From 78ea62d0cf2a680785eea4d7873d658da9fdf632 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 28 Feb 2024 21:09:33 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .gitlab/ci/docs.gitlab-ci.yml                 |   2 +-
 .../layout/first_hash_element_indentation.yml |   1 -
 .rubocop_todo/rspec/context_wording.yml       |   1 -
 .../graphql_shared/possible_types.json        |   4 +-
 .../components/advanced_settings.vue          |  43 ++++-
 .../pages/import/github/status/index.js       |   2 +
 .../components/registry/title_area.vue        |   2 +-
 app/controllers/groups_controller.rb          |   4 +-
 app/controllers/import/github_controller.rb   |  18 +-
 app/graphql/types/ci/catalog/resource_type.rb |   8 +
 app/models/ci/runner.rb                       |   4 +-
 app/policies/group_policy.rb                  |   4 +
 app/serializers/project_import_entity.rb      |   4 +
 app/services/import/base_service.rb           |   4 +-
 app/services/import/github_service.rb         |  33 +++-
 app/views/groups/edit.html.haml               | 103 ++++++------
 app/views/import/_githubish_status.html.haml  |   2 +
 .../import/bitbucket_server/status.html.haml  |   6 +-
 app/views/import/github/new.html.haml         |   2 +-
 app/views/import/github/status.html.haml      |   1 +
 ...cate-based-integration-with-kubernetes.yml |   4 +-
 db/docs/namespace_root_storage_statistics.yml |   4 +-
 db/docs/namespace_statistics.yml              |   4 +-
 ...ipeline_id_to_vulnerability_occurrences.rb |  11 ++
 ...143045_add_remove_group_to_member_roles.rb |  15 ++
 ...ipeline_id_to_vulnerability_occurrences.rb |  20 +++
 db/schema_migrations/20240214035028           |   1 +
 db/schema_migrations/20240219143045           |   1 +
 db/schema_migrations/20240226072310           |   1 +
 db/structure.sql                              |   5 +-
 doc/administration/appearance.md              |   2 +-
 .../backup_restore/backup_gitlab.md           |   2 +-
 .../disaster_recovery/bring_primary_back.md   |   2 +-
 doc/administration/gitaly/configure_gitaly.md |   2 +-
 doc/administration/pages/index.md             |   6 +-
 .../settings/account_and_limit_settings.md    |   4 +-
 doc/api/code_suggestions.md                   |   2 +-
 doc/api/graphql/reference/index.md            |  88 +++++-----
 doc/api/group_protected_branches.md           |   4 +-
 doc/api/group_ssh_certificates.md             |   2 +-
 doc/api/import.md                             |  11 +-
 doc/api/integrations.md                       |   6 +-
 doc/api/markdown.md                           |   2 +-
 doc/api/merge_request_approvals.md            |   2 +-
 doc/api/product_analytics.md                  |   4 +-
 doc/api/project_import_export.md              |   2 +-
 doc/ci/environments/index.md                  |   2 +-
 doc/ci/environments/kubernetes_dashboard.md   |   3 +-
 doc/ci/yaml/index.md                          |   8 +-
 doc/development/activitypub/actors/index.md   |   2 +-
 .../activitypub/actors/releases.md            |   2 +-
 doc/development/activitypub/index.md          |   2 +-
 .../documentation/experiment_beta.md          |   2 +-
 .../documentation/feature_flags.md            |   6 +-
 .../advanced_search/elasticsearch.md          |   2 +-
 doc/integration/oauth_provider.md             |   2 +-
 .../incident_timeline_events.md               |   2 +-
 doc/operations/incident_management/slack.md   |   2 +-
 doc/operations/metrics.md                     |   4 +-
 doc/security/email_verification.md            |   4 +-
 doc/security/two_factor_authentication.md     |   4 +-
 doc/update/background_migrations.md           |   2 +-
 doc/update/deprecations.md                    |  52 +++---
 doc/user/analytics/analytics_dashboards.md    |  10 +-
 doc/user/analytics/dora_metrics.md            |   4 +-
 .../policies/scan-execution-policies.md       |   4 +-
 .../policies/scan-result-policies.md          |   2 +-
 .../vulnerability_report/pipeline.md          |   2 +-
 .../compliance/compliance_center/index.md     |   2 +-
 doc/user/custom_roles/abilities.md            |   1 +
 doc/user/group/epics/manage_epics.md          |   2 +-
 doc/user/group/issues_analytics/index.md      |   4 +-
 .../group/reporting/git_abuse_rate_limit.md   |   4 +-
 doc/user/group/ssh_certificates.md            |   4 +-
 .../group/value_stream_analytics/index.md     |   2 +-
 doc/user/okrs.md                              |   8 +-
 doc/user/organization/index.md                |   2 +-
 .../packages/composer_repository/index.md     |   2 +-
 doc/user/permissions.md                       |   2 +-
 doc/user/profile/account/delete_account.md    |   2 +-
 .../account/two_factor_authentication.md      |   2 +-
 doc/user/project/import/bitbucket_server.md   |   2 +-
 .../project/integrations/beyond_identity.md   |   2 +-
 doc/user/project/integrations/git_guardian.md |   4 +-
 .../project/integrations/webhook_events.md    |   2 +-
 doc/user/project/integrations/webhooks.md     |   4 +-
 doc/user/project/issue_board.md               |   2 +-
 doc/user/project/issues/managing_issues.md    |   2 +-
 .../merge_requests/approvals/settings.md      |   2 +-
 doc/user/project/merge_requests/changes.md    |   4 +-
 doc/user/project/merge_requests/index.md      |   4 +-
 .../merge_when_pipeline_succeeds.md           |   4 +-
 doc/user/project/pages/index.md               |   2 +-
 doc/user/project/pages/redirects.md           |   2 +-
 doc/user/project/protected_branches.md        |   4 +-
 .../remote_development/connect_machine.md     |   4 +-
 doc/user/project/remote_development/index.md  |   4 +-
 doc/user/project/repository/branches/index.md |   2 +-
 .../service_desk/using_service_desk.md        |   2 +-
 doc/user/project/time_tracking.md             |   2 +-
 doc/user/project/web_ide/index.md             |   4 +-
 doc/user/search/exact_code_search.md          |   6 +-
 doc/user/tasks.md                             |  14 +-
 doc/user/todos.md                             |   4 +-
 lib/api/groups.rb                             |   2 +-
 lib/api/import_github.rb                      |   3 +-
 lib/gitlab/github_import.rb                   |   4 +
 locale/gitlab.pot                             |  46 ++++-
 qa/Gemfile.lock                               |   3 +-
 qa/qa/tools/long_running_spec_reporter.rb     |  14 +-
 .../tools/long_running_spec_reporter_spec.rb  |   8 +-
 .../import/github_controller_spec.rb          |  45 +++++
 spec/db/schema_spec.rb                        |   1 +
 .../components/advanced_settings_spec.js      |  44 +++--
 .../types/ci/catalog/resource_type_spec.rb    |   1 +
 spec/lib/gitlab/github_import_spec.rb         |   7 +
 .../api/graphql/ci/catalog/resources_spec.rb  |   8 +-
 spec/requests/api/import_github_spec.rb       |  70 ++++++++
 spec/services/import/github_service_spec.rb   | 157 +++++++++++++++++-
 .../policies/group_policy_shared_context.rb   |   2 +
 120 files changed, 807 insertions(+), 305 deletions(-)
 create mode 100644 db/migrate/20240214035028_add_first_and_latest_pipeline_id_to_vulnerability_occurrences.rb
 create mode 100644 db/migrate/20240219143045_add_remove_group_to_member_roles.rb
 create mode 100644 db/post_migrate/20240226072310_prepare_index_for_initial_and_latest_pipeline_id_to_vulnerability_occurrences.rb
 create mode 100644 db/schema_migrations/20240214035028
 create mode 100644 db/schema_migrations/20240219143045
 create mode 100644 db/schema_migrations/20240226072310

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 98c7b9e3231..98f30dfba17 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -58,7 +58,7 @@ docs-lint links:
 
 .docs-markdown-lint-image:
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.18-vale-2.29.6-markdownlint-0.37.0-markdownlint2-0.10.0
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.19-vale-3.0.7-markdownlint-0.39.0-markdownlint2-0.12.1
 
 docs-lint markdown:
   extends:
diff --git a/.rubocop_todo/layout/first_hash_element_indentation.yml b/.rubocop_todo/layout/first_hash_element_indentation.yml
index d43547a82fd..2a96ea2cc9a 100644
--- a/.rubocop_todo/layout/first_hash_element_indentation.yml
+++ b/.rubocop_todo/layout/first_hash_element_indentation.yml
@@ -221,7 +221,6 @@ Layout/FirstHashElementIndentation:
     - 'spec/services/ci/pipeline_artifacts/coverage_report_service_spec.rb'
     - 'spec/services/clusters/update_service_spec.rb'
     - 'spec/services/google_cloud/get_cloudsql_instances_service_spec.rb'
-    - 'spec/services/import/github_service_spec.rb'
     - 'spec/services/notes/render_service_spec.rb'
     - 'spec/services/packages/debian/parse_debian822_service_spec.rb'
     - 'spec/services/projects/container_repository/delete_tags_service_spec.rb'
diff --git a/.rubocop_todo/rspec/context_wording.yml b/.rubocop_todo/rspec/context_wording.yml
index 1e31d9570fd..b4fb5d0ef6a 100644
--- a/.rubocop_todo/rspec/context_wording.yml
+++ b/.rubocop_todo/rspec/context_wording.yml
@@ -2562,7 +2562,6 @@ RSpec/ContextWording:
     - 'spec/services/ide/terminal_config_service_spec.rb'
     - 'spec/services/import/bitbucket_server_service_spec.rb'
     - 'spec/services/import/fogbugz_service_spec.rb'
-    - 'spec/services/import/github_service_spec.rb'
     - 'spec/services/import/gitlab_projects/file_acquisition_strategies/remote_file_s3_spec.rb'
     - 'spec/services/import/gitlab_projects/file_acquisition_strategies/remote_file_spec.rb'
     - 'spec/services/incident_management/incidents/create_service_spec.rb'
diff --git a/app/assets/javascripts/graphql_shared/possible_types.json b/app/assets/javascripts/graphql_shared/possible_types.json
index c721e9e3a77..63ea8830cae 100644
--- a/app/assets/javascripts/graphql_shared/possible_types.json
+++ b/app/assets/javascripts/graphql_shared/possible_types.json
@@ -11,8 +11,8 @@
     "AuditEventStreamingHeader",
     "AuditEventsStreamingInstanceHeader"
   ],
-  "CiRunnerCloudProvisioningOptions": [
-    "CiRunnerGoogleCloudProvisioningOptions"
+  "CiRunnerCloudProvisioning": [
+    "CiRunnerGoogleCloudProvisioning"
   ],
   "CiVariable": [
     "CiGroupVariable",
diff --git a/app/assets/javascripts/import_entities/import_projects/components/advanced_settings.vue b/app/assets/javascripts/import_entities/import_projects/components/advanced_settings.vue
index d22a52df326..a3f8b8a885f 100644
--- a/app/assets/javascripts/import_entities/import_projects/components/advanced_settings.vue
+++ b/app/assets/javascripts/import_entities/import_projects/components/advanced_settings.vue
@@ -1,14 +1,30 @@
 <script>
-import { GlAccordion, GlAccordionItem, GlAlert, GlForm, GlFormCheckbox } from '@gitlab/ui';
+import {
+  GlAccordion,
+  GlAccordionItem,
+  GlAlert,
+  GlSprintf,
+  GlLink,
+  GlForm,
+  GlFormCheckbox,
+} from '@gitlab/ui';
+import { helpPagePath } from '~/helpers/help_page_helper';
 
