@;C&a$hwJzkTxZSXr(8;iVJ*iY1?QNl34nN}!IG}&tXU}vCS8zq^b8Ot1fP~g
z(aXh)P*YB<*%N59;z(2-p>YIf+Ri;GI-X<*krGq!lIJ8~dNw{=aVKmoJn++IjgWpt
zVogmEts_SAhiS*U!~;rT4an1bV8Fnm;>CuA$6=_>sO5yq=1hGQEgf9FZCMs^Q&j>9
z8mQ<d<TiHQ-Y|VYCngvdmFpw!sscjbrPj-t5AX~Oz`w_yEE%rx`8GU6|5Tb0E^f+=
zan(Pa(bpLhh?&mAopV04y$P_#3+Vb7fAEPle|QWz0589kNdXsTNu8({Wq&A)u2fmm
z;63IT*By)!haI7#(2%teWg3W|GUGN?;@QKDaDEyDe}B~TDMLyl>A;W@qSC&@!AuKz
zj_eV!gImJ?3?7XV+2xp2`tm9hni}|)a?E^1)W9gKcT+i*8P@UlyEam`BdqFo0jYWV
zL`&J^nL_ZgOecTlw!WmgET9B*ZBDlDGMw+7RWb1es9u?83IZH&)xh%sPFQu3df?rA
z*72qv7j|P@h5qqCIdK*U7Dw!lT7bc;L#jUu!~lm!2zo!p_vvo~90pkf*Tn>Jd_C^q
zE?lF|Cub2i?-o;7vrrwodNG9Srk-%D+82AXdKxd0=(u^Gk8<D)hJ6_z482&$OOh-Q
z=i>3E$7lKa$6t5vO)Pg^E{boWKS{pmpovxAZesar>Y^rpu69?HBx+u91fA5e*V-YW
zEM}D)n(L}f-q`+jv{o62eL8K^E$_O>inN>kv1or&DT=<*to?ckk@Rj}v0sUMSb1~k
zpTX?c`Vt9We}jGZW<F`0UvsqSk6I<4VAn?qcTqLDM#!X<UySd8Ms0~@4NK+V!n1Va
zhZtMGgwm%S)5=@6f?7JzS1vnTMn-v^s+@#(M`do#&ioe2sD7DCFQjhP>xXHKQN~q!
z_b|fSjnjmk^c%nvBH#D#_%ts2AGbdjT~S}$=$tSrAE?<0X>cs~R;vhYR1o<Z=2hVE
zYMSVo8@4v@R-}jQXHnLCWT___>&5#>Ts5`hTU}4!@tDXWl8ngfA-S+N>3p}DI<h&=
zhC38W7@$(Eu}O$cNSiT~u7#+fHZ1eNI93r;><K@bI)75~(Ug|Foaf9eotfHT^I5q1
z$6mj&lgp#RIG4Qc$ieB1ettvBJoCvJ!}`xtP?ttl0Xz%%UG$cW?&brXO)?&XTSb*R
zKDD<l7lbgm`!@0sGJkpeoS4ZzT_v6XS~gWW?)D0NXhVn!eC?%q3B;-sFL3mxzD4IF
zC$sGJ&CkL8Ox2)@f;D7_@_@4{S(Pni_$7ohS|US3o00}H2KW!>$H9@Q+shw)U>g&Z
zl!w=%jOy4%xu?g^<q4=AlM2~l!f({zbM#HF2{3Kh9T~iTomSf_G9Se*fFrd42`X%^
zT{7M(tOy_0y=Nlxr-Yo2MGh<05*qm+-+G@b^Y53z=kmFjorffhD)xL-f;l{lisZVd
ztHUW(4f+m8>1f3E(FyR$-M<@=ESmZrb%;iE{`~;><CwJ6L0|4bl%W+|?+avLwKrz%
zH+qR#YAWVe-upl3F?qBy7^}QsSyh#)h@-DP`(#}$XoBlA&qa|^g<@XcKn|sE$vDl<
zOR(P-p$!rJ9MCN=P6ox0&M1*k?UI#NjmxAlQY|-Bbh%nhz^la{<)AhqNHvty=FJ^Y
z;#;0#e>gL3;wD%p>3Hkff_j7xRr4M~D-G&sHa>S;#Nm%cn;p7pSF#}m915K^uJ{z}
zx^SCHRf#tO$BBbY?ov>W?RL$=;9uI?H;2*u(A!xI+w2+*TU}hd6M(B|Dvk1lKMI*m
zsvb*sZbc%U3Eg(@5tYdyYhMawz&WjiHsa@F)Sg@k<4wef87-#(x~JF7V$r(I%6OQ7
zK)L-`!~m%xWktKs?*d%Fwjp&Lfb2rFO-|u$0KoQ@443x_9WV_u;}~hj1Guj+N;>fU
ze#P2DkUQ!%964>W498Yxlc90<DvcZfQ5<XH*z`=eU2*~}eR|WYQ%6E4a(NKua0fTO
z`C2V(Y<9^x#^p9BN$3;AlV11hLVPC`;K>76D;eV=awNSoWpSTJd=6j<6M(S5IiidW
zn^hqyS3y<kvpiZq1WzO>^tv%Ui3;1^cDb9Ew}8@Z7`}W!Lv5c(S-N8sw-d>wD*WOd
zKyVU6a3=*zVfCEUuEip-fo!j!4^I$x$Qola&Y>UKifOUYYz01GFDWkJQZpIbJei5K
z2&no`Y<&ebZ_u;p7*XpIjuHyPKAXthz8}`IV&te0M1_Wyxz_O8hoEsqvz4s63uUT8
zYd*4{7$2c7$YHR-K@9ZIX?SBa21ob@sLW|GN60naRK-r`Zdl$c%e2qs2TO|Jpg6Wi
zwW&mmmQN59l@Xh=(0BS__5jv<pzS>g?HK4fg$aUR0DQviMfYFRC7AN{O^=HE1<l-S
zBTb4t=LMe^V$iZNmEZJ6eVS_uMEk<S+(lErmNCbJANaL%Ung|jLG_n$4lS>cqjb({
z@1$-fA2SRNV_oElfIbjzY5rZq0m%n|4%ru<Q|k<O_^MM3=1JO&oclFq24dK$uZC7@
z9Dyq5BYi<~P4;kS59Mz<dBp`60~(8jG0o07$C`F<+z8hYm9p!tzQOh)Uuw}~tg8nm
zrqDt*UGD`q&>)Q<t7FXdRQ{aLWSl0U-z8)(P+=@7zYPjSwP`hqnVJTnF!z#z9}EyT
zw9LBpOXcw!YX78sa_6AUHj&p0UuzCLjrruz39yyrhPUj@n*sYMt!n^0TP1(N8R<S0
z_R~$D(LvK9?Y@k(2WnbRVbvI&fe>v5cttLJNKC9$=gbVB8EFThMp@3f3C*Zl@s!6z
zfng;o<`DfOUYTviLjCNDK<OVsat`Jlq4nZFEpLEFmXIbq0k_cx4Py*|<4~j*Pk>1t
ztvd|rd<;P|;v@&NH)_NBB10X=rZUO`%(3HaO(;GSR#j+0H7x1oogjU3;OB>^-ar+F
zp%kjoCc*%+2rFWW3b}URc!AkUxJL{<rNCSBAzc7jWLPxKANMQPUe{D0<7>V6YJ?IW
z<Ma%b2!K;BU!U<g_nO_o_J03yX6rIL?vzefOmm#8>ld|N9TKrshC7_zMQyRRl_-Cx
z!^?)Y1+RzbJCV@g-6G$2Mx65xw8~^+6j8ail3)9#=^%-kbD$+eAw$6%JCTSDxL~jQ
ze)|d_(K|Bt9Ig?rDfKL>Y9C-cPLHEi39TP@zB4*s(nM(aWml;>Y`5HnFIm|PRg3+?
z;lNkl>_I9VY=wGg>FOpqoO0=AT@0gqyY2e5I!B4!H9#(yH7?|06jK|AP@AI~!S*O_
z3mQx61cTATu2B`YvjyxJGvykBvGNY7pbjayUcyCjU>)6mdSfvq5MgQ^J7Y-u9m<y8
zIM;5dEHs8pD`5{pGwaC)wqi5cix%>=!R9gI^-r=0Ehl^~#apRC`vRo_Ur^WpsflDx
zdI+`BS~4J+4?MK2Db5@<#Gk?IsSljt-je5GP!}ZhGQr~}ptb$D3${!o5z3-~w9TfV
z#eP{pB%O&tFEQQFim>-UU$$_>T!ay!&j5R5hq$f7SLlG7(`{hC*-$ux6Oi5+l9&4q
z6;klRGpt~XBZ?*gRW*UdfuPt=rhQvSw}tQUHD}FM$i0Z|*2p0&R8wQprd9W$km~`m
z`spSFJ(RTREgI0fbEXq-i0I{ev!8=Cl_vf43j=N=@A%!n%_;Dz%^~!=tiRPehSNWZ
zMkyjTj|x);e~vCAYk$TuSC{JWbR9puRr$x5Jf{=R;s!I^E6H5RyOS95x(Ukb#s{z|
z(07tymC$QMF*1hAo7Sy%1(_lLs`IhcD5<hdWIAgI=+`j>^?&hf1I4o@Q(Yu7+`PHr
zdd<Bcer0dBnjV2wLVQK+^3-q%^o3X)57FMQ5hkdsy-q6pIpK^?dnwBtli}mb#JyQR
z^Lzx+Hrb$*c7zEc0)ubawDTh({-h`vrY@5Lau0`VP8AtFwe;ql)=n)Aw&_^yN&IC$
zo0r@(@5BA8>?jn|@c6S-O!)=oD}({FOA1lI)e=Xd2;*u8pfBRgUS#C*o!gf`Mqb%4
zo-0X!jOPgs<}aUe!kmlWvI4^6<Iy<@;p}J4bQn8kYQ({@pAu>q$>i&|@z$;f6a|ju
zkm-=pVCq=jEVAhr3Z$JN%Zl9+K+UZ&pgxjTl<)#)R7xaJgg+q7AIcoeI?6Vt47M^G
zY09G#oMqShv*Mxuznc3*4R?Y=e(`{4(=6L~oW2tDA4NdN1Kx*Lije|x8YpjK3&;IG
z89Z6bBou9fbD}rFdWH$oFhsuk;_*Ix6U*`T;}$QOx10;Ue`ocU3aovC!|xW1`~=$(
zw5b}p5B$8M2hbG46{v=4;hd5BvDYIPVTkz$3H%zU$>~>M0@Su4Gd%F8T7xjA31#GG
zv#tTA{=YsSPncx6%=$Sb1EJ6LdEuZ%RA-Rtc)V3namyDIE-%8$vOWZGa-Lz9-}e(J
zDoN~if=rc^rwyj5Et~Bf!Vmb)ibM$FunY95vdT!65PPtSOKB^{_D8P5tcHul$9q$^
z{Z7jICzNt!B#n=WgvB90l|h+NG|Ah#$uM}6k7hb8tcMZr370ue7|**7@mc(LJ6Wjc
zNw4TDR^>v6B>(2*Ir%&ah+1rSuvnA^M8izY1HVJee7wm%xBP0Em1DA$k3^ME2TaeZ
zcBrO(q>*wA$^ctVlyO_7f(T5%o^<;KBHu?HB*e4(sVZ;4TLP;tO^ZLH!U&~+c+Qni
zyZyPKn7aJJ5o_IR0^N0__eji05pz=>;fs75GfW1pNQGP>`Ygd2{V;5$|FxxM@bw)M
zxI`8&z>XU-9|z2^uw(u%Z4(6l;qpKN6MyWdpN*$bUfFA3aD27c5pviHc36U83sBBL
zxfI4RarzTE`qMIp{J&Yr5YQp{rdK28?dBk&%7@9jo5|jFbYxFM015W3GNvYl;?NWi
z;aDnYB`qxpgtn>S1}#~)`e_O8;~(CupOi?LQs%2xdmMtv)WN>u#H#}{O`Id&0)V>7
zcjhfv9Cpfngs}R5fd#5Q{_!&n<Tdmy8#qoFY<q|E7HEpni^=XjNPsu1%Nx+B0E@g%
z`r||+K$;58=}d>dG}du9#oz%5E%C(r9L(X`U~ZWAl*i|sjg2;;BJ;5v)l?kJ^HL!U
z0pq-)ZB0jMm!xbm?=4g<hN(B}CUH!NVSiR;)VQ0CaFKba4x<MI@6ZcTh3`_!^96XE
z`$7uy0(c(kYH&6C?yU0yzg#GJV;RBw5eq-$Q$k}EkqCe6OmzouB^2XnIu-OcAuiFV
zZWHx>J>w3IM!TlJykS}Q@Gvca>D8tTJARvQ(l5fW&9Ea8J_WOCMW+h}85#h=Cvdrk
z`1Jmtw4wHT_p!Oko)w1>8z#rPOO^MfjKdDCY>Zpa#OiM~iQ6A*VsBsdkr`>?esGt6
z$2Z3z|0Q8%?4^elavk%9KO>bLaq#pACmomXGFe^~d?}!m_|7`VX}0WexJ<WKn4KpO
ztt2~!F^?WH6qxjvYK?PgcDECAKN4zoB!Y|^C!&GT%QJNtBBAVWm}nPB?zb&e4Cnx8
zEnlcS1Y51al_VL^U35=Ov%pzq^z;qSOj-Dyfn8MH;!PyW{WHQC_7L4OZeaaEQ;leQ
zp~CmiTzEX5TzJ?*c~IxZ4{6oQfd?F5&g=uB@8X+C?B7gwPkSD72j6ALCHbmB>x5iF
z4!RK$n)x`_$$0c=6T`W<TTC*P`<Q3`FNPseTfZ(EYf^QW7yt1$%7j$GlQKiH$QcW8
z3@X2Spi%Wrsa(}uI1vcpJl{3b8Nz?xS*v3-s`bI^Ct@aMPNSp9@b|8!wtE8+-1Q>r
zg`iUST?$=g1#L#@G*Ax{%WdSxgr2O_@6-_dlmm<WR`<Sn!9G*EL{NmnWXZV<W(L?!
za_LRSkDPf*-SkrFIXjjK**Wv9Uf5OFHi$b+d}kZOci_oLGAOjVSw<O1z2_C_|BSqJ
zO|(lcAh;@-l#`O-$bsu?`YD%UA#ExIN@gY%X(!D2=#@497Ti};|7#NMy<jUELdnU8
zek%?;kxyWHve<f)G+^W_lA6Y|X6U%AD=zSXmG0+L=c3>iP&gl{!C_U<{wRF{Aesne
zF@C-7ZRmFDzo<sIcE_VfxLShT*4b75NNA69sSBabLpN?}R;ci<6*mfDqd{T@O5BHI
ztjD^YcsDiw(EnUU2ovjZB0sg+N-_2rUMuQ#6HwKlY_7b4^fUN3!M!sFvnguS`XW7B
zEKg$W6UG$IBBGb^#4=M6`jW;yeKlvo<+l~3OkMiYm=vn9rlW&gS8jhE=Ha~YCc9qx
zke*yH)obS_{JuE-x0iN!d!}wx%#2hEs*v4Yr-zN;qjUXxqPDoc?L8#%pYbqSmRUY~
zEMIyxYwQ#)I#v>BAgLH_SGaUEipGBDjc}VHJT*Fil|NtWj|Qd;8a0H`6=P~{se9?3
zMJ^=%Bq`o}fU?AUGq?|$xHuJ?!B(t3oj)r85PyBJ9e|hqZ;Fe-=`;gA(<+784YqTA
zFR~};)rvan3H?z!28=x;TIszLpw;Z9rQa6VX(eW;`IwblfN7R_`6>KDpe=ps`E=A{
zzntTw0>#JxidO&ZhE!06Cw_&wx_9{uKGK02bZ?x55cn<MrU?=CQ4eGrQt&Sm(?jkT
zOLA2GQJpe|BnI7s#f^3Uy*9*CL#|PYyAb97gOsmME;~hSO<kC07`<b1t|H2RPdJD<
zsD#kn_}n$2h|#9+`k*TFO>=v^&6z9X_QK{a!n4u^Z|?n65-p!1f46=F&@>xH!RFZY
z2Mhy~Sa$WsO9q?~H{Hl==fmeeZayWfj5yS0nJpB2@TskWrg@l6I|Ce>YgNAVFuhK7
znBgwEAJ*j8_OuL^{LTUU*oxw|HL(|Ls)8Kmgu;N^o1vxp@2K0eaO)54+VF`3a21`x
zKbcm1uG6}&_bNB7PQHjaJzkfg7)g0kj%<Ix2ehqKd;utFYN~;>JOF&?oBWPJtLnt|
zH+zTykk=!Q6WHFx=G@GaF=<t3J~iFu1#~w#7U=WTA#Vzv2)bnE2nt&boI0BSJdJ{T
zuMWCw$pgQKZifj2#yZOx083*tNF4G{h2QxQml#!_GNnj*!#{9T&s&q^EdkCePx0wr
z`OKLiuI(IZ;}w7DCZ<yPf*^s#TbLaL{i38#`OlEkQ_X=>AuhX5Qf|X8=7eN9=YZs2
z9I^CX?^fTy`LXDa{)@pMDVt^H22NM@!EQE7_>AF0r3*KdDn@KBwe~V$w(hs;R6MP?
zZ?>p1OFbtv0;<2B8=3npz{t9JMS<a#AZMhWv-B6{I{cYHL9ugOGdMB3!zvgfCVR>;
z)i?*dKp-|TmDrb8<)gITGQ^L&Jdd4_w??*+K)FT={5wkBwM38HbR#DhxG*2A)&M})
zf$AHhpzw^91bPUIEquD$XGd5|b~B&8R$CYbp*$W86M;XaIei+<e<i^ni{9fMjIs~4
zWe{@1{>z#%$NmwvZ2hsXpeVyn)9xolbg7`ol(ytt&vC@M*PZ-~s6?ZZM-h_t%Ut++
z-{7mJ^n20Hs5X=@U2ml-VRQ)y#i5nV6<_~nD~@~-@+KQSgp$v+9I6ztCN~2iyJJes
zl`Bw=BtxD7Eow$By<hQMV{hLm6DiQ<WaF(=oI+E$F8DK1>rf&`?Bh6+<0oiXekrJs
zPr0Gvke}||pErVGKeqh4ITApyfI~;#po%+~9%o<Z@01azd2S0XP$%3E`f<Q`VXntt
z2($^!8@N`)Fk&+Pmn9o}`3Bk9PdwsW_MEw$TJ<``Qo_HJXTOQ20Sqc&-zS92vd)L)
zYwvKDVdLk&_3!m`(90hr!Xxfs-`|-7tpe(F$cF^q#K+VI1UHeS9KZu)sgV{tdz|;D
zRf%!<xb|1S+)Eyp_|J=b3m_>r_RD+9#<-{WcT>*hB5^z*FT4{LHDT^mhbE!?$4-qB
zp5~7Qz@ihx@lXo-4BD+i)?UQHO#@glA>T@%*b`mUCleYL0<0c@>pWiHQ0j~NViMv{
z@8?&|JE&ggF{8;INqMV*xk!<>lg*@r+`>WKhZPaaaYi1!uF`$LcB;OWrOsu2ZlPk9
zxyUD!$>si6JDB)7E_Z?SZ)nH*i}pr6qmj2D?he)ORL9(f#YqSS)rSgh;q_3pZerc}
zX4Up)(|g4tgBIU!h^m9cWC{7K8LFm6HZ0&Ra@gT-AiH0qK0k4nnXee!;+u8Wsu|hz
z;v(}j0jX@JZj-Qqbz~GsXZ9<Nq=5Yf1<=yZYkFWOGL6@3t7h()Wo1%Ta`~n)rx1e=
zf}u|>&@tC}C!%lV%q^^*?Csgxr1u|vUxV;ZbF<8;kUcC+e-`3Do@{(lSy;RA@*d@V
zliA5BNWHXd$Z?i$%O$A!yXq~GgXv_)oFEA;tBX#Z%=zz=J1pGY(VyGA@8J%k1kfHA
zBlRb;on57a-0B@h3h&D{v>1+Ms~WIt>lcsK<r9}ZJifJBF13mn$3)KOsST)Z;VPUl
zsc?%3G_evUO}-$@_DR23YYaO+SgJ1U%2t@Wd4IOzK>nN9mvOJ(3Mh9~`gsvKApMgq
z<ctko^;5jIu4U8BzEG4y%!MhT#O#5PD;^479fZA(<k*}GiG>CWT_2_NZ#ITsgTCw@
z)TM5d#<3<)DDpc$3vRW3iF@B>>G1>2G4c;Z1aSPqzxTDJ%ix=!*PF|&?{~?+bXn_&
z`JH#{asvg4+_V1lIs&rInWoHj;v6deb`t@lC2g^~-b?a#U%-whP)Tp>X*&`D7)0fN
z0vy8#qFpjle`Q(M;+@6W0d6m@!(jpt#xAPywBm^QFL|a1>LLIowC3c{U2k{wt=Glr
zl0*dmSi(Q2C5Y845yldto|et?of^%5h(?E6&leKEzIl#cJu2z^^;}v5S9`ho%54C1
z`S;GlXUD7TXwV0q{cNu_?Bedtq%xjE37zoE0t4><*Jq{wRfpcC#^9ug0&>9j+5lss
zOf0=TJEXWbPZ-xsq~8wuqH!Wfw34*lg=vB)mqT`+$T7l*-&|gi{%@mQMWz1_y52G@
zj;3oD9VEC1cZVPeFu0T8Fu1!84DJaU2o^NB3~qxHWPqSSf;)p-aDo$@K$0`h^Iq?_
z&)(<k{xMf~SM{t__mZlvUbQM0rA9%|{v1D%rPy$<uy<R))&_<M)&E$rrt3u8f7dr6
zXi(%Z_^pPzXSSH@u9RAdIQ<2}C^=WTF$L0NGdSef97tQm|H-pd|K=k*!YC|1oU&{+
zW<5aKJY+)zJd4mw72B0lfaiAz9j`NCdLKn6I7?X17=^uoB{<B7cm;d^{P`>7_TB2A
z^PrA(i{{?`i_3+OE&KcWmG5h=!Z`<n6cPusEAphzHk&*tz(O5QI88)~@8y&^e!UVD
zHaY#Ob&P9SabsMg(;VwlE+kz~R^(?JlZ_n(CMJmpJHc29Jy;tu+wlMmQEQ1Z2zq;a
zJ3t5ab~_H%vibQ1(&kO`DdcAg>D}9U_>2W>x!&`a!HC-~&;9&bcS5RXuv>9^_?BO&
zsnE3j=J=lQL6N1RHOzW2!A!i=DId!y%UdvTqsL7wD$^KXM=0!7k7lvcLw)jb5eNh-
z$mYlW?Te3I8z%AZS96Sz<{O`!R#UEpuoz;vWvRp2`P2<YRcE6(%%MvN^qd|(+eic4
zN+0S8J=6K7`w4!Y&cEeCrvQTB7xJhy1))@gdvp-$XrcX2$has$*Rma|_8z|XRuDjm
z-~_|w)AlnIpqu)3jZ50NI><R{H~G40R!QmN?CZ4PaBy1}1*ILH#H{0=tX2b%bF+`p
z7+Qb)8^kZ05QXq4rRz{@zo#_82pw|!_Gl~4ma@t*S@MdcL0nC+dKO)Z>PXa1(H{GU
zj@PsF?SLyn`E|taSAq!-$7!jSs>?(ulds=I34Eo)q$fe?kC#IjNS2=2RxcKk^NkZA
z$e;qDF1sghi3B4{XQWrjm|RfKzt|6kV+V^tb7jKZYo~TO#fEK()U_T3Nga|M7>)Y&
z^<_6K@@r^6Ydp->)ZeuPzV(~pVdRjOY1b3;df3JS0e48>TBxV7YyMJ1Z1yd)q>q-;
z^GE;P%X)t-2eI*`PkPlva2eK36CB32Dpr5DkUkq;>2D=qVzTT40@C?`Sc0}7u0*>#
zAsjfZ!Loe;T^s0fG&xL2ae$lyKN5a>>++0o2@kWE(dEP7dX<u#%q}UGEe~%PJG9X0
zv;QC3Zy0kMeTwnc+~<DBa-?;k#r1TGc>$T_)J<c2MjGsuMNXzlYu-tzj4u{0CbUC+
zC23Ln%m?>Lh211lZZbo22N!(EEEfPz9EmnJZ=u4HiC>Pe7TnmOx6|6{VcmV%DTm7*
zq;VJYmQ%}<{wAruYrlK!;DYNl&^lr$#)Co1{{5MX2}ob@qwMs7JXWecLOp|pFygyg
zYoKgIJ}VceGh*OQ`ulia79FI07yG`-i!1}GBX=4kh&$Eo)k@z@w95D+AeNF6{5FzX
zr_p+}rRvGvS|6H9u-%8tWc3ZtmlVZ99Q$oLY@SxkX;wwlZV^5wx?@OVf}qbKF25mj
zYCrHpE^;_H(WM*X2pw^P1Qcg!bilHw=e538LfK^{9wKil2U^>JV7D^CiALWRMjsyc
zHnz{&M7AdR?As<}B~4`eR)U~TSd1?g@a4WLs9$Cz!-UcCi+GQngXrbn=vS+R2t);t
zOg27!q90p)4Z*<Bt4lGQ<);3gv6?FdhE48-S;|586y%?f7+4F<pl{_NJ>_iAoP`fO
z<G1T$njGWKVj82c@`X|}l$Rfr!Ir0tWf*@MhK;yEzypx>Qz#fmSLz6_uRb!GyxaXy
z;Rm@dpx<sm5Gx|_=IiHBa87`@bpd!aw6V=bnFu3y*D7SA$hEYl%9~6~O%fNPif_1r
zD|q+O;A{FCyF#tTTEczH3vjD89|BR|jW4yloi(oC%a(V!l0>t}^)3q?P{8veW)_~H
zAUl~+N<gNvHMu0nE9EvSXJIvzy8y>Azhbs1Qlv9!(>P?Z=W8WW1~uh-Q*Sc+(xS6>
zl+8%0yti5u{GRGAUS+U}>D54WT;)(eQ811LN<9^n(j@-&47l2^cjPim>ssO6%=8(9
zvdQ%g2SVKwyU;1yKD-Dk-B5&#W1FG6(LwXrm|-vBTpa9|d@^xsJ>UXDnD`lr&p}7)
zf<3mV?3;pQZ&RN*K^+(*cg?uNo+l=a5R-s4u_}$&#N*lee6eAWEO}+KrA5)}H)g*w
zp1%M!<*~5t0D~Q@1dL2n5#vgJAYJG2mI_UwAX(wE0y4dMM0xKMmcOEA9UQv+Ubcwh
z9dz38kpWZ1l`Es^75X<<A?A=dff8_rDvZi~Oitgg^pNug^Z7JX2O&OkKwP%0w{+zX
z<+mM$g~cRAg*yU2$E%19<H>64OI5$SSJjDFBS~tl?1ChDY+cOjV$$uFf)KMiPB9EG
zN8-9fEEEbrBS>Xn(1n5}4wym(L^rBZR1o8|qs5RqJPVMx&oi#tnPlf_UgA^ALA^O-
zHA~C(iSF``K9e<Sa}D~@o&MuwfBgg$e}M!h$j9(zw1g-0AC?)DMaX6@>1SeA%`WT)
z3n8}-V^ak47<UrG!7jAP`cwE1w;4crZO0XK<&DW&37igC*%0rTSC#7W{H{zJ!3XZ8
z+*CupH{?1{u$a<s!v*+wK6qa%qxb+e4)yI~3TlhvME!wlYMaGyl4t3R&?4=bihD(J
znbsPD^T=oyf=U&`(Enchr)`D4#5erE3m`p8aqf@O!{1~?Z{#o=wR1?{Txpr$gm+=D
z_v8k;d8Muk>2<`WUcFfn?1Dt*t^YooXggrehe3`!C=E#O;oXVFDqFhOKhMQV5}wtc
zQ;*EfRrwU>jez22U7Epu*u9Djlwgt${xj;bPyB7TB;b)g&aJ<=lKnKPHe!y6<;I|D
zl?Sc`!7e)cUM37D>fjN=X8u0v;15nVPEeR-KUBE8T>IDQ4>ha`ylC}Jtu%XT?UB9~
z$tOEK!m<vk0b^qAj|Pg*8Df(zBSWo;$TTEuM=zp=vQ(Y*=%6gPUKMyFPh2}7t1OuT
zntjL{w{b(|OxE&k3dB1r>*DvPz_R4zt_hf^4nj|5jfLSHxgb{%<Q{G5L6p={3Te7d