 export default {
   components: {
     GlAccordion,
     GlAccordionItem,
     GlAlert,
+    GlSprintf,
+    GlLink,
     GlForm,
     GlFormCheckbox,
   },
+  inject: {
+    isFineGrainedToken: {
+      default: false,
+    },
+  },
   props: {
     stages: {
       required: true,
@@ -24,6 +40,7 @@ export default {
       default: false,
     },
   },
+  docsLink: helpPagePath('user/project/import/github', { anchor: 'use-the-github-integration' }),
 };
 </script>
 <template>
@@ -32,9 +49,27 @@ export default {
       :title="s__('ImportProjects|Advanced import settings')"
       :visible="isInitiallyExpanded"
     >
-      <gl-alert variant="warning" class="gl-mb-5" :dismissible="false">{{
-        s__('ImportProjects|The more information you select, the longer it will take to import')
-      }}</gl-alert>
+      <gl-alert variant="warning" class="gl-mb-5" :dismissible="false"
+        >{{
+          s__('ImportProjects|The more information you select, the longer it will take to import')
+        }}
+        <p v-if="isFineGrainedToken" class="mb-0">
+          <gl-sprintf
+            :message="
+              s__(
+                'ImportProjects|Your fine-grained personal access token may not support collaborator import. Please use a classic token with %{codeStart}read:org%{codeEnd} scope to import collaborators. See the %{linkStart}documentation%{linkEnd} for further details.',
+              )
+            "
+          >
+            <template #code="{ content }">
+              <code class="gl-ml-2">{{ content }}</code>
+            </template>
+            <template #link="{ content }">
+              <gl-link :href="$options.docsLink" target="_blank">{{ content }}</gl-link>
+            </template>
+          </gl-sprintf>
+        </p>
+      </gl-alert>
       <gl-form>
         <gl-form-checkbox
           v-for="{ name, label, details } in stages"
diff --git a/app/assets/javascripts/pages/import/github/status/index.js b/app/assets/javascripts/pages/import/github/status/index.js
index e9c98d0adb5..c38a6a5e6ae 100644
--- a/app/assets/javascripts/pages/import/github/status/index.js
+++ b/app/assets/javascripts/pages/import/github/status/index.js
@@ -1,5 +1,6 @@
 import mountImportProjectsTable from '~/import_entities/import_projects';
 import GithubStatusTable from '~/import_entities/import_projects/components/github_status_table.vue';
+import { parseBoolean } from '~/lib/utils/common_utils';
 
 const mountElement = document.getElementById('import-projects-mount-element');
 
@@ -8,5 +9,6 @@ mountImportProjectsTable({
   Component: GithubStatusTable,
   extraProvide: (dataset) => ({
     statusImportGithubGroupPath: dataset.statusImportGithubGroupPath,
+    isFineGrainedToken: parseBoolean(dataset.isFineGrainedToken),
   }),
 });
diff --git a/app/assets/javascripts/vue_shared/components/registry/title_area.vue b/app/assets/javascripts/vue_shared/components/registry/title_area.vue
index 41ce6f8b597..8cb29ad5aba 100644
--- a/app/assets/javascripts/vue_shared/components/registry/title_area.vue
+++ b/app/assets/javascripts/vue_shared/components/registry/title_area.vue
@@ -115,7 +115,7 @@ export default {
         <slot name="right-actions"></slot>
       </div>
     </div>
-    <p>
+    <p v-if="infoMessages.length">
       <span
         v-for="(message, index) in infoMessages"
         :key="index"
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 2ca7c7e368a..a049c7de974 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -21,7 +21,9 @@ class GroupsController < Groups::ApplicationController
   before_action :group, except: [:index, :new, :create]
 
   # Authorize
-  before_action :authorize_admin_group!, only: [:edit, :update, :destroy, :projects, :transfer, :export, :download_export]
+  before_action :authorize_admin_group!, only: [:update, :projects, :transfer, :export, :download_export]
+  before_action :authorize_view_edit_page!, only: :edit
+  before_action :authorize_remove_group!, only: :destroy
   before_action :authorize_create_group!, only: [:new]
   before_action :load_recaptcha, only: [:new], if: -> { captcha_required? }
 
diff --git a/app/controllers/import/github_controller.rb b/app/controllers/import/github_controller.rb
index 0159c1913af..89357732b52 100644
--- a/app/controllers/import/github_controller.rb
+++ b/app/controllers/import/github_controller.rb
@@ -15,6 +15,7 @@ class Import::GithubController < Import::BaseController
 
   rescue_from Octokit::Unauthorized, with: :provider_unauthorized
   rescue_from Octokit::TooManyRequests, with: :provider_rate_limit
+  rescue_from Octokit::Forbidden, with: :provider_scope_validation_error
   rescue_from Gitlab::GithubImport::RateLimitError, with: :rate_limit_threshold_exceeded
 
   delegate :client, to: :client_proxy, private: true
@@ -49,8 +50,8 @@ class Import::GithubController < Import::BaseController
   end
 
   def status
-    # Request repos to display error page if provider token is invalid
-    # Improving in https://gitlab.com/gitlab-org/gitlab-foss/issues/55585
+    @fine_grained = Gitlab::GithubImport.fine_grained_token?(session[access_token_key])
+
     client_repos
 
     respond_to do |format|
@@ -204,6 +205,8 @@ class Import::GithubController < Import::BaseController
   end
 
   def client_repos
+    # Request repos to display error page if provider token is invalid
+    # Improving in https://gitlab.com/gitlab-org/gitlab-foss/issues/55585
     client_repos_response[:repos]
   end
 
@@ -250,6 +253,17 @@ class Import::GithubController < Import::BaseController
       alert: _("GitHub API rate limit exceeded. Try again after %{reset_time}") % { reset_time: reset_time }
   end
 
+  def provider_scope_validation_error
+    session[access_token_key] = nil
+    redirect_to new_import_url,
+      alert: format(
+        s_("GithubImport|Your GitHub access token does not have the correct scope to import. " \
+           "Please use a token with the '%{repo}' scope, and with the '%{read_org}' scope " \
+           "if importing collaborators."),
+        repo: 'repo', read_org: 'read:org'
+      )
+  end
+
   def auth_state_key
     :"#{provider_name}_auth_state_key"
   end
diff --git a/app/graphql/types/ci/catalog/resource_type.rb b/app/graphql/types/ci/catalog/resource_type.rb
index 55bba39948b..bc5a692169f 100644
--- a/app/graphql/types/ci/catalog/resource_type.rb
+++ b/app/graphql/types/ci/catalog/resource_type.rb
@@ -54,6 +54,10 @@ module Types
           description: 'Number of times the catalog resource has been starred.',
           alpha: { milestone: '16.1' }
 
+        field :starrers_path, GraphQL::Types::String, null: true,
+          description: 'Relative path to the starrers page for the catalog resource project.',
+          alpha: { milestone: '16.10' }
+
         def open_issues_count
           BatchLoader::GraphQL.wrap(object.project.open_issues_count)
         end
@@ -81,6 +85,10 @@ module Types
           markdown_context = context.to_h.dup.merge(project: object.project)
           ::MarkupHelper.markdown(object.project.repository.readme&.data, markdown_context)
         end
+
+        def starrers_path
+          Gitlab::Routing.url_helpers.project_starrers_path(object.project)
+        end
       end
       # rubocop: enable Graphql/AuthorizeTypes
     end
diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 5fb982ee21e..506f4a7c327 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -42,6 +42,8 @@ module Ci
     # Prefix assigned to runners created from the UI, instead of registered via the command line
     CREATED_RUNNER_TOKEN_PREFIX = 'glrt-'
 
+    RUNNER_SHORT_SHA_LENGTH = 8
+
     # This `ONLINE_CONTACT_TIMEOUT` needs to be larger than
     #   `RUNNER_QUEUE_EXPIRY_TIME+UPDATE_CONTACT_COLUMN_EVERY`
     #
@@ -394,7 +396,7 @@ module Ci
       return unless token
 
       start_index = authenticated_user_registration_type? ? CREATED_RUNNER_TOKEN_PREFIX.length : 0
-      token[start_index..start_index + 8]
+      token[start_index..start_index + RUNNER_SHORT_SHA_LENGTH]
     end
 
     def tag_list
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index adbc399866b..8c2664d638a 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -250,6 +250,8 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
 
     enable :read_billing
     enable :edit_billing
+
+    enable :remove_group
   end
 
   rule { can?(:read_nested_project_resources) }.policy do
@@ -372,6 +374,8 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
   rule { maintainer & ~raise_admin_package_to_owner_enabled }.enable :admin_package
   rule { owner & raise_admin_package_to_owner_enabled }.enable :admin_package
 
+  rule { can?(:remove_group) }.enable :view_edit_page
+
   def access_level(for_any_session: false)
     return GroupMember::NO_ACCESS if @user.nil?
     return GroupMember::NO_ACCESS unless user_is_user?
diff --git a/app/serializers/project_import_entity.rb b/app/serializers/project_import_entity.rb
index e5d1b84b7e4..e83bb363bf1 100644
--- a/app/serializers/project_import_entity.rb
+++ b/app/serializers/project_import_entity.rb
@@ -17,6 +17,10 @@ class ProjectImportEntity < ProjectEntity
     project.import_failures.last&.exception_message
   end
 
+  expose :import_warning, if: ->(_, options) { options[:warning] } do |_, options|
+    options[:warning]
+  end
+
   # Only for GitHub importer where we pass client through
   expose :relation_type do |project, options|
     next nil if options[:client].nil?
diff --git a/app/services/import/base_service.rb b/app/services/import/base_service.rb
index 64cf3cfa04a..b8dae5e8a20 100644
--- a/app/services/import/base_service.rb
+++ b/app/services/import/base_service.rb
@@ -32,8 +32,8 @@ module Import
       project.errors.full_messages.join(', ')
     end
 
-    def success(project)
-      super().merge(project: project, status: :success)
+    def success(project, warning: nil)
+      super().merge(project: project, status: :success, warning: warning)
     end
 
     def track_access_level(import_type)
diff --git a/app/services/import/github_service.rb b/app/services/import/github_service.rb
index fc9b1c31b33..ebbf43fc192 100644
--- a/app/services/import/github_service.rb
+++ b/app/services/import/github_service.rb
@@ -5,6 +5,9 @@ module Import
     include ActiveSupport::NumberHelper
     include Gitlab::Utils::StrongMemoize
 
+    MINIMUM_IMPORT_SCOPE = 'repo'
+    COLLAB_IMPORT_SCOPES = %w[admin:org read:org].freeze
+
     attr_accessor :client
     attr_reader :params, :current_user
 
@@ -12,12 +15,26 @@ module Import
       context_error = validate_context
       return context_error if context_error
 
+      if provider == :github # we skip scope validation for Gitea importer calls
+
+        if Gitlab::GithubImport.fine_grained_token?(access_params[:github_access_token])
+          Gitlab::GithubImport::Logger.info(
+            message: 'Fine grained GitHub personal access token used.'
+          )
+          warning = s_('GithubImport|Fine-grained personal access tokens are not officially supported. ' \
+                       'It is recommended to use a classic token instead.')
+        else
+          scope_error = validate_scopes
+          return scope_error if scope_error
+        end
+      end
+
       project = create_project(access_params, provider)
       track_access_level('github')
 
       if project.persisted?
         store_import_settings(project)
-        success(project)
+        success(project, warning: warning)
       elsif project.errors[:import_source_disabled].present?
         error(project.errors[:import_source_disabled], :forbidden)
       else
@@ -99,6 +116,20 @@ module Import
 
     private
 
+    def validate_scopes
+      scopes = client.octokit.scopes
+
+      unless scopes.include?(MINIMUM_IMPORT_SCOPE)
+        return log_and_return_error('Invalid Scope', format(s_("GithubImport|Your GitHub access token does not have the correct scope to import. Please use a token with the '%{scope}' scope."), scope: 'repo'), :unprocessable_entity)
+      end
+
+      collaborators_import = params.dig(:optional_stages, :collaborators_import) || false # if not set, default to false to skip collaborator import validation
+
+      return if collaborators_import == false || scopes.intersect?(COLLAB_IMPORT_SCOPES)
+
+      log_and_return_error('Invalid scope', format(s_("GithubImport|Your GitHub access token does not have the correct scope to import collaborators. Please use a token with the '%{scope}' scope."), scope: 'read:org'), :unprocessable_entity)
+    end
+
     def validate_context
       if blocked_url?
         log_and_return_error("Invalid URL: #{url}", _("Invalid URL: %{url}") % { url: url }, :bad_request)
diff --git a/app/views/groups/edit.html.haml b/app/views/groups/edit.html.haml
index 5c09fdcd021..1c1388013af 100644
--- a/app/views/groups/edit.html.haml
+++ b/app/views/groups/edit.html.haml
@@ -5,57 +5,62 @@
 
 = render 'shared/namespaces/cascading_settings/lock_popovers'
 
-%section.settings.gs-general.no-animate.expanded#js-general-settings
-  .settings-header
-    %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
-      = _('Naming, visibility')
-    = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
-      = _('Collapse')
-    %p.gl-text-secondary
-      = _('Update your group name, description, avatar, and visibility.')
-      = link_to _('Learn more about groups.'), help_page_path('user/group/index')
-  .settings-content
-    = render 'groups/settings/general'
+- if can?(current_user, :admin_group, @group)
+  %section.settings.gs-general.no-animate.expanded#js-general-settings
+    .settings-header
+      %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
+        = _('Naming, visibility')
+      = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
+        = _('Collapse')
+      %p.gl-text-secondary
+        = _('Update your group name, description, avatar, and visibility.')
+        = link_to _('Learn more about groups.'), help_page_path('user/group/index')
+    .settings-content
+      = render 'groups/settings/general'
 
-%section.settings.gs-permissions.no-animate#js-permissions-settings{ class: ('expanded' if expanded), data: { testid: 'permissions-settings' } }
-  .settings-header
-    %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
-      = _('Permissions and group features')
-    = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
-      = expanded ? _('Collapse') : _('Expand')
-    %p.gl-text-secondary
-      = _('Configure advanced permissions, Large File Storage, two-factor authentication, and customer relations settings.')
-  .settings-content
-    = render 'groups/settings/permissions'
+  %section.settings.gs-permissions.no-animate#js-permissions-settings{ class: ('expanded' if expanded), data: { testid: 'permissions-settings' } }
+    .settings-header
+      %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
+        = _('Permissions and group features')
+      = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
+        = expanded ? _('Collapse') : _('Expand')
+      %p.gl-text-secondary
+        = _('Configure advanced permissions, Large File Storage, two-factor authentication, and customer relations settings.')
+    .settings-content
+      = render 'groups/settings/permissions'
 
-= render_if_exists 'groups/settings/merge_requests/merge_requests', expanded: expanded, group: @group
-= render_if_exists 'groups/settings/merge_requests/merge_request_approval_settings', expanded: expanded, group: @group, user: current_user
-= render_if_exists 'groups/analytics', expanded: expanded
+  = render_if_exists 'groups/settings/merge_requests/merge_requests', expanded: expanded, group: @group
+  = render_if_exists 'groups/settings/merge_requests/merge_request_approval_settings', expanded: expanded, group: @group, user: current_user
+  = render_if_exists 'groups/analytics', expanded: expanded
 
-%section.settings.no-animate#js-badge-settings{ class: ('expanded' if expanded) }
-  .settings-header
-    %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
-      = s_('GroupSettings|Badges')
-    = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
-      = expanded ? _('Collapse') : _('Expand')
-    %p.gl-text-secondary
-      = s_('GroupSettings|Customize this group\'s badges.')
-      = link_to s_('GroupSettings|What are badges?'), help_page_path('user/project/badges')
-  .settings-content
-    = render 'shared/badges/badge_settings'
+  %section.settings.no-animate#js-badge-settings{ class: ('expanded' if expanded) }
+    .settings-header
+      %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
+        = s_('GroupSettings|Badges')
+      = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
+        = expanded ? _('Collapse') : _('Expand')
+      %p.gl-text-secondary
+        = s_('GroupSettings|Customize this group\'s badges.')
+        = link_to s_('GroupSettings|What are badges?'), help_page_path('user/project/badges')
+    .settings-content
+      = render 'shared/badges/badge_settings'
 
-= render_if_exists 'groups/compliance_frameworks', expanded: expanded
-= render_if_exists 'groups/custom_project_templates_setting'
-= render_if_exists 'groups/templates_setting', expanded: expanded
-= render_if_exists 'shared/groups/max_pages_size_setting'
+  = render_if_exists 'groups/compliance_frameworks', expanded: expanded
+  = render_if_exists 'groups/custom_project_templates_setting'
+  = render_if_exists 'groups/templates_setting', expanded: expanded
+  = render_if_exists 'shared/groups/max_pages_size_setting'
 
-%section.settings.gs-advanced.no-animate#js-advanced-settings{ class: ('expanded' if expanded), data: { testid: 'advanced-settings-content' } }
-  .settings-header
-    %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
-      = _('Advanced')
-    = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
-      = expanded ? _('Collapse') : _('Expand')
-    %p.gl-text-secondary
-      = _('Perform advanced options such as changing path, transferring, exporting, or removing the group.')
-  .settings-content
-    = render 'groups/settings/advanced'
+  %section.settings.gs-advanced.no-animate#js-advanced-settings{ class: ('expanded' if expanded), data: { testid: 'advanced-settings-content' } }
+    .settings-header
+      %h4.settings-title.js-settings-toggle.js-settings-toggle-trigger-only{ role: 'button' }
+        = _('Advanced')
+      = render Pajamas::ButtonComponent.new(button_options: { class: 'js-settings-toggle' }) do
+        = expanded ? _('Collapse') : _('Expand')
+      %p.gl-text-secondary
+        = _('Perform advanced options such as changing path, transferring, exporting, or removing the group.')
+    .settings-content
+      = render 'groups/settings/advanced'
+- elsif can?(current_user, :remove_group, @group)
+  = render 'groups/settings/remove', group: @group, remove_form_id: 'js-remove-group-form'
+  = render_if_exists 'groups/settings/restore', group: @group
+  = render_if_exists 'groups/settings/immediately_remove', group: @group, remove_form_id: 'js-remove-group-form'
diff --git a/app/views/import/_githubish_status.html.haml b/app/views/import/_githubish_status.html.haml
index 5eae48fd237..f4615566ed2 100644
--- a/app/views/import/_githubish_status.html.haml
+++ b/app/views/import/_githubish_status.html.haml
@@ -9,6 +9,7 @@
 - provider_title = Gitlab::ImportSources.title(local_assigns.fetch(:provider))
 - optional_stages = local_assigns.fetch(:optional_stages, [])
 - status_import_github_group_path = local_assigns.fetch(:status_import_github_group_path, '')
+- is_fine_grained_token = local_assigns.fetch(:is_fine_grained_token, false)
 
 - header_title _("New project"), new_project_path
 - add_to_breadcrumbs s_('ProjectsNew|Import project'), new_project_path(anchor: 'import_project')
@@ -22,6 +23,7 @@
                                import_path: url_for([:import, provider, { format: :json }]),
                                status_import_github_group_path: status_import_github_group_path,
                                cancel_path: cancel_path,
+                               is_fine_grained_token: is_fine_grained_token.to_s,
                                details_path: details_path,
                                filterable: filterable.to_s,
                                paginatable: paginatable.to_s,
diff --git a/app/views/import/bitbucket_server/status.html.haml b/app/views/import/bitbucket_server/status.html.haml
index 6994404c8c9..5375ca4a40b 100644
--- a/app/views/import/bitbucket_server/status.html.haml
+++ b/app/views/import/bitbucket_server/status.html.haml
@@ -5,4 +5,8 @@
     = sprite_icon('bitbucket', css_class: 'gl-mr-3', size: 48)
   = _('Import projects from Bitbucket Server')
 
-= render 'import/githubish_status', provider: 'bitbucket_server', paginatable: true, default_namespace: @namespace, extra_data: { reconfigure_path: configure_import_bitbucket_server_path }
+= render 'import/githubish_status',
+  provider: 'bitbucket_server',
+  paginatable: true,
+  default_namespace: @namespace,
+  extra_data: { reconfigure_path: configure_import_bitbucket_server_path }
diff --git a/app/views/import/github/new.html.haml b/app/views/import/github/new.html.haml
index 0ad1e137f75..219b7344f12 100644
--- a/app/views/import/github/new.html.haml
+++ b/app/views/import/github/new.html.haml
@@ -39,7 +39,7 @@
           %li= safe_format(s_('GithubImporter|%{code_start}repo%{code_end}: Used to display a list of your public and private repositories that are available to connect to.'), code_pair)
         - else
           %li= safe_format(s_('GithubImporter|%{code_start}repo%{code_end}: Used to display a list of your public and private repositories that are available to import from.'), code_pair)
-          %li= safe_format(s_('GithubImporter|%{code_start}repo.org%{code_end} (optional): Used to import collaborators from GitHub repositories.'), code_pair)
+          %li= safe_format(s_('GithubImporter|%{code_start}read:org%{code_end} (optional): Used to import collaborators from GitHub repositories.'), code_pair)
 
   = render_if_exists 'import/github/ci_cd_only'
 
diff --git a/app/views/import/github/status.html.haml b/app/views/import/github/status.html.haml
index 0f56ae92557..9646bbc4a64 100644
--- a/app/views/import/github/status.html.haml
+++ b/app/views/import/github/status.html.haml
@@ -9,6 +9,7 @@
 = render 'import/githubish_status',
   provider: 'github', paginatable: true,
   default_namespace: @namespace,
+  is_fine_grained_token: @fine_grained.to_s,
   cancel_path: cancel_import_github_path,
   details_path: details_import_github_path,
   status_import_github_group_path: status_import_github_group_path(format: :json),
diff --git a/data/deprecations/14-5-certificate-based-integration-with-kubernetes.yml b/data/deprecations/14-5-certificate-based-integration-with-kubernetes.yml
index a94d2fc7f7d..2e66d269fa9 100644
--- a/data/deprecations/14-5-certificate-based-integration-with-kubernetes.yml
+++ b/data/deprecations/14-5-certificate-based-integration-with-kubernetes.yml
@@ -1,13 +1,13 @@
 - title: "Self-managed certificate-based integration with Kubernetes"
   announcement_milestone: "14.5"
-  removal_milestone: "17.0"
+  removal_milestone: "18.0"
   breaking_change: true
   body: |
     The certificate-based integration with Kubernetes [will be deprecated and removed](https://about.gitlab.com/blog/2021/11/15/deprecating-the-cert-based-kubernetes-integration/).
 