zv#U0TX=;HMgg}VT)}Ym<?UoXX-K9YnrscL9T^=!II{CG7{*Pe0I&o^hDewB`X8lnf
zb`N=V-(T3goU4*JR@X(c(y$BtUS-D7Q~8z`80e*t;Nj2uZ!z#CCq%Ha_zOJ*Wo>_0
z+0fxvV0`#owQ%}Y{ibiWQ6Cu<S80t?23aVsi9jijLvr<2bmS&lye)%ghTPjR+rXJ#
zIcH5icuo-XHA=`eNb~B4|L$c=7#*;%?&Vxus_;ed#%PubUq$#RWMx|RN<TTFg|3OY
zuNDPoOk;-|3!_sfvgkVhY1{Yn^sM8I?3a|vvBmUWiqha*LTruJkvE#)AWd&230#$i
zxI-rs55J$hjNU()>P9+W(qhpaOVLl{b_Q<@J5gsCnUXbh)Cf+%OJVw<)2l_8DOz2y
z545aatxVvA-MCn1bvDpKDNITS3NuH_v#$Jbz%@>&mTsw09XhZ6$09>K!R^)IZ)nJq
z@LyU=*FH-K)G$ksG*;GI_;6776|Xam?}w0}`aGB3rG0-PMGW%fR5&w;Md(W50&kWJ
z5+X3Pka6SU$zJ;ko^ZzxzTH6JU_4)d$K>9dm4}DR4(t4RHOu^Ezl|!ZugMU;3^xS;
z7kAZjBc~|1^p1A)%5WkUCVLJDzrW10WCNwb_IRnjgAOe)<x|HpU&gVkd9j}j&w3&S
z@DI#SbUZ&iBWf2V<ZMeIxB-Xo6$9**JUIAu4_Qa{It<ZS1M?qwf@;YBL@;cU|8>GG
zsNXZHO=6caVJ_>?cZ!r8=-m~*_DL`GxA@6S_Fa)$P8Ks*S&;YSww>w56K*VLXWYg9
z)@eLT%Zyq=<DJiI2kUjc3Z2#|klk`Ir!<&rzYJFS>&t%myblC0y@lE-n0x?uvm(W(
ztBk1OKDxn=PE+#~&;F&GqX1c~hb2TFw=K^Jwia4CuNeO#Wu<8;=5g1<eph0{9-gy`
z(c!Tm{I$MmdGZ`z0RfkBeYQwz4={`9Q&oj(cV=YWM(U#{IhweQ$i}owoy}!+<!K=-
z59c)YGptmr*mW@bR91QN!*gL$rh+lHK5aD{{J6U8mjEl}jw86rS|$`@Qb_l5k5hTC
zD(Bm^X^*q=i}NJdzidq<X*-0$9;6s^6L}$SC|hwDJ$w>UyfcFC5v$q}nrD_8;jhMB
z2PVam;>qoGX6@?9>Sr5t+pDff8p_;0!ipAmwQO%^5xZ+9C<_Bkg1!a?m;=6&H`J^S
zM`N#NLnI@!0;`BHc(B$@y6(*Gb;lp{S9T7`x;@FQj3gZJCtQDTr{4brFe)wnQ0r_>
z;#%w?d<P35MfbMp{Q>&PAlketbkC++14*syEXQ(XJ`oH^(!qfi<F398FIDTJ@Be|D
zx2<Gox>8E)ipY=6>p>}AFI-a7^m#!m;{PFhMrTga7QR(3w8V&lJ6b4MyNEL&rZl<+
zPQ88DrBw!-%>`@tYK<2?IH&=&J_@~Wz9jPNZ`1R~F-|n#{WVvmyEN(lwi83FCbHV_
z;G2RIxW?}(A+-(c=G5x^1@!^Fm4=3{npUB6C6VgzRYmmQ;n`Tv0ErKy5Tysz3(uuy
zfAzs1ar$^<9xT@uUHLfGrEV*#!te_=_t!lqrxDareSad5WAN%PkHThI!4ZM1k?#kx
zM`T6B@%wKaCvQc5iY+H+^UV>TIjGr!Y_tB7h4Ut4^QGmn|3pTqKinn7nccdJ3_}O`
z{_@UAq4e)&4X4!}pgOO-x;?Exx1x+Hc0`vqbt+}Jk|0E;{G+18gL);#=JeRA&ENkM
z{NY$Od#~FSlR?FVSkh~$%M}~^f-0)xE6u!YF=0$qu<pzoh>Q*X|35aZ&o>enF{}YN
z?APDvu^U*{`uAE;6Ti*YoA%R8VO{;39^ro;6`&5@NI+X_BAmZq734~xDw-=hJxmDq
znI|HmCL4*@T9~~xODHj`Vq*NaG`B39*=Sb(jjW>{EATay+A5HGi0Z$EL1k1dM)UtI
zd{A8#q#4ToUxlt-7!R_oPFPq8v381_mJrkdhXlQd!JKhUr#3+usfVCL10k#g)_=={
zHEqUtE3pzpvbE;|ATM_d#d<VQUhjawq|Fx4Jwa&(Y`ySlWjSz!K*oMHo@Cu?`hN>=
zEFlYs`ygg5{MS3)0xW6GaPtyPj+9RxQ__0<snZq8;0T>ejQ=$L!j_N#{h!m&CrcW+
z|2<5a?DiO39>a;ZbKm4IT-Qb{!jak*9#gnBKwG%-sl!nYqB|RbBUFo>W^@>3Cv0xz
z$mdy2u}cNX>5buK$<x|=sAU&xlK9){{|T9G<9{7%pBNOR$#I>+|GZ^j&Z}Tx6bWh5
z`C=3<87L=n#Q2J%wje!RGs)rnd|VGInPp{Hi+?fH{pey{ta`hd#_X*0#q%U&NkOMo
z1^L0l!}XLu!`=lqsV%m&))t(H0qiKnPZori`r_o|0kY|)e;U|<I_g`(*p{382n7~j
zL50EHNdt4st_SCz;#<wTM%TuaK263-O6&+4cnM2Ot$W#7EMKxEP1acObY4wLpR>4@
zG<*NZCM==9s8EZ;gsPgFhoowtO`4=@&^&i{+{_JN&G{I-TBQ4CmfV(&M-QhTf44^d
z)|0~7dZ`~Z3PV6MbCO8ceFO()L7x&7###W}_>$<NK~-({WkvEgV+SBZCpgYUZvQYz
zFpDaw?Amyionx{tc?8=QBko~K%qvAIA%HTZYs@9>eTC;XSKjg-xjWvhbwI8t&V^-}
zR7)6amcGx~s~v{Fm~DnQvO~cdj2GI9h^iE-RSRgg`Z%!i&_&ybIm=kP0DoNR?t=XW
zpRf6?4EAw$x-Z}#m03p6jE&M5iFH2{qfFi9Wh9c#O(P*8P-Wzr)?)fXspnZi*-VkX
zk{u^KX~(ebdj97dh^kWWCI!aIe{ypFxAPBKphF{}&+CMgct~PN{6s!U)bq{V>8{6z
z**~a;x^o=-r`aZIN;J?<Bn=>L(_ZBV-W>P#0%6L%1Mnk{1&s$~r6n;UBebj3|4*kd
zis(cmTA{7YZDwd?3PC{00<of3&<w?I=|`&B5Ro@(%8$>g&^R;X)z!p8cOayh?-;#J
z0UBZWBV@u{it5M1Kw1^`M>L^uM|B!h2lYcDJN4>|f~$o008w+{1l7yz5D`N)o0Y%2
zI`#czAs`n-70R&jQ*jYK-jd)YD;)W32^?+HCxgG5U<m`<B&@aH-2y;-5J#rFP!wrD
zzvmSef_yD1Vk`ZP>UxovPr-jmIc)g087%~GwnUX=;b*V@h*{Bb9?Djt|B99W^wV4k
z+P(DwS1+NPNEjX!qI6^R=~l2Y8T_@VnvMVT!2}}+)9;H!2vZB>p{K!w0DIGARQ^lq
zH@FO_AS@M-7tRSzU~I!raPpxmbmK45$E;|8s6681^D>=MIF?+;KI1=~vnk2~U%>*S
zF2!+eOrjf<)t%qbD_(Z$4hmUzOzQpl!@YF!GKkY*rOiJia0V^uu5+%!+n>8CH~+5Z
zb56j9*KP0BstfD!7img72Obza^-AD$0vF7AQ<wJ{j|Lk5b|C0g=6vXvOpb}h*3!XB
ze-Rg6!zof+bFuT{EWh5|miF(HX(Ep*>TzH3jGd!xR!lbq=PbFz#9@a`uANniBcCMQ
zB{wYd7p+y}Pz9&1_U)P}0<-<LG79A~4Lq6|@O-N|myD_I$G%ZE5h|tkdi2_>viGSP
zly8jZ=0}^Ix)x>5uy)^iop_XGwoSHaAGN)VN>}fKeO{gHdU?<l%?cafG)0~4*RCO`
zAzp<8;&C7NQ<tsxHx?rw7p#~ju*RYJt+F-?>rZJ^b6-8Q7D<yB)+oo-y|YarpTOGo
zQMc|~4>m=r#l)YM;}1SA)26=C^S7OqEHJ2D?!+oyQYUTN178U!bNcS2l)FbtgVOik
z`bmABO8o0;@CTH=L858WS@c^H@-r$U=~hQS$6+Vy)+w_=OI-r6!N0#iNizhWWCGf(
z2&d5w`uj2JRaVtPls#izJYr-p1V%-}KIL*04r*VwJ<njAgWA5%O!_4{_WFo|NgvM4
z9d$)vEBkWJOx1i)DAc=9aWZm$y%-kEc3w`SqMlQs@20~HgHR8$H=F_7IR*t=u%5=U
zj4#FOE2oB@@lQmh@Qsrx=e4urC(llz#PyD*2CK-Su}Bfw?vlOwoRtz&uLaQFbPCia
z3EMu)D&V{s*FpG@r&(7$-bAv(Ky$==c3Yfa7EM=#SLhuNv-kONAO2ZiIcZt|I(R|J
zQM2+jB$yctYqL8BG*EB$Mb8<cCK!!hcSe81o!`h3oMO--yuYLaQ)koI(kZfd;k?y9
zJ8O&ODo_Z(1tBq$N`=2e+H>Fx2|q}62%cM-_>4bc>?6dm`-0*-!^M>afs*!9D!ze5
zi)iuWFp&F5By%JyW1n)D%KPdm%F%7RcEAvzk?k&pW9pVFliPq2G|MgK`lkSOcY15*
z;(d_epdcK;!TWLdN&^|*5Ci#&vg-~@{szzTru}Rr3TwU*LoUu8WFLatHv~?kSfW>S
zJ<H|Mt-_iP`hIYN3`F9ajZt}10Z*$|na-^~AI#Fktf}K?d%l(24#9`|G?)EEyGW~c
zjURc#^;#+rf4H{lN;uLNtv)qNSfw@eG^%8Yz(d{@!G&getRA=YsJ7ibaa_%9LHW4+
z9Rq9@SNyE`KK!Kw4Vst?F%V(a0$4&@XTKQ$E>T4*?qKpEmn(lJdZibLRKy+MO@KZc
zkZDhk4sHC$hvA}euI?)OmD1Mf(gB(kph}zwJOWO^D*(F*<)K6TXoh?e_RzIo$i>gS
ze1sGRbIADKyo9Sp$3r~CQMZ`2=zq_;J{vZ@{5_g7P*eQ_Clxg*geWz=cT*~qP=co;
z$Dp)ex#vbKCpZ;zG-H>FW{h0z22lRF?k*MK=UOP{&~U|`lBK8`evzPH0}T)J3-2U*
zj#vN~ea|$Dkhvka5^58!?G3h0Xrlvku;aJG;nhW%#e<?4E$t;Tyhq0^q<yZ8zX$9w
z`w9t2+atM5k4wWo*wJvp6n7tFrC$f**Bd$v*w~g=OWSn49i;b`B|)&i=#QgFv<d8?
zZ3a1$g*N#Qr;T@g#vR&sDWO^ndqdJ>56EGWtro7YUVsf)gQ04MAwA2y9-?rJ(5Vhs
z(2_h0Ik3xSIH*Y5T^;I>yO2p+=w=1moqUiTu`z2mRMa(9ASeDY-qiXuD80o?inQe0
zpxNzze5^uTEF>eGR~V!&LASV1+k^G&ZHErk-Hx1@x~^$m=tAc`jj6{wth7BQ?=C3@
zr@L}Cf57@M%Lp2DVJTm8*DT009ezH1NKp7P{0oh&95VZJM@gZr!^kpRC4g|rjTKgQ
zEku(;A;=Enr}^>T^78WzE-vpT85QEP2v@FK<xOt&4Ubp6bF<c2UE`8fn0mw`U}Jc&
z%8XY=+HBCB6_92oJS!EtM|9(iva9fbqqeh5$HwoP;wAe@q1cExi>(zh-=j}mXA-X+
zXi0HK?wCE1Dqs3F<?r~HZb0Ohtc50JZ(~Z!**lA9kk4P;W6z*<mke1J0^q#l2t`#F
zKO{fZ7hKMtazLGhE#w+MCuzmx`U(G))wm(Qt986i>IHc$(u4!0|Kt0L6$aqmg~Iyk
zO(@U4aQv9{+Wa;ESC>8GdVYj8Ud3O4s8X?;l@+4gl%HfHqg9ns*|NFF?S5U5>-TDy
z9EkL1<Ktv;-{9$thIy#vJi;)2`Q-7GxAUrNr0xZJ>eXB(b`ni^)Z1pK_)?1INy=(0
zL6sX$YJ7y>2v_mRbIeo?P4V-u*yVq#dn~|SZ3M1ixKGsTkRb967Q+w;^890RkxS(B
z4}jN)&yeQ0)pz<GSnRKp1&NJQRA=F1nXp&P<qt7YU{ok1{*>*MzmJ;`fHXdiBi=8g
zckJK*&zdf$5J{h~NY+OMCcuzysM3n5<7~*rwBsyH=wAcmg1MqrLTpx8LJf6%6F%qs
z(&0w?7zZg=uXx5Y#t#m4Rw)3wjHf8gUyg&QjjT`bl!2AGfL#rlX-t=qt8VdM0M6?X
zi2Fsj(hunvh~_bgW0RvgcR%*8tkc0ExPTU$ss+lQ6z$K7gK##hLM|{`GzPwB-Ttht
z3)=9MPc{?U)*|%@+@l$@jY4nuy0m%%)A@Xq=_p!OPO7Z%%E;7MA_nq2)91j5HP##u
z_)S=Megf}{z{`d^`z>}MP3oqO!Jpc=OR;f~mn;)|M4`VQ@`)S${2m0{1hE9S`E(~z
zdw8}JRIYL>nr##!8g$WsMb<MEeD?kHl+BzJjw4yOp!Zlueb?mB|3fF(XI-FKesT5E
zv2{<i=yhMRV29pBDX%6AaMCIEOG+ow_CDhz>ZUM6&c<Yo$$oVO92j4HN2O=`wF{@~
z(HYGC2IrW6yP2zC3zd-WtCb`)`N=<l*(g7f8TuSTb8M&HA#e2f4-y%{Hu1b3%l+Qu
zDKQ?zj*ghpL_4I#pFx51;?p?V-`^Nrxe(rum*S|X2kJbo@f2&<0M?$bV%55eptukt
z?IY1CUy#}5P8`4JJ}bi>&f)f9tZk#!$Y?!XGL3p%o`oK17TDv=|MYA|6BGa!=kY#h
zut#y=1<Jc2c$JqSh0iq=sv7J+Zu#oJZkZX@)^nrBUmI30Ia5{!m7zy2Mi-dXpm}|0
z5A)rx{_cpKNF!_7<Xg-zeUOa#iwqpvEnko;yorwe3aJE@6;*Y%&_DUxQi&Qt$Sl3I
zRl7|Do0mZwwsz`|vGw8@_ziW6pL%P$@Ui9{vNOUi$UUmx_Jn<z%%Q<FY$H-&c+nI}
zR~&+CebfKmM9qf!Mf2#-1yM?%vhJ$m1VA*a{%#~ok=Z7XlY{H8mU@X)@~JRW+99wu
z3XMr-VigvnC<(6eC&^OiMEU}mLf0NbK9=rkD_%X}jbXUB*I#m<a5L7<NOs<h>HL3&
zL2RX6j#T`h-?`abFnyF#RNp<5!5~*RpRxB`Fy0*g2@L99%IKq!w-jP6lL2=6&!g1t
zUanHmGW@VtzYLHgyU5lf_h6m!{&j6)P^_u3igBh#sXhstNojT^_ySl$hN|6>ngUFA
zTq*Gu3O+(`dxVTHY0mWNJrsuEu7$<i`_zKdb$+Gh3AAs12*2Hy|2y@Hy^o_O{LgJ7
z8vi7Is!kh8C|S@TGehy8=UQsdNZyOv>HI~G(qGhiL_~Z`K;|m_vnwp_=b9S$7i^;r
zBu>^eT+^s+@MnR|WNGg+&;9+>)wBv>#_GSw?c~6Z4rGy9Ru90;adkZ}hBue(y>tqT
z)N|(2Dny?qh49N0@F}wN{s=?n>aj@l{hF=u_IDL7Hf&qcq20dYM6&ZL!`v@G(`=fw
zLRqcn`_~GIZM12dx%(2ZpuYfAp>akdAA1<(0uJ`fN0IYc^J8W(*VRMNLve2@Tv{j*
zDVQr0AT?UY1$bLjCFFBxzw^A{r$NL8<no=2j0M8yH{_eM3ArP7RIxi)fD850jow#k
z|Ks0UNx2W7@U&P8GUbN}7}I~9SRZgix(zJAjnO}DYP^a*WmL`k4AEz}A1Cm~5cLSU
zC$L0d2&#Drf73a&OM#Q6I)NGRj#+y0iul?rwXhTT=1~h>{sjG%C^LDVqK~P&AkrTW
zG|R%ha&Cc5*f0=FAKm<ZK<3goIOwWGW~|+D_>M<wi7-+a4M?LOa-#lBMe&ll{LL>;
z6WQ7-29c%zz5Pud)YYr(4qA)Q$ZG?`0va(LZNm%}GRHipmA1B&E9extt;wZqM;k;1
zZ2~I1$R|`A*P?8O@QHV=!aKox;bowQ`)M9t6VjpD36siQ>oIn>3#saQv{52_>Yl#l
zC?FzGPOs_CY&uF|+>3c_Dw`UF%m($7(kgE5bA5EzXOWL+rU<a7&a9RC;qtZDl7>WM
zExdn0@H1-K?0C|rN))us$W3Rc1G(#YXSIMZa$gDVjw9R8Dnfn?%uVYvG_v_vidz7W
z!{Q;TG82uXl*9DUP#ssnwm0YbE%~fd;_$sORp`cH#AIwR<B)ob8g#l0X8gTi9n4iP
zk?xvzzr2V>F*`|~yR<vPwe1XS;Sj?AIunnd8Q}C@=PPQFF*JgPPG3Di9x4T(jt3)_
z9T~*MX#fh|)(C#+439ohgl1SFq*p!4(A+lwH?-zBkRzDgloCPm>>tgc{zr567oja^
zK^<VwF^WKLQhw?<zJB_~0$|#($}ln1TPfo6$9cF^#iHomg~Lt<Is7#_Nn*tHwTXW9
zXu~3Wloi_x{fZJ@lD*)k#qU_W^B<;{%l#p>ghjRt?m3|fRuwYNU2#(lz;lqA%nwx2
zt*BhL!XLBso<g8C%=Tj^o-&FiIYL)u3ege;ka|_a<I=Q}H;F&BotgCz<|N14lQV5>
zZ>jXQx;K@IFmixoK}&aSQ?)FAP$9kYZnG;$Ei}S;;qIW7*eO@hBFpR!1uwfv6Rn)#
z1x=2mn8LSW9aa{7&=|Lp|HP6<B?|uU_#UT|p${80yow3vP*>E08ZbM}DWV3fi{kW~
zFR@*gt!kNz@f9-XJmC9t-FSfHb>E-?>Jzv4dDT~!`z=<d#z-Mv|HAb(cxf0Il;a#y
z3wg1*C*%wj#n|<7s^<!8q<+}hv@eR_KT1FA53~h-M;U(aZ=_fQo53Wab-`3KH!-%w
zvhsw~TcX*CUn(KPtW=L!(uNL&8K)#HFQ-4yqKO)<gkWqcCr$O3*g`zLYB!#>h*#cQ
zBM9+F9qzd5k>o)ozOm2e1bJS)a<^w2EL~z^XiDTa=C6kBHOe0LpPh*So(*D1!PAQ4
z5_YJWD+f<^NIWcEVELmS6zC-$gtDjBPR2S_Ga*l78zB@)Te<iV`$7wIi3vA>(n-8{
ziClo#s)F|K0Yi1>k&ONz;PK;?&_o338ll=<cY9&x&}29Lmy(O`6hB8&^>^`-R(m^a
zu{V<g?Elmx=M+(;#_UergOpzSq9hRN`Gxb<BHfvC;WANAs|L}dBFnNP$J8>9)woxQ
z=gZ17b?5yy06DHh=1ZF}Mcnm~@}UyRW-4=sX}8;#!Lk-Vmu=KL{0rGccs&b^5&KXh
zP|52P^Utsu3gR;98@fJMG?TaOU5(f_f$cD2HLYQDFAFA1oc<4l#l?~#J2_G*j0akR
z*IfkxhGkoGG-dClPL8NQ?m=rIF;3JS8vK?BywhhP!#A70U!aOLZ;Ln&C~3y0_w!$%
z<*?7+2jiJ@k~iPw_Sv8pKc?$|YFdj#$<mx2VmEZfoq`oVXtgkeB^9`U)GQE=!S6$I
ztjV$n0Q)C7VG_1yAX`%Z91*D0EJb4IHr~XNy3eSV&tu<oSTP=)Qi#M+G0YI$t(}_S
zcbN+sj4bY=SUjo1i(Dhs_A;Hm=XkvcXD3A_k{rnLyOLFNGuf7Hf=vh+Z`Lwm_%tJi
zR^ah`6x7g$I8!O$P$_Q6kIRPgMxChez%Q`0rD|E<$9c)n6V<#r`Fzwz@Oz<Y!<ZyS
zxT5sRbHrQ|C5tY%cw}^u#2++5BbY5@RBO5Zb;^_)iS5hJ=$`B-Jbcl4&Z;`E+?`h#
zmQe|oePa)|?LXB*+-^g(vB1L#5f}1!i}8a5WeKZWu6%Ef%`*Tl^SamCt$3vlC;gAA
z#EV2Y7S=PK{eLUE7vIx(-V@6hn--nQ3e%m9{@wkUb;CQ_u~Nwx>%1lNJ>tE->w^>t
zo0Q7CwH8VgDgV*hX}hu9U@4EVj~)z5IYn5Yh*y$Axy(OwaCe1vfS#sNUTb&7N;D?(
zu4JLl6cbpX{w(p<-7}8DCg6H$99_=8MWc=_?d&M<%<ms9vB*_Y6z3(6+@`(w_qC%&
z$On-&>-PrPXF`Qezi$g^5sCC1Vsc0K)wdd(QRwa-1(&6_9>h@L#f5jXu)o7aS*Gpf
zcAJe8Jg&9kgsFVR9;cWcN*q5^(WmtLMe}4GnB7aGWK`EnrA0cj6)h=d!7gg<fW$=2
zWezcN%XGwDPR!vSnKvZI%>k<fW0Xt0MzI@$Qdo9tcrRGynb~<Irwa~Bw6aDo+-VM4
z6FFjMAsyG^%9lj2#y;DrtnMjc0vH?USz=_j;ln~X9f#B#r+vIf`o{zvVUs`d;;AZA
zb2VSJ$Rsto(zRE8K+lW2P1md&_sG!_M0l-{_VP!8T2^h1tq%%r6LQS6QOk15SY<&A
zA|bCfP7|Buse!!3bY6LC#PV+q$+2@@;bqY#CeLwdoe-{P<S}UC^e)Y=g=Bn<FueJe
z*S7#S9jsota@IY)RWYpYvk{8pSAs4>!3|4LaJH>Wm2t>`)9qg?XXt<z5Sl)^-X80m
ztx3*3)Mpc8BlP%Qv`SB4`^*aT*h^2F^v_oYtY3fI>B9cmr|bWE^r)Szk7>}nr5*U$
z^x%d!=1=Ud$nrJJKKwVim4q<6yY=`0f0At5>NYGxO-r6UhRC%<@3dIwW$dNs&C^hL
zm=<R&gy!JRm`GB^PwC)2&!<z(39z?g#j=@63O@yp<G!gKKX4E)t*l6`W=TEs*+ftr
z4|p&uY+H3AcEZe74)~opE}I`*FBsiDoyJctc!l4XMP-XITE0IGk{+SNg+2@#jmPt&
zfjRA_WF~}=6?p%xpyvH!qs!nWIRzqsNHgw}9meeM5Bp?AMm%osHA?5NDvWB5`>bmz
z@2i2BM@zgGIw=np!3yJNX<X!E0)tu6Z?D!{{@!=5mdm~-+>Y?imh+h^WQ%#`KhP37
z6kAI?GRMa2kv;zQ$l1oP+|Yy3HvYj7fBp4)TL#XmF)-9Ww2&<<sQWi3W}2kJrEHSH
zuGBrp@q_WEdO$v5uS>VB+`hz(K7Ug-IR4?gF?IVuiklDm*ZxFiVZ=BZIxjX5C+~6E
zptMKH$j~l-?YVD!ulv!5&hfV=$2MT#1m)FNpbz)@4=Fh+@GdPYiRx6B<-Jhlv?_C%
zL9x^?bq!|Eq}*!W3ftYq>{~>Y_&$kl><K$;{mgXg;CVtd@brgyh^sg+kTJ^5ckH3k
z0H7av#Me1xb9Xsl6-c}50?Y0mP<JS4p5b4gcIe6$?lK7UtVmR3o=HKdej%W#{Ivhp
z6p0aL;AI=!XDDasz`xRSpG;)&)fFHc=(}6NOC;`x!1Kf1RD+J0nbq|g1kJXT4YK4m
zs{tn-^R%puz>I4Wj$K!}wm(11B+XE}e9Ljw<IjP>Ecw+EpO0=#JN#5%HD(ty%^0oc
za3Gx38RfXv)fuF`;%jd4Idsw$QSMD!uolgSJX<2{dB5#c3%C+19;FEbaIw803oUr&
zG;0u))l$Ue`Ua+lV^t-BpqJaXC-@LG&iKWBdix52J>0H_GPDw=5;?m`xT+5Pow!Vo
z9!G^mP<Ll6i5Mlrx()kn*EwlM&!EQ3*g-98I!KAYoX9!<{>2y86$Kylpq&zw{xobF
zZEWa_elROXzQ3lvQ%<bn4n&WhP1RRcZXzYUT+Y<6e#Ps0?_xO)x06+wWm=lp3`fqh
zuLp;a|D12YM(AYNi}_mxwps%xu7O}+{icd;eQ?**cD6x8MEP|*4cNQBE)hLm<-F*n
z{|>ree-uCLYx9EHQM1WaOZL9KQ92y7>FZ#!@cWW@quoS8UrA_lX#$?|x`VGQu~Ac7
z^~+1dRmG->vx+bL=PR%Y4*MK`@Jk?(8}`cj!GSv?MO%C+MUu|2DPx+s8WM!yIODJ(
zoZsks)xqRb@bLQ=N22dirfdW+an4dcCl(l<T+PSx2hTVQK@Od&#eU7=xTppk{PCE$
z(JSJ5;@rE~lVm>zub8x6?eD3RC_@(ge{Id`YMi?ecfNzA_kM5gkiZx=m+QEBa_Mjs
z+-xr8xG+w3>Hs8VH)ex>kv0jaa|_}{8$R;nL(0z_lyG!(Hl)@<BOTX*ms0o#ugB8=
zn8cdaDp>|#D`8?{D)DXPL43vPF1$$h#zPM_UKdXDta|MivPm)Tyr8;Zcj{OvCcFki
zoh3fZ?k100eGzl~d+|ie!2&@QCKTsF&$p=^p{<7?k>>y-i0+F3B#VzcP>3t47z-bh
zzBLFML8l^tQvcK+%V8UT7`>lvDk?pY>E=HJ1ZlEBA-rPJLpq64V%YCib0E?Td%69e
zX1$GOz=9W@Qm?80UaBJ;!=|09J9<3~r`@Dvg1J%}&5UN)a!|;SN-o16s5-TKBOM1`
zp(j&7bxOG%Q6W>sp{pg~Dz!sG+?8ot`F3w1JEPD+5DMYON%%4(=H=yNH<trpQ}q(I