     As a self-managed customer, we are introducing the [feature flag](../administration/feature_flags.md#enable-or-disable-the-feature) `certificate_based_clusters` in GitLab 15.0 so you can keep your certificate-based integration enabled. However, the feature flag will be disabled by default, so this change is a **breaking change**.
 
-    In GitLab 17.0 we will remove both the feature and its related code. Until the final removal in 17.0, features built on this integration will continue to work, if you enable the feature flag. Until the feature is removed, GitLab will continue to fix security and critical issues as they arise.
+    In GitLab 18.0 we will remove both the feature and its related code. Until the final removal in 18.0, features built on this integration will continue to work, if you enable the feature flag. Until the feature is removed, GitLab will continue to fix security and critical issues as they arise.
 
     For a more robust, secure, forthcoming, and reliable integration with Kubernetes, we recommend you use the
     [agent for Kubernetes](https://docs.gitlab.com/ee/user/clusters/agent/) to connect Kubernetes clusters with GitLab. [How do I migrate?](https://docs.gitlab.com/ee/user/infrastructure/clusters/migrate_to_gitlab_agent.html)
diff --git a/db/docs/namespace_root_storage_statistics.yml b/db/docs/namespace_root_storage_statistics.yml
index ba5882ee901..98508d4484c 100644
--- a/db/docs/namespace_root_storage_statistics.yml
+++ b/db/docs/namespace_root_storage_statistics.yml
@@ -7,4 +7,6 @@ feature_categories:
 description: Stores usage data totals for all available consumable features across projects for a given namespace.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/29570
 milestone: '12.1'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  namespace_id: namespaces
diff --git a/db/docs/namespace_statistics.yml b/db/docs/namespace_statistics.yml
index 0e49484a00d..07ce93e468b 100644
--- a/db/docs/namespace_statistics.yml
+++ b/db/docs/namespace_statistics.yml
@@ -7,4 +7,6 @@ feature_categories:
 description: Stores usage statistics for both CI minutes and a limited set of storage types for a given namespace. This should not be confused with namespace_root_storage_statistics table which holds statistics across more storage types for a group.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/965
 milestone: '9.0'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  namespace_id: namespaces
diff --git a/db/migrate/20240214035028_add_first_and_latest_pipeline_id_to_vulnerability_occurrences.rb b/db/migrate/20240214035028_add_first_and_latest_pipeline_id_to_vulnerability_occurrences.rb
new file mode 100644
index 00000000000..73e5a56baed
--- /dev/null
+++ b/db/migrate/20240214035028_add_first_and_latest_pipeline_id_to_vulnerability_occurrences.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddFirstAndLatestPipelineIdToVulnerabilityOccurrences < Gitlab::Database::Migration[2.2]
+  milestone '16.10'
+  enable_lock_retries!
+
+  def change
+    add_column :vulnerability_occurrences, :initial_pipeline_id, :bigint, null: true
+    add_column :vulnerability_occurrences, :latest_pipeline_id, :bigint, null: true
+  end
+end
diff --git a/db/migrate/20240219143045_add_remove_group_to_member_roles.rb b/db/migrate/20240219143045_add_remove_group_to_member_roles.rb
new file mode 100644
index 00000000000..22047afd163
--- /dev/null
+++ b/db/migrate/20240219143045_add_remove_group_to_member_roles.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddRemoveGroupToMemberRoles < Gitlab::Database::Migration[2.2]
+  milestone '16.10'
+
+  enable_lock_retries!
+
+  def up
+    add_column :member_roles, :remove_group, :boolean, default: false, null: false
+  end
+
+  def down
+    remove_column :member_roles, :remove_group
+  end
+end
diff --git a/db/post_migrate/20240226072310_prepare_index_for_initial_and_latest_pipeline_id_to_vulnerability_occurrences.rb b/db/post_migrate/20240226072310_prepare_index_for_initial_and_latest_pipeline_id_to_vulnerability_occurrences.rb
new file mode 100644
index 00000000000..f9c1515b147
--- /dev/null
+++ b/db/post_migrate/20240226072310_prepare_index_for_initial_and_latest_pipeline_id_to_vulnerability_occurrences.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class PrepareIndexForInitialAndLatestPipelineIdToVulnerabilityOccurrences < Gitlab::Database::Migration[2.2]
+  milestone '16.10'
+
+  TABLE_NAME = :vulnerability_occurrences
+  INITIAL_PIPELINE_INDEX = 'index_vulnerability_occurrences_on_initial_pipeline_id'
+  LATEST_PIPELINE_INDEX = 'index_vulnerability_occurrences_on_latest_pipeline_id'
+
+  # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/work_items/443282
+  def up
+    prepare_async_index TABLE_NAME, :initial_pipeline_id, name: INITIAL_PIPELINE_INDEX
+    prepare_async_index TABLE_NAME, :latest_pipeline_id, name: LATEST_PIPELINE_INDEX
+  end
+
+  def down
+    unprepare_async_index TABLE_NAME, :initial_pipeline_id, name: INITIAL_PIPELINE_INDEX
+    unprepare_async_index TABLE_NAME, :latest_pipeline_id, name: LATEST_PIPELINE_INDEX
+  end
+end
diff --git a/db/schema_migrations/20240214035028 b/db/schema_migrations/20240214035028
new file mode 100644
index 00000000000..9be69dbfb48
--- /dev/null
+++ b/db/schema_migrations/20240214035028
@@ -0,0 +1 @@
+3c817aa6647e70b9888da3b4c044bd1b63f3bfeb5a47d85debe1350675088499
\ No newline at end of file
diff --git a/db/schema_migrations/20240219143045 b/db/schema_migrations/20240219143045
new file mode 100644
index 00000000000..5f98c2db602
--- /dev/null
+++ b/db/schema_migrations/20240219143045
@@ -0,0 +1 @@
+12e8704b5f9d37baadb7e125d08096c7a1df93f667d64ff1f9496e59e046d0a4
\ No newline at end of file
diff --git a/db/schema_migrations/20240226072310 b/db/schema_migrations/20240226072310
new file mode 100644
index 00000000000..606683724ea
--- /dev/null
+++ b/db/schema_migrations/20240226072310
@@ -0,0 +1 @@
+3f8a87162219ad7ee8ee3f0c13e2a7281da64b4f1d02c25deebf9f6fb9333cb3
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index bcf93cab916..e7eb54dd5e2 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -4106,7 +4106,6 @@ CREATE TABLE application_settings (
     lock_toggle_security_policy_custom_ci boolean DEFAULT false NOT NULL,
     toggle_security_policies_policy_scope boolean DEFAULT false NOT NULL,
     lock_toggle_security_policies_policy_scope boolean DEFAULT false NOT NULL,
-    include_optional_metrics_in_service_ping boolean DEFAULT true NOT NULL,
     rate_limits jsonb DEFAULT '{}'::jsonb NOT NULL,
     elasticsearch_max_code_indexing_concurrency integer DEFAULT 30 NOT NULL,
     enable_member_promotion_management boolean DEFAULT false NOT NULL,
@@ -4120,6 +4119,7 @@ CREATE TABLE application_settings (
     lock_duo_features_enabled boolean DEFAULT false NOT NULL,
     asciidoc_max_includes smallint DEFAULT 32 NOT NULL,
     clickhouse jsonb DEFAULT '{}'::jsonb NOT NULL,
+    include_optional_metrics_in_service_ping boolean DEFAULT true NOT NULL,
     CONSTRAINT app_settings_container_reg_cleanup_tags_max_list_size_positive CHECK ((container_registry_cleanup_tags_service_max_list_size >= 0)),
     CONSTRAINT app_settings_container_registry_pre_import_tags_rate_positive CHECK ((container_registry_pre_import_tags_rate >= (0)::numeric)),
     CONSTRAINT app_settings_dep_proxy_ttl_policies_worker_capacity_positive CHECK ((dependency_proxy_ttl_group_policy_worker_capacity >= 0)),
@@ -10670,6 +10670,7 @@ CREATE TABLE member_roles (
     remove_project boolean DEFAULT false NOT NULL,
     admin_terraform_state boolean DEFAULT false NOT NULL,
     admin_cicd_variables boolean DEFAULT false NOT NULL,
+    remove_group boolean DEFAULT false NOT NULL,
     occupies_seat boolean DEFAULT false NOT NULL,
     CONSTRAINT check_4364846f58 CHECK ((char_length(description) <= 255)),
     CONSTRAINT check_9907916995 CHECK ((char_length(name) <= 255))
@@ -17293,6 +17294,8 @@ CREATE TABLE vulnerability_occurrences (
     location jsonb,
     detection_method smallint DEFAULT 0 NOT NULL,
     uuid uuid DEFAULT '00000000-0000-0000-0000-000000000000'::uuid NOT NULL,
+    initial_pipeline_id bigint,
+    latest_pipeline_id bigint,
     CONSTRAINT check_4a3a60f2ba CHECK ((char_length(solution) <= 7000)),
     CONSTRAINT check_ade261da6b CHECK ((char_length(description) <= 15000)),
     CONSTRAINT check_f602da68dd CHECK ((char_length(cve) <= 48400))
diff --git a/doc/administration/appearance.md b/doc/administration/appearance.md
index 89a385b2263..0331924493e 100644
--- a/doc/administration/appearance.md
+++ b/doc/administration/appearance.md
@@ -100,7 +100,7 @@ You can add also add a [customized help message](settings/help_page.md) below th
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](feature_flags.md) named `disable_preferred_language_cookie`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 You can remove the cookie-based language selector from the footer of the sign-in and register pages by enabling the `disable_preferred_language_cookie` feature flag.
 
diff --git a/doc/administration/backup_restore/backup_gitlab.md b/doc/administration/backup_restore/backup_gitlab.md
index a66bb172565..a0d02874bd0 100644
--- a/doc/administration/backup_restore/backup_gitlab.md
+++ b/doc/administration/backup_restore/backup_gitlab.md
@@ -613,7 +613,7 @@ sudo -u git -H bundle exec rake gitlab:backup:create GITLAB_BACKUP_MAX_CONCURREN
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../feature_flags.md) named `incremental_repository_backup`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 NOTE:
 Only repositories support incremental backups. Therefore, if you use `INCREMENTAL=yes`, the task
diff --git a/doc/administration/geo/disaster_recovery/bring_primary_back.md b/doc/administration/geo/disaster_recovery/bring_primary_back.md
index dcbfbd7c990..fbf95d1b8b7 100644
--- a/doc/administration/geo/disaster_recovery/bring_primary_back.md
+++ b/doc/administration/geo/disaster_recovery/bring_primary_back.md
@@ -105,7 +105,7 @@ Use-cases:
 
 FLAG:
 On self-managed GitLab, by default this feature is available.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 When you add a secondary site which has preexisting file data, then the secondary Geo site will avoid re-transferring that data. This applies to:
 
diff --git a/doc/administration/gitaly/configure_gitaly.md b/doc/administration/gitaly/configure_gitaly.md
index 861e0eea3ed..90f310725e7 100644
--- a/doc/administration/gitaly/configure_gitaly.md
+++ b/doc/administration/gitaly/configure_gitaly.md
@@ -1130,7 +1130,7 @@ Configure the `cat-file` cache in the [Gitaly configuration file](reference.md).
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flag](../feature_flags.md) named `gitaly_gpg_signing`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 By default, Gitaly doesn't sign commits made using GitLab UI. For example, commits made using:
 
diff --git a/doc/administration/pages/index.md b/doc/administration/pages/index.md
index a9f57fdbf03..7da2ef08c0a 100644
--- a/doc/administration/pages/index.md
+++ b/doc/administration/pages/index.md
@@ -106,7 +106,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 Prerequisites:
@@ -200,7 +200,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 This configuration is the minimum setup for GitLab Pages. It is the base for all
@@ -289,7 +289,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 Prerequisites:
diff --git a/doc/administration/settings/account_and_limit_settings.md b/doc/administration/settings/account_and_limit_settings.md
index 3b7d5d258a2..f125690dcfb 100644
--- a/doc/administration/settings/account_and_limit_settings.md
+++ b/doc/administration/settings/account_and_limit_settings.md
@@ -193,7 +193,7 @@ DETAILS:
 > - It's deployed behind a feature flag, disabled by default.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `two_factor_for_cli`. On GitLab.com, this feature is not available. This feature is not ready for production use. This feature flag also affects [2FA for Git over SSH operations](../../security/two_factor_authentication.md#2fa-for-git-over-ssh-operations).
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `two_factor_for_cli`. On GitLab.com and GitLab Dedicated, this feature is not available. This feature is not ready for production use. This feature flag also affects [2FA for Git over SSH operations](../../security/two_factor_authentication.md#2fa-for-git-over-ssh-operations).
 
 GitLab administrators can choose to customize the session duration (in minutes) for Git operations when 2FA is enabled. The default is 15 and this can be set to a value between 1 and 10080.
 
@@ -314,7 +314,7 @@ DETAILS:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/423302) in GitLab 16.7 [with a flag](../feature_flags.md) named `ui_for_organizations`. Disabled by default.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../feature_flags.md) named `ui_for_organizations`. On GitLab.com, this feature is not available. This feature is not ready for production use.
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../feature_flags.md) named `ui_for_organizations`. On GitLab.com and GitLab Dedicated, this feature is not available. This feature is not ready for production use.
 
 By default, users can create organizations. GitLab administrators can prevent users from creating organizations.
 
diff --git a/doc/api/code_suggestions.md b/doc/api/code_suggestions.md
index bd5e214b036..9c5acdfb0e3 100644
--- a/doc/api/code_suggestions.md
+++ b/doc/api/code_suggestions.md
@@ -19,7 +19,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `code_suggestions_completion_api`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 ```plaintext
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index df2e53bda31..18783d30c58 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -6787,37 +6787,6 @@ Input type: `PromoteToEpicInput`
 | <a id="mutationpromotetoepicerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 | <a id="mutationpromotetoepicissue"></a>`issue` | [`Issue`](#issue) | Issue after mutation. |
 
-### `Mutation.provisionGoogleCloudRunner`
-
-Provisions a runner in Google Cloud.
-
-DETAILS:
-**Introduced** in GitLab 16.10.
-**Status**: Experiment.
-
-Input type: `ProvisionGoogleCloudRunnerInput`
-
-#### Arguments
-
-| Name | Type | Description |
-| ---- | ---- | ----------- |
-| <a id="mutationprovisiongooglecloudrunnerclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
-| <a id="mutationprovisiongooglecloudrunnerdryrun"></a>`dryRun` | [`Boolean`](#boolean) | If true, returns the Terraform script without executing it. Defaults to false. True is currently not supported. |
-| <a id="mutationprovisiongooglecloudrunnerephemeralmachinetype"></a>`ephemeralMachineType` | [`GoogleCloudMachineType!`](#googlecloudmachinetype) | Name of the machine type to use for running jobs. |
-| <a id="mutationprovisiongooglecloudrunnerprojectpath"></a>`projectPath` | [`ID!`](#id) | Project to create the runner in. |
-| <a id="mutationprovisiongooglecloudrunnerprovisioningprojectid"></a>`provisioningProjectId` | [`GoogleCloudProject!`](#googlecloudproject) | Identifier of the project where the runner is provisioned. |
-| <a id="mutationprovisiongooglecloudrunnerprovisioningregion"></a>`provisioningRegion` | [`GoogleCloudRegion!`](#googlecloudregion) | Name of the region to provision the runner in. |
-| <a id="mutationprovisiongooglecloudrunnerprovisioningzone"></a>`provisioningZone` | [`GoogleCloudZone!`](#googlecloudzone) | Name of the zone to provision the runner in. |
-| <a id="mutationprovisiongooglecloudrunnerrunnertoken"></a>`runnerToken` | [`String`](#string) | Authentication token of the runner. |
-
-#### Fields
-
-| Name | Type | Description |
-| ---- | ---- | ----------- |
-| <a id="mutationprovisiongooglecloudrunnerclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
-| <a id="mutationprovisiongooglecloudrunnererrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
-| <a id="mutationprovisiongooglecloudrunnerprovisioningsteps"></a>`provisioningSteps` | [`[CiRunnerCloudProvisioningStep!]`](#cirunnercloudprovisioningstep) | Steps used to provision the runner. |
-
 ### `Mutation.refreshStandardsAdherenceChecks`
 
 Input type: `RefreshStandardsAdherenceChecksInput`
@@ -16080,6 +16049,7 @@ Represents the total number of issues and their weights for a particular day.
 | <a id="cicatalogresourceopenissuescount"></a>`openIssuesCount` **{warning-solid}** | [`Int!`](#int) | **Introduced** in GitLab 16.3. **Status**: Experiment. Count of open issues that belong to the the catalog resource. |
 | <a id="cicatalogresourceopenmergerequestscount"></a>`openMergeRequestsCount` **{warning-solid}** | [`Int!`](#int) | **Introduced** in GitLab 16.3. **Status**: Experiment. Count of open merge requests that belong to the the catalog resource. |
 | <a id="cicatalogresourcestarcount"></a>`starCount` **{warning-solid}** | [`Int!`](#int) | **Introduced** in GitLab 16.1. **Status**: Experiment. Number of times the catalog resource has been starred. |
+| <a id="cicatalogresourcestarrerspath"></a>`starrersPath` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 16.10. **Status**: Experiment. Relative path to the starrers page for the catalog resource project. |
 | <a id="cicatalogresourceverificationlevel"></a>`verificationLevel` **{warning-solid}** | [`CiCatalogResourceComponentVerificationLevel`](#cicatalogresourcecomponentverificationlevel) | **Introduced** in GitLab 16.9. **Status**: Experiment. Verification level of the catalog resource. |
 | <a id="cicatalogresourcewebpath"></a>`webPath` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 16.1. **Status**: Experiment. Web path of the catalog resource. |
 
@@ -16630,8 +16600,8 @@ Machine type used for runner cloud provisioning.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cirunnercloudprovisioningmachinetypedescription"></a>`description` | [`String`](#string) | Description of the machine type. |
-| <a id="cirunnercloudprovisioningmachinetypename"></a>`name` | [`String`](#string) | Name of the machine type. |
-| <a id="cirunnercloudprovisioningmachinetypezone"></a>`zone` | [`String`](#string) | Zone of the machine type. |
+| <a id="cirunnercloudprovisioningmachinetypename"></a>`name` | [`GoogleCloudMachineType`](#googlecloudmachinetype) | Name of the machine type. |
+| <a id="cirunnercloudprovisioningmachinetypezone"></a>`zone` | [`GoogleCloudZone`](#googlecloudzone) | Zone of the machine type. |
 
 ### `CiRunnerCloudProvisioningRegion`
 
@@ -16642,7 +16612,7 @@ Region used for runner cloud provisioning.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cirunnercloudprovisioningregiondescription"></a>`description` | [`String`](#string) | Description of the region. |
-| <a id="cirunnercloudprovisioningregionname"></a>`name` | [`String`](#string) | Name of the region. |
+| <a id="cirunnercloudprovisioningregionname"></a>`name` | [`GoogleCloudRegion`](#googlecloudregion) | Name of the region. |
 
 ### `CiRunnerCloudProvisioningStep`
 
@@ -16665,22 +16635,22 @@ Zone used for runner cloud provisioning.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cirunnercloudprovisioningzonedescription"></a>`description` | [`String`](#string) | Description of the zone. |
-| <a id="cirunnercloudprovisioningzonename"></a>`name` | [`String`](#string) | Name of the zone. |
+| <a id="cirunnercloudprovisioningzonename"></a>`name` | [`GoogleCloudZone`](#googlecloudzone) | Name of the zone. |
 
-### `CiRunnerGoogleCloudProvisioningOptions`
+### `CiRunnerGoogleCloudProvisioning`
 
-Options for runner Google Cloud provisioning.
+Information used for runner Google Cloud provisioning.
 
 #### Fields
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="cirunnergooglecloudprovisioningoptionsprojectsetupshellscript"></a>`projectSetupShellScript` | [`String`](#string) | Instructions for setting up a Google Cloud project. |
-| <a id="cirunnergooglecloudprovisioningoptionsregions"></a>`regions` | [`CiRunnerCloudProvisioningRegionConnection`](#cirunnercloudprovisioningregionconnection) | Regions available for provisioning a runner. (see [Connections](#connections)) |
+| <a id="cirunnergooglecloudprovisioningprojectsetupshellscript"></a>`projectSetupShellScript` | [`String`](#string) | Instructions for setting up a Google Cloud project. |
+| <a id="cirunnergooglecloudprovisioningregions"></a>`regions` | [`CiRunnerCloudProvisioningRegionConnection`](#cirunnercloudprovisioningregionconnection) | Regions available for provisioning a runner. (see [Connections](#connections)) |
 
 #### Fields with arguments
 
-##### `CiRunnerGoogleCloudProvisioningOptions.machineTypes`
+##### `CiRunnerGoogleCloudProvisioning.machineTypes`
 
 Machine types available for provisioning a runner.
 