zelsf>7%<W(&Tj3`tZz^(g2=s^aa~LU6RnZL-v@*kY_UEqH&u<TOxGiUC24w-6|kV+
zz2PvUo`WK0Z<GlqsP)d$VeQhn>TPW$qO|>G;_UfZ==|5xS#Sk?WYrgpK(aeCx+9&J
zAqq~(18P8C%|YGs1XL)KGUf~hxAw)__iM0;3pXP-5bKN%zVWbZl<1BkF69L-;-Q;5
zkQ4)YSRr9$1G6M)oj4T?0A2Ayv>gdrSR+9#vPpB#&RNDsC~dnp%AM&JI*(WN{Wgt~
zso`ec&uCIQc}mM@b1Qa8oif2Is&`K=y)ELxo8EUGd1a-E*IsX74=EeGFEi)0Svioj
zX^^zV1aM!mkr^56DrF_HTbUPKHg^4h{2~MHReU*H9-q%QJ8v>{%Ph10{yWniHF6_q
z;^$2BQqF@A(w}lu*{U;`y=c&!koan5k8u>6`({;$V!3Vig5hE%omQP*h=l4xEwcGy
zxIojxN*r1)J=8(6(T?}t!np6wF7j5VacWxNHylqdfJ8`MSkndv_es7w6iz1{b@9BT
zYMh<w(R5&$H)mK8MyOlbu)DtY<2mdaL#DX9GsY!PEPehiC@YsfngVAYMF(fk3YhnY
zUx|+y*^Ll(SG}XMY{2Qxfhgn_A2@NT*_r%QkF(VA(AayzapAh=>G|24x`7&&#wPHU
z1xfsG-V%i>zRHl6{-X0ziUwNy#yccQ2Ah5LY2RN81(hVH4N}ZsUkDJAiE;Z(3?n7J
z9r9i82~UGGC!*b=cLp;wvu@8TsNykHrpyrrdeI0Z;A4<c$FP$WtHtRVc^N@LV!Wht
ziOzW6f7VY&d4~&45zQWreiJFMOG=Zd(Oav7!6@Ry;O_kEIq;y8kT39$eZk>_Fl*_q
zb0{P7OU1?O<bIr<%gT8E{oaC*mxpdM=FKBp0dI~Lpm3qZ%j?KNkFF{jp+OypxiSY?
zm2|5nh=$dY3ZCN{pSP;ik`*#kW1^Yx1S()d;FL`b=ChHFy?N7c?J=5f4*j~+5uPsm
zK{Rpa@7Vda*`0zHcAPtrf%8V6Pi@97uc~g6_K69qfr8YH72#=78GPFNQ_&|~8xk(?
z^PQt_>wAx4Q@oZ@@3ZVN-o4(K*m6DOcXes6MIpq+=X3z8ojTOYqoIXrb&fg2LpU`Z
zWqZbBKS6%~N&M#80_dY^mkb%siXw@`h#0H6&mtd4k){No?=pD4u3vZg)A(0>LIh*?
zD)*g@Vm7ejy^KUc^N{Ha0P5HpT{eoMV+FGSnwA7r4z(8%b=Ajlz??>g|9S3R5O>5X
z7QVhb`2RW{`?r8w=z8av5qNeo$Qu#G#S8>A_w8^EzxmI<a!cyROaABf&GtH;JD{lO
z12TBF7O!ipKW>0gP>&!RrGiSN@2@6ux3w+#)yJq90sDm`5tqYAKt0Zel#iuzmqv~_
zz1cD|2jtgA=!YVO$~4&F!1v}1GNP9w6BJ!L?{*%Q0^`GM_Te!OlP80PfnEMrJM1g<
z0}BYBw~a&q14eIe`;24pnWYWFoOAU6XW8CqYG~}Lfouiqt5(6=4(kCr<>RR2M!SsM
z?By6zrIu-tLxc|#AmV^Ls}=Nu-bdzZ8Z<K=g7w_wjZR1KA1Ae04LvBot4Ol=dWi*d
zaPxKxrg{JHl|u$SeM=ywj+YZyiNf;a55Fstdf(U@YWBp6W~rMUc!mKI&W~^X+FAMB
zW!FJh{MAI3A6xBm1yYC&dos6YuH^~b@!R+958p-2ekpvRN_fIpcxSWmL6<MO72qx4
z(8te+^-(vR*(;fo8I)et^%1?YN?JoGnzuh{$w`$?Cm6X}I=ic(>Sb^sTl~b%)dYXw
z(aqU{&;+He_@0Vd`!QvR&OY4<C-M8-6?1Csm-$9ZT_4x8D=xns<j3%?FK}M-xDcr5
zRBCD2z%F!RK1EtoYAww!%=XzCx7}$D72I+)8*o<o1WR&5{J=+7krU$#eW@8HxdkiO
zOoWT$Kisw)%5Wl|&s(08ODkV``=!_&dHIy+bv_??3Yq$0Vr=}hpm%cmqEm}`%FCJ+
z+pws<WKN@quX>H<SGoy7e{~Lxz(DrmPKj?Bl*zAw*Yd_i<T7*pwyrEBq}_B$+i*)6
zhTu2lQ2v{l+k%x@4RN!smb1Sap}eyEz2$9RHlMSER;6G+X~iTZ$pTp1&|nE&Q4e9S
zi)5{fYqyS-H%ihAO<`47zRrpC9JufVFe2xYJ3h(pb+PJ;eMeI)1>KpCmn^<?<ek*K
z+5a1WjIcUMEv2k$)FWk;ad0mp1?Y_-jXF#|sinr7E2l`!9XMv&5Va{=iN?t-BD<S%
z;+_PT(k%94eqgE-K+1IN#QvbmImUq%w!zPfILvbG$<W(Vd-TW~=5^t(aFM36{ZrD=
z;<a;>8^lJL`Fv<#R|iWj@@X&xeMV4TYidE)TO^OIP?)erCBa3b8&jAqIHKJKD+c3{
z$!Yh%?hB<{*2ECezO(5HItFGKRW@>NX4+(4Fj9{dzxFjBQA!B$8yUUFFpCGVKwRSA
z;lz0N$>Ru-E*#pjVC)J40Irwuq)5A;K@`8(fd?)3j=L6xmicG7TFzJBj9oCRdP=Jy
z8$t<a=^<D(u;A#dgxCGepM|%)glhK+8z1cA{jt37WWN5qX=uTJ-oB?R|Bg#&p@^{(
z!%*jeN-I<P89K|X)-zSFfFdvU)A9aBy)8bPl&6=6RLP`h9VsCnGE-nyMVz3X{8BDj
z7|=7>Q5lL)ndE<Bf?gX8qG3#eXOUN*y}b~R8@?`wvq$111rXMJQk^Q1d=lB+2&W}U
zEAyUBkYKu+;2E;CdJU|9q4MlUI^rYa(nRBlyH<jS&a6=9*XP?@c;6r&3p$|t=8srt
z3D;kTomSp{G-mi+7u<}E)Sz07^a&2z@i(8E+tT;-avpyf(L@oiUkbc(dvhpBJ+hy%
zO+AOm8B2jPc<~&FS^tu1-)s_mW)BIKW>!I&DixKfm{fjy1B89!$5YYoGm1$PN%46Y
zm3FxN=}Zj26*@IcYFX=lBy-Zi+v;xgx|*3<HZ>Z?U0BIe{?q4Vobqz>wfL085@lMB
z@k@id#M01#8rIwD!$u4uscN-Lk#B~nhq%47c|?XxlMK`zLK7Xg5;HNZuBM<z0{)y2
z{EOWy5o7c4jPTL@RQ`QA!Ez{k8`K;TL^D0jJ2cKMq>2PM`ic8!wn4%ZgDNdm{fiz$
z@GP5I1)jM_rTtQd&5sd70@XKsm7NQD?2ET+t=4lJE_dOM6z~ioSBlv7&?Ppt*e%)0
zP){WMS7$=#C2yIHOOz_FpG`7JDJ&L_*)Jb@79=$n(!?5uv;K-QyO(0H=&NI}(HHYc
zN6ZVJuSmY<Br^sb+l`A#OP|FRz8{-_{l9gHsC9oaHpdBc3F=99%l2!AVE74Yl+IDl
zrRJc&z)FkTY9@Ku4lVGJFNFxhQTBWWU?j&ps;NX6F+?~bsvE+x_MK|`|AD&plk$qI
zVhnKLVmU7_E@X0}ubYH;@sb(2RfRZv9^&)2DXq80eu`Fas3U{d4J>GIt;KIeD$MS?
z$Wc#zF&U&gs7m?@O?)+ovMwX2h57P<H9Xk=4}8bh10r@b-&akH+~L&us`W6an)f9W
zRJ_pt&`vsCx`unt`BrjZR$||GGK>7j*xy;+sLYAOR(V84H6&&PLV||>9}``GheCa1
zbu(?uDyeMe$Bg|_+M)Xjm(M`q{+3=s6ZXqurCjrrbLLIQ9((TZ$Wki)L6l+@47&Q9
z&=a8(Y=97_0^Z)<=Hpwc*1?(yGfkIlw3dSe1|_GBybYj+CJD`=rJ8M*KKA#6pMb5_
zYPyAUY84zJhMC^4(zv$?HoyMJ6vTei7xq=9jK=$32`T4m$fX(GFKPPvz!o8mWKv;z
zWdTksnhCR7J~Y7l%B64p+i$WH$z&szOk0_$1<2djPuTi^gx%+pz|)>9XVe8^Kv}!D
zbxttynseS==v3lcjWJ>+dhEY`j^3$8jC<qR+X-(#&ZuOhO65>+%G}E^A9NXReuA4_
zaG?Z&v7r+*{KSVQicseppUZkBgrD?DZbeWp%xFK^nF3CZ+y|H|tyD!cHJ6gS$(Kpj
z;$Mcmp!{MMAZPHyZx@q+*NPNa9c&K%At5Sfz6F6a?U#ia4=`wpvO)}RAg)}r?Y?H_
z?UonrIfI^XK|DX<zNUNBMDy=cuJbSpwg9Fic!rE(2U_4P2W3)eGSSiD#I+Ik%R0*u
zu_=b;^>GHBz<#cDILf4M`kC04)0-5yIi0)URLhu%TqY~8tTB>JVz}^ugCxGYTS(CI
zeNP1`nsbT|p3;9fz09g-Re5ZF#r74}#xoVQEc3odXOD25sD7mu+1@}Jb|#SB)~eIW
zOCIH;IwR1r<M<PFLE7xqS|9m;%-ed6+U9+G<^B(P+@1}O!&6G*)ua5VN{YQ0>ReUo
za7)#nCioQ&4kv@zEd-mDxyc_3FRYIt%70z{^m7I@B7-`mgj{L3y4DA(KNhY@u2R<r
zm^{I$Rt`vhWBq|lw_De@zJ*<w%G0OX-tTpd>ejy;kiGVD+@-E+$OL|d`6tuHd~9*h
zuj&i@4BIo-I4d(Ypern;2?>9QtM&RVrgba)jc<DTgzvinBFagN>Td}{HH0o9+Y+%7
z;fzT>IUC7~`H!oOFW3DVVE!w<=`e&dy-n*j6QxqBq9cb%>xHUDjJja)H=b#>Lo}`S
zau_6QEs~}*##5juc=V2NlO}|t1t?lQhm!4R31MR<a~T=SHbgurXS^2JxpX!Gj&-O`
zya9=%-wiAHKG1Xnm?E}B<^}VvQz<3up$j8f4??w|FM4RIBYg({!LvvbB6nB)87*S!
zHhuXVEvrDQssZ!D5Dh7Jm!Aj4Za->KX*1HqSaphD7s}&3SM9XciYWtF{Sq*}Hp`yi
z>}qGZLc5QaJ7y=F@6P2ilq5h2DVWH4^1#wlO(|$%apWZC_tj*z)Cc@(ZK{*`{7oQt
zWB3v#uy|q8nox&|e*B2sA)*6NZC-u7hTRZ%%J(JnrcPzA`8#YVLl7)fo64V~GYQIE
z*qW`D;$+1&#pBA+9L&;q`suA;sZ0Ap$fw`MFj(G8IxnMrUQjQfneBT>S4i=Dt5S<t
zU!{@|<Fp4RIH5`4Pp@+g?NMiFY}v+dVX+RG6pouZruDtX&R6A_;JxFQHzD_<QQP+C
z-G6FP0^K+7;*B3Yd^1f6|D_f!c(=>FZ#T|@ZxWF5=U|lh_$Y0=FN?&KiAI2sp-GAS
zCGs6H(;GA>xlri4&6<}>8<8TuM~$H|CP7nO&vUiOA859PoSbtHcpivYD-hUkz^Fyz
zfbgT|SKGD|j+l>02949}e?h*C6=XFPyn_ZxZWsDu_D23Oef8R@<fw3amWzm9V^s3p
zIKA;dwZ2Qe?O?XGlRK{8{u2{FFivS3#4S8GE`^-9Rr+V*_UXK)W_&`*UqHlxuq-?0
zzqcuE<M{{w`}2^~)v>I?f>S6OBJ2SCva7J9&fbZF64}c6x?!NTV$P|7fzzp4(N#CS
zh2J*}QscVfgD7SA=?|6Qd+i?0U)X|r&>C+2FqK!r{J+B1|G#HXx(@RTLvjn(+3T|k
zMI(GVU}gcG>pd<K#s9g`ANZdOld6WVdQ8RBc33Zf#8fXF=8Y(WZ5ucRsl-Rs<rUS(
zr>6>RsLH2PXp)FM!-3C<sbqx~7Tf&HzF;OF6YyGy-cbjO^ZEqF;)0TKlal$gz^hld
zY#%?a$u}Em3PlWG@XOapz|p5B3N_uAYCmj@wxI!xm=+mJtTx9xS>@&33XRYw1RpGm
z*oHIPG9-Q=G$uU`_v0OYOxRKZs9WD3X1*vX`a6#EiGC04pzMyy%q*h8OI`%aX8-#F
zjxP2|?ZpKOsx}a$INXzcnzBkn+~#SM%nV+!v*&8<h{+g;d~iR%wHDPt8{~CB>5jb2
z@Q!U6yjxrOO=@@Yjagwzu%k+hLrXyOnQ%YYL@&adpzTET#fgLls<OE6H}}0<e7ICl
zqwl*=x}h+<m|kFxJ+<t*SZKpxO+Qzk9%^pdVu~lcbiaFVKR?gXG<S7%o{58b@aE5j
z@v)@;f;WuKoH`I2U{t;(24EjCr>w4B6v}WM55Wk%H>5`VI__IK<Q5EsE$jQ^bz-(q
ziQ?rzw25JdtFozUm>U93XUV(H_h-{f7933dTO`?_<hNlw?=e1EQOvNK4p|64D><9F
zCw4dQuqQzv$u5S}%(v&)-a;WctiWpews{N40Q1PRC6T#VfkSdh0W?7C$hCIHH96Bx
z+0=Bgg9&&=sS$;?K*oshAF`ACD*IQD2fzfo7THVf$GY({o<k=XeuA1^28-^3dQ+@p
z3PghfVTS@pVRaB-J%6^?d6GdOM%-pHe{tt-CW;72B4f-i&qSpMnxm4Nlh@ExwS6;`
z-OiFkC!vo65R4ab?65JzLmW&t>mSLU+Yws>dAa&FyC8Yl`y0=MrCy>qzEdwiB?Qi?
z(@=*yWI(s@YO=v(Gpxp#s#ISyrs~@EWmH@0PEo~o<<S>?YxJG-bZY~))W;CdLJ4n3
z0H2fq9+&La-?a*o2>{=KxhN^Sbbv4KQK^8z(HV@0<&2ALgF|{SgIRlA5s+8>bs%gV
zHPl$(nIsd%=9JI`yog^J+%_^YGSSBKumFYl5l`G+dp$L`s7XHyrTY~4r`aEXq`VvJ
zt07bf&T~@yoZX`IXHC{LgXdM$pN$<l<Q~ZCsQ(Xp?*SFX(k%)Dq9_?jk|atLBn%)~
z$zcX0XF>81B}+z-EIDT-3>gH597M@k7?PuaNRo`?DF5I&=R3@t``%jj-Fw%1|9ao7
zUOm+ncJ11=Yp1U6zBf7zderq~_U*kFTrLo?Gt(3?W&%QCSPmo9GR^O;vN9S+#!ClH
zK07M|=IZf!e%Lxg+Qx`hPLV}LCVBY%lgXKDpAb{2y&k<=g6M>Z&#s%Xp;;~ZTAOp+
zz}NI6FNj@id9+zOt@~d1;tjK}do+3h-UbI{L4(jEB`1uRoI8Ybe4M<9!GYQz-s5<b
z^x#`R7%_?Hyg1E~?U$nhIbq4BN%&)BmVSLh_b4PI)SzsY)?w};PFCY~be2`=Xo@mM
z+c_2hn_z=#6~_&TmXZc>qz-wV9Qx^orvsea3HzmRL-^f4I^lGkPB1KQtAnHp0B-c&
zH!9MI>fv2awIF}SzA^wvrpdIqB$;p&f3AfXu@LOF#(9=fBikL3H3>0Z0$|)4_s){*
z?gH!)Mpy5cK+!M>jmXGb#F{K&pJ()V)n*v2RP>aOli}l!)THHWN8*<QdCaGj|K%bz
zb<yt5B95hAEaItYs^7i%R=W#|fTbM~PYW;EDkksVH~UUS_-2pu?2(KQj*=#IO~7|@
z*_;t;{zxwPowBYV9Ac{ZT>#&;1mJemTWIe_#;jrspQH26G9j0<xp9tEDdllsg|&E4
zn+F5=C*D}b-RC|0M^(REX?uyKH|hr-$KB(y>PjP1ApP`%%i>sJr|&uTOZr!kw1fCf
z*X{Q<#o&n_A{O^{ZlY=FQPhW)fwxj+_3I&sxeYv|PJQ-tRg<67xe1Dn*1jNUV3;?H
z(Z-wlbFv!WU+TtWEZ_EE6zEzsM@`uFel?l`nbfE6HhN5&J!3tzR_XM!ZBJl8dY6V%
zHITlQ*xfaGf`xZ-vpmkS?Yt67Pcf``YawOv*#RQjtI?VKctS)JP>tl(>O**Y4)%f@
zv$M{d^lk=S5w}eN!zlC@3|my{_o~h#KYdX$Tk7$w4=Q|_iM4|s$IbJYZvtvn%+*r^
zYh!rAfHU_%q{TW-=v91%L5rK`1mJai?(DFW2B=zomgn@*=CyiyoW-(@k)yPvY!*S~
zcQq=lYo*|xu+R_hMLm5oIi1lgD4fXA0I<1XQ-hV6_nCG#4ug}@VqP5w=1%4oS-+d7
zi80r2(FXB_JWplnZ?Q?^lQhzs-Gj<s@NmRP`Ky~5Kd6PgRbyO<8xZ<qSoI0$o;{T}
z(YoWAbVWiO_>|&y@s1$jT-AJ1MjzKQ7?YW{I6eSH85ItncHd@+;kleHkY*rF{$`pR
zQ5hHu4VNBQOI~?C#sJfz0dtn!gZh5bZ1ngtyMqSo{;2x^Sq~A~@lSxRcQZYaf^^Dl
zBZ1}uU4pp1Z*N+D&!aYf%Q2w0nWpcJU8VQpo7^z2<MFw!t(qcru_vslCIMs>VZTzO
zegOHO9Xuj8iI__1Jk99l0O4lZzm<|wmi~qPU>}2kp%)K6_&DFSYwT_ZWo;)=I&Ze&
zM(o0kGGJ7e_NG9D*)0=-CKG0c+iODO5r??3m{@knoUV3!Rbl2l#6)4sE5sNp^mC7?
zvRHaQYKI!Gho^?h)1KOw5I+7MSeswKKGjp35*FG~Y+a~8fSooa&qEx0p<J`-QIxO@
zCJs3>*}}I&LwiYg^ZUv#(nM7P45<K5sUtH;@VGn6Th-Ws|0w*Ll~%b-7cyv%FL})$
zu*^=v1VDSPIS}&d2AaaigONv8@1~lP$C<xB44=1j7KrL^4o&Aix<OyIqOViHEIXSM
zS?O3RJY!;4L=M%een%C{p7TTU$=l)FhLGOtG(jJ?&u!xd9K62yrT8sLpgpgOnl~n!
z(ZLP4f!5ZG-B>^PlH@X}5E1xZPkdH(#4r+&Yo)11zxvt6UhBFUjvl;!pY{HX!=_Ck
zrHr6b^>U`w$3`@?o*<?ajuBj?T6e%ZYIu@Mm(-jt`USm}=eJfTscUt%*=b_YqV$OG
z8aEK$=dOUb0zMrSLS*#yIkc_aUg)*G$Jz)nT!(6xfA%eCwXDtkynE2+V6;&%JzR@`
z9mu3Zm#PlyyS^_opEjW}N$jO^*&>)@^4?1Gxvm)20r~0A_2X}An&@aTR39YyZ1g&3
zv{a_cU)$&nlO~Uk!)<-Nsvpqle{x$tpi_G$BPKzuwXyVCh#wCvMoxj7Q-Lfq@!dj`
zOhu99<WrS#sI!})+84t)HuThhiFd=GX(N%bVuyhgb;L(#JQ6U~<HAaQmZlw4@_qGS
zKUq;MhLla^`zq<{SGTayDSc9O`w3;vtPvcmRf$G?9TDwOR%i7EGxQzA(A&~MVbuBb
zX)z?xx?G`g#Yxke)ME)>H?Y>kYfC|i(P1O5_<#d6R0Kxz{~8|n_94ZCte@Z0AmI^l
zF0-8<3n68QJz!h58tYMcpF-kX_D){=10QqPHrT8@25&d5pT-?flc_mdQ=-vjGe_S6
zbww=qtf#s4&m_!zX`-Bf#-3hRAU$<bdUWtcVSgH@)^O&@q?nifsJoYlSOEkb%?a$3
zs=@nIlzbAZ_CsprrD1k4I5U9B?#scbuv{U%(x)yrE^W~t<{<|ke*OCOvPGExvegc2
z)>%PJlw2~IgXe1QwAx^77r$N2h!r(FdE9wFttn>>gBR1zR>TFQ)@xd}myvb@tta>4
z9Yr;5vI%JQLD`psV8HRsmx|^gocm(-7q}am=(+&{wKjEm>UTv1e|O=;iZ2^C5>#oX
z3{oGo(Z?Uovrgms`~aY4Se1O;>?XW~Dlxz_?VxpUpq$oae4}sdcPDS>$J8jW{Ip<P
zp9RlkR?@WUjcMiOLe3e>YS-iZaUVCC)s1Vm%%|;5`R2E}ddbB*3y7hk36TQjqhJO4
z;HMyt&j%qzX%M{ABA4mb-Ky;(8Yg>7-WwY&8{}I_YbxOf<zrB)Rgo%p_1`p4=56*o
z&tWozCIbv%8kNI}YnwP8IOvE5pdT-zudhT!P!>0&q+K%6G0FWmh%fr(`yjq(C<&T?
zg1j`<nry#Jx?!5(q}?ssm(&nqS*e{K`DES{n|9bzJB)*PPFJ36X1-_BbH0%7n^C~Q
zwzshKiV*!Zv;{rt0U{haD>Sr>HxE-lXpgU<ePg1*s_y8<xJikI#=>F2i2Z)5Mv4l}
z_|A=h#n0kB^GRBo9@jQ4Ui5YlAVkcCTJn7z#6P-;hzB7h8g7h>w(BXj<84Ia|Mc(O
z=l`ZJ(ElgC;?$Ho4ta~XGxt8-@T}XZ{Dh(9CxcHwRp$wrek@^A-E*rt`qaW_+_Ed7
zw(1o29fQicx}>Yc+}nMYJj;Lrfcyh9uG;m(2F0Ug6{pQscY223zZ{W1+8yrH<$~fP
za)F$gujaS-It^DR>K;o=OKaTM4klq1Au0<`-!)Ot<W@2mX?=<C6APbs#p!lSD*|W*
z-I==ZE#&$7br8UEB-wgj)g^#`HP@oe=ik}lna&z0sO{$#Hu1k~B)?`Nl>em{%0FVw
zjlqM@Gu@aY7D5#6hH%9gau|YmN4e-=ea!xnzy<@z22&jNqe~3l#4$1^V({Y4fXhbP
zp#A2QcWc-O3Fr__*wyr*I?z1Nl2idDTL=;2cm9BXM7b%4h6k1cMzjUc6o*-1k>~95
zlz%PE7Ap2@-j#zS*0O6WYSi6Mi2a$PwaT_Fw92tuI@7~!q*tc%+Qr)-*qu7x?b&hD
zijwrcZ%gogWqu1rQo8oF<<bKhp?GcW!5o~mwy)VAw<-5+SQ_j%x!SGM8wl!ZrZ()B
zCpzkrpO&F7$4=bM<V7PpSfVZ<x0BR2+8~HK>ZI&y;K(FajVRI2z8u)z;bsJ6TkG}t
z&)B#D8MbWj)(sOpUlS{JXjUBy1?eMo-l5^F2%d$IFr7-g{72CKNXxjDy9}12*7xC3
zI&ZDStQ@E-t*IK0kF`hcwx7_?Ypr7i<*IYdy~MqT{v?VC_BmwHt;6Z)0)ruEc6}P8
zLj0Jz`{zYx`|On1e&pWAx6J{v;mtT@jURTn-so6kMryUeHGn>al!1fRGCyB>7Lvp>
zXL)l9R}c7EYSp^<h@XkGyc*gZg9%oPG@)%1-zd#sp{yEZ`Z=mhDgryZjri!H2yE!N
z+13>Bi(U0bP9`||^nS2ATb$^g>Cs$ilSoeKl4xhrTv8^OQ#l=MIiXWJCVL+)gKdXt
zn_5JKSb&d&X%`fzmvuc<y4Wvz1XaeK?>WVRc@|B1%VM8RUhjpbpv%OC*f&NGO(*#f
zNemo6;sq(Cg6*PS9DdccV)<O7a=D7x<X>Nx$>BV_r|ce>2h{&oudk3wCQ6+S{w&^Y
zrvT}^AAg6>rL9j}4d^j6<t*Sh$@$9#axcE6Dm`^-<><l>;}!zQndN~l8<8rH@gj4O
zg--wdO*eeysZ_1GCmcpET$L#Muv0#43~fFQ9_$>G+dmQ0YW8etm2`vfBi@Ki^~))&
z2Kb>5`fb(317xDWgwM~&r+b>VEHJ`2;U?hS*h=|sXQ&rC(-2g{ifJ=z*{64Ws*;(@
z%US*Wol9`!L>CTmz)5iPZ5x6e4bc>AiD;k8*B8Vn2G%%@k=czpq1!~uvnfCn;H7bD
z7G>7g2k_L`?|)bjjcM<N3fPb~;Y{WNaW>Z&ub1x0GvOyr7%(jQld3F<vd8Qs)hO>7
z2C&T2_WU%3TtB&3<O$g$ds$s77FFId6d(8H*&@c}Ya{Zu<7x=@rW*~#^-B$z2e%X<
zi@c=<u33#_B=?Nr*Ow=1zl5bSvkA)S(TjG6vBCt_h42yMOx#YR&+qFC(ADY}&HHps
zt6V0v76|6E%S<S>^sUfXq>WhW&>O^g&yDEf5w_h56+?Cn8C#tW#mL)xy-;Brer!@5
zFAntTjk_l^DZr*5T=6vTv=V^*LL9zKU3i89pIIM!bPpT@Xc~w5K)p~O#Y`~XsPdO#
zOnXK8gM9b0gh7PWh1S-wGnDojZ1dSVEz#Oms?cHLYh&f7)BEW2u(uRNNqN9@$KjvB
zAd11JbY)$}SW%6oYI@5JxwTh5fr;Q=sMacwN*LA?@21xJj(j3JL;1@+1W^C5Y11-q
zH4fdiXCjq@(NZwu2fA#r%wp~%n6Kr!$hB^m@@{m*E*BCH_Al1}MPYFvX~!TXDZ`}M
z&OIjBgu12PWG{631>~pd_G^6vJoyjvj2gKzRh+yh%&?)#9Z|RApUt;Yh|O%@@lwWv
z#k7)4mQw^ZUBrbDpwzkz_6M$?U}X<vm}2xok7qLwJEY8`5n#}mYd$(UnQEVb*6rfK
z!}&UroLYL!#<FG!x+^T^X&I*C6HlqSE%kPu=vs*=ION8QUo@p^E#!LBUyezk%rRsA
zWrh>^ppz|c8Aa2YZ%85*v+=_ThkTw?tvI|`y`&lzVlzZ*z8Aq<DIE0{L(@XtC$xQl