@@ -16694,9 +16664,24 @@ four standard [pagination arguments](#pagination-arguments):
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="cirunnergooglecloudprovisioningoptionsmachinetypeszone"></a>`zone` | [`String!`](#string) | Zone to retrieve machine types for. |
+| <a id="cirunnergooglecloudprovisioningmachinetypeszone"></a>`zone` | [`GoogleCloudZone!`](#googlecloudzone) | Zone to retrieve machine types for. |
 
-##### `CiRunnerGoogleCloudProvisioningOptions.zones`
+##### `CiRunnerGoogleCloudProvisioning.provisioningSteps`
+
+Steps used to provision a runner in the cloud.
+
+Returns [`[CiRunnerCloudProvisioningStep!]`](#cirunnercloudprovisioningstep).
+
+###### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="cirunnergooglecloudprovisioningprovisioningstepsephemeralmachinetype"></a>`ephemeralMachineType` | [`GoogleCloudMachineType!`](#googlecloudmachinetype) | Name of the machine type to use for running jobs. |
+| <a id="cirunnergooglecloudprovisioningprovisioningstepsregion"></a>`region` | [`GoogleCloudRegion!`](#googlecloudregion) | Name of the region to provision the runner in. |
+| <a id="cirunnergooglecloudprovisioningprovisioningstepsrunnertoken"></a>`runnerToken` | [`String`](#string) | Authentication token of the runner. |
+| <a id="cirunnergooglecloudprovisioningprovisioningstepszone"></a>`zone` | [`GoogleCloudZone!`](#googlecloudzone) | Name of the zone to provision the runner in. |
+
+##### `CiRunnerGoogleCloudProvisioning.zones`
 
 Zones available for provisioning a runner.
 
@@ -16710,7 +16695,7 @@ four standard [pagination arguments](#pagination-arguments):
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="cirunnergooglecloudprovisioningoptionszonesregion"></a>`region` | [`String`](#string) | Region to retrieve zones for. Returns all zones if not specified. |
+| <a id="cirunnergooglecloudprovisioningzonesregion"></a>`region` | [`GoogleCloudRegion`](#googlecloudregion) | Region to retrieve zones for. Returns all zones if not specified. |
 
 ### `CiRunnerManager`
 
@@ -26563,22 +26548,22 @@ four standard [pagination arguments](#pagination-arguments):
 | <a id="projectrequirementsworkitemiid"></a>`workItemIid` | [`ID`](#id) | IID of the requirement work item, for example, "1". |
 | <a id="projectrequirementsworkitemiids"></a>`workItemIids` | [`[ID!]`](#id) | List of IIDs of requirement work items, for example, `[1, 2]`. |
 
-##### `Project.runnerCloudProvisioningOptions`
+##### `Project.runnerCloudProvisioning`
 
-Options for provisioning the runner on a cloud provider. Returns `null` if `:google_cloud_runner_provisioning` feature flag is disabled, or the GitLab instance is not a SaaS instance.
+Information used for provisioning the runner on a cloud provider. Returns `null` if `:google_cloud_runner_provisioning` feature flag is disabled, or the GitLab instance is not a SaaS instance.
 
 DETAILS:
 **Introduced** in GitLab 16.9.
 **Status**: Experiment.
 
-Returns [`CiRunnerCloudProvisioningOptions`](#cirunnercloudprovisioningoptions).
+Returns [`CiRunnerCloudProvisioning`](#cirunnercloudprovisioning).
 
 ###### Arguments
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="projectrunnercloudprovisioningoptionscloudprojectid"></a>`cloudProjectId` | [`GoogleCloudProject!`](#googlecloudproject) | Identifier of the cloud project. |
-| <a id="projectrunnercloudprovisioningoptionsprovider"></a>`provider` | [`CiRunnerCloudProvider!`](#cirunnercloudprovider) | Identifier of the cloud provider. |
+| <a id="projectrunnercloudprovisioningcloudprojectid"></a>`cloudProjectId` | [`GoogleCloudProject!`](#googlecloudproject) | Identifier of the cloud project. |
+| <a id="projectrunnercloudprovisioningprovider"></a>`provider` | [`CiRunnerCloudProvider!`](#cirunnercloudprovider) | Identifier of the cloud provider. |
 
 ##### `Project.runners`
 
@@ -32100,6 +32085,7 @@ Member role permission.
 | <a id="memberrolepermissionread_code"></a>`READ_CODE` | Allows read-only access to the source code. |
 | <a id="memberrolepermissionread_dependency"></a>`READ_DEPENDENCY` | Allows read-only access to the dependencies and licenses. |
 | <a id="memberrolepermissionread_vulnerability"></a>`READ_VULNERABILITY` | Read vulnerability reports and security dashboards. |
+| <a id="memberrolepermissionremove_group"></a>`REMOVE_GROUP` | Ability to delete or restore a group. This ability does not allow deleting top level groups. Review the Retention period settings to prevent accidental deletion. |
 | <a id="memberrolepermissionremove_project"></a>`REMOVE_PROJECT` | Allows deletion of projects. |
 
 ### `MemberRolesOrderBy`
@@ -34343,13 +34329,13 @@ abstract types.
 
 ### Unions
 
-#### `CiRunnerCloudProvisioningOptions`
+#### `CiRunnerCloudProvisioning`
 
-Options for runner cloud provisioning.
+Information used in runner cloud provisioning.
 
 One of:
 
-- [`CiRunnerGoogleCloudProvisioningOptions`](#cirunnergooglecloudprovisioningoptions)
+- [`CiRunnerGoogleCloudProvisioning`](#cirunnergooglecloudprovisioning)
 
 #### `DependencyLinkMetadata`
 
diff --git a/doc/api/group_protected_branches.md b/doc/api/group_protected_branches.md
index afc40b98e7c..b3b7044167b 100644
--- a/doc/api/group_protected_branches.md
+++ b/doc/api/group_protected_branches.md
@@ -8,14 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/110603) in GitLab 15.9 [with a flag](../administration/feature_flags.md) named `group_protected_branches`. Disabled by default.
 > - Flag `group_protected_branches` [renamed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/116779) [flag](../administration/feature_flags.md) to `allow_protected_branches_for_group` GitLab 15.11.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `allow_protected_branches_for_group`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 ## Valid access levels
 
diff --git a/doc/api/group_ssh_certificates.md b/doc/api/group_ssh_certificates.md
index 3b6e026476f..5e4b0dcbf9c 100644
--- a/doc/api/group_ssh_certificates.md
+++ b/doc/api/group_ssh_certificates.md
@@ -13,7 +13,7 @@ DETAILS:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/421915) in GitLab 16.4 [with a flag](../user/feature_flags.md) named `ssh_certificates_rest_endpoints`. Disabled by default.
 