z)a?w8-;0g7&-|hC=xRxm&<=@BYgjCuoAy+x8NA%<bSh{8D1uwWCcKwcGdR!3=}{;O
z5scr@(O)dD<OP*WB!lhNDK4=vs_J~}^Fhtjs}wVt)kXQ&^N^Z*9(ItVWMGrbTiG^6
zXCTDK;@*!ZRxcCjK{4Q7sYO!Nk_pc*<xtJSxGj<kGf1Xm#T^InhCuC#YY4`ov;=yE
zxq3X33#>U5s;16A9(|CitV1XDnct)H^GFI+r5jrx)K?T{UAkZGwp|l73|)8&=cS6%
zW%N+f17y}H@Y;#^Kol-KX-=O!4*X4I^_v5UQghX{jDm~KHE(!X-|^Z-)tqxk?^%S@
zh;hII$XBQMN+acqs%xqG0qm7-$~DHmJ$mK=K&89IuAiq0KB=FcFI$RfSs<n&JJFiU
z2huyffVjV5viAHYqJy?q7P?L{xH@Y+A1N&r)x`wPehdPsf!YPvCPa;}Uh|}}uPDc2
zcp^R|eOen2_Q3ZTUwyP0kxqwT4eRL7N47gKJ_nubOunsz2d@VK9@ERGPx<U13Vk=!
zRV*L4>7L484uY66W$*TFO9C^Tf>3d<q<JlQj4u9|PrTM~;68?K+*x28g0wYCL*6x~
z)b4RzmU{7#I4gXS%FlrWTj3apdFqwdO6*yZQ~BZWg8C<1>mcECjWx~i8a$U$0-z$r
z3lbTQLVWZi0RbgbURcT`$`B;X4D*g&WL@F2tL~2S`I>t9LKb5E#av2rIuXGln1!j1
zheL&O8Lm)VQM?JplEz-$3^Rq`(UZ<Wz)45a$h|ZsSX^+pC3Pbx_6tSS-cCXS_`7f0
zTNoQ3h(o!0k!Rxa<D14#+PWMurkOQDnUv0VZEW~gMQF=8(_XD@w$Otxx{OQ*(>c`g
z#J6=CRQPo(V3flkiG54wAuq^KLj{x}7N9|LO-r=O=jgj*k3M&{eWcfyr4W5FEw|EJ
zz3UqTHXVX7)?c)bKMfHhXn=OqQgs};zpoe@wQUWqX=qGjAu8h|<yc&j6<6Z<JUFPA
z<eN~EVPKn7_drz<vB|McD}C_TJAB^3?Jn65OCOz7yUoO8@86J;%fB@cBS4~EFq&Q3
zpKX4(Qg3WWwumsJq1`~g19`3p!Fo@ZE0>dFgifb`@IIJ&0cieA2qMNXA?)h7ne2IP
z{LA+LiQj#%=XAfTFI>QH7XP3BK9*;enxO|d-jTSq>@#QE=Y+QGk=1vyLureqWS7OF
zt&mJq|1L5;p}dXYZSzZk=|}qXPaHY$Lz^Dq@4f92A`01J8g@A6`qgjw6N5#=M^^xW
zRL_u{&E?yDo%k#f14TFi1LQrI|G0xXyoh`{iE207ARuCa_YAt*Ok@4d<ExwbA|r*M
z4cfv|0p~zG7}37r*mfg>9zh{A-fHjmU)%+VZ#jb1b4rhQRU;jLs7+lo6?swSj^sao
znqzyqix<hecKe7~wf5}zL8Q}%d++E}@p)5LneWL4zMmOq72yiH6~?nzG0ET8sPy)+
z3Gj4{CbDWx?O_ZnPWf3aQ(qj%d%G~F8Jg5_Rw}L_{;;a8VZ^?>tld5yS6DW!^=s9`
z;epf|tBod;%6b#K%A+tKBP@y$)&t;;M5K250QX=~Lj9?3uwRvCABFP|3_gWwobC#5
zRNP#F3B*f=>;)IJCfWP77GL{NlnA#{d%=n~SH!<FkX^TGEb}COA{}$HSL20sGW2w}
z#FI_bRih#Wvv|S&g>}u?$*z(or|5p8RvO8syxjBEcY7ymWHi_+ErmuPY`js5j1$GD
zM{5=|1S&L>7V(nNxL5_P2?~BbMh}7u@WBxZa}65VIB7}!kTZC`h^VXN-ISe@*tG4j
zx}6^CqDe^jo5yziY%aa&+hcb<)`zKTcpthx(gtCxm@|piXk{Jk3T)sgZ%hgYst=Mx
zz1G!defWFGe~ujS$H`Y0?fVxc{>p|9#DL8xQ)MBsfBoq)pwy`XDE(dfyYBg95A-&2
zt7AHtA~K}KKp@9sq=rcZyk(eIyE4-g|IYzBNS_vFLU5Y#ow4`(8;rn5*Z>d=aR>u8
ztkNLhzYbR`_{bjxzt3x*pt=7l1E)>A1<PGF`tvB0f<^t^6s#8lq4`%C2nNLmiTnlj
z5(Z70+uu$9U+ow^Rc4A2j7}H&jQS(3ZMWA=dj{fdc3?Z;&tvTsnB}i4C^IaJuMN6&
zB@0mvs+{8X@vrKLc2`^c_ZROyg@~mDga370P(wKX!tb)TCn>euc(8vRlF#5*al;7$
z<NRI7%}MfqX=C5@2_C#QZZu4uUom~<>MoeP%?wmQAy#@<88-O;N0%G2Fmc2Rl!5{9
zuB=D^$SVdS^VjM{6xfCS-*)Niws!ewn*XyW7Zb@9+~{nd5K{mp1c_W3#=kHBN2vj=
z)b9qMwLKziKiXye6eUMLDuTvK_17}~KUu?^gU~t&$TP~zBl9MV?9b$7h8`<W|6jrd
zk$B5(_eZ@y&OslcL4OOM6f*4p2OF<e>mRb>NvqxohUF0{vkRK6;RmGIw$rNB<HzO^
zVy62Cyd+Uz)Pfh~h1TCoeeFa)jmP)AbD7h^-nsSU1C-<{wI4sz!~Sa~5n{XS4L9di
z`f5E%NxCY(Iaq;8SEqxN1d{(RS&v9yW5d+0&ffJPFxyq_5b*K8v3t0mC4Bd@8|>??
zD_sD9Hm&_rn*#0_SB8ZL^Zl1XZHHzc5dCEw=&GqPK6_}siFt({l#rUSXAi#5<?_*Z
z%i>m5@LW-4+-3P%M1tvZes_PSctu`e!eH<QAUxFkTr_H`U#$CzCT@qi=}C9g`})d!
zHJ>&8&Fy~@Pmd#0y2D#wb=}BNx<h?a2n7Z9;-{18vp((fSUyNY`%)&8H$!Qd)r{LT
zox96})M{h2lw2ZHpizXvZLR!oyf@M_MSLoS!sj3QDlWS#vse-mu$~dP@f^5*bS=C1
zc<*%T(1)U&u>8Jh0)uuEQ-Wbv(hhkHW&F;ouGe95T-{GZA1(`?+wZDx9R`B$o~4Pa
zEFG-+HjzU<Ko0;L>))CV7E1)%rE@als!q&)4LxCt{s2h10W+oq27<Zq5ViII8d-$-
zT#CB>zpwvQxKXsZKC+@BvvDofEIMx>Oie7W^d)kYpZb8WNt9gnpDAOF8*=4Jd>uKj
z{SEmNlF6h)xSeU5*n`_!GbU`qC|yrwR{5o9RmwBL-yN&<y=6JhWBC)S-&p9Kg-?*#
zgx`ahm(|qC<ZQ%CG~%OxKkU#;C$CTh5|6@5<)Ou2QyByE&kifn{A^z9HNEhnZ4oF(
zFMeB6!Ms0SFTVPwHRX+7&Ws~OAQ|GR&OS3nz+A{Rf_pKhGQu+NSs;E|aG<I56(&ZU
z=_!`Bl6@lV>0sb6u75FBQC#BXnTo%feyf;p5IYr4X}RiOTXda9Bmb6-+t~L^_?>-$
z^5NA?KkI61-tt)CJW}RT3RTm#F`=$;Lf-vMYwmJ>;k-rW(iwDh{hWrb@w_xCh_667
zk#OEPbLqqnS8|8yoB*%J671D7N6pnY*vy58^y-$fH5+LsAS_Lr0QMG(lY*hp#`=Qf
z!dAnU#9xQ6Z4&W|3vLzfArOU&So4&N_es<|=BJv(q8aPPEU1-@?Aq7lzYe4^HZX!q
zXu7yyAwH2t4YSwN=e)i3&AZ_a1ZgrlH!^At{7v;*YEETLHp*J&e0vo=%5$T$(p@W*
zXPDPG*&ce@kLI4Kv#dH^CdW7s$se~6$@0nmbM@}Eu*>8)<GH%~iY6G5oDgYNXIW82
zB<&|fTGYFL5FwIUs|qtkx%+)p)M8CV^uLM%HQeV`^Sj-41k?^$yGN?uQ+~^a8{(0a
z+j(aAtx~pdU6&g!^Q`k*z1c#KNdEMU_Os5vn;DS1tRwbWq9*w+<ETzhO(&y_*NdsK
z?B(GOy-x?sa9*~xf3f!;jP$j5BYQJq!E**tdR++GE+L6_m5~lEc*=}g&Zos=4Kni$
zyk$aVqVt=vuhzH$`|fU)<vMOerf?vsD0K8<rTdKi>M{bPOk@RbRAjZjS@M>MwGyk^
zv5cm5J3B<C^0^<7!>j^lvenkDNWLnhL6Y82;U+Q|viFv?tOht`(;RUG$c;Pgz|8S%
z@bH1*gGqfay$)>T;>7&d=OqygT9=FZUyGP~P+byOLR=Yuyl}H_KZEy+Fg!)BTXtV;
zV0qWwPG%-Co!R7yjJO2XmvEYANr?jI!iCLGSexZL7Ba2+w4>qr2Xds7#nJ<R%*2L>
zmwPGP<xY^}(S5G(>1=|d`BE(yl|Sq>3R!1@G!05!-{pr&(G_CGsy(?D?sB5N9mNz(
zc$4G=kJjadFU;%K@bhoRe+X#3x~?y}{O1}-X2&zVx>mF4b4UKG$}t!`Ev&*T3ZJF9
z*PCg5RgL1oJYCZk_9sll6r9vRR~6<ny^19Tx1?R(<0q*3wQ&R5K>gCBtNN6?OuxI=
zk@F-GSaQ|NLO6L75#TDH7XruPOtdT!o8zv3>$giU%s#T}v$CNevhuizq!GC{`cQh>
z!WVE(zv9}ZFe9~Zs_Kqk_NvZ39H&N7Jo`4@5Bn|-luLM!s;^D9m!|zHMe+s_!||)y
zw6FOG6|1~X7eD+Wlo0z{apA%2f#eFx)+65XQN>q{2*lvW>&yzxE8=Fyui7${kp0#B
z6ysHbz19E0WNbM_#$ln<ceP2tt<H?7GxB3PHb9w<ItyKQn}1|>CF}Bwmeq1^&|dPJ
z*`45LN9jQ<>M9-ifp;H+rNkogq!b2prLnG)VyzkDkV!u7VG2bjkKN9VU(N+t;TZM_
zdM_3j9PZuySko+e)lk~-Y#FM})hxnAnj^h~mBU_`d%t$RFcNLOwvl)Wt|=i`w=3y?
z#U_~u%vyHaQqsKIM~WK_(!@Q3(;$J-i^v+dr~~foFW5HA?>OodU$y+&p%#O2)ARlF
zGCTb^=vUzA8BsFL)=sMOBA!t}GI2_@6k2VE+ZReTkf*yWjXBls!^A!E{3~G&1pC@d
z(Di2ToBe_)?Yu>4GMKgq+4A~F{UP7-Rjqt3B+}SSZhxjr$5&A@M;iJ>Rm;eNiLb9-
zG4ew30y`O?jMEL2jMbEWZ~@=zxMIt#fnY%^u2;H(-W9;VLIwo)Rb+Cd-%xPc&PBn#
z>?Ff%Pe91;tgs{t31&M~s|84Ao>Hnr!J>8Z@71_L+vFNesd*<Dea~(bGfU%hs9hBX
z1;*#j*NGBMF{&EU7{rXP{1piYL#OTp1_Y96cYHkW0qUh!9DQS0F8yu=m(Q@std=;|
z+-Ep81YHeT0Lqf5nX27SdwW0ZF65+L4fKKa1SR6`b2)FkL(L|LyWhG1uR_U|pw-eH
zdp41!Np-~&2Y}XAtSeT>ZEY^>`A4tz481^nYUWDxFEZ|b>hc_xSu$;%f3-94xu~y%
z?!*i`#f%0cGP+BP>_V*`Sv4{>SHqkzsJ(?k6s?8n3pG^wQAx!uGWEjfKbJFK84e;8
z+OHZ13uMxFP5oMdT2ioJDW>S8RTn=wE`2510)ly_GRL1JE!bt=BS$ScPFt8!u2SFK
zUC2YBykLp#07QWowU@ze+kpZFd(`=`^pf9cf%GotTK^Te_50iuIL4gIjom)0BYIIt
zwK7)v$d=fB<R)1oeh@3PmRLp@On*~NE|rzxCO*dWOPg3(Mc9!2oaD{nrf{sGKNY2`
z?Zxz>>iFmN#a(M;sZ}d}WtjkgUY|DO=a0Ed2(pX$kqXu(qv;i7YkGbvqbh_G;bBhL
zPCioT@KUKcbwdp_)R7l<8NG+AYo;m<Q$s1_?<I8U%W5wx46Ox&`N2<-)C!^itJi5+
z0tV?_`-h@PS#aru9!8k`L-H>vF!vi|d#mhJry+|)`$*@>S?jA&O+45Mf4|*s1WKl`
zTVqdg(HfEriL_pxOppIL{)|85itr8ww|J&6=-WL)8fop!FWzGvDncZoGi~$WSRFNQ
z?Q;w;dvn4R1yPXiGUVB~Dyj`bSv8@Hl1G5tlG74C6Hz0sjZFF4eI$7gmqnNk2hl!W
za$s&;3|8UDNNz3rj*0spur?)Sq+KY;+*Ao^=|bPIPEF}VkX62O=4W8S93)_a9MQdU
z)^<#b_?rO4V&3OAjEYF$^#qZ$4kZMHOmbnQ+VBj%jc?DVPJ8Kgo$jFkI?dvp%()tJ
zqJ+qtit}aXA{!Gjr)0c>D0%#AwytBtG8T8Gkqr_X^~1g9Fr>&w%0v+!YzC#Dam34(
zHh8R&P}Qq$jh4-HXyKAWwx7~Zk+|6|CwIo~wch%ERt_?r{A-L`-NyaR5h&f~ZTP;I
z=vgPwr!{*jgM#j;g&RByx&DE+6a?=8b-XJ87Cn(DJtRKVDr_YjkVMK77#UhtK+P*#
zYw2c1R{a~EpAGvQEme_iW#7-0?j$Vj55wCpmTX?}jn@&0@NnFmslo{hC~P7eV^s`r
zmws|9=OzQ0u+BqcqAr?xvIj(Ev-A&iMBlI8pPO^BiN!=Rn|?JhBcXRd>n7U!H10UY
z%ngFFdY_7ccnz7NS675*Q7!E8FAM6C=?0}IaiT@2l0_x1xhSx-<SA1>iUet_QE26|
zXC|M?R&4!;q*91Gb+6u#MOkdqp4AGQvoj0s$tB3sv^LorLc2L>;+(*DH4KGtE(DZI
zvK~|n9iW=r@U?1pqp@E)Wyl=XZGol0y#K7FunUQ$%8az*Ibm_<C~~UNHN_8jDxihD
z+9%2ancM|Z$5xmeP|+L*^j5W+tL?LSXrLI;6+<lPj{VS(-f<K%dDbXa!Fe|{c1ls_
zBT`|B#gAu$yZ03CSSN?1FGSRqtLz^1dg?W;Pj?cxKX-7WMw)iGS5@+RPMc&O>RQ7z
z6C_*IYm#86psA+6{0tL5KTI%$*Uo_qT5>)TW^_2={<Pe>U@+vktXP<jHkb$rJSAMh
z%~ms-AbC7jzy0~fVG3URzxa3q%gY^hTa%>Q@yvGU8dg-}^SO`S#FEm5W!EFeRyl8~
z>K2WA-E@2#iIYgT{gRtE^tL3?Z4xKadJ;_150T&7arsKx=7CQ>3QaD3=WLxF9Qe-V
z+fQ)T!1p_Zh6#FD$3F2jSU&e2+xtwPWBNtjt8pw!pwg#OXB#8(X-S9t6ZR~%<YbXy
zaa!lSSC?M7;dNMR`)`LGE-?TV**xr$u35`Sbjs4ci4?_%17wK9Jmroa<6jLJKs$UC
zQo*#$c?s3ztb@Nkm$Q%E_@bUZF<Dx-CP}lBvrm(f6l`1voRM`cri=%Qg{9~fxSFp%
zdSTtW{-w}bQ~Sm0TVZG`jSqDeJn!@jh6j-lb(L^iWf`Z*YAiY^bx?8$Dj;*s^gAh{
zc%7<OrMjr0GB73?S2Va-Bm^VNN)zN1C~sN?JapCO*PE@JxuqgDA~!K<VFJOQs&5>#
z?-=u%sH5R?m2=RaRdOcG@H9TLGl(QoR~h$N6B%XUQI9UG7+;_YNF^624}h2AP2@WL
zS`nV6&T7oBE3LR^UEKS*@W2G(R?@pOW)fF)ubMVX*oxUsBV?6Zv_@(Cq~O#={l#kK
zOl9jbkNPPnFw$CmBd9>2SbePt(ym^&AGW`duJ!`)2DHNOV*&7*)*SKh6u7O=aY_*<
zxiYEt7d3mA597F+*5u;@ifnShK`24cuw4gF$Y^+ip#5%k7PXj=r_<iTkKU2^ToyT%
zsI26*@guodMISZs6f%sfQ5QUjdC6K;u6o<wftbrs>uY|_#UI-qnaE)mPL9DIqn04#
z2#qcn9~s~|!Ih}aB`_drfMyT~ii}8%vSh$Psp+IXG?;zfY)6I?y;-~~T*qxRKcUSb
zb~_BE3=CNKwNo+q?5{BK?}6x1Mxube&kI_xMq*QAy&I{_9qH*2o6|b^p0TV~nH7+d
zq}9A~>uRtl2?RNwnT$}vyqb9frdH}>Z#Uf#IjJH&iUQu#=jrq1!LV1qG4ZW(K4f(a
zent|Uef@>npzLVgb1dGV&oU4qgB~UzQQSv*V!~TDU*@GN+L1))CeZ#GN~qZW9%A6`
zn)F-~>o4(v2;!uR9+se*vp#*F_V)y&(q&K-LQ5J`Lo;R9_xrsHs3nc^Ri2GYJ%^~`
zbe~06VyN0o7ghcq#8Hb5fSvSE^TnBkL@B!#0KHo%kQ!Z6&7AAc+_K)j|3|Py;(-q$
z^l?=cl^ID0c-U%1qNp3KY66Nh-=YcRx(<RD(QBkgRpCtpf6?eSSXl}r<2I5PNk~&6
zyYvFc@hiIoWYBI{yT{&|jL1Q++Am5w6|%@C^afPff<FKWSGxjpCtnQ*S|n^Xpef9C
z*(wKH>HkpduC*tqq_5kYs`DC$v~$01AO5aZ&$lSuC?H2i25%?KqZ5iSwjrD+TcOiA
zA_$Mao=-~e`{+aOxD?T~x3XWK&IQp;Iy4f@1%z0>`r9T(7&J|HknkDjsy#Z9V?mjw
z^Fw4Z%x1oS;kMV1<yVL@9Y!qirRihl7URfJU2QI&+NUO=Ixmei14&@U2bfpws;1Ex
z+-mxGVdb52R4wkK=%hExThtg&jp8&+lz2F)Q$bol5EQ)kSIy&&gTW;Ws1|{JWZW~J
zg_RG_;$Wz}%0F1UhHAXjyzkq(tBG_AIc1`P<**vOUrdP{`^loo07c&&;5sNl@k_rP
zc^h0HGl}c^d^COU^C{omt3jc5sBg=#U3B+2vOD2w^WaMoYTlaHL}aT0^V-vYP^3vA
zSa8j;23Vzyx=hRC&b|(;nW>`YcM0~k4~hbpuF~+_WGl+?_RWvnxWm^GZ_*Df%kY=R
zt^1@i#{*S0eJ1nx-W*2U9U`1Ufy(dVIX17A1UrLodCXWxZ8OC?+(3BC)h9&p+3n{H
zIf}YS9Hd9C8E9DYv}15*!3ApHoJ5Sogsvk@2kDSfq}5XvQEvLaAb}LA;yJP>&^-i=
zNIn-=)4Iw~DQ<hnUB@C{Hm$7th-AOtfZKPoA=__jrRH`>@lP#d8zq%1(gTX|rNe!9
z*1+?sT}V30%OI;M?2UxO!TaJU*2hQ-FJ+>f)-f3yS(ND6iRWg4hSG2R1C<Y{`7Bq)
zuJ_W=Bj(x_Iak)<iPWQ(aY?97be2PUFe<3xXVS0L(UFNz(j6M2fgBl_SgncbznyV4
zbRP^ZJ8_jBYhm_78gb(2$5G--R9dH+OcR1X(qZSqbfOXyo8GzNgx3>=InsYnCbYXh
z8j8N=Z^$hpiSW{M?!0Pt3MapKwOjTbko=dI&WYUFh{<w)WEYBGcYquRvO$*SYkOyv
zvE&$6=SXX3CF}~}$^Pi%Vi;<ArPh_0>=z;kUhw;tXtLC37L>kE9O694YLM8{4u_M^
z2*ts*dmA_qf#RgLxVkrPuF>;hp@J-K+Vc)a_L?Wu4IzX7bn@*EZX@?yRwwQ-F>RzA
zor5fGH++ydVZsdga>EWPe6}Wx62Nc(8CG1~O;9t1><3Y<3;5}kF0G-?$BA`ZYP%I3
z5-q>1v-9N!ac>}A$s+jpPB;eliS?X0dG}4SA$t5=<7cT)->DPXg4TcxCb9nCI06Lc
zywx+l|N8S**>4xiRd1mggpM3AQm)QOc0KV!9?Xhwk5FBcJBa;XUej-#e`9Tx4(sZ2
z=|Gw_PMOlO;=XFut5_o~2zUx|-!Vv~dOgU{kO@pywZgmc`U=YlEd6h*BXjWS*w>Rm
zbycKM3P?wv^{F699%CeguDYd&G`wO%<$P5GIiv$ZUO1;()#8vGB*g6Mxk~zMufo!+
z7eKm&&^vQpDorYfPA!q%bSo+%g&b@eqhkD>+kyUE7gtO+vM7(M6hIE*rnsG0FVFEL
zrE|J=LzkTe`|H>iub}Lax8O3Vct-WZ6oClNtF!$Kj_bzAx6He%oS53O$cj9baBB%Z
z@=4z8?q96$Wpt6~GNI+br;?+-+!9(n(DILF5BLb?MdgSpc<XYJCK_l{ChXjN@Njo?
zL~Tiz1X+cY)x@NVqzi%h!;u+aLb#OAU0}7jkX8nX@_Js=o^H*=Hm>pJR|$vM@}q0X
zV^V+q#+@<<xq*${;Y@d)TuWB&Re26C1q`VI8?%qO!#_g(p1~0TUFdtaU3Q+0Y0YPF
zyGuq*7l(-(!~IHTH{9feCR?obMV$pvu+&;z%6}?{%sg68g<zr)S4Wc`$;DIl>y9}x
zUK~CYxHnjY1XG|@)Tk&&I+JYFXc{70I!i4p(p3A%D$@r3{X_lGS>t##Tix0BTUS;f
zC4_(D$3s6?LYS>jYca}AI-U1Jvm0F`UkZ`<vCL!lICnSy=dfx;HwhJf2nX`ymnvKM
zo=_95J>c5~1M86YG}%n7WY1ok9~ca6`$M!tx7NQ%*uX9y_?&fd_x_oNk54fwj@7F*
zDy;N2zwCr$ouLe>nf)qiWmN5LDBZ)GG+)1Fm<V=D(&Ghjv4MZZC}#;#m4(mZ+&Ph&
z*}9hu%%(s78Nm35Q=Aky^WuU&qUFGsr5VM0rgrJ~@_TT1xn(xGppp;dTk*{EdX2g>
zQ)N||igk^xkqJnft$5niP@&jV@nmdwZp<yE*rFg<U2wlBc@r4No|2zXw0v8nlKf;0
z+{7FhZZDPXnIyd5c7IJhdZ4HyYNJxT#(~BB6LDQ4@4i}Gaav+RQHv@hsRE)kogrSc
z#vV7}15+&!04kV}A4q4zYdOOP8xo4r<0j(3Oh6yHO3%JAV*TVP=ShtMf$88pO~n*A
z55c{Os*Qvq^4saI(>ZBg%;5b2)yH<78s?w!IM>wM$@NSU^NPyZ6*3_}LxCo3_0wD+
z-Z0Q-HR(%Y-bX(5>_#(eUaLW6L{$eB6BTuceSHoSX;$jVSlo)dZQrW;S}kYg_P|)d
zP~(zB2AmHsY~PLp@tqoz>4c(03FSfiMv<A*&hEMAUJ@BkQG9oAZqCymEft)b&E9KL
zTOY9uJe^j0^I4L!t|XS;B3@HRu6q+X7O|LPJ?Q7)x_uWpd-^#RF|pCd{+ZQR1cMUc
z*&mUkA5@#4PW426Jl|&_LS9HteOLAnw6YduZ`V!_)Bzb|ByfO~gKX|Wzt)MT0&2+d
z6gz5~6QeIfvMBpw@c!8E_BRmFEoAf~bK9Wsff{>DMilgXqx?Kk#_}GeN-!#>5R`yM
z*T})g05cDiE*E)G!Xy1ibTQWBLP5F#7ZLfXSf8jwY`I2jqw`w>ud{~#eH+(K0qO2#
z(%&VQd&mD>_+KFcr`wv&CDn~%-tPn4NMw|d?k?BnA>GgZcOim0{~bg?Y;C`Mq7g0d
ztgN6im-TYX0`wlz4gr1SZ4Cb|{I63eVp^E&lIV999K<4NWMco?2?9sn6T*qa^8YSG
zu>6042x|XJss3--{l|j;pHN_&2kUq8N9jU8{$NVHGc3y-`++kQ5!-!Rk1HcXc>THz
z2p9KjV1tdC?+Xo+=ZtK7-j5FrKfXmgTw{mqsR|&wo>VA-a^wv-mpd`89E`}$0CG?b
zj_e@+H+DNaWpveP2U1P`d^$eU&xqt{M6MPk2@qV}^~r7bWLYy^o24Lo8QHsBa?!e|
zkf?|(M)qT<U^3%_ytOv8S0Ze9u&zBV*QVFY$j%ED%zXTuccuh6=qQk%T%2i6tsy22
zjIf5><A=pLL1Yl;G_ZmYEC+EOgyv;{RS{<kJ+&cdA>xd9W2fcixi~c`fseB&m24cS
z)R&qx_8Y(=P|5l?0H;e}mjDp&!AScJ;2&UCl6f|)&L=&zYmj|gbx%V+yTgb{D4s%G
z-rV_drJ>fjel#gW;ly}3N|h2jhZT2r$<4lNDV8(uQ_#(w+MHK00^e?s+&9c%&{5{t
zH6Jnp9rF~tXUosi6#O#dbL`{oI(f0+UBH-F8l_Pstk%0Kf3M{7VytTDQ}?Xy7xiqL
zPgTT1e;52&i*t>{&Zn`WxM{PS61pyp-1xFizp#wM^wzNJ=aX%{z@*HcSVb*4c3qkx
zGuOPh@yiQq-GU!;MNM^^Gd5%YaSzlq!{@MP70>#W7yiWRZxm}vtM{DFoA26u{g2z`
z2>nM$+bFW-C#e1N<Zv)(SrEpGJ#V>d7uxR;YtJ0t`oRo>@1Uym>|~i!FE0ryZ_lPj
zM}o)689WvA%J|-G!<0LQ+Yg7niU@yIqa2|Si9D?Pu=>hZZ22pngrf#433ia=+b92<
zzoX^6^g-c!Df1RR`f;oWo)n7rA>>Ci*R5tE@Xv4L&)^THR}3!ot|yTkvA`iAv7s2l