 FLAG:
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 Use this API to create, read and delete SSH certificates for a group.
 Only top-level groups can store SSH certificates.
diff --git a/doc/api/import.md b/doc/api/import.md
index 118132016f7..e640326acb2 100644
--- a/doc/api/import.md
+++ b/doc/api/import.md
@@ -46,7 +46,7 @@ POST /import/github
 curl --request POST \
   --url "https://gitlab.example.com/api/v4/import/github" \
   --header "content-type: application/json" \
-  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --header "Authorization: Bearer <your_access_token>" \
   --data '{
     "personal_access_token": "aBc123abC12aBc123abC12abC123+_A/c123",
     "repo_id": "12345",
@@ -79,7 +79,14 @@ Example response:
     "id": 27,
     "name": "my-repo",
     "full_path": "/root/my-repo",
-    "full_name": "Administrator / my-repo"
+    "full_name": "Administrator / my-repo",
+    "refs_url": "/root/my-repo/refs",
+    "import_source": "my-github/repo",
+    "import_status": "scheduled",
+    "human_import_status_name": "scheduled",
+    "provider_link": "/my-github/repo",
+    "relation_type": null,
+    "import_warning": null
 }
 ```
 
diff --git a/doc/api/integrations.md b/doc/api/integrations.md
index cb4425924a6..c6b6d3c7991 100644
--- a/doc/api/integrations.md
+++ b/doc/api/integrations.md
@@ -710,7 +710,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, ask an administrator to [disable the feature flag](../administration/feature_flags.md) named `git_guardian_integration`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 [GitGuardian](https://www.gitguardian.com/) is a cybersecurity service that detects sensitive data such as API keys
 and passwords in source code repositories.
@@ -900,7 +900,7 @@ DETAILS:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/425066) in GitLab 16.9 as a [Beta](../policy/experiment-beta-support.md) feature [with a flag](../administration/feature_flags.md) named `gcp_artifact_registry`. Disabled by default.
 
 FLAG:
-On GitLab.com, this feature is not available. The feature is not ready for production use.
+On GitLab.com and GitLab Dedicated, this feature is not available. The feature is not ready for production use.
 
 ### Set up Google Cloud Artifact Registry
 
@@ -942,7 +942,7 @@ GET /projects/:id/integrations/google-cloud-platform-artifact-registry
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/439200) in GitLab 16.10 as a [Beta](../policy/experiment-beta-support.md) feature [with a flag](../administration/feature_flags.md) named `google_cloud_workload_identity_federation`. Disabled by default.
 
 FLAG:
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 ### Set up Google Cloud Identity and Access Management
diff --git a/doc/api/markdown.md b/doc/api/markdown.md
index 1dc1c6e3dfc..1582a8d9f11 100644
--- a/doc/api/markdown.md
+++ b/doc/api/markdown.md
@@ -22,7 +22,7 @@ FLAG:
 On self-managed GitLab, by default this feature is enabled and authentication is required.
 To remove the requirement to authenticate, an administrator can
 [disable the feature flag](../administration/feature_flags.md) named `authenticate_markdown_api`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 All API calls to the Markdown API must be [authenticated](rest/index.md#authentication).
 
diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index 574c333a8b5..9e55523902e 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -26,7 +26,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `approval_group_rules`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 Group approval rules apply to all protected branches of projects belonging to the group. This feature is an [Experiment](../policy/experiment-beta-support.md).
diff --git a/doc/api/product_analytics.md b/doc/api/product_analytics.md
index 426b0fc5a74..8a855136804 100644
--- a/doc/api/product_analytics.md
+++ b/doc/api/product_analytics.md
@@ -8,7 +8,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - Introduced in GitLab 15.4 [with a flag](../administration/feature_flags.md) named `cube_api_proxy`. Disabled by default.
 > - `cube_api_proxy` removed and replaced with `product_analytics_internal_preview` in GitLab 15.10.
@@ -16,7 +16,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../administration/feature_flags.md) named `cube_api_proxy`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 NOTE:
diff --git a/doc/api/project_import_export.md b/doc/api/project_import_export.md
index c42d49e4804..7631e35b236 100644
--- a/doc/api/project_import_export.md
+++ b/doc/api/project_import_export.md
@@ -224,7 +224,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../administration/feature_flags.md) named `import_project_from_remote_file`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 ```plaintext
 POST /projects/remote-import
diff --git a/doc/ci/environments/index.md b/doc/ci/environments/index.md
index 16787262f75..377f20be9f0 100644
--- a/doc/ci/environments/index.md
+++ b/doc/ci/environments/index.md
@@ -484,7 +484,7 @@ stop_review:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `environment_stop_actions_include_all_finished_deployments`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 You can define a stop job for the environment with an [`on_stop` action](../yaml/index.md#environmenton_stop) in the environment's deploy job.
 
diff --git a/doc/ci/environments/kubernetes_dashboard.md b/doc/ci/environments/kubernetes_dashboard.md
index f03d4d125f7..2471c3f5cd3 100644
--- a/doc/ci/environments/kubernetes_dashboard.md
+++ b/doc/ci/environments/kubernetes_dashboard.md
@@ -35,8 +35,7 @@ add one when you create an environment.
 
 Prerequisites:
 
-- The agent for Kubernetes must be shared with the environment's project, or its parent group, using the [`user_access`](../../user/clusters/agent/user_access.md) keyword.
-- Self-managed only. KAS is running on the GitLab subdomain. For example, `kas.example.com` and `example.com`.
+- A GitLab agent for Kubernetes is [configured](../../user/clusters/agent/install/index.md) and shared with the environment's project, or its parent group, using the [`user_access`](../../user/clusters/agent/user_access.md) keyword.
 
 ::Tabs
 
diff --git a/doc/ci/yaml/index.md b/doc/ci/yaml/index.md
index b160a089236..b24d6631f6f 100644
--- a/doc/ci/yaml/index.md
+++ b/doc/ci/yaml/index.md
@@ -542,7 +542,7 @@ In this example:
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To enable the feature, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `auto_cancel_pipeline_on_job_failure`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 Use `workflow:auto_cancel:on_job_failure` to configure which jobs should be cancelled as soon as one job fails.
 
@@ -2501,7 +2501,7 @@ DETAILS:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142054) in GitLab 16.9. This feature is an [Experiment](../../policy/experiment-beta-support.md).
 
 FLAG:
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 Use `identity` to authenticate with third party services using identity federation.
@@ -3391,7 +3391,7 @@ as an artifact and published with GitLab Pages.
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 **Status:** Experiment
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/129534) in GitLab 16.7 as an [Experiment](../../policy/experiment-beta-support.md) [with a flag](../../user/feature_flags.md) named `pages_multiple_versions_setting`, disabled by default.
@@ -3399,7 +3399,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flag](../../administration/feature_flags.md) named
-`pages_multiple_versions_setting`. On GitLab.com, this feature is not available. This feature is not ready for production use.
+`pages_multiple_versions_setting`. On GitLab.com and GitLab Dedicated, this feature is not available. This feature is not ready for production use.
 
 Use `pages.path_prefix` to configure a path prefix for [multiple deployments](../../user/project/pages/index.md#create-multiple-deployments) of GitLab Pages.
 
diff --git a/doc/development/activitypub/actors/index.md b/doc/development/activitypub/actors/index.md
index 88975773bdd..0025c9da443 100644
--- a/doc/development/activitypub/actors/index.md
+++ b/doc/development/activitypub/actors/index.md
@@ -15,7 +15,7 @@ FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flags](../../../administration/feature_flags.md)
 named `activity_pub` and `activity_pub_project`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 This feature requires two feature flags:
diff --git a/doc/development/activitypub/actors/releases.md b/doc/development/activitypub/actors/releases.md
index acca9ce2d62..56560ceebeb 100644
--- a/doc/development/activitypub/actors/releases.md
+++ b/doc/development/activitypub/actors/releases.md
@@ -15,7 +15,7 @@ FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flags](../../../administration/feature_flags.md)
 named `activity_pub` and `activity_pub_project`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 This feature requires two feature flags:
diff --git a/doc/development/activitypub/index.md b/doc/development/activitypub/index.md
index 31cde3f5549..24ad30af5e4 100644
--- a/doc/development/activitypub/index.md
+++ b/doc/development/activitypub/index.md
@@ -15,7 +15,7 @@ FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flags](../../administration/feature_flags.md)
 named `activity_pub` and `activity_pub_project`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 Usage of ActivityPub in GitLab is governed by the
diff --git a/doc/development/documentation/experiment_beta.md b/doc/development/documentation/experiment_beta.md
index c66604c9fb7..f9799b8301f 100644
--- a/doc/development/documentation/experiment_beta.md
+++ b/doc/development/documentation/experiment_beta.md
@@ -33,7 +33,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can enable the feature flag named `example_flag`.
-On GitLab.com, this feature is not available. This feature is not ready for production use.
+On GitLab.com and GitLab Dedicated, this feature is not available. This feature is not ready for production use.
 
 Use this new feature when you need to do this new thing.
 
diff --git a/doc/development/documentation/feature_flags.md b/doc/development/documentation/feature_flags.md
index 9bf686f57fb..73edda2f357 100644
--- a/doc/development/documentation/feature_flags.md
+++ b/doc/development/documentation/feature_flags.md
@@ -73,7 +73,7 @@ A `FLAG` note renders on the GitLab documentation site as:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `example_flag`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 ### Self-managed GitLab availability information
@@ -94,9 +94,9 @@ This feature is not ready for production use.
 
 | If the feature is...                        | Use this text |
 |---------------------------------------------|---------------|
-| Available                                   | `On GitLab.com, this feature is available.` |
+| Available                                   | `On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.` |
 | Available to GitLab.com administrators only | `On GitLab.com, this feature is available but can be configured by GitLab.com administrators only.` |
-| Unavailable                                 | `On GitLab.com, this feature is not available.`|
+| Unavailable                                 | `On GitLab.com and GitLab Dedicated, this feature is not available.`|
 
 ### Optional information
 
diff --git a/doc/integration/advanced_search/elasticsearch.md b/doc/integration/advanced_search/elasticsearch.md
index a08e7fa9c8b..8304a4bdad2 100644
--- a/doc/integration/advanced_search/elasticsearch.md
+++ b/doc/integration/advanced_search/elasticsearch.md
@@ -401,7 +401,7 @@ from the Elasticsearch index as expected.
 FLAG:
 On self-managed GitLab, by default this feature is available.
 To hide the feature, an administrator can [disable the feature flag](../../administration/feature_flags.md) named `search_index_all_projects`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 When you select the **Limit the amount of namespace and project data to index** checkbox:
 
diff --git a/doc/integration/oauth_provider.md b/doc/integration/oauth_provider.md
index a41f1838c7c..548ee4de158 100644
--- a/doc/integration/oauth_provider.md
+++ b/doc/integration/oauth_provider.md
@@ -152,7 +152,7 @@ application are also deleted.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../administration/feature_flags.md) named `hash_oauth_secrets`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 By default, GitLab stores OAuth application secrets in the database in hashed format. These secrets are only available to users immediately after creating OAuth applications. In
 earlier versions of GitLab, application secrets are stored as plain text in the database.
diff --git a/doc/operations/incident_management/incident_timeline_events.md b/doc/operations/incident_management/incident_timeline_events.md
index e57e5ce6cd1..021279b7c2a 100644
--- a/doc/operations/incident_management/incident_timeline_events.md
+++ b/doc/operations/incident_management/incident_timeline_events.md
@@ -92,7 +92,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `incident_timeline_events_from_labels`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 A new timeline event is created when someone adds or removes [labels](../../user/project/labels.md) on an incident.
diff --git a/doc/operations/incident_management/slack.md b/doc/operations/incident_management/slack.md
index 99ed91a33a9..e6872e7eee4 100644
--- a/doc/operations/incident_management/slack.md
+++ b/doc/operations/incident_management/slack.md
@@ -16,7 +16,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, this feature is not available.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 Many teams receive alerts and collaborate in real time during incidents in Slack.
diff --git a/doc/operations/metrics.md b/doc/operations/metrics.md
index 26a81f133e1..ec6f3ef1a0a 100644
--- a/doc/operations/metrics.md
+++ b/doc/operations/metrics.md
@@ -8,7 +8,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com
+**Offering:** Self-managed
 **Status:** Experiment
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/124966) in GitLab 16.7 [with a flag](../administration/feature_flags.md) named `observability_metrics`. Disabled by default. This feature is an [Experiment](../policy/experiment-beta-support.md#experiment).
@@ -16,7 +16,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `observability_metrics`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 Metrics provide insight about the operational health of monitored systems.
diff --git a/doc/security/email_verification.md b/doc/security/email_verification.md
index eb408733557..7f91370ea7c 100644
--- a/doc/security/email_verification.md
+++ b/doc/security/email_verification.md
@@ -8,12 +8,12 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/86352) in GitLab 15.2 [with a flag](../administration/feature_flags.md) named `require_email_verification`. Disabled by default.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `require_email_verification`. On GitLab.com, this feature is not available.
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `require_email_verification`. On GitLab.com and GitLab Dedicated, this feature is not available.
 
 Account email verification provides an additional layer of GitLab account security.
 When certain conditions are met, an account is locked. If your account is locked,
diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md
index a6cb51b51c8..35a290ac20f 100644