z5uVklkn1LWPkTIlRM5Od<7J9ne&{KCDdbwcnD~<K7xY<Zs)};sfk<ye?WAp%YMW{6
z`9+507H4OVh58fuf*!_RRq`hoB+)PJ6uG5dB`ADni}^OUieX%rV<P?j@wG{SB><-f
zhO1{RP4O-Ct}Fw#=!32{Q$0G!dJwh~z^~)QFQLv=?eG*=8VoU|>d!@+Fo$=z$-js?
zZ(!`~gB_ReL<*x7GxfX$`bps}lQ4qMzO&0DEEM9fqKD_XTiw+0eB>|!z)NO2s(q9;
z@lwu@2f%s%-6$aX;xP;XdmJm*>hoS_rH9)lhHR{b$=lTXAdyP6wdW0Sf@tR^ieEi!
z(rRj1(;y;I?ce5_HPRqQ?}Y)FfRo;jU^u!Xz~&`jgYa&Xi^O@qi3wms`(+~J_zWwJ
zxr<LBO$)u)`zFUDk4iup&bMlXyVs~bsrSMFxa2ahqo2x|_5Qg45RrDsL}MI5Dn*(y
z#6~T2qM)gx1e`ix2cr5q1XlhjP{wg?F`efpNzNU^IK<c1W~G%eXu>=Ocnb6QNmQuw
zd@)D4RX!9lt^SRvuPG0Fn8`PomlvY}!s*_9mKUB{4;buPd*kzryCL4<y!^0q#BTKi
zIj0MKS)oEaQ8&H_R=L8Paev9}{+3^6U&m%B&$R&6cPk-tW|FWQ55NJb_k8^NeFn;1
zsKUzgBw-Jiu;1|=lYI#Hdp`DgI@$;WBB*Y_qU0~h0Kso*u0#U}sQnU){;U^-zUh2H
za7W}`G?yv(*E?H$f7eagMAs#Y;5J@UnaZxz^qiO%fWfmNv;q@s5JwWHzoXGZ(~@aU
zzz_cx>`{Z*ZY-+18*&RjQ%RMnbX;|#1EO7ID@U$ty#ySWestwYySq#kdmxKtEJ2z!
z;bGEdJq+S^dwEXAO-9u&?$e6#!^mE{-Yl6o2h4|)VP2{zZbXrO!MAJx%bQCWqNr%T
z1}G0txY_Y^%A{$b`ePOjh(qT2R4%28P*%4pUe^!S^b0pjJ68j=2IdjwYP2P_gdaWe
z#;HP1EQ`d@0kptlE|=!-**`5i>dKnjzDZupjC%^bIgqdabb#%zr<aBc21|cnHclnk
zzA4!b6F|$Ya^u+4Cij0jY9WntD3zC1i&+on1U2npW35?77WPb45xOTQF2wmhTWm?f
zFGyXj<Gd5H6?A$eW&B!Pu`bq1ksZKUnk)8`Y&6{O(OBwqv?|7ncj<%L!mr^cuP}Qi
zLCI(`qBO;VbT1^OHI1)l+{-c9b`KP5+ZwwW@Kr9y^bPK}Yfrw%TNy`S{shC_2**5n
z`9W9(%fndIHvm8QI*Pr6NEtjM(EQ-GP;~E-5AxTk{4z~)aqjCDVkUlm&eO<(KW=xk
zsui;G?IH6Z7CF8-eE>1xn3vM2<{YM2x<GXsbHJBn;yb$+v>$%cc$gy9<N0fKMGTV%
zKkD&;d2E0UFlLBY)z5_a5%=dV3(S*R=mDaxAKtR|D#<-w&GQb>nwygo^Z!;kRV(2A
zmGkJ%X)DeLwB^9F^N;yNw=_ov{W;s1^aAK;yUsCRW~P#Y)<Z)1IeqXFBtaqpZQrYl
z;#JTeCMv-L^4kkITkD^0!iT3OTD_@mDN<%aV)1~@LD28Cw_Pm`O%wgeoETzblT_ke
zrd@75c_K;!M{@)5*<ABF+y3aIcOUJ<EM(%PlaZ1U`mjfcv5#>7kLLk?FFYT|@?mlv
zUbpd9GOZJ_$H1QiG(X*XU*iu@?Nsr3&NO=qbZzJ!>9D`{_cOZpv7DH+y|Pi?C3QLo
zg~L?2cwcXZNr@Tr+iBqeyg`9KUp)WGG^!`=J*&g;5dD*pi@SC6?Bk&LJOsOnVw}bD
zywpq+apwn#Te@6>)?z(){Yvz?M>ItBPZGMKoys&Ce~W_TBe-qN4~xsn0KMyrYBF}i
zZj@E}SA}ED{q7sV^Nrb1w^0c<55z0r=C)++`k!u&;Jy1`c(d&1H{4I4mD3<4#@hn^
z^V^!k6)Lpviub?MKRKsx4@ut2!PU5A)N3s4AU;>)ZFQIcp3d;V<6G}M;#_wM>E)ah
z^wIFUbZOdtEP%6&w6DDrxl`xQvSY_|AFPokfZ4dCFVFGov8tu3gzPQC4{-8%=QsDW
znO7QDZohf+Lf9pgbf*V{ruCt9+KcCJ#Yf)q{S3SXYs1@$`4tyh-ubu@0~nq`k8$)%
z?>l;!Vp~uJSot}Y?S=8ySGU`}Io!?mzo^>HTW$&_VmmxxBb<@M$6nPhqz=q|Y^U+M
zPx|o>mu(Z_uDc)=PcG)v+6O0&76-+KqY*G%g>jPUc0U+aUFR@-ZM%{)CS6)skujb-
zM@cB6SwGs3P?dDbt=l^sgIK+Tl8`>fjwy`IBqvj({=p+IfAt`+3<Df(MxFILsGy=8
zFTmy~@Rpq1i?=f?LLzP5n>?DttZF|fy8*hEoGtT)-)K1f5w}y$I`0~IDtfu5geREH
zr;x!6+dE_k4<RE&I{V3Yh{7@xNb?*H!YyI|8nnEQD_KR2wVCX*Gj79}P9+54TAlkY
zux+JbQLq@PM#@uv{yI5vo2CT0%tK*37Ykk3`3EDQx;pdnGd%*Um4l1C+9P73%wqqZ
zn7c2192#PM(6FV=GYJpda_=xQ<h2^>-O?c@pw~O|*0S96jUjxVr&7Ax({CNO2EcqZ
zL+<O+AVSh4H0k=YBQjTV)7vI;{nHZY)y3R5oUKpT4ZSs;co2{zy0IR<#}*`<gtTQc
zKxnK%;p+%1#O~`hc2j8st7*LhSvBq<7dbW%NMu%=MOO2!lZ5B<P<Yhy<%NZptMHaE
zfuOgAfzU4`6NW$~ugrojqNk+<3n?_l?LJ)K6q4319?*pDttq<v8+}l;wAbKWaxecC
zwhcSaKwhz6aLA)G)%>8$o0u@Gtscx01IEhus(=))sq?lqJ5{)AQwm;leYMbViUqNw
z32oTg3S=&stMiH2lUCr5FKfzN&}q<CP&@yVRP)HwYyB#~T!HO8p2*%VnQELMJ_s+i
zLFB8wp8cZ;dsTe#qE5%?g7U>Xb1^4j;OlQ#?@B_Cj!TEWp3~7kqRMrBSe4e%7)JOm
zAtBpgr?C9M3GYQp*P<3CekZ=8$L7paX7nyVwDS&o1$*-+_kI7Vit=J_iI1E(Q(C`-
z^PmKU%yXaaK!`Le9>5)O(jqn$R>DL~Q^{{ILqb)!k2RLV*-WZ3arVtsTr-y(GoIWL
zzE<mgLH5;D{TnA6p1&CB-1XD1P`{ho<ZaCQVj<i7QQ)efiI@6G4TKs(c(A1h2j523
z;UzCZAVoaDTqb{62jevsS@a*9X{u$mp_e?@P;d+C@t9&N&(J65dcs3K1H?m<91+<I
z`}N=>h`wW*8#=XYCk=*eT@DLojsLjrgp1!c6--=@+pY`xiuX-qCbyQG<|AK9ycHr~
zu%!>w{(H;nfm{cMct6ia`h8-U__dJl^wJU8!>g~S3CJ*@Jc^MfX$FG$=yMljnY5~#
z_?Zq;y*u24ciW*@GxVn)(UnZ$MTd$%!=HY`L_68x#JmyQn3r>yk6~Ow&%iw>mNs40
zHfpd3RJ?^V>_WM%lAOZOSbSDX!~zNJb=!P4QnFf)M+zI=?jX5A{UXM(l%e@~iU41m
z;Twg?wrfETx&W~mRYQF*5@m4c!oW#g0NU{B_j?Hk_|2;I`L=zvnquf{Ekq=cN_OT?
z<RWYw^3E#QQev$Z=-W$FKn~)yy9yp+_LQwfXlD#V6Sp~Q>A54DO5*VHEOd8I0*6y%
zIoim(pi;(<O7om5(a#_PC!T;jIeF`YFrRjD@)_qwQqxybs~nL0mv}!3b2^7DT_-lN
zZlT)(P18!5EA1ID?=R-=L}Cc?*GPp46RL>OXcd^kvzw*9JX%uci|fGwHet-%iK<U$
zzXN1^qxy-R-7ozFFqp#w>}Txf?D{OOQ{sC&MRx7oYxhTy0mSN<lZIm-sUV?jZnZC8
z9liKM$WwOXp(|O;{0nmVA_8hICdeQzw|NXiX@L#c0?29+=ZaUK(8Xu9;%5`>ZT;r>
zgp?BI&FXf6;Gw32#u0LJ^;*uH=s`Q;M-R||P4<9hSvAa=KiLQ~ubK3K1jrYbD5GaE
zy!_Y@J?lN5y=*7vJ?==hBB``{_z-;@d>AW^GznzdL#!Lk*HR5ogvr5kd$f1GefI7A
z{jSj26s>D<PHJIf64~QnO|+tz^1%3UrpZXDHZ@=DBT)M}De24GupMcj$o%@KLuwxn
zKo<k{!!jY_(W_ShZBS95A=z}=jyrJXoLUM9Go|P$h6*$UJyitiUt>34V7;jj{sLzi
z_n~=siistyj=JB>qEqEN9y=V?RZjEp>z*@q93!0_Pzv;=g-tYl5{Q%hYJyGQLW1kT
z%<0?*i^GhM@#{EdtEb6gz}>e~=SnKz2Ol3nW{+9EOlT%cQ8|7)iUyx#vX?r)VRBQ`
zido9yBbXL<GX+q<_AV&!?K}6q?~dK_rOMY*j15LV*KIj%(6@6Z(4ms`E3QG~*`V%8
zpJK*PyGxS)wWoXMVNPs}@-y0B65_GMrXB7;4s`wh1!dUhm0uHIKe?WH?{q%J!a0PQ
zvB<43-|{K#Z5X~kV3mpFCZwijMC?t`*|c-(HKP!aN%wg$x{74CInS546j|oc$IpWE
zLhl&oAY`@rI`!I;Gp2@A2O#VNw9oWfA<Nf`;ZG(e@YiV0ek#s!!G)IJ0;z_>fy%m;
zSdCCytTmD>Gov^4I|?pqzm=RZLdj_w>(>S2_SV*1>%JC?#=U{xBOA7V<4zAk;B<U#
z*DaDLyw67p!(LeGO|8$G4Qxc~5b1!s`sr%imap&JSNL*{25lLp{hDIW`3RUhjP`Eu
z)ZxcNazl+~%tj_D;YgqDH_rLYzu5)7l;BUQfSYLVU*VTlb}Rt#9%hHo!~^LtPP9oU
z@8@7!wG9gE5L-G2;%S{`-+IIwt+!KOVSIqf(dpkislo5p`t_vhIQLpbFzEZOdOFj=
z(E{)kll9`u#x^JoUE#23BFSS4v@L)PurfZRrn{Td9Ge1W(l*pHA_f<r5Hogt%wwnJ
ze?0rl@9TH6?HXB5tas*4eZop9+_YiEVB_dZ?%BKkkhuws;8HTv!PMdUShYD};q58R
z@QKujM^p;?VjQjSzrV-&&gpuN(^lGtAec0>)2871Z3?z;yBfgu$j3Zb9=9iVy`E6H
zwt=(M0ZAC!3puJ^=uR<NJ>8-Wwo2NDaBUu&q{X`PY*1Rsg)xwQ&wDJp&p<I+v>p#8
z;(wV%&De@~)?2LzS4*YMPC@jQ)lX;L%;wV%QvPiKU69lCLxd12xZ`vm=Zs-i0G$Ot
zg)AeJ2<U~=h7No)%obdA-ON9uPKvVIQAYByG39QerZUEzcM|VN*J1AzT<)JY@3nwK
z(;o$jtZ?_zerO;IWs)&K`(cGxas>o*FtpP4cRU+7+wyw4HK$Md^ut}rNMR7H6gj0I
z0yg+)>MTX_2*&D0iz}|RXOr%2ZG%uhGKL#;-nBxo6)or;wV8Y^C*v)^<~&-|@we;v
z$3?}xn&17EbT;!!>8zzjri!kQRpS#1LQE;|6F-u9I(+ze`uJ8>M$M!<n2FPPy1Jjj
z)&lhA*R$XnI-bZzF38Am@wwoeH*zcJC#4FnTqsY`qCA-koL(OVfu%@g|G(a@GAgR>
z?+zg#-8BNzA@DGCNJ*EJbeA$iBLWiA5(6kT42{H~bT={rf^-bsDJ7*c#1Ma2&-;FP
z|KH#9;jVSpS@)i^e|z7v*IoClySdVwPyU$Y)c#u?{r{;>6(OyOWl~)^DWGM(G%DNu
z5%Dc#vIC%S5eEL6i4&??<bnMHOS(IJAW2UFu8RMw^=9+3t-pQxJLz7leX|YB;K$yK
zg{LvZD__g&QIfG-b6$Z~od2Xm;O2NPWIL>oWyN9EzYKJcdlM-2gAAoKEN3hK5U@KU
zL2>xSXngEqI}c|_o~)^Wy7KZ3Pnv4V>-rJ2@UP&Nd?8K@b_F0*if4mt`St=T`{T~p
zoHxu!kOpxkv5gHGQCW1CxLBKI;_o8LF!V`_8fJ=<5_4!?Oby!Yk`}exv2338tkMz7
zv$b$$1F=@7NozVMW6$96$tQ_^{-D~bNWvK=HbQ1224H^r%nu}R$*h?$U7hgS(n&oq
zGx%>))_EzwqjT7*k*hC;^otGr<<?5m|JJbeu7(P_wwa&re2y9$_S*tIyw{L!INlIZ
zpqT|Z@d;X5&KDc%`)QUi!;<K@%Wy4Gi-}5;4KONWV94suin!_BU-8S@-Wyfdj_(xx
zO&yMyYmvrmWz*`#MM}@KMgLt=$D6G_PV0h=%S*;6t9U=RrnBH(jJ#b?Q?YrxvBr<+
zfZE%TC(Oz;#O5aDj5Yc;HGexPFpUnHj=mYV`KF_DFQKC+(fSfPCZnZwd2`lvrz?)V
zQ~CA3oyW>3mzH8=?ay|twj2nidyU%O`Za14Uiz^%d>DPcMgQ={)xUQBGDax^(BiI-
z=`u)}i~x`M6&bFE!Y)nVXjvCJ=W&BusJ-qs;pGyvsb2DO`HAzF;;%<vt5eI&8^~P8
z&kBbjz>(i3AFg+lxV!>pOqsh;x5cx!_S=bW)G=W^q0$#jmY|ug-RIl`p}0JbI1>p9
zxRH;&GxOQW)q5hD(H(^Rb0IH(Aww>fn$RM;i4`oxRJdFF*t&H^(~~KZ`c%%sN)sl7
zH@MgDgVP<QxGp@Hcyk`}*wFbOj1^2)`DzH}zLNjiPu%afwsrPpquQo#F`;ZaW#VD@
z<(shRs#8Q-trWuqVzt_>{$W(GY_`?T8i`>k(ft>*|7we~|NnpTZ^+8w>f#|r9^nnU
z{3`#c+G?j?m0zROLByY?_fznykg`IxT%bWwXDYlXtbfd$6~;nU1pnB)Zl1k@oe9qP
zR5$*IKl3h(Uf{W|u*b;RL)J+0X9WL!SkEg)u=Wbb65V(CPd0euqW7tLwu;hQ2{U$<
ztfJ`CvpCy6Utedi-Cu7v?*Dv4icMzh)F`rq7CU5W^365ZQ;+hjT>_Ur`>(nyad9y}
zeL7;s8jY@;^t(BY%J~p$W{vK?6wh0$q5jTCQhJ#xj(I-8B%g*M0DFkCPH*Mitk@>}
zzY($psC$#FrD@>8x!)3w1}2~0-SSh{>)$b48IRitUb)xm@?}Bk2v@{3I6Fz8(=uMC
z*j)~=P3os=9EJoc2Q^UBBH&ZCIh7ZI98lIk373!87GES8y_zOjsW4=Z?`Cf)g*c%r
z=uZ(Pp9e+v)khMhE7mgG9nkY<)^k$&46!F~*O#-!=lPtL(Zhdt1`<71u@RO;=yVy`
zp2HC$m2h#TXz)am$_tWY5dw$#A{U3Ngyz{#E)VYjDA&Vb;09|JM{4sSpUpXPsf3Sm
zr)oW-a+1L5n)@-d#|_-E8+6Rk6#Z`Iq|ZqCsYc^YnJ*~6miG6Ij_z}BvW5ahO&&Sn
z_KA*k)zHZyI_xb$2TX2r)YXOs72Z)_1cx~Ub#*>o_F5+X`p`+i-S4{9?3nC*Y<M?#
z4;+ot$ZchQh(yQ*7@KDV;8=LMxIB5VQ2OSS)meO!bRO`6V&`MGLuNnmqbyN;548$d
zulmhANK$t2B@u_tRE5sga#x=T_?$4UI4IDa0;|+f>Kop(7p@-`y(E}1#|=L)fEQ8P
z*!YFQ4zQoLS2G)C{{9A9_VsR@jc~+yie-rNtS*jCx$lBXsdXh?%5hM0US~sXE~EI=
zR6me);PRvETZ>H@2M^^GB5T56ygRL}6M{$<{`v_TGD*ji_{}Rg2*rbNg!OI27IQwa
zJ76b1WXE4Ur5Lt!d25e_oUwE#-JS&Jk|u!7LWBy0Hoh`7G(Hp7=L5WcpA@!bRA@+O
zDTAl0@f=y>Y6<~NqQ9e#%wsEqkl^zVj*u`{Y-a}52aR!dGi{khvvcK6T;(qOTi(Z8
z{+oG;6RQ``jqP}oph)6Zs^3M6`;=xOj=c%ssP;c(|9}fMGaU+ny4q#q6JaG<S`_fd
zQu0a`g%1}-Sgq9l!7gdlC2}N9_vpb`OMU3~+i>sUY9ZE2=2s$M?Fl)WCs1-=<m!;E
zA;e$C@&muc(hA>vhIDm)(2B_&3=qkreoMwP{z(t3T4hfX#lg}P-CG~m#(~HgY^9>H
z)THSrm3mM_Qp?bccAil~=H2bid<T7<jQM-Ojr9WfR|k*j)1K{I@Y_z-*Ve?ssPn~=
z;md44Dx#o_L#A8M`C+q^f|39F(+*O%H~!j~;pL@Y^<JuWk3z&@mueYi7pm=cc9noB
zyu)y5TPaUE@;D}%n9$=j^T}~h1xi-o%yse!N_EaSDqaKQ7T8y`jDwI+s%T^D&J}Ga
z`xPFkn)C<KA%8qRVL7UDMdN^Nhn!t>^38*}$sGH6zgq>9wAOc{EpaE~y`s@$N4`09
zUJ~n#t^3l^g>4e+Lu<hpX5WCN7)*3@x1GcYPm($Z<!#^!Es9jAmeGBJf?6z5KjjyG
z8K~_Olarm<1ef-EXl^NN6*UR12?g4lFBj%7ILuq*=`-khO5}506Bf2*oIK)JKSRz<
z(*`Bp#eag_avFQ5kup)%lr<|?Pw9GnBD~=G^PlFH<taBgX;`_%R;TuUGR!z+zVQLr
zP|uNga`mZ^9ym1$M$6%rY@C29T8QKa&U<zU9E)irzfenjSR1b39Db$~90%4F`W<KM
zs=+IGB4R+=E$e3A9yhlq4W6=HJ4|rin!#!JsRE8`%KyzTRc1?4zd8!G(9Y`myw9sD
zaJx=a|EiTNJIaN_MB?Ol-h)@u`^51)o9_U%2orsk2k-Rruwa6Uu2{ty$mGf|i!qhB
zg?r7_qE33`Dsi>dFNp`8B#nmVu4BR7By7uNRtyVRV?Su+TN|I55&In-V5@3Mm`1vR
zvE^pPrjm<fO{X$RET!u}6#@S&<kVT_>*@EEDlIr$50Gc*_gVjG_m@KKrlwl0RV={8
zo%fr_w3^aHR~{F?`(Cev)aQUSQ@<Cnl7A=!NhT^+zYxi%sGG`h?v$Nj0*;rqgytQ1
zv77&6`PkIt4kZWW9eXe#P47a_HLQ{emN90{J|qghG$x|)MBKbRylH~S6y@+a%7XOl
zeeopz9X=|d6)~ndp~u7DvU3tY>^m`3G0}1skFq}g%=h!xO^@h7t0lZD^2Aq=Z}n@g
z@`omSL75?$Yz@Bd&qaj94KABng?5%15xiD@ab7pZOfFb%H`%EVN*e1#NaCNYf3r5x
z21ck&U@7+Y*0)>&=l<#NvCwGpe79?%ErZ9nv{KB{TW@AT%;QYIQ4V1yBO%%Hi8wp%
zLVV3TnvI#}Q2lepEK$&)IjF@+8LP~8;s!bp>GfcUk2Na{)z_!lh+wvJbnsOYVP|I_
zJ&<E18ZG9=?aquMgIrLVEcr4u`iN<gAgyP7Qu}J_qn^kx6<;lrMUdF)_l{y!bA8WV
zDuE-`<J9^xL`iV#RGA#K9;}+Go?c_lxEZYKa0}U0{c%#A!rS?(*_d8e!iI)H0y3DB
zKmxvW$mVmWL8{eu)B>iksvAWVcLkWLgg2598AN2eYNs#{FX~<>?81_#?W}^K;1!&&
z(u{N<fnr*^<DyX7karLZi9fbIJjl&E1_P>F{NzK)I^2|9{6oO=QSxbbB*xx$ctF8Y
z@q575cGyUmK*jg#Qr@Gn6NL$G#^k~Fdcc$rpmonU^xC^6h-F}lM1{Fi|IEjd^~d0r
zh9ncT>QVW3A-}Oy8b9AEhs;x3yUFjD`h%7*Lmc`kfsvhAsPLHDXH6Y%2oZc@I9Kt@
zYrW>Kj4+%xqQ_I9Gj%JFPIUI3z+^WZ9gqqGXr6HD$cPT~mQ1$=h1`hiFp=ury>3NA
zfqCjuY+s^57E3WzZQ}Mt#Lzu2cGX6!r}tE?ha4@~&vVBQaas8mfsiP2&jMg7^3=i-
zNDI*uP%@j3z+d}1Y}BM{=}(JEUkD&B7H%gf*&uJGGTdr^RkGo~J$Lfzj2&S%mFeLy
zCzVdK38<nzqVv2GZxhs%U`XqjiP9Y*MY}B2@Adbq{$(HRAHa>DCu{Y#3saa;0UfZr
zmXkZWY6H=0{;fVo6shZ4ncK;9vLC>P^hQyMLdLGzWmc92tVVdd^eu18_M4=H{Q6Y2
zJD)O`EJ#%bEXJ^N<3Iv4EtNjrli?8$t^zTlt?Wc=Sv$HvOCwc>+&_PYvH3$nF1H^B
zwS6)*8U!6qaf>ZrJB#1O<t0M&;K;O`#JB3joW(e_oLj-3kINQD4&Q1ALfrp!hU}*C
z0L}3-3zO2l!?M?d-wz8h&L+E4{F?u69%tAvWDNy7nHpHYhh2-gCw~eRMZ`w!O!f+Z
z4hSI3Qgd*$O!*Igg5vY!mzlH`$u9$$Q9p&as55&%-z^?rU^LYv_0rU~4;EVaSUf8m
zbxhk`*nMv{sP94XK5bw^;{5w09eH?Uoe4n(Y_9?iJfeSwy%=(LHZ#Uz)?_Ri-)t#z
zb1g9CbjKYD^;z(_BF56~-i1ePuf2sPzY9$<b9P)GJ&YJUTW7%y(pd=EmBa<oi<2e9
zSN?WJOc~b^4KUHyr;`f4|3~a&D=mueBUJc@R#fJBhL9c0XWI{Bq(du|C?8d-cVrIp
z^h5pd$O-xMdgQ0ed;*{FA^p%3=$+{c9U{N{1_FU<yDbqYczO!ow`bda_0NAMChV*|
zX}9#No=K3zni7)4*SzCLdEKV3KIl3g7Pm=7+7MM&SLY-Hs1RFP1?<&o9!C^~jf@R{
zQ<Ssu`{fg~gK@9{qDtvy)_fk}d6@170RBwK1!+FPN8Ra75vyQnXdmzcOtz6*<QIXk
z-#72^r+-%(h&tSfEhlmQ;Y_YtCb8;tiY5|A3}bTHc>VKWFS8C>wJ&dQz|`I<PJ7ny
zW&;}D{qC%DIBiF&KRs$sD9`vtq?*=n;-*hj$G&+Z`TDopZL!cm@&LV*EKYdP-)3Kw
z@tOKGTlq>21zEljztac1ikSpcyrWmUJoq-L_X_Oki~}cbzctn6aI*`#aNFh`#};5A
zzis`+{M>xnbL>WPBXSg_nj&8E+GM;c0W6JYv*uGjqldTJWj7wh^kpKlWws7u8xLDF
z1-pjBunzD-F&i664nY2Q-N!TNZP4L<smiSW4s~tv^DYI-<!jvR{iddl=ryr01`V54
zH-DRV@&H8f5bNp%`kMf#f*?qr9u+4jnU~M7`ZSgoeCuG|Tj=EJT}y5&`b1y*b>np2
z1K&;zmV>=%hFH9rRSi)DVZ}2=KbM}Mwn#y}onUrStV*(Gm4Bt!@Y_dfRGkssB2)r<
z)MM4rj6)T7g^Ll7iT`}SLl=5`rTbK4YyWkpuZuRuY(fiD<VK&u%w&JQHN~ZkG-P;l
zY(IJ!O`TpmF`*_H6tX4a`z9@-<Olq^RsxycaH!~ci3h9f5taSx?1k^R7~Pj#s#K3l
zB+Lgze@nLC^mHQbLM#QpEcRmAI8M(9?GE7whoxTHXAADn>;-Yr$W#@+**MsFX{(XM
zwRz`B3lV5!g!T~-^oQH6#qD1J2_Uz-<-l9PQPT}mKeV^vub1kbT`JLA0u$%hI;*>^
zdi2)P`Gq4tl~gbX?>?nB`gH1jnE{RQ8zU}@0J8wNN%|fVQ*#|xo-h{`HUkb$ySnL$
zE+{$}#=ksDeIy+o<>ECP?ABIYxZJH;KJ8+-r5VEL6&PY?_u3@3XXV%8uqL)Xeea1M
zYMmx~YEd0X_nL%uIZ7pF$BJhSUzw<4oPZb`^vv<&5E(yYtpJJ9AC2FcP{j4R>0FZ9
ze|2)4O9q%NL!5RvT45g~Ge+n>giE|@j1&VR!Xt`-QcUQ=61gX@pcHkJ=f^V}k&IPT
z4@+d84&oX%mMRbU8Q{$13{QGr=0Az8DNn`U!+fDq1}OM61V*jcYoSkzz0^2F3<U;x
zYt+8C1$}!nA|W&4B+w+b3lUu@aaZaJ(C?@n4tb;$o2lKJHM;Hogv~-sN4n;=Gp=0L
zX$3M`sYH$im|eKOGze6zhC*8)LCYqmjFfK>2nuBYfRuB8H#wd17b0`A_@<mQ=@o=g
z5f`xP$u-QJM-i#7(Z;T*hazCR+udJt;&PwelBnHZ%TLOCAD#7o8x*}7dLQ4VFm^k0
eO+fQ+x9wvXdc8%(N?z&yTtnr#a^*AI@c#gxJ9hm5

literal 0
HcmV?d00001

diff --git a/doc/user/group/devops_adoption/index.md b/doc/user/group/devops_adoption/index.md
index dfb166b61ca..c33396ea2ff 100644
--- a/doc/user/group/devops_adoption/index.md
+++ b/doc/user/group/devops_adoption/index.md
@@ -36,6 +36,18 @@ DevOps adoption shows feature adoption for development, security, and operations
 A feature shows as **adopted** when a group or subgroup has used the feature in a project in the last full calendar month.
 For example, if an issue was created in a project in a group, the group has adopted issues in that time.
 
+![DevOps adoption report for a group](img/devops_adoption_v17_8.png)
+
+The **Overview** tab illustrates the:
+
+- Total number of features adopted.
+- Features adopted in each category.
+- Number of features adopted in each category by month in the **Adoption over time** bar chart.
+The chart shows only data from the date you enabled DevOps adoption for the group.
+- Number of features adopted in each category by subgroup in the **Adoption by subgroup** table.
+
+The **Dev**, **Sec**, and **Ops** tabs illustrate the features adopted in development, security, and operations by subgroup.
+
 The DevOps adoption report excludes:
 
 - Dormant projects. The number of projects that use a feature is not considered. Having many dormant projects doesn't lower the adoption.
@@ -61,16 +73,7 @@ To view DevOps adoption:
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Analyze > DevOps adoption**.
-
-The **Overview** tab displays the:
-
-- Total number of features adopted.
-- Features adopted in each category.
-- Number of features adopted in each category by month in the **Adoption over time** chart.
-The chart shows only data from the date you enabled DevOps adoption for the group.
-- Number of features adopted in each category by subgroup in the **Adoption by subgroup** table.
-
-The **Dev**, **Sec**, and **Ops** tabs display the features adopted in development, security, and operations by subgroup.
+1. To view the features adopted by category in a month, hover over a bar.
 
 ## Add a subgroup to DevOps adoption
 
diff --git a/doc/user/group/ssh_certificates.md b/doc/user/group/ssh_certificates.md
index bb395404141..b4dea73e382 100644
--- a/doc/user/group/ssh_certificates.md
+++ b/doc/user/group/ssh_certificates.md
@@ -5,17 +5,67 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 description: "Manage Git access to projects by adding CA certificates to your top-level group, instead of individual groups."
 ---
 
-# Manage group's SSH certificates
+# Manage group SSH certificates
 
 DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** GitLab.com
 
-Manage Git access to the projects by sharing public Certified Authority (`CA`) files in your organization's top-level group.
+You can control and manage Git access to your projects and groups with SSH certificates.
 
-Git access control options on GitLab SaaS (SSH, HTTPS) rely on credentials (such as access tokens and SSH keys)
-setup in the user profile and are out of control of the organization.
-To temporarily grant Git access to your projects, you can use SSH certificates.
+SSH certificates are cryptographically signed documents that authenticate a user's identity and
+permissions.
+They are issued by a trusted Certificate Authority (CA) and contain information such as
+the user's identity, validity period, and permissions.
+
+The benefits of SSH certificate authentication are:
+
+- **Centralized access control**: You can manage access through a central CA, instead of individual
+  user-managed SSH keys.
+- **Enhanced security**: SSH certificates are more secure than traditional SSH keys.
+- **Time-limited access**: You can set certificates to expire after a specific period.
+- **Simplified credential management**: Organizations can maintain a list of approved
+  SSH certificate credentials for repository access.
+- **Independent from user-managed credentials**: Access is controlled with group-managed
+  certificates, and not users' personal public SSH keys.
+
+## SSH certificates and SSH keys
+
+The following table compares SSH certificates and SSH keys:
+
+| Feature                   | SSH certificates                      | SSH keys |
+| ------------------------- | ------------------------------------- | -------- |
+| **Access control**        | Centralized through group-managed CA. | Distributed across individual user accounts. |
+| **Expiration**            | Built-in expiration.                  | No built-in expiration. |
+| **Credential management** | Managed by group Owners.              | Managed by individual users. |
+| **Setup complexity**      | More complex initial setup.           | Simpler initial setup. |
+
+## Authentication flow
+
+The following diagram illustrates how SSH certificate authentication works
+in GitLab, from requesting a certificate to accessing a repository:
+
+```mermaid
+%%{init: { "fontFamily": "GitLab Sans" }}%%
+sequenceDiagram
+    accTitle: SSH certificate authentication flow
+    accDescr: Sequential diagram showing how a user obtains an SSH certificate from a Group Certificate Authority and uses it to access a Git repository through GitLab.
+
+    participant User
+    participant GroupCA as Group Certificate Authority
+    participant GitLab
+    participant GitRepo as Git Repository
+
+    User->>GroupCA: Request SSH certificate
+    GroupCA->>User: Issue signed SSH certificate
+    User->>GitLab: Attempt to access repository via SSH
+    GitLab->>GitLab: Verify certificate is valid and issued by Group CA
+    GitLab->>GitRepo: Grant access
+    GitRepo->>User: Allow repository operations
+```
+
+The authentication process verifies that users have valid SSH certificates before
+allowing repository access.
 
 ## Add a CA certificate to a top-level group
 
@@ -68,11 +118,17 @@ The user certificates can only be used to access the projects in the top-level g
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/426235) in GitLab 16.9.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/488635) in GitLab 17.7. Feature flag `enforce_ssh_certificates_via_settings` removed.
 
-You can enforce usage of SSH certificates and forbid users from authenticating using SSH
+You can enforce the usage of SSH certificates and restrict users from authenticating using SSH
 keys and access tokens.
 
-When SSH certificates are enforced, only individual user accounts are affected.
-It does not apply to service accounts, deploy keys, and other types of internal accounts.
+When SSH certificates are enforced:
+
+- Only individual user accounts are affected.
+- It does not apply to service accounts, deploy keys, and other types of internal accounts.
+- Only SSH certificates added to the group by Owners are used to authenticate repository access.
+
+NOTE:
+Enforcing SSH certificates disables HTTPS access for regular users.
 
 Prerequisites:
 
diff --git a/doc/user/project/quick_actions.md b/doc/user/project/quick_actions.md
index ffca5609137..33ded641566 100644
--- a/doc/user/project/quick_actions.md
+++ b/doc/user/project/quick_actions.md
@@ -185,6 +185,7 @@ To auto-format this table, use the VS Code Markdown Table formatter: `https://do
 | `/unassign`                                                   | **{dotted-circle}** No | **{check-circle}** Yes | **{check-circle}** Yes | Remove all assignees. |
 | `/unlabel ~label1 ~label2` or `/remove_label ~label1 ~label2` | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Remove specified labels. |
 | `/unlabel` or `/remove_label`                                 | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Remove all labels. |
+| `/unlink`                                                     | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Remove link to the provided work item. The `<work item>` value should be in the format of `#work_item`, `group/project#work_item`, or the full work item URL. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/481851) in GitLab 17.8. |
 | `/unsubscribe`                                                  | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Unsubscribe to notifications. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/420796) in GitLab 16.4 |
 | `/weight <value>`                                             | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Set weight. Valid options for `<value>` include `0`, `1`, and `2`. |
 
diff --git a/lib/object_storage/direct_upload.rb b/lib/object_storage/direct_upload.rb
index a3ce50874be..33808f0828c 100644
--- a/lib/object_storage/direct_upload.rb
+++ b/lib/object_storage/direct_upload.rb
@@ -89,7 +89,7 @@ module ObjectStorage
             UseIamProfile: config.use_iam_profile?,
             ServerSideEncryption: config.server_side_encryption,
             SSEKMSKeyID: config.server_side_encryption_kms_key_id,
-            AwsSDK: Feature.enabled?(:workhorse_use_aws_sdk_v2, :instance) ? "v2" : "v1"
+            AwsSDK: "v2"
           }.compact
         }
       }
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 0016812822b..092d81a84a0 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -23748,6 +23748,9 @@ msgstr ""
 msgid "Failed to create a branch for this issue. Please try again."
 msgstr ""
 
+msgid "Failed to create a new directory. See exception details for more information."
+msgstr ""
+
 msgid "Failed to create a to-do item for the design."
 msgstr ""
 
@@ -40612,10 +40615,13 @@ msgstr ""
 msgid "PagesDomain|Certificate Key is too long. (Max %d bytes)"
 msgstr ""
 
+msgid "PagesUsageQuota|Active parallel deployments"
+msgstr ""
+
 msgid "PagesUsageQuota|Learn about limits for Pages deployments"
 msgstr ""
 
-msgid "PagesUsageQuota|Parallel deployments"
+msgid "PagesUsageQuota|Remaining deployments"
 msgstr ""
 
 msgid "Pages|+ %{n} more deployments"
@@ -40663,9 +40669,6 @@ msgstr ""
 msgid "Pages|No deployments yet"
 msgstr ""
 
-msgid "Pages|Pages deployments"
-msgstr ""
-
 msgid "Pages|Parallel deployments"
 msgstr ""
 
diff --git a/qa/qa/page/group/runners/index.rb b/qa/qa/page/group/runners/index.rb
index 41c1a0838cc..bfc5232cc6b 100644
--- a/qa/qa/page/group/runners/index.rb
+++ b/qa/qa/page/group/runners/index.rb
@@ -51,6 +51,10 @@ module QA
               runner.tags.all? { |tag| has_content?(tag) }
             end
           end
+
+          def has_no_runner?(runner)
+            has_no_element?("runner-row-#{runner.id}")
+          end
         end
       end
     end
diff --git a/qa/qa/page/project/settings/runners.rb b/qa/qa/page/project/settings/runners.rb
index ce3bc1a5396..5dac4bc6b4d 100644
--- a/qa/qa/page/project/settings/runners.rb
+++ b/qa/qa/page/project/settings/runners.rb
@@ -12,6 +12,10 @@ module QA
           def has_online_runner?
             has_element?('runner-status-icon', status: 'online')
           end
+
+          def has_offline_runner?
+            has_element?('runner-status-icon', status: 'offline')
+          end
         end
       end
     end
diff --git a/qa/qa/resource/runner_base.rb b/qa/qa/resource/runner_base.rb
index 8274ea2f433..6e3ac8fe9ca 100644
--- a/qa/qa/resource/runner_base.rb
+++ b/qa/qa/resource/runner_base.rb
@@ -65,6 +65,10 @@ module QA
         end
       end
 
+      def unregister!
+        unregister_runner
+      end
+
       def remove_via_api!
         super
       ensure
@@ -124,6 +128,12 @@ module QA
         raise(e)
       end
 
+      def unregister_runner
+        raise "Cannot unregister runner: Docker container not initialized for runner '#{name}'" unless @docker_container
+
+        @docker_container.run_unregister_command!
+      end
+
       def populate_initial_id
         tag_list = tags ? { tag_list: tags.compact.join(',') } : {}
         runner = runner(**tag_list)
diff --git a/qa/qa/resource/user_runners.rb b/qa/qa/resource/user_runners.rb
index fb504bc725f..90195556d54 100644
--- a/qa/qa/resource/user_runners.rb
+++ b/qa/qa/resource/user_runners.rb
@@ -39,6 +39,10 @@ module QA
         start_container_and_register
       end
 
+      def unregister!
+        unregister_runner
+      end
+
       def remove_via_api!
         super
       ensure
@@ -106,6 +110,12 @@ module QA
         raise(e)
       end
 
+      def unregister_runner
+        raise "Cannot unregister runner: Docker container not initialized for runner '#{name}'" unless @docker_container
+
+        @docker_container.run_unregister_command!
+      end
+
       def populate_initial_id
         tag_list = tags ? { tag_list: tags.compact.join(',') } : {}
         runner = runner(**tag_list)
diff --git a/qa/qa/service/docker_run/gitlab_runner.rb b/qa/qa/service/docker_run/gitlab_runner.rb
index a5e54713e2e..15f31f44b5c 100644
--- a/qa/qa/service/docker_run/gitlab_runner.rb
+++ b/qa/qa/service/docker_run/gitlab_runner.rb
@@ -52,6 +52,14 @@ module QA
           shell("docker exec #{@name} sh -c '#{prove_airgap}'") if network == 'airgapped'
         end
 
+        def run_unregister_command!
+          cmd = <<~CMD.tr("\n", ' ')
+            docker exec --detach #{@name} sh -c "#{unregister_command}"
+          CMD
+
+          shell(cmd, mask_secrets: [runner_auth_token])
+        end
+
         def tags=(tags)
           @tags = tags
           @run_untagged = false
@@ -105,6 +113,15 @@ module QA
           CMD
         end
 
+        def runner_auth_token
+          runner_list = shell("docker exec #{@name} sh -c 'gitlab-runner list'")
+          runner_list.match(/Token\e\[0;m=([a-zA-Z0-9_-]+)/i)&.[](1)
+        end
+
+        def unregister_command
+          "gitlab-runner unregister --url #{@address} --token #{runner_auth_token}"
+        end
+
         # Ping Cloudflare DNS, should fail
         # Ping Registry, should fail to resolve
         def prove_airgap
diff --git a/qa/qa/specs/features/browser_ui/4_verify/runner/deprecated_unregister_runner_spec.rb b/qa/qa/specs/features/browser_ui/4_verify/runner/deprecated_unregister_runner_spec.rb
new file mode 100644
index 00000000000..3d536d1b680
--- /dev/null
+++ b/qa/qa/specs/features/browser_ui/4_verify/runner/deprecated_unregister_runner_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Verify', product_group: :runner do
+    describe 'Runner' do
+      let(:executor) { "qa-runner-#{SecureRandom.hex(6)}" }
+      let!(:runner) { create(:deprecated_group_runner, name: executor, tags: ["e2e-test-#{SecureRandom.hex(6)}"]) }
+
+      after do
+        runner.remove_via_api!
+        # Skip 404 since the test deletes the runner by unregistering in this case
+      rescue StandardError => e
+        raise e unless e.message.include?('404')
+      end
+
+      it 'user unregisters a runner with deprecated registration token',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/510655' do
+        Flow::Login.sign_in
+
+        runner.group.visit!
+
+        Page::Group::Menu.perform(&:go_to_runners)
+
+        Page::Group::Runners::Index.perform do |group_runners|
+          expect { group_runners.has_active_runner?(runner) }.to eventually_be(true).within(sleep_interval: 2)
+        end
+
+        runner.unregister!
+
+        Page::Group::Runners::Index.perform do |group_runners|
+          group_runners.refresh
+          expect { group_runners.has_no_runner?(runner) }.to eventually_be(true).within(sleep_interval: 2)
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/specs/features/browser_ui/4_verify/runner/unregister_runner_spec.rb b/qa/qa/specs/features/browser_ui/4_verify/runner/unregister_runner_spec.rb
new file mode 100644
index 00000000000..cd32a18b000
--- /dev/null
+++ b/qa/qa/specs/features/browser_ui/4_verify/runner/unregister_runner_spec.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Verify', product_group: :runner do
+    describe 'Runner' do
+      let(:executor) { "qa-runner-#{SecureRandom.hex(6)}" }
+      let!(:runner) { create(:project_runner, name: executor, tags: ["e2e-test-#{SecureRandom.hex(6)}"]) }
+
+      after do
+        runner.remove_via_api!
+      end
+
+      it 'user unregisters a runner with authentication token',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/510652' do
+        Flow::Login.sign_in
+
+        runner.project.visit!
+
+        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
+        Page::Project::Settings::CiCd.perform do |settings|
+          settings.expand_runners_settings do |page|
+            expect(page).to have_content(executor)
+            expect(page).to have_online_runner
+          end
+        end
+
+        runner.unregister!
+
+        page.refresh
+
+        Page::Project::Settings::CiCd.perform do |settings|
+          settings.expand_runners_settings do |page|
+            expect(page).to have_content(executor)
+            expect(page).to have_offline_runner
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/spec/service/docker_run/gitlab_runner_spec.rb b/qa/spec/service/docker_run/gitlab_runner_spec.rb
index ce24c310028..216c55570c0 100644
--- a/qa/spec/service/docker_run/gitlab_runner_spec.rb
+++ b/qa/spec/service/docker_run/gitlab_runner_spec.rb
@@ -200,6 +200,31 @@ module QA
       end
     end
 
+    describe '#unregister!' do
+      let(:run_unregister_command) { subject.send(:run_unregister_command!) }
+
+      before do
+        allow(subject).to receive(:shell)
+
+        subject.instance_eval do
+          def runner_auth_token
+            token
+          end
+        end
+
+        run_unregister_command
+      end
+
+      it 'sets url' do
+        expect(subject).to have_received_masked_shell_command(/ --url #{subject.address} /)
+      end
+
+      it 'sets masked token' do
+        auth_token = subject.runner_auth_token
+        expect(subject).to have_received_masked_shell_command(/ --token #{auth_token}/)
+      end
+    end
+
     RSpec::Matchers.define "have_received_masked_shell_command" do |cmd|
       match do |actual|
         expect(actual).to have_received(:shell).with(cmd, mask_secrets: anything)
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 7c561f3fd0d..3ba7a04f456 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -264,7 +264,7 @@ RSpec.describe 'Database schema',
       approval_merge_request_rules: 17,
       ci_builds: 27,
       ci_pipelines: 24,
-      ci_runners: 16,
+      ci_runners: 17,
       ci_runners_e59bb2812d: 16,
       deployments: 18,
       epics: 19,
diff --git a/spec/features/projects/files/user_creates_directory_spec.rb b/spec/features/projects/files/user_creates_directory_spec.rb
index 2c3b6e6d2a5..61b692ec75c 100644
--- a/spec/features/projects/files/user_creates_directory_spec.rb
+++ b/spec/features/projects/files/user_creates_directory_spec.rb
@@ -29,7 +29,7 @@ RSpec.describe 'Projects > Files > User creates a directory', :js, feature_categ
 
     it 'creates the directory in the default branch' do
       fill_in(:dir_name, with: 'new_directory')
-      click_button('Create directory')
+      click_button('Commit changes')
 
       expect(page).to have_content('master')
       expect(page).to have_content('The directory has been successfully created')
@@ -39,7 +39,7 @@ RSpec.describe 'Projects > Files > User creates a directory', :js, feature_categ
     it 'does not create a directory with a name of already existed directory' do
       fill_in(:dir_name, with: 'files')
       fill_in(:commit_message, with: 'New commit message', visible: true)
-      click_button('Create directory')
+      click_button('Commit changes')
 
       expect(page).to have_content('A directory with this name already exists')
       expect(page).to have_current_path(project_tree_path(project, 'master'), ignore_query: true)
@@ -58,7 +58,7 @@ RSpec.describe 'Projects > Files > User creates a directory', :js, feature_categ
       click_button('New directory')
 
       fill_in(:dir_name, with: 'new_directory')
-      click_button('Create directory')
+      click_button('Commit changes')
 
       expect(page).to have_content('files')
       expect(page).to have_content('new_directory')
@@ -70,18 +70,34 @@ RSpec.describe 'Projects > Files > User creates a directory', :js, feature_categ
       first('.add-to-tree').click
       click_button('New directory')
       fill_in(:dir_name, with: 'new_directory')
+      choose('Commit to a new branch', option: true)
       fill_in(:branch_name, with: 'new-feature')
-      click_button('Create directory')
     end
 
-    it 'creates the directory in the new branch and redirect to the merge request' do
-      expect(page).to have_content('new-feature')
-      expect(page).to have_content('The directory has been successfully created')
-      expect(page).to have_content('New merge request')
-      expect(page).to have_content('From new-feature into master')
-      expect(page).to have_content('Add new directory')
+    context 'when create a merge request for changes is selected' do
+      it 'creates the directory in the new branch and redirect to the merge request' do
+        click_button('Commit changes')
 
-      expect(page).to have_current_path(project_new_merge_request_path(project), ignore_query: true)
+        expect(page).to have_content('new-feature')
+        expect(page).to have_content('The directory has been successfully created')
+        expect(page).to have_content('New merge request')
+        expect(page).to have_content('From new-feature into master')
+        expect(page).to have_content('Add new directory')
+
+        expect(page).to have_current_path(project_new_merge_request_path(project), ignore_query: true)
+      end
+    end
+
+    context 'when create a merge request for changes is not selected' do
+      it 'creates the directory in the new branch and redirect to that directory' do
+        uncheck('Create a merge request for this change')
+        click_button('Commit changes')
+
+        expect(page).to have_content('The directory has been successfully created')
+        expect(page).to have_content('new_directory')
+        expect(page).to have_current_path(project_tree_path(project, File.join('new-feature', 'new_directory')),
+          ignore_query: true)
+      end
     end
   end
 
@@ -102,7 +118,7 @@ RSpec.describe 'Projects > Files > User creates a directory', :js, feature_categ
       click_button('New directory')
       fill_in(:dir_name, with: 'new_directory')
       fill_in(:commit_message, with: 'New commit message', visible: true)
-      click_button('Create directory')
+      click_button('Commit changes')
 
       fork = user.fork_of(project2.reload)
       wait_for_requests
diff --git a/spec/features/work_items/create_issue_work_item_spec.rb b/spec/features/work_items/create_issue_work_item_spec.rb
index acc373a1bc0..a43b655565b 100644
--- a/spec/features/work_items/create_issue_work_item_spec.rb
+++ b/spec/features/work_items/create_issue_work_item_spec.rb
@@ -24,6 +24,7 @@ RSpec.describe 'Create issue work item', :js, feature_category: :team_planning d
         expect(page).to have_selector('[data-testid="work-item-assignees"]')
         expect(page).to have_selector('[data-testid="work-item-labels"]')
         expect(page).to have_selector('[data-testid="work-item-milestone"]')
+        expect(page).to have_selector('[data-testid="work-item-parent"]')
 
         send_keys 'I am a new issue'
         click_button 'Create issue'
diff --git a/spec/frontend/boards/components/board_card_spec.js b/spec/frontend/boards/components/board_card_spec.js
index fe8f4dccb93..f7510466c6b 100644
--- a/spec/frontend/boards/components/board_card_spec.js
+++ b/spec/frontend/boards/components/board_card_spec.js
@@ -1,7 +1,7 @@
 import { GlLabel } from '@gitlab/ui';
 import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
-
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import waitForPromises from 'helpers/wait_for_promises';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
@@ -143,6 +143,14 @@ describe('Board card', () => {
     expect(wrapper.classes()).not.toContain('is-active');
   });
 
+  it('render card with unique id', () => {
+    mountComponent();
+
+    expect(findBoardCardButton().attributes().id).toBe(
+      `listItem-${mockIssue.referencePath.split('#')[0]}/${getIdFromGraphQLId(mockIssue.id)}`,
+    );
+  });
+
   describe('when mouseup event is called on the card', () => {
     beforeEach(() => {
       mountComponent({ mountOptions: { attachTo: document.body } });
diff --git a/spec/frontend/repository/components/new_directory_modal_spec.js b/spec/frontend/repository/components/new_directory_modal_spec.js
index 620b01a23d2..9918c6bf7f4 100644
--- a/spec/frontend/repository/components/new_directory_modal_spec.js
+++ b/spec/frontend/repository/components/new_directory_modal_spec.js
@@ -1,4 +1,3 @@
-import { GlModal, GlFormTextarea, GlFormCheckbox } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import axios from 'axios';
@@ -6,21 +5,22 @@ import MockAdapter from 'axios-mock-adapter';
 import waitForPromises from 'helpers/wait_for_promises';
 import { createAlert } from '~/alert';
 import { HTTP_STATUS_OK } from '~/lib/utils/http_status';
-import { visitUrl } from '~/lib/utils/url_utility';
+import * as urlUtility from '~/lib/utils/url_utility';
+import { logError } from '~/lib/logger';
+import CommitChangesModal from '~/repository/components/commit_changes_modal.vue';
 import NewDirectoryModal from '~/repository/components/new_directory_modal.vue';
 
 jest.mock('~/alert');
-jest.mock('~/lib/utils/url_utility', () => ({
-  visitUrl: jest.fn(),
-}));
+jest.mock('~/lib/logger');
 
 const initialProps = {
   modalTitle: 'Create new directory',
   modalId: 'modal-new-directory',
   commitMessage: 'Add new directory',
   targetBranch: 'some-target-branch',
-  originalBranch: 'master',
+  originalBranch: 'main',
   canPushCode: true,
+  canPushToBranch: true,
   path: 'create_dir',
 };
 
@@ -35,6 +35,7 @@ const defaultFormValue = {
 describe('NewDirectoryModal', () => {
   let wrapper;
   let mock;
+  let visitUrlSpy;
 
   const createComponent = (props = {}) => {
     wrapper = shallowMount(NewDirectoryModal, {
@@ -46,89 +47,50 @@ describe('NewDirectoryModal', () => {
         static: true,
         visible: true,
       },
+      stubs: {
+        CommitChangesModal,
+      },
     });
   };
 
-  const findModal = () => wrapper.findComponent(GlModal);
+  const findCommitChangesModal = () => wrapper.findComponent(CommitChangesModal);
   const findDirName = () => wrapper.find('[name="dir_name"]');
-  const findBranchName = () => wrapper.find('[name="branch_name"]');
-  const findCommitMessage = () => wrapper.findComponent(GlFormTextarea);
-  const findMrCheckbox = () => wrapper.findComponent(GlFormCheckbox);
-
-  const fillForm = async (inputValue = {}) => {
-    const {
-      dirName = defaultFormValue.dirName,
-      branchName = defaultFormValue.branchName,
-      commitMessage = defaultFormValue.commitMessage,
-      createNewMr = true,
-    } = inputValue;
-
+  const fillForm = async (dirName = defaultFormValue.dirName) => {
     await findDirName().vm.$emit('input', dirName);
-    await findBranchName().vm.$emit('input', branchName);
-    await findCommitMessage().vm.$emit('input', commitMessage);
-    await findMrCheckbox().vm.$emit('input', createNewMr);
     await nextTick();
   };
 
   const submitForm = async () => {
-    const mockEvent = { preventDefault: jest.fn() };
-    findModal().vm.$emit('primary', mockEvent);
+    findCommitChangesModal().vm.$emit('submit-form', new FormData());
     await waitForPromises();
   };
 
-  it('renders modal component', () => {
+  beforeEach(() => {
+    visitUrlSpy = jest.spyOn(urlUtility, 'visitUrl');
     createComponent();
-
-    const { modalTitle: title } = initialProps;
-
-    expect(findModal().props()).toMatchObject({
-      title,
-      size: 'md',
-      actionPrimary: {
-        text: NewDirectoryModal.i18n.PRIMARY_OPTIONS_TEXT,
-      },
-      actionCancel: {
-        text: 'Cancel',
-      },
-    });
   });
 
-  describe('form', () => {
-    it.each`
-      component            | defaultValue                  | canPushCode | targetBranch                 | originalBranch                 | exist    | attributes
-      ${findDirName}       | ${undefined}                  | ${true}     | ${initialProps.targetBranch} | ${initialProps.originalBranch} | ${true}  | ${'value'}
-      ${findBranchName}    | ${initialProps.targetBranch}  | ${true}     | ${initialProps.targetBranch} | ${initialProps.originalBranch} | ${true}  | ${'value'}
-      ${findBranchName}    | ${undefined}                  | ${false}    | ${initialProps.targetBranch} | ${initialProps.originalBranch} | ${false} | ${'value'}
-      ${findCommitMessage} | ${initialProps.commitMessage} | ${true}     | ${initialProps.targetBranch} | ${initialProps.originalBranch} | ${true}  | ${'value'}
-      ${findMrCheckbox}    | ${'true'}                     | ${true}     | ${'new-target-branch'}       | ${'master'}                    | ${true}  | ${'checked'}
-      ${findMrCheckbox}    | ${'true'}                     | ${true}     | ${'master'}                  | ${'master'}                    | ${true}  | ${'checked'}
-    `(
-      'has the correct form fields',
-      ({
-        component,
-        defaultValue,
-        canPushCode,
-        targetBranch,
-        originalBranch,
-        exist,
-        attributes,
-      }) => {
-        createComponent({
-          canPushCode,
-          targetBranch,
-          originalBranch,
-        });
-        const formField = component();
+  describe('default', () => {
+    beforeEach(() => {
+      createComponent();
+    });
 
-        if (!exist) {
-          expect(formField.exists()).toBe(false);
-          return;
-        }
+    it('renders commit changes modal', () => {
+      expect(findCommitChangesModal().props()).toMatchObject({
+        modalId: 'modal-new-directory',
+        commitMessage: 'Add new directory',
+        targetBranch: 'some-target-branch',
+        originalBranch: 'main',
+        canPushCode: true,
+        canPushToBranch: true,
+        valid: false,
+        loading: false,
+      });
+    });
 
-        expect(formField.exists()).toBe(true);
-        expect(formField.attributes(attributes)).toBe(defaultValue);
-      },
-    );
+    it('includes directory name input', () => {
+      expect(findDirName().exists()).toBe(true);
+    });
   });
 
   describe('form submission', () => {
@@ -141,61 +103,53 @@ describe('NewDirectoryModal', () => {
     });
 
     describe('valid form', () => {
-      beforeEach(() => {
-        createComponent();
+      it('enables submit button when form is complete', async () => {
+        await fillForm({ dirName: 'test-dir' });
+        expect(findCommitChangesModal().props('valid')).toBe(true);
       });
 
-      it('passes the formData', async () => {
-        const { dirName, branchName, commitMessage, originalBranch, createNewMr } =
-          defaultFormValue;
+      it('passes additional formData', async () => {
+        const { dirName, branchName } = defaultFormValue;
         mock.onPost(initialProps.path).reply(HTTP_STATUS_OK, {});
         await fillForm();
         await submitForm();
 
-        expect(mock.history.post[0].data.get('dir_name')).toEqual(dirName);
-        expect(mock.history.post[0].data.get('branch_name')).toEqual(branchName);
-        expect(mock.history.post[0].data.get('commit_message')).toEqual(commitMessage);
-        expect(mock.history.post[0].data.get('original_branch')).toEqual(originalBranch);
-        expect(mock.history.post[0].data.get('create_merge_request')).toEqual(String(createNewMr));
-      });
-
-      it('does not submit "create_merge_request" formData if createNewMr is not checked', async () => {
-        mock.onPost(initialProps.path).reply(HTTP_STATUS_OK, {});
-        await fillForm({ createNewMr: false });
-        await submitForm();
-        expect(mock.history.post[0].data.get('create_merge_request')).toBeNull();
+        const formData = mock.history.post[0].data;
+        expect(formData.get('dir_name')).toBe(dirName);
+        expect(formData.get('branch_name')).toBe(branchName);
       });
 
       it('redirects to the new directory', async () => {
         const response = { filePath: 'new-dir-path' };
         mock.onPost(initialProps.path).reply(HTTP_STATUS_OK, response);
 
-        await fillForm({ dirName: 'foo', branchName: 'master', commitMessage: 'foo' });
+        await fillForm('foo');
         await submitForm();
 
-        expect(visitUrl).toHaveBeenCalledWith(response.filePath);
+        expect(visitUrlSpy).toHaveBeenCalledWith(response.filePath);
       });
     });
 
     describe('invalid form', () => {
-      beforeEach(() => {
-        createComponent();
+      it('passes correct prop for validity', async () => {
+        await fillForm('');
+        expect(findCommitChangesModal().props('valid')).toBe(false);
       });
 
-      it('disables submit button', async () => {
-        await fillForm({ dirName: '', branchName: '', commitMessage: '' });
-        expect(findModal().props('actionPrimary').attributes.disabled).toBe(true);
-      });
-
-      it('creates an alert error', async () => {
+      it('creates an alert error and logs the error', async () => {
         mock.onPost(initialProps.path).timeout();
+        const mockError = new Error('timeout of 0ms exceeded');
 
-        await fillForm({ dirName: 'foo', branchName: 'master', commitMessage: 'foo' });
+        await fillForm('foo');
         await submitForm();
 
         expect(createAlert).toHaveBeenCalledWith({
           message: NewDirectoryModal.i18n.ERROR_MESSAGE,
         });
+        expect(logError).toHaveBeenCalledWith(
+          'Failed to create a new directory. See exception details for more information.',
+          mockError,
+        );
       });
     });
   });
diff --git a/spec/frontend/usage_quotas/components/sectioned_percentage_bar_spec.js b/spec/frontend/usage_quotas/components/sectioned_percentage_bar_spec.js
index 6b022172d46..a693a2caa7f 100644
--- a/spec/frontend/usage_quotas/components/sectioned_percentage_bar_spec.js
+++ b/spec/frontend/usage_quotas/components/sectioned_percentage_bar_spec.js
@@ -1,3 +1,4 @@
+import { GRAY_100 } from '@gitlab/ui/src/tokens/build/js/tokens';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import SectionedPercentageBar from '~/usage_quotas/components/sectioned_percentage_bar.vue';
 
@@ -98,4 +99,88 @@ describe('SectionedPercentageBar', () => {
       section4.find(`[data-testid="${LEGEND_SECTION_COLOR_TESTID}"]`).attributes('style'),
     ).toBe('background-color: rgb(78, 127, 14);');
   });
+
+  describe('hiding labels', () => {
+    beforeEach(() => {
+      createComponent({
+        propsData: {
+          sections: [
+            {
+              id: SECTION_1,
+              label: 'Section 1',
+              value: 20,
+              formattedValue: '20',
+              hideLabel: true,
+            },
+            {
+              id: SECTION_2,
+              label: 'Section 2',
+              value: 40,
+              formattedValue: '40',
+            },
+          ],
+        },
+      });
+    });
+
+    it('hides the label when hideLabel=true', () => {
+      const section1 = wrapper.findByTestId(PERCENTAGE_BAR_SECTION_TESTID_PREFIX + SECTION_1);
+      expect(section1.find(`[data-testid="${LEGEND_SECTION_COLOR_TESTID}"]`).exists()).toBe(false);
+    });
+
+    it('does not hide the label when hideLabel=false', () => {
+      const section2 = wrapper.findByTestId(
+        PERCENTAGE_BAR_LEGEND_SECTION_TESTID_PREFIX + SECTION_2,
+      );
+      expect(section2.find(`[data-testid="${LEGEND_SECTION_COLOR_TESTID}"]`).exists()).toBe(true);
+    });
+  });
+
+  describe('custom colors', () => {
+    beforeEach(() => {
+      createComponent({
+        propsData: {
+          sections: [
+            {
+              id: SECTION_1,
+              label: 'Section 1',
+              value: 20,
+              formattedValue: '20',
+              color: GRAY_100,
+            },
+            {
+              id: SECTION_2,
+              label: 'Section 2',
+              value: 40,
+              formattedValue: '40',
+            },
+          ],
+        },
+      });
+    });
+
+    it('uses the custom color in the percentage bar', () => {
+      const section1PercentageBar = wrapper.findByTestId(
+        PERCENTAGE_BAR_SECTION_TESTID_PREFIX + SECTION_1,
+      );
+      expect(section1PercentageBar.attributes('style')).toContain(
+        'background-color: rgb(220, 220, 222);',
+      );
+    });
+
+    it('uses the custom color in the legend', () => {
+      const section1Legend = wrapper.findByTestId(
+        PERCENTAGE_BAR_LEGEND_SECTION_TESTID_PREFIX + SECTION_1,
+      );
+
+      expect(
+        section1Legend.find(`[data-testid="${LEGEND_SECTION_COLOR_TESTID}"]`).attributes('style'),
+      ).toBe('background-color: rgb(220, 220, 222);');
+    });
+
+    it('falls back to the palette color when not specified', () => {
+      const section2 = wrapper.findByTestId(PERCENTAGE_BAR_SECTION_TESTID_PREFIX + SECTION_2);
+      expect(section2.attributes('style')).toContain('background-color: rgb(177, 79, 24);');
+    });
+  });
 });
diff --git a/spec/frontend/vue_shared/issuable/list/components/issuable_item_spec.js b/spec/frontend/vue_shared/issuable/list/components/issuable_item_spec.js
index a702b7726cb..5a3f81851f6 100644
--- a/spec/frontend/vue_shared/issuable/list/components/issuable_item_spec.js
+++ b/spec/frontend/vue_shared/issuable/list/components/issuable_item_spec.js
@@ -4,6 +4,7 @@ import { useFakeDate } from 'helpers/fake_date';
 import { TEST_HOST } from 'helpers/test_constants';
 import { shallowMountExtended as shallowMount } from 'helpers/vue_test_utils_helper';
 import waitForPromises from 'helpers/wait_for_promises';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import { visitUrl } from '~/lib/utils/url_utility';
 import IssuableItem from '~/vue_shared/issuable/list/components/issuable_item.vue';
 import WorkItemTypeIcon from '~/work_items/components/work_item_type_icon.vue';
@@ -23,6 +24,7 @@ const createComponent = ({
   showWorkItemTypeIcon = false,
   isActive = false,
   preventRedirect = false,
+  fullPath = 'gitlab-org/issuable-project-path',
 } = {}) =>
   shallowMount(IssuableItem, {
     propsData: {
@@ -34,6 +36,7 @@ const createComponent = ({
       showWorkItemTypeIcon,
       isActive,
       preventRedirect,
+      fullPath,
     },
     slots,
     stubs: {
@@ -71,6 +74,7 @@ describe('IssuableItem', () => {
   const findIssuablePrefetchTrigger = () => wrapper.findByTestId('issuable-prefetch-trigger');
   const findStatusEl = () => wrapper.findByTestId('issuable-status');
   const findRelationshipIcons = () => wrapper.findComponent(WorkItemRelationshipIcons);
+  const findIssuableTitleLink = () => wrapper.findByTestId('issuable-title-link');
 
   describe('computed', () => {
     describe('author', () => {
@@ -692,6 +696,24 @@ describe('IssuableItem', () => {
         });
       });
     });
+
+    it('renders link with unique id for issuable', () => {
+      wrapper = createComponent({ issuable: { ...mockIssuable, namespace: { fullPath: '' } } });
+
+      expect(findIssuableTitleLink().attributes().id).toBe(
+        `listItem-${'gitlab-org/issuable-project-path'}/${getIdFromGraphQLId(mockIssuable.id)}`,
+      );
+    });
+
+    it('renders link with unique id for work item', () => {
+      wrapper = createComponent({
+        issuable: { ...mockIssuable, namespace: { fullPath: 'gitlab-org/test-project-path' } },
+      });
+
+      expect(findIssuableTitleLink().attributes().id).toBe(
+        `listItem-${'gitlab-org/test-project-path'}/${getIdFromGraphQLId(mockIssuable.id)}`,
+      );
+    });
   });
 
   describe('when preventing redirect on clicking the link', () => {
diff --git a/spec/frontend/work_items/components/create_work_item_spec.js b/spec/frontend/work_items/components/create_work_item_spec.js
index c323c57e578..7143f9b37fc 100644
--- a/spec/frontend/work_items/components/create_work_item_spec.js
+++ b/spec/frontend/work_items/components/create_work_item_spec.js
@@ -13,6 +13,7 @@ import WorkItemAssignees from '~/work_items/components/work_item_assignees.vue';
 import WorkItemLabels from '~/work_items/components/work_item_labels.vue';
 import WorkItemCrmContacts from '~/work_items/components/work_item_crm_contacts.vue';
 import WorkItemMilestone from '~/work_items/components/work_item_milestone.vue';
+import WorkItemParent from '~/work_items/components/work_item_parent.vue';
 import WorkItemProjectsListbox from '~/work_items/components/work_item_links/work_item_projects_listbox.vue';
 import TitleSuggestions from '~/issues/new/components/title_suggestions.vue';
 import {
@@ -78,6 +79,7 @@ describe('Create work item component', () => {
   const findLabelsWidget = () => wrapper.findComponent(WorkItemLabels);
   const findCrmContactsWidget = () => wrapper.findComponent(WorkItemCrmContacts);
   const findMilestoneWidget = () => wrapper.findComponent(WorkItemMilestone);
+  const findParentWidget = () => wrapper.findComponent(WorkItemParent);
   const findProjectsSelector = () => wrapper.findComponent(WorkItemProjectsListbox);
   const findSelect = () => wrapper.findComponent(GlFormSelect);
   const findTitleSuggestions = () => wrapper.findComponent(TitleSuggestions);
@@ -123,6 +125,7 @@ describe('Create work item component', () => {
       },
       provide: {
         fullPath: 'full-path',
+        groupPath: 'group-path',
         hasIssuableHealthStatusFeature: false,
         hasIterationsFeature: true,
         hasIssueWeightsFeature: false,
@@ -509,6 +512,10 @@ describe('Create work item component', () => {
       it('renders the work item milestone widget', () => {
         expect(findMilestoneWidget().exists()).toBe(true);
       });
+
+      it('renders the work item parent widget', () => {
+        expect(findParentWidget().exists()).toBe(true);
+      });
     });
   });
 
diff --git a/spec/frontend/work_items/components/shared/work_item_link_child_contents_spec.js b/spec/frontend/work_items/components/shared/work_item_link_child_contents_spec.js
index 29d57817997..bd9595118ec 100644
--- a/spec/frontend/work_items/components/shared/work_item_link_child_contents_spec.js
+++ b/spec/frontend/work_items/components/shared/work_item_link_child_contents_spec.js
@@ -1,6 +1,7 @@
 import { GlLabel, GlLink, GlButton, GlAvatarsInline } from '@gitlab/ui';
 import Vue from 'vue';
 import VueApollo from 'vue-apollo';
+import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 
 import WorkItemLinkChildMetadata from 'ee_else_ce/work_items/components/shared/work_item_link_child_metadata.vue';
@@ -114,6 +115,14 @@ describe('WorkItemLinkChildContents', () => {
     });
   });
 
+  it('renders link with unique id', () => {
+    createComponent();
+
+    expect(findTitleEl().attributes().id).toBe(
+      `listItem-${workItemTask.namespace.fullPath}/${getIdFromGraphQLId(workItemTask.id)}`,
+    );
+  });
+
   describe('item title', () => {
     beforeEach(() => {
       createComponent();
diff --git a/spec/frontend/work_items/components/work_item_drawer_spec.js b/spec/frontend/work_items/components/work_item_drawer_spec.js
index ec8489304e3..5886dfaec89 100644
--- a/spec/frontend/work_items/components/work_item_drawer_spec.js
+++ b/spec/frontend/work_items/components/work_item_drawer_spec.js
@@ -5,6 +5,7 @@ import VueApollo from 'vue-apollo';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import { stubComponent } from 'helpers/stub_component';
+import { resetHTMLFixture, setHTMLFixture } from 'helpers/fixtures';
 
 import { TYPE_EPIC, TYPE_ISSUE } from '~/issues/constants';
 import { DETAIL_VIEW_QUERY_PARAM_NAME } from '~/work_items/constants';
@@ -41,7 +42,7 @@ describe('WorkItemDrawer', () => {
 
   const createComponent = ({
     open = false,
-    activeItem = { iid: '1', webUrl: 'test', fullPath: 'gitlab-org/gitlab' },
+    activeItem = { id: '1', iid: '1', webUrl: 'test', fullPath: 'gitlab-org/gitlab' },
     issuableType = TYPE_ISSUE,
     clickOutsideExcludeSelector = undefined,
     isGroup = true,
@@ -395,4 +396,25 @@ describe('WorkItemDrawer', () => {
       expect(document.activeElement).toBe(findReferenceLink().element);
     });
   });
+
+  describe('when drawer is opened from a link', () => {
+    beforeEach(() => {
+      setHTMLFixture(
+        `<div><a id="listItem-gitlab-org/gitlab/1" tabIndex="1">Link 1</a><div id="drawer-container"></div></div>`,
+      );
+    });
+    afterEach(() => {
+      resetHTMLFixture();
+    });
+
+    it('focuses on the link when drawer is closed', async () => {
+      createComponent({ attachTo: '#drawer-container', open: true });
+
+      findGlDrawer().vm.$emit('close');
+
+      await nextTick();
+
+      expect(document.activeElement).toBe(document.getElementById('listItem-gitlab-org/gitlab/1'));
+    });
+  });
 });
diff --git a/spec/graphql/types/work_item_type_spec.rb b/spec/graphql/types/work_item_type_spec.rb
index 86515e1fd9e..f7760ea118f 100644
--- a/spec/graphql/types/work_item_type_spec.rb
+++ b/spec/graphql/types/work_item_type_spec.rb
@@ -35,9 +35,11 @@ RSpec.describe GitlabSchema.types['WorkItem'], feature_category: :team_planning
       reference
       archived
       name
+      duplicatedToWorkItemUrl
+      movedToWorkItemUrl
     ]
 
-    expect(described_class).to have_graphql_fields(*fields)
+    expect(described_class).to have_graphql_fields(*fields).at_least
   end
 
   describe 'pagination and count' do
diff --git a/spec/lib/object_storage/direct_upload_spec.rb b/spec/lib/object_storage/direct_upload_spec.rb
index 041fac43084..614f8b5ae22 100644
--- a/spec/lib/object_storage/direct_upload_spec.rb
+++ b/spec/lib/object_storage/direct_upload_spec.rb
@@ -137,16 +137,6 @@ RSpec.describe ObjectStorage::DirectUpload, feature_category: :shared do
         end
       end
 
-      context 'when workhorse_use_aws_sdk_v2 is set to false' do
-        before do
-          stub_feature_flags(workhorse_use_aws_sdk_v2: false)
-        end
-
-        it 'sets AwsSDK to v1' do
-          expect(subject[:ObjectStorage][:S3Config][:AwsSDK]).to eq("v1")
-        end
-      end
-
       context 'when V2 signatures are used' do
         before do
           credentials[:aws_signature_version] = 2
diff --git a/spec/migrations/20241206154945_queue_requeue_delete_orphaned_groups_spec.rb b/spec/migrations/20241206154945_queue_requeue_delete_orphaned_groups_spec.rb
index 47aee132a0e..bee266925be 100644
--- a/spec/migrations/20241206154945_queue_requeue_delete_orphaned_groups_spec.rb
+++ b/spec/migrations/20241206154945_queue_requeue_delete_orphaned_groups_spec.rb
@@ -8,42 +8,8 @@ RSpec.describe QueueRequeueDeleteOrphanedGroups, migration: :gitlab_main, featur
 
   it 'does not schedule a new batched migration' do
     reversible_migration do |migration|
-      migration.before -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
-
-      migration.after -> {
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      }
-    end
-  end
-
-  context 'when executed on .com' do
-    before do
-      allow(Gitlab).to receive(:com_except_jh?).and_return(true)
-    end
-
-    describe '#up' do
-      it 'schedules background migration' do
-        migrate!
-
-        expect(batched_migration).to have_scheduled_batched_migration(
-          table_name: :namespaces,
-          column_name: :id,
-          interval: described_class::DELAY_INTERVAL,
-          batch_size: described_class::BATCH_SIZE,
-          sub_batch_size: described_class::SUB_BATCH_SIZE
-        )
-      end
-    end
-
-    describe '#down' do
-      it 'removes scheduled background migrations' do
-        migrate!
-        schema_migrate_down!
-
-        expect(batched_migration).not_to have_scheduled_batched_migration
-      end
+      migration.before -> { expect(batched_migration).not_to have_scheduled_batched_migration }
+      migration.after -> { expect(batched_migration).not_to have_scheduled_batched_migration }
     end
   end
 end
diff --git a/spec/migrations/20250109105904_queue_re_enqueue_delete_orphaned_groups_spec.rb b/spec/migrations/20250109105904_queue_re_enqueue_delete_orphaned_groups_spec.rb
new file mode 100644
index 00000000000..8eda9aa6e17
--- /dev/null
+++ b/spec/migrations/20250109105904_queue_re_enqueue_delete_orphaned_groups_spec.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueReEnqueueDeleteOrphanedGroups, migration: :gitlab_main, feature_category: :groups_and_projects do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'does not schedule a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+    end
+  end
+
+  context 'when executed on .com' do
+    before do
+      allow(Gitlab).to receive(:com_except_jh?).and_return(true)
+    end
+
+    describe '#up' do
+      it 'schedules background migration' do
+        migrate!
+
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :namespaces,
+          column_name: :id,
+          interval: described_class::DELAY_INTERVAL,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      end
+    end
+
+    describe '#down' do
+      it 'removes scheduled background migrations' do
+        migrate!
+        schema_migrate_down!
+
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      end
+    end
+  end
+end
diff --git a/spec/presenters/work_item_presenter_spec.rb b/spec/presenters/work_item_presenter_spec.rb
index 522ffd832c1..635939d6e9b 100644
--- a/spec/presenters/work_item_presenter_spec.rb
+++ b/spec/presenters/work_item_presenter_spec.rb
@@ -3,12 +3,74 @@
 require 'spec_helper'
 
 RSpec.describe WorkItemPresenter, feature_category: :portfolio_management do
-  let(:work_item) { build_stubbed(:work_item) }
+  let(:user) { build_stubbed(:user) }
+  let(:project) { build_stubbed(:project) }
+  let(:original_work_item) { build_stubbed(:work_item, project: project) }
+  let(:target_work_item) { build_stubbed(:work_item, project: project) }
+  let(:target_work_item_url) { Gitlab::UrlBuilder.build(target_work_item) }
+
+  subject(:presenter) { described_class.new(original_work_item, current_user: user) }
 
   it 'presents a work item and uses methods defined in IssuePresenter' do
-    user = build_stubbed(:user)
-    presenter = work_item.present(current_user: user)
-
     expect(presenter.issue_path).to eq(presenter.web_path)
   end
+
+  shared_examples 'returns target work item url based on permissions' do
+    context 'when anonymous' do
+      let(:user) { nil }
+
+      it { is_expected.to be_nil }
+    end
+
+    context 'with signed in user' do
+      before do
+        stub_member_access_level(project, access_level => user) if access_level
+      end
+
+      context 'when user has no role in project' do
+        let(:access_level) { nil }
+
+        it { is_expected.to be_nil }
+      end
+
+      context 'when user has guest role in project' do
+        let(:access_level) { :guest }
+
+        it { is_expected.to eq(target_work_item_url) }
+      end
+
+      context 'when user has reporter role in project' do
+        let(:access_level) { :reporter }
+
+        it { is_expected.to eq(target_work_item_url) }
+      end
+
+      context 'when user has developer role in project' do
+        let(:access_level) { :developer }
+
+        it { is_expected.to eq(target_work_item_url) }
+      end
+    end
+  end
+
+  describe '#duplicated_to_work_item_url' do
+    subject { presenter.duplicated_to_work_item_url }
+
+    it { is_expected.to be_nil }
+
+    it_behaves_like 'returns target work item url based on permissions' do
+      let(:original_work_item) { build_stubbed(:work_item, project: project, duplicated_to: target_work_item) }
+    end
+  end
+
+  describe '#moved_to_work_item_url' do
+    subject { presenter.moved_to_work_item_url }
+
+    it { is_expected.to be_nil }
+
+    it_behaves_like 'returns target work item url based on permissions' do
+      # Create original work item in other project
+      let(:original_work_item) { build_stubbed(:work_item, moved_to: target_work_item) }
+    end
+  end
 end
diff --git a/workhorse/go.mod b/workhorse/go.mod
index 05cfe20901f..0b9baf9a984 100644
--- a/workhorse/go.mod
+++ b/workhorse/go.mod
@@ -9,7 +9,6 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1
 	github.com/BurntSushi/toml v1.4.0
 	github.com/alecthomas/chroma/v2 v2.14.0
-	github.com/aws/aws-sdk-go v1.55.5
 	github.com/aws/aws-sdk-go-v2 v1.32.3
 	github.com/aws/aws-sdk-go-v2/config v1.28.1
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.42
@@ -59,6 +58,7 @@ require (
 	github.com/DataDog/datadog-go v4.4.0+incompatible // indirect
 	github.com/DataDog/sketches-go v1.0.0 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/aws/aws-sdk-go v1.55.5 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.6 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.18 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22 // indirect
diff --git a/workhorse/internal/config/config.go b/workhorse/internal/config/config.go
index 4579f4650c3..41166dfe8cb 100644
--- a/workhorse/internal/config/config.go
+++ b/workhorse/internal/config/config.go
@@ -103,7 +103,7 @@ type S3Config struct {
 	UseIamProfile        bool   `toml:"-"`
 	ServerSideEncryption string `toml:"-"` // Server-side encryption mode (e.g. AES256, aws:kms)
 	SSEKMSKeyID          string `toml:"-"` // Server-side encryption key-management service key ID (e.g. arn:aws:xxx)
-	AwsSDK               string `toml:"-"` // Use "v1" to force using AWS SDK v1. Default is v2.
+	AwsSDK               string `toml:"-"` // DEPRECATED. AWS SDK v2 is always used now.
 }
 
 // GoCloudConfig holds GoCloud-specific configuration
diff --git a/workhorse/internal/upload/destination/destination.go b/workhorse/internal/upload/destination/destination.go
index 2a544fb34d0..735decfed74 100644
--- a/workhorse/internal/upload/destination/destination.go
+++ b/workhorse/internal/upload/destination/destination.go
@@ -203,21 +203,12 @@ func getClientInformation(ctx context.Context, opts *UploadOpts, fh *FileHandler
 		}
 		uploadDestination, err = objectstore.NewGoCloudObject(p)
 	case opts.UseWorkhorseClientEnabled() && opts.ObjectStorageConfig.IsAWS() && opts.ObjectStorageConfig.IsValid():
-		if opts.ObjectStorageConfig.S3Config.AwsSDK == "v1" {
-			clientMode = "s3_client"
-			uploadDestination, err = objectstore.NewS3Object(
-				opts.RemoteTempObjectID,
-				opts.ObjectStorageConfig.S3Credentials,
-				opts.ObjectStorageConfig.S3Config,
-			)
-		} else {
-			clientMode = "s3_client_v2"
-			uploadDestination, err = objectstore.NewS3v2Object(
-				opts.RemoteTempObjectID,
-				opts.ObjectStorageConfig.S3Credentials,
-				opts.ObjectStorageConfig.S3Config,
-			)
-		}
+		clientMode = "s3_client_v2"
+		uploadDestination, err = objectstore.NewS3v2Object(
+			opts.RemoteTempObjectID,
+			opts.ObjectStorageConfig.S3Credentials,
+			opts.ObjectStorageConfig.S3Config,
+		)
 	case opts.IsMultipart():
 		clientMode = "s3_multipart"
 		uploadDestination, err = objectstore.NewMultipart(
diff --git a/workhorse/internal/upload/destination/destination_test.go b/workhorse/internal/upload/destination/destination_test.go
index 7ebea8fc535..12dcde29136 100644
--- a/workhorse/internal/upload/destination/destination_test.go
+++ b/workhorse/internal/upload/destination/destination_test.go
@@ -298,7 +298,7 @@ func TestUploadWithS3WorkhorseClient(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			s3Creds, s3Config, sess, ts := test.SetupS3(t, "")
+			s3Creds, s3Config, client, ts := test.SetupS3(t, "")
 			defer ts.Close()
 
 			if tc.awsSDK != "" {
@@ -325,10 +325,10 @@ func TestUploadWithS3WorkhorseClient(t *testing.T) {
 
 			if tc.expectedErr == nil {
 				require.NoError(t, err)
-				test.S3ObjectExists(t, sess, s3Config, remoteObject, test.ObjectContent)
+				test.S3ObjectExists(ctx, t, client, s3Config, remoteObject, test.ObjectContent)
 			} else {
 				require.Equal(t, tc.expectedErr, err)
-				test.S3ObjectDoesNotExist(t, sess, s3Config, remoteObject)
+				test.S3ObjectDoesNotExist(ctx, t, client, s3Config, remoteObject)
 			}
 		})
 	}
diff --git a/workhorse/internal/upload/destination/objectstore/s3_client_test.go b/workhorse/internal/upload/destination/objectstore/s3_client_test.go
index eb39949b525..2d5684dde93 100644
--- a/workhorse/internal/upload/destination/objectstore/s3_client_test.go
+++ b/workhorse/internal/upload/destination/objectstore/s3_client_test.go
@@ -4,7 +4,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
@@ -22,7 +21,7 @@ func TestS3ClientSetup(t *testing.T) {
 	options := client.Options()
 	require.Nil(t, options.BaseEndpoint)
 	require.Equal(t, "us-west-1", options.Region)
-	require.True(t, aws.BoolValue(&options.UsePathStyle))
+	require.True(t, options.UsePathStyle)
 
 	clientCache.Lock()
 	require.Len(t, clientCache.clients, 1)
diff --git a/workhorse/internal/upload/destination/objectstore/s3_object.go b/workhorse/internal/upload/destination/objectstore/s3_object.go
deleted file mode 100644
index c96404e50f4..00000000000
--- a/workhorse/internal/upload/destination/objectstore/s3_object.go
+++ /dev/null
@@ -1,125 +0,0 @@
-package objectstore
-
-import (
-	"context"
-	"io"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"gitlab.com/gitlab-org/labkit/log"
-
-	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
-)
-
-// S3Object represents an object stored in Amazon S3.
-type S3Object struct {
-	credentials config.S3Credentials
-	config      config.S3Config
-	objectName  string
-	uploaded    bool
-
-	*uploader
-}
-
-// NewS3Object creates a new S3Object with the provided object name, S3 credentials, and S3 config.
-func NewS3Object(objectName string, s3Credentials config.S3Credentials, s3Config config.S3Config) (*S3Object, error) {
-	o := &S3Object{
-		credentials: s3Credentials,
-		config:      s3Config,
-		objectName:  objectName,
-	}
-
-	o.uploader = newUploader(o)
-	return o, nil
-}
-
-func setEncryptionOptions(input *s3manager.UploadInput, s3Config config.S3Config) {
-	if s3Config.ServerSideEncryption != "" {
-		input.ServerSideEncryption = aws.String(s3Config.ServerSideEncryption)
-
-		if s3Config.ServerSideEncryption == s3.ServerSideEncryptionAwsKms && s3Config.SSEKMSKeyID != "" {
-			input.SSEKMSKeyId = aws.String(s3Config.SSEKMSKeyID)
-		}
-	}
-}
-
-// Upload uploads the S3 object with the provided context and reader.
-func (s *S3Object) Upload(ctx context.Context, r io.Reader) error {
-	sess, err := setupS3Session(s.credentials, s.config)
-	if err != nil {
-		log.WithError(err).Error("error creating S3 session")
-		return err
-	}
-
-	uploader := s3manager.NewUploader(sess)
-
-	input := &s3manager.UploadInput{
-		Bucket: aws.String(s.config.Bucket),
-		Key:    aws.String(s.objectName),
-		Body:   r,
-	}
-
-	setEncryptionOptions(input, s.config)
-
-	_, err = uploader.UploadWithContext(ctx, input)
-	if err != nil {
-		log.WithError(err).Error("error uploading S3 session")
-		// Get the root cause, such as ErrEntityTooLarge, so we can return the proper HTTP status code
-		return unwrapAWSError(err)
-	}
-
-	s.uploaded = true
-
-	return nil
-}
-
-// ETag returns the ETag of the S3 object.
-func (s *S3Object) ETag() string {
-	return ""
-}
-
-// Abort aborts the multipart upload by deleting the object.
-func (s *S3Object) Abort() {
-	s.Delete()
-}
-
-// Delete deletes the S3 object if it has been uploaded.
-func (s *S3Object) Delete() {
-	if !s.uploaded {
-		return
-	}
-
-	session, err := setupS3Session(s.credentials, s.config)
-	if err != nil {
-		log.WithError(err).Error("error setting up S3 session in delete")
-		return
-	}
-
-	svc := s3.New(session)
-	input := &s3.DeleteObjectInput{
-		Bucket: aws.String(s.config.Bucket),
-		Key:    aws.String(s.objectName),
-	}
-
-	// We can't use the request context because in a successful
-	// case, the original request has already completed.
-	deleteCtx, cancel := context.WithTimeout(context.Background(), 60*time.Second) // lint:allow context.Background
-	defer cancel()
-
-	_, err = svc.DeleteObjectWithContext(deleteCtx, input)
-	if err != nil {
-		log.WithError(err).Error("error deleting S3 object", err)
-	}
-}
-
-// This is needed until https://github.com/aws/aws-sdk-go/issues/2820 is closed.
-func unwrapAWSError(e error) error {
-	if awsErr, ok := e.(awserr.Error); ok {
-		return unwrapAWSError(awsErr.OrigErr())
-	}
-
-	return e
-}
diff --git a/workhorse/internal/upload/destination/objectstore/s3_object_test.go b/workhorse/internal/upload/destination/objectstore/s3_object_test.go
deleted file mode 100644
index 1063257d494..00000000000
--- a/workhorse/internal/upload/destination/objectstore/s3_object_test.go
+++ /dev/null
@@ -1,159 +0,0 @@
-package objectstore
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
-	"gitlab.com/gitlab-org/gitlab/workhorse/internal/upload/destination/objectstore/test"
-)
-
-type failedReader struct {
-	io.Reader
-}
-
-func (r *failedReader) Read(_ []byte) (int, error) {
-	origErr := fmt.Errorf("entity is too large")
-	return 0, awserr.New("Read", "read failed", origErr)
-}
-
-func TestS3ObjectUpload(t *testing.T) {
-	testCases := []struct {
-		encryption string
-	}{
-		{encryption: ""},
-		{encryption: s3.ServerSideEncryptionAes256},
-		{encryption: s3.ServerSideEncryptionAwsKms},
-	}
-
-	for _, tc := range testCases {
-		t.Run(fmt.Sprintf("encryption=%v", tc.encryption), func(t *testing.T) {
-			creds, config, sess, ts := test.SetupS3(t, tc.encryption)
-			defer ts.Close()
-
-			deadline := time.Now().Add(testTimeout)
-			tmpDir := t.TempDir()
-
-			objectName := filepath.Join(tmpDir, "s3-test-data")
-			ctx, cancel := context.WithCancel(context.Background())
-
-			object, err := NewS3Object(objectName, creds, config)
-			require.NoError(t, err)
-
-			// copy data
-			n, err := object.Consume(ctx, strings.NewReader(test.ObjectContent), deadline)
-			require.NoError(t, err)
-			require.Equal(t, test.ObjectSize, n, "Uploaded file mismatch")
-
-			test.S3ObjectExists(t, sess, config, objectName, test.ObjectContent)
-			test.CheckS3Metadata(t, sess, config, objectName)
-
-			cancel()
-
-			require.Eventually(t, func() bool {
-				return (test.S3ObjectDoesNotExist(t, sess, config, objectName))
-			}, 5*time.Second, time.Millisecond, "file is still present")
-		})
-	}
-}
-
-func TestConcurrentS3ObjectUpload(t *testing.T) {
-	creds, uploadsConfig, uploadsSession, uploadServer := test.SetupS3WithBucket(t, "uploads", "")
-	defer uploadServer.Close()
-
-	// This will return a separate S3 endpoint
-	_, artifactsConfig, artifactsSession, artifactsServer := test.SetupS3WithBucket(t, "artifacts", "")
-	defer artifactsServer.Close()
-
-	deadline := time.Now().Add(testTimeout)
-	tmpDir := t.TempDir()
-
-	var wg sync.WaitGroup
-
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-
-		go func(index int) {
-			var sess *session.Session
-			var config config.S3Config
-
-			if index%2 == 0 {
-				sess = uploadsSession
-				config = uploadsConfig
-			} else {
-				sess = artifactsSession
-				config = artifactsConfig
-			}
-
-			name := fmt.Sprintf("s3-test-data-%d", index)
-			objectName := filepath.Join(tmpDir, name)
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			object, err := NewS3Object(objectName, creds, config)
-			assert.NoError(t, err)
-
-			// copy data
-			n, err := object.Consume(ctx, strings.NewReader(test.ObjectContent), deadline)
-			assert.NoError(t, err)
-			assert.Equal(t, test.ObjectSize, n, "Uploaded file mismatch")
-
-			test.S3ObjectExists(t, sess, config, objectName, test.ObjectContent)
-			wg.Done()
-		}(i)
-	}
-
-	wg.Wait()
-}
-
-func TestS3ObjectUploadCancel(t *testing.T) {
-	creds, config, _, ts := test.SetupS3(t, "")
-	defer ts.Close()
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	deadline := time.Now().Add(testTimeout)
-	tmpDir := t.TempDir()
-
-	objectName := filepath.Join(tmpDir, "s3-test-data")
-
-	object, err := NewS3Object(objectName, creds, config)
-
-	require.NoError(t, err)
-
-	// Cancel the transfer before the data has been copied to ensure
-	// we handle this gracefully.
-	cancel()
-
-	_, err = object.Consume(ctx, strings.NewReader(test.ObjectContent), deadline)
-	require.Error(t, err)
-	require.Equal(t, "context canceled", err.Error())
-}
-
-func TestS3ObjectUploadLimitReached(t *testing.T) {
-	creds, config, _, ts := test.SetupS3(t, "")
-	defer ts.Close()
-
-	deadline := time.Now().Add(testTimeout)
-	tmpDir := t.TempDir()
-
-	objectName := filepath.Join(tmpDir, "s3-test-data")
-	object, err := NewS3Object(objectName, creds, config)
-	require.NoError(t, err)
-
-	_, err = object.Consume(context.Background(), &failedReader{}, deadline)
-	require.Error(t, err)
-	require.Equal(t, "entity is too large", err.Error())
-}
diff --git a/workhorse/internal/upload/destination/objectstore/s3_session.go b/workhorse/internal/upload/destination/objectstore/s3_session.go
deleted file mode 100644
index e001998a9d2..00000000000
--- a/workhorse/internal/upload/destination/objectstore/s3_session.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package objectstore
-
-import (
-	"sync"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
-
-	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
-
-	"gitlab.com/gitlab-org/labkit/fips"
-)
-
-type s3Session struct {
-	session *session.Session
-	expiry  time.Time
-}
-
-type s3SessionCache struct {
-	// An S3 session is cached by its input configuration (e.g. region,
-	// endpoint, path style, etc.), but the bucket is actually
-	// determined by the type of object to be uploaded (e.g. CI
-	// artifact, LFS, etc.) during runtime. In practice, we should only
-	// need one session per Workhorse process if we only allow one
-	// configuration for many different buckets. However, using a map
-	// indexed by the config avoids potential pitfalls in case the
-	// bucket configuration is supplied at startup or we need to support
-	// multiple S3 endpoints.
-	sessions map[config.S3Config]*s3Session
-	sync.Mutex
-}
-
-func (s *s3Session) isExpired() bool {
-	return time.Now().After(s.expiry)
-}
-
-var (
-	// By default, it looks like IAM instance profiles may last 6 hours
-	// (via curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role_name>),
-	// but this may be configurable from anywhere for 15 minutes to 12
-	// hours. To be safe, refresh AWS sessions every 10 minutes.
-	sessionExpiration = 10 * time.Minute
-	sessionCache      = &s3SessionCache{sessions: make(map[config.S3Config]*s3Session)}
-)
-
-// SetupS3Session initializes a new AWS S3 session and refreshes one if
-// necessary. As recommended in https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/sessions.html,
-// sessions should be cached when possible. Sessions are safe to use
-// concurrently as long as the session isn't modified.
-func setupS3Session(s3Credentials config.S3Credentials, s3Config config.S3Config) (*session.Session, error) {
-	sessionCache.Lock()
-	defer sessionCache.Unlock()
-
-	if s, ok := sessionCache.sessions[s3Config]; ok && !s.isExpired() {
-		return s.session, nil
-	}
-
-	cfg := &aws.Config{
-		Region:                        aws.String(s3Config.Region),
-		S3ForcePathStyle:              aws.Bool(s3Config.PathStyle),
-		S3DisableContentMD5Validation: aws.Bool(fips.Enabled()),
-	}
-
-	// In case IAM profiles aren't being used, use the static credentials
-	if s3Credentials.AwsAccessKeyID != "" && s3Credentials.AwsSecretAccessKey != "" {
-		cfg.Credentials = credentials.NewStaticCredentials(s3Credentials.AwsAccessKeyID, s3Credentials.AwsSecretAccessKey, "")
-	}
-
-	if s3Config.Endpoint != "" {
-		// The administrator has configured an S3 endpoint override,
-		// e.g. to make use of S3 IPv6 support or S3 FIPS mode. We
-		// need to configure a custom resolver to make sure that
-		// the custom endpoint is only used for S3 API calls, and not
-		// for STS API calls.
-		s3CustomResolver := func(service, region string, optFns ...func(*endpoints.Options)) (endpoints.ResolvedEndpoint, error) {
-			if service == s3.EndpointsID {
-				return endpoints.ResolvedEndpoint{
-					URL:           s3Config.Endpoint,
-					SigningRegion: region,
-				}, nil
-			}
-
-			return endpoints.DefaultResolver().EndpointFor(service, region, optFns...)
-		}
-
-		cfg.EndpointResolver = endpoints.ResolverFunc(s3CustomResolver)
-	}
-
-	sess, err := session.NewSession(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	sessionCache.sessions[s3Config] = &s3Session{
-		expiry:  time.Now().Add(sessionExpiration),
-		session: sess,
-	}
-
-	return sess, nil
-}
diff --git a/workhorse/internal/upload/destination/objectstore/s3_session_test.go b/workhorse/internal/upload/destination/objectstore/s3_session_test.go
deleted file mode 100644
index 39f2b17eb07..00000000000
--- a/workhorse/internal/upload/destination/objectstore/s3_session_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-package objectstore
-
-import (
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/sts"
-	"github.com/stretchr/testify/require"
-
-	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
-)
-
-func TestS3SessionSetup(t *testing.T) {
-	resetS3Sessions()
-
-	credentials := config.S3Credentials{}
-	cfg := config.S3Config{Region: "us-west-1", PathStyle: true}
-
-	sess, err := setupS3Session(credentials, cfg)
-	require.NoError(t, err)
-
-	s3Config := sess.ClientConfig(s3.EndpointsID)
-	require.Equal(t, "https://s3.us-west-1.amazonaws.com", s3Config.Endpoint)
-	require.Equal(t, "us-west-1", s3Config.SigningRegion)
-	require.True(t, aws.BoolValue(sess.Config.S3ForcePathStyle))
-
-	sessionCache.Lock()
-	require.Len(t, sessionCache.sessions, 1)
-	sessionCache.Unlock()
-
-	anotherConfig := cfg
-	_, err = setupS3Session(credentials, anotherConfig)
-	require.NoError(t, err)
-
-	sessionCache.Lock()
-	require.Len(t, sessionCache.sessions, 1)
-	sessionCache.Unlock()
-}
-
-func TestS3SessionEndpointSetup(t *testing.T) {
-	resetS3Sessions()
-
-	credentials := config.S3Credentials{}
-	const customS3Endpoint = "https://example.com"
-	const region = "us-west-2"
-	cfg := config.S3Config{Region: region, PathStyle: true, Endpoint: customS3Endpoint}
-
-	sess, err := setupS3Session(credentials, cfg)
-	require.NoError(t, err)
-
-	// ClientConfig is what is ultimately used by an S3 client
-	s3Config := sess.ClientConfig(s3.EndpointsID)
-	require.Equal(t, customS3Endpoint, s3Config.Endpoint)
-	require.Equal(t, region, s3Config.SigningRegion)
-
-	stsConfig := sess.ClientConfig(sts.EndpointsID)
-	require.Equal(t, "https://sts.amazonaws.com", stsConfig.Endpoint, "STS should use default endpoint")
-}
-
-func TestS3SessionExpiry(t *testing.T) {
-	resetS3Sessions()
-
-	credentials := config.S3Credentials{}
-	cfg := config.S3Config{Region: "us-west-1", PathStyle: true}
-
-	sess, err := setupS3Session(credentials, cfg)
-	require.NoError(t, err)
-
-	require.Equal(t, "us-west-1", aws.StringValue(sess.Config.Region))
-	require.True(t, aws.BoolValue(sess.Config.S3ForcePathStyle))
-
-	firstSession, ok := getS3Session(cfg)
-	require.True(t, ok)
-	require.False(t, firstSession.isExpired())
-
-	firstSession.expiry = time.Now().Add(-1 * time.Second)
-	require.True(t, firstSession.isExpired())
-
-	_, err = setupS3Session(credentials, cfg)
-	require.NoError(t, err)
-
-	nextSession, ok := getS3Session(cfg)
-	require.True(t, ok)
-	require.False(t, nextSession.isExpired())
-}
-
-func resetS3Sessions() {
-	sessionCache.Lock()
-	defer sessionCache.Unlock()
-	sessionCache.sessions = make(map[config.S3Config]*s3Session)
-}
-
-func getS3Session(cfg config.S3Config) (*s3Session, bool) {
-	sessionCache.Lock()
-	defer sessionCache.Unlock()
-	session, ok := sessionCache.sessions[cfg]
-	return session, ok
-}
diff --git a/workhorse/internal/upload/destination/objectstore/s3v2_object.go b/workhorse/internal/upload/destination/objectstore/s3v2_object.go
index 38af2258bc9..c2ee356832f 100644
--- a/workhorse/internal/upload/destination/objectstore/s3v2_object.go
+++ b/workhorse/internal/upload/destination/objectstore/s3v2_object.go
@@ -84,7 +84,7 @@ func (s *S3v2Object) Upload(ctx context.Context, r io.Reader) error {
 
 	input := &s3.PutObjectInput{
 		Bucket: aws.String(s.config.Bucket),
-		Key:    aws.String(normalizeKey(s.objectName)),
+		Key:    aws.String(s.Name()),
 		Body:   r,
 	}
 
@@ -125,7 +125,7 @@ func (s *S3v2Object) Delete() {
 
 	input := &s3.DeleteObjectInput{
 		Bucket: aws.String(s.config.Bucket),
-		Key:    aws.String(normalizeKey(s.objectName)),
+		Key:    aws.String(s.Name()),
 	}
 
 	// We can't use the request context because in a successful
@@ -138,3 +138,8 @@ func (s *S3v2Object) Delete() {
 		log.WithError(err).Error("error deleting S3 object", err)
 	}
 }
+
+// Name returns the object name without a leading slash.
+func (s *S3v2Object) Name() string {
+	return normalizeKey(s.objectName)
+}
diff --git a/workhorse/internal/upload/destination/objectstore/s3v2_object_test.go b/workhorse/internal/upload/destination/objectstore/s3v2_object_test.go
index 458780e96ec..4e1087a3b3a 100644
--- a/workhorse/internal/upload/destination/objectstore/s3v2_object_test.go
+++ b/workhorse/internal/upload/destination/objectstore/s3v2_object_test.go
@@ -10,9 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -25,22 +24,21 @@ type s3FailedReader struct {
 }
 
 func (r *s3FailedReader) Read(_ []byte) (int, error) {
-	origErr := fmt.Errorf("entity is too large")
-	return 0, awserr.New("Read", "read failed", origErr)
+	return 0, fmt.Errorf("entity is too large")
 }
 
 func TestS3v2ObjectUpload(t *testing.T) {
 	testCases := []struct {
-		encryption string
+		encryption types.ServerSideEncryption
 	}{
 		{encryption: ""},
-		{encryption: s3.ServerSideEncryptionAes256},
-		{encryption: s3.ServerSideEncryptionAwsKms},
+		{encryption: types.ServerSideEncryptionAes256},
+		{encryption: types.ServerSideEncryptionAwsKms},
 	}
 
 	for _, tc := range testCases {
-		t.Run(fmt.Sprintf("encryption=%v", tc.encryption), func(t *testing.T) {
-			creds, config, sess, ts := test.SetupS3(t, tc.encryption)
+		t.Run(fmt.Sprintf("encryption=%s", string(tc.encryption)), func(t *testing.T) {
+			creds, config, client, ts := test.SetupS3(t, string(tc.encryption))
 			defer ts.Close()
 
 			deadline := time.Now().Add(testTimeout)
@@ -48,6 +46,7 @@ func TestS3v2ObjectUpload(t *testing.T) {
 
 			objectName := filepath.Join(tmpDir, "s3-test-data")
 			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
 
 			object, err := NewS3v2Object(objectName, creds, config)
 			require.NoError(t, err)
@@ -57,24 +56,22 @@ func TestS3v2ObjectUpload(t *testing.T) {
 			require.NoError(t, err)
 			require.Equal(t, test.ObjectSize, n, "Uploaded file mismatch")
 
-			test.S3ObjectExists(t, sess, config, objectName, test.ObjectContent)
-			test.CheckS3Metadata(t, sess, config, objectName)
-
-			cancel()
+			test.S3ObjectExists(ctx, t, client, config, object.Name(), test.ObjectContent)
+			test.CheckS3Metadata(ctx, t, client, config, object.Name())
 
 			require.Eventually(t, func() bool {
-				return (test.S3ObjectDoesNotExist(t, sess, config, objectName))
+				return (test.S3ObjectDoesNotExist(ctx, t, client, config, objectName))
 			}, 5*time.Second, time.Millisecond, "file is still present")
 		})
 	}
 }
 
 func TestConcurrentS3v2ObjectUpload(t *testing.T) {
-	creds, uploadsConfig, uploadsSession, uploadServer := test.SetupS3WithBucket(t, "uploads", "")
+	creds, uploadsConfig, uploadsClient, uploadServer := test.SetupS3WithBucket(t, "uploads", "")
 	defer uploadServer.Close()
 
 	// This will return a separate S3 endpoint
-	_, artifactsConfig, artifactsSession, artifactsServer := test.SetupS3WithBucket(t, "artifacts", "")
+	_, artifactsConfig, artifactsClient, artifactsServer := test.SetupS3WithBucket(t, "artifacts", "")
 	defer artifactsServer.Close()
 
 	deadline := time.Now().Add(testTimeout)
@@ -86,14 +83,14 @@ func TestConcurrentS3v2ObjectUpload(t *testing.T) {
 		wg.Add(1)
 
 		go func(index int) {
-			var sess *session.Session
+			var client *s3.Client
 			var config config.S3Config
 
 			if index%2 == 0 {
-				sess = uploadsSession
+				client = uploadsClient
 				config = uploadsConfig
 			} else {
-				sess = artifactsSession
+				client = artifactsClient
 				config = artifactsConfig
 			}
 
@@ -110,7 +107,7 @@ func TestConcurrentS3v2ObjectUpload(t *testing.T) {
 			assert.NoError(t, err)
 			assert.Equal(t, test.ObjectSize, n, "Uploaded file mismatch")
 
-			test.S3ObjectExists(t, sess, config, objectName, test.ObjectContent)
+			test.S3ObjectExists(ctx, t, client, config, object.Name(), test.ObjectContent)
 			wg.Done()
 		}(i)
 	}
diff --git a/workhorse/internal/upload/destination/objectstore/test/s3_stub.go b/workhorse/internal/upload/destination/objectstore/test/s3_stub.go
index 87cb69dfc5b..8f62b903236 100644
--- a/workhorse/internal/upload/destination/objectstore/test/s3_stub.go
+++ b/workhorse/internal/upload/destination/objectstore/test/s3_stub.go
@@ -2,32 +2,33 @@
 package test
 
 import (
+	"context"
+	"io"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awscfg "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/config"
 
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-
 	"github.com/johannesboyne/gofakes3"
 	"github.com/johannesboyne/gofakes3/backend/s3mem"
 )
 
 // SetupS3 sets up a local S3 server with a default bucket for testing purposes and returns the necessary credentials, configuration, session, and server.
-func SetupS3(t *testing.T, encryption string) (config.S3Credentials, config.S3Config, *session.Session, *httptest.Server) {
+func SetupS3(t *testing.T, encryption string) (config.S3Credentials, config.S3Config, *s3.Client, *httptest.Server) {
 	return SetupS3WithBucket(t, "test-bucket", encryption)
 }
 
 // SetupS3WithBucket sets up a local S3 server for testing purposes and returns the necessary credentials, configuration, session, and server.
-func SetupS3WithBucket(t *testing.T, bucket string, encryption string) (config.S3Credentials, config.S3Config, *session.Session, *httptest.Server) {
+func SetupS3WithBucket(t *testing.T, bucket string, encryption string) (config.S3Credentials, config.S3Config, *s3.Client, *httptest.Server) {
 	backend := s3mem.New()
 	faker := gofakes3.New(backend)
 	ts := httptest.NewServer(faker.Server())
@@ -37,7 +38,7 @@ func SetupS3WithBucket(t *testing.T, bucket string, encryption string) (config.S
 		AwsSecretAccessKey: "YOUR-SECRETACCESSKEY",
 	}
 
-	config := config.S3Config{
+	cfg := config.S3Config{
 		Bucket:    bucket,
 		Endpoint:  ts.URL,
 		Region:    "eu-central-1",
@@ -45,36 +46,38 @@ func SetupS3WithBucket(t *testing.T, bucket string, encryption string) (config.S
 	}
 
 	if encryption != "" {
-		config.ServerSideEncryption = encryption
+		cfg.ServerSideEncryption = encryption
 
-		if encryption == s3.ServerSideEncryptionAwsKms {
-			config.SSEKMSKeyID = "arn:aws:1234"
+		if encryption == string(types.ServerSideEncryptionAwsKms) {
+			cfg.SSEKMSKeyID = "arn:aws:1234"
 		}
 	}
 
-	sess, err := session.NewSession(&aws.Config{
-		Credentials:      credentials.NewStaticCredentials(creds.AwsAccessKeyID, creds.AwsSecretAccessKey, ""),
-		Endpoint:         aws.String(ts.URL),
-		Region:           aws.String(config.Region),
-		DisableSSL:       aws.Bool(true),
-		S3ForcePathStyle: aws.Bool(true),
-	})
+	ctx := context.Background() // lint:allow context.Background
+	awsCfg, err := awscfg.LoadDefaultConfig(ctx,
+		awscfg.WithRegion(cfg.Region),
+		awscfg.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(creds.AwsAccessKeyID, creds.AwsSecretAccessKey, "")),
+	)
 	require.NoError(t, err)
 
 	// Create S3 service client
-	svc := s3.New(sess)
+	client := s3.NewFromConfig(awsCfg, func(o *s3.Options) {
+		o.UsePathStyle = true
+		o.BaseEndpoint = aws.String(ts.URL)
+	})
 
-	_, err = svc.CreateBucket(&s3.CreateBucketInput{
+	_, err = client.CreateBucket(ctx, &s3.CreateBucketInput{
 		Bucket: aws.String(bucket),
 	})
+
 	require.NoError(t, err)
 
-	return creds, config, sess, ts
+	return creds, cfg, client, ts
 }
 
 // S3ObjectExists will fail the test if the file does not exist.
-func S3ObjectExists(t *testing.T, sess *session.Session, config config.S3Config, objectName string, expectedBytes string) {
-	downloadObject(t, sess, config, objectName, func(tmpfile *os.File, numBytes int64, err error) {
+func S3ObjectExists(ctx context.Context, t *testing.T, client *s3.Client, config config.S3Config, objectName string, expectedBytes string) {
+	downloadObject(ctx, t, client, config, objectName, func(tmpfile *os.File, numBytes int64, err error) {
 		require.NoError(t, err)
 		require.Equal(t, int64(len(expectedBytes)), numBytes)
 
@@ -86,26 +89,24 @@ func S3ObjectExists(t *testing.T, sess *session.Session, config config.S3Config,
 }
 
 // CheckS3Metadata is a helper function for testing S3 metadata.
-func CheckS3Metadata(t *testing.T, sess *session.Session, config config.S3Config, objectName string) {
-	// In a real S3 provider, s3crypto.NewDecryptionClient should probably be used
-	svc := s3.New(sess)
-	result, err := svc.GetObject(&s3.GetObjectInput{
+func CheckS3Metadata(ctx context.Context, t *testing.T, client *s3.Client, config config.S3Config, objectName string) {
+	result, err := client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(config.Bucket),
 		Key:    aws.String(objectName),
 	})
 	require.NoError(t, err)
 
 	if config.ServerSideEncryption != "" {
-		require.Equal(t, aws.String(config.ServerSideEncryption), result.ServerSideEncryption)
+		require.Equal(t, config.ServerSideEncryption, string(result.ServerSideEncryption))
 
-		if config.ServerSideEncryption == s3.ServerSideEncryptionAwsKms {
+		if config.ServerSideEncryption == string(types.ServerSideEncryptionAwsKms) {
 			require.Equal(t, aws.String(config.SSEKMSKeyID), result.SSEKMSKeyId)
 		} else {
 			require.Nil(t, result.SSEKMSKeyId)
 		}
 	} else {
-		require.Nil(t, result.ServerSideEncryption)
-		require.Nil(t, result.SSEKMSKeyId)
+		require.Empty(t, result.ServerSideEncryption)
+		require.Empty(t, result.SSEKMSKeyId)
 	}
 }
 
@@ -114,10 +115,10 @@ func CheckS3Metadata(t *testing.T, sess *session.Session, config config.S3Config
 // S3ObjectExists because deletion may need to be retried since deferred
 // clean up callsinternal/objectstore/test/s3_stub.go may cause the actual deletion to happen after the
 // initial check.
-func S3ObjectDoesNotExist(t *testing.T, sess *session.Session, config config.S3Config, objectName string) bool {
+func S3ObjectDoesNotExist(ctx context.Context, t *testing.T, client *s3.Client, config config.S3Config, objectName string) bool {
 	deleted := false
 
-	downloadObject(t, sess, config, objectName, func(_ *os.File, _ int64, err error) {
+	downloadObject(ctx, t, client, config, objectName, func(_ *os.File, _ int64, err error) {
 		if err != nil && strings.Contains(err.Error(), "NoSuchKey") {
 			deleted = true
 		}
@@ -126,17 +127,24 @@ func S3ObjectDoesNotExist(t *testing.T, sess *session.Session, config config.S3C
 	return deleted
 }
 
-func downloadObject(t *testing.T, sess *session.Session, config config.S3Config, objectName string, handler func(tmpfile *os.File, numBytes int64, err error)) {
+func downloadObject(ctx context.Context, t *testing.T, client *s3.Client, config config.S3Config, objectName string, handler func(tmpfile *os.File, numBytes int64, err error)) {
 	tmpDir := t.TempDir()
 
 	tmpfile, err := os.CreateTemp(tmpDir, "s3-output")
 	require.NoError(t, err)
 
-	downloadSvc := s3manager.NewDownloader(sess)
-	numBytes, err := downloadSvc.Download(tmpfile, &s3.GetObjectInput{
+	result, err := client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(config.Bucket),
 		Key:    aws.String(objectName),
 	})
 
+	numBytes := int64(0)
+	if err == nil {
+		var copyErr error
+		defer func() { _ = result.Body.Close() }()
+		numBytes, copyErr = io.Copy(tmpfile, result.Body)
+		require.NoError(t, copyErr)
+	}
+
 	handler(tmpfile, numBytes, err)
 }