--- a/doc/security/two_factor_authentication.md
+++ b/doc/security/two_factor_authentication.md
@@ -201,7 +201,7 @@ To disable 2FA for all users even when forced 2FA is disabled, use the following
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/270554) in GitLab 13.7.
 > - [Moved](https://gitlab.com/gitlab-org/gitlab/-/issues/299088) from GitLab Free to GitLab Premium in 13.9.
@@ -209,7 +209,7 @@ DETAILS:
 > - Push notification support [introduced](https://gitlab.com/gitlab-org/gitlab-shell/-/issues/506) in GitLab 15.3.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `two_factor_for_cli`. On GitLab.com, this feature is not available. The feature is not ready for production use. This feature flag also affects [session duration for Git Operations when 2FA is enabled](../administration/settings/account_and_limit_settings.md#customize-session-duration-for-git-operations-when-2fa-is-enabled).
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `two_factor_for_cli`. On GitLab.com and GitLab Dedicated, this feature is not available. The feature is not ready for production use. This feature flag also affects [session duration for Git Operations when 2FA is enabled](../administration/settings/account_and_limit_settings.md#customize-session-duration-for-git-operations-when-2fa-is-enabled).
 
 You can enforce 2FA for [Git over SSH operations](../development/gitlab_shell/features.md#git-operations). However, you should use
 [ED25519_SK](../user/ssh.md#ed25519_sk-ssh-keys) or [ECDSA_SK](../user/ssh.md#ecdsa_sk-ssh-keys) SSH keys instead. 2FA is enforced for Git operations only, and internal commands such as [`personal_access_token`](../development/gitlab_shell/features.md#personal-access-token) are excluded.
diff --git a/doc/update/background_migrations.md b/doc/update/background_migrations.md
index d0d255d1c75..f2b21f5d210 100644
--- a/doc/update/background_migrations.md
+++ b/doc/update/background_migrations.md
@@ -179,7 +179,7 @@ Refer to this feature's history for more details.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, ask an administrator to [disable the feature flag](../administration/feature_flags.md) named `optimize_batched_migrations`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 To maximize throughput of batched background migrations (in terms of the number of tuples updated per time unit), batch sizes are automatically adjusted based on how long the previous batches took to complete.
 
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index 56c59df9474..c8a5e2d9058 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -235,6 +235,32 @@ Before upgrading to GitLab 18.0, please ensure you have [migrated](https://docs.
 
 <div class="deprecation breaking-change" data-milestone="18.0">
 
+### Self-managed certificate-based integration with Kubernetes
+
+<div class="deprecation-notes">
+- Announced in GitLab <span class="milestone">14.5</span>
+- Removal in GitLab <span class="milestone">18.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/groups/gitlab-org/configure/-/epics/8).
+</div>
+
+The certificate-based integration with Kubernetes [will be deprecated and removed](https://about.gitlab.com/blog/2021/11/15/deprecating-the-cert-based-kubernetes-integration/).
+
+As a self-managed customer, we are introducing the [feature flag](../administration/feature_flags.md#enable-or-disable-the-feature) `certificate_based_clusters` in GitLab 15.0 so you can keep your certificate-based integration enabled. However, the feature flag will be disabled by default, so this change is a **breaking change**.
+
+In GitLab 18.0 we will remove both the feature and its related code. Until the final removal in 18.0, features built on this integration will continue to work, if you enable the feature flag. Until the feature is removed, GitLab will continue to fix security and critical issues as they arise.
+
+For a more robust, secure, forthcoming, and reliable integration with Kubernetes, we recommend you use the
+[agent for Kubernetes](https://docs.gitlab.com/ee/user/clusters/agent/) to connect Kubernetes clusters with GitLab. [How do I migrate?](https://docs.gitlab.com/ee/user/infrastructure/clusters/migrate_to_gitlab_agent.html)
+
+Although an explicit removal date is set, we don't plan to remove this feature until the new solution has feature parity.
+For more information about the blockers to removal, see [this issue](https://gitlab.com/gitlab-org/configure/general/-/issues/199).
+
+For updates and details about this deprecation, follow [this epic](https://gitlab.com/groups/gitlab-org/configure/-/epics/8).
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="18.0">
+
 ### Slack notifications integration
 
 <div class="deprecation-notes">
@@ -1752,32 +1778,6 @@ In [Support additional filters for scan result policies](https://gitlab.com/grou
 
 <div class="deprecation breaking-change" data-milestone="17.0">
 
-### Self-managed certificate-based integration with Kubernetes
-
-<div class="deprecation-notes">
-- Announced in GitLab <span class="milestone">14.5</span>
-- Removal in GitLab <span class="milestone">17.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
-- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/groups/gitlab-org/configure/-/epics/8).
-</div>
-
-The certificate-based integration with Kubernetes [will be deprecated and removed](https://about.gitlab.com/blog/2021/11/15/deprecating-the-cert-based-kubernetes-integration/).
-
-As a self-managed customer, we are introducing the [feature flag](../administration/feature_flags.md#enable-or-disable-the-feature) `certificate_based_clusters` in GitLab 15.0 so you can keep your certificate-based integration enabled. However, the feature flag will be disabled by default, so this change is a **breaking change**.
-
-In GitLab 17.0 we will remove both the feature and its related code. Until the final removal in 17.0, features built on this integration will continue to work, if you enable the feature flag. Until the feature is removed, GitLab will continue to fix security and critical issues as they arise.
-
-For a more robust, secure, forthcoming, and reliable integration with Kubernetes, we recommend you use the
-[agent for Kubernetes](https://docs.gitlab.com/ee/user/clusters/agent/) to connect Kubernetes clusters with GitLab. [How do I migrate?](https://docs.gitlab.com/ee/user/infrastructure/clusters/migrate_to_gitlab_agent.html)
-
-Although an explicit removal date is set, we don't plan to remove this feature until the new solution has feature parity.
-For more information about the blockers to removal, see [this issue](https://gitlab.com/gitlab-org/configure/general/-/issues/199).
-
-For updates and details about this deprecation, follow [this epic](https://gitlab.com/groups/gitlab-org/configure/-/epics/8).
-
-</div>
-
-<div class="deprecation breaking-change" data-milestone="17.0">
-
 ### Single database connection is deprecated
 
 <div class="deprecation-notes">
diff --git a/doc/user/analytics/analytics_dashboards.md b/doc/user/analytics/analytics_dashboards.md
index bee2c2b83d3..3dc7e0b99b9 100644
--- a/doc/user/analytics/analytics_dashboards.md
+++ b/doc/user/analytics/analytics_dashboards.md
@@ -8,14 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 **Status:** Experiment
 
 > - Introduced in GitLab 15.9 as an [Experiment](../../policy/experiment-beta-support.md#experiment) feature [with a flag](../../administration/feature_flags.md) named `combined_analytics_dashboards`. Disabled by default.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `combined_analytics_dashboards`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 Analytics dashboards help you visualize the collected data.
@@ -110,7 +110,7 @@ To view a list of dashboards (both built-in and custom) for a project:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `combined_analytics_dashboards` and `project_analytics_dashboard_dynamic_vsd`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 Prerequisites:
@@ -130,7 +130,7 @@ To view the Value Streams Dashboard as an analytics dashboard for a project:
 > - [Enabled on GitLab.com and self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/416970) in GitLab 16.8.
 
 FLAG:
-On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../administration/feature_flags.md) named `group_analytics_dashboards`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../administration/feature_flags.md) named `group_analytics_dashboards`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Prerequisites:
 
@@ -148,7 +148,7 @@ To view a list of dashboards (both built-in and custom) for a group:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per group or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `group_analytics_dashboard_dynamic_vsd`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 To view the Value Streams Dashboard as an analytics dashboard for a group:
diff --git a/doc/user/analytics/dora_metrics.md b/doc/user/analytics/dora_metrics.md
index bd67257fb2d..c49d411d354 100644
--- a/doc/user/analytics/dora_metrics.md
+++ b/doc/user/analytics/dora_metrics.md
@@ -134,14 +134,14 @@ The first step is to benchmark the quality and stability, between groups and pro
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 **Status:** Experiment
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/96561) in GitLab 15.4 [with a flag](../../administration/feature_flags.md) named `dora_configuration`. Disabled by default. This feature is an [Experiment](../../policy/experiment-beta-support.md).
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per project or for your entire instance, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `dora_configuration`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 This feature is an [Experiment](../../policy/experiment-beta-support.md).
 To join the list of users testing this feature, [here is a suggested test flow](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/96561#steps-to-check-on-localhost).
diff --git a/doc/user/application_security/policies/scan-execution-policies.md b/doc/user/application_security/policies/scan-execution-policies.md
index bbe98e481cb..fb0f746f857 100644
--- a/doc/user/application_security/policies/scan-execution-policies.md
+++ b/doc/user/application_security/policies/scan-execution-policies.md
@@ -106,7 +106,7 @@ the following sections and tables provide an alternative.
 
 FLAG:
 On self-managed GitLab, by default the `branch_exceptions` field is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `security_policies_branch_exceptions`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 This rule enforces the defined actions whenever the pipeline runs for a selected branch.
 
@@ -129,7 +129,7 @@ In GitLab 16.1 and earlier, you should **not** use [direct transfer](../../../ad
 
 FLAG:
 On self-managed GitLab, by default the `branch_exceptions` field is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `security_policies_branch_exceptions`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 This rule schedules a scan pipeline, enforcing the defined actions on the schedule defined in the `cadence` field. A scheduled pipeline does not run other jobs defined in the project's `.gitlab-ci.yml` file. When a project is linked to a security policy project, a security policy bot is created in the project and will become the author of any scheduled pipelines.
 
diff --git a/doc/user/application_security/policies/scan-result-policies.md b/doc/user/application_security/policies/scan-result-policies.md
index 75d2c1a7bd5..c649b26b726 100644
--- a/doc/user/application_security/policies/scan-result-policies.md
+++ b/doc/user/application_security/policies/scan-result-policies.md
@@ -202,7 +202,7 @@ the defined policy.
 > - Feature flag `scan_result_policies_block_force_push` [was removed](https://gitlab.com/gitlab-org/gitlab/-/issues/432123) in GitLab 16.8.
 
 FLAG:
-On self-managed GitLab, by default the `block_branch_modification` field is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `scan_result_policies_block_unprotecting_branches`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default the `block_branch_modification` field is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `scan_result_policies_block_unprotecting_branches`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 The settings set in the policy overwrite settings in the project.
 
diff --git a/doc/user/application_security/vulnerability_report/pipeline.md b/doc/user/application_security/vulnerability_report/pipeline.md
index 96d0b6d75a7..b19d5dc28b4 100644
--- a/doc/user/application_security/vulnerability_report/pipeline.md
+++ b/doc/user/application_security/vulnerability_report/pipeline.md
@@ -111,7 +111,7 @@ This does not apply for the vulnerabilities existing on the default branch.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `pipeline_security_dashboard_graphql`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 To change the status of findings to **Dismiss** or **Needs triage**:
 
diff --git a/doc/user/compliance/compliance_center/index.md b/doc/user/compliance/compliance_center/index.md
index a1b072c0a9a..68449b60fce 100644
--- a/doc/user/compliance/compliance_center/index.md
+++ b/doc/user/compliance/compliance_center/index.md
@@ -473,7 +473,7 @@ To delete a compliance framework from the compliance projects report:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature an administrator to [disable the feature flag](../../../administration/feature_flags.md) named
-`compliance_framework_report_ui`. On GitLab.com, this feature is available.
+`compliance_framework_report_ui`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 With compliance frameworks report, you can see all the compliance frameworks in a group. Each row of the report shows:
 
diff --git a/doc/user/custom_roles/abilities.md b/doc/user/custom_roles/abilities.md
index 013ca1252fe..38698cefaf5 100644
--- a/doc/user/custom_roles/abilities.md
+++ b/doc/user/custom_roles/abilities.md
@@ -41,6 +41,7 @@ These requirements are documented in the `Required permission` column in the fol
 | Name | Required permission | Description | Introduced in | Feature flag | Enabled in |
 |:-----|:------------|:------------------|:---------|:--------------|:---------|
 | [`archive_project`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134998) |  | Allows archiving of projects. | GitLab [16.6](https://gitlab.com/gitlab-org/gitlab/-/issues/425957) | `archive_project` | GitLab [16.7](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/139260) |
+| [`remove_group`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/145166) |  | Ability to delete or restore a group. This ability does not allow deleting top level groups. Review the Retention period settings to prevent accidental deletion. | GitLab [16.10](https://gitlab.com/gitlab-org/gitlab/-/issues/425962) |  |  |
 | [`remove_project`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/139696) |  | Allows deletion of projects. | GitLab [16.8](https://gitlab.com/gitlab-org/gitlab/-/issues/425959) |  |  |
 
 ## Infrastructure as code
diff --git a/doc/user/group/epics/manage_epics.md b/doc/user/group/epics/manage_epics.md
index cbc47a0a668..7cb2c5beb01 100644
--- a/doc/user/group/epics/manage_epics.md
+++ b/doc/user/group/epics/manage_epics.md
@@ -258,7 +258,7 @@ To filter:
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `or_issuable_queries`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 When this feature is enabled, you can use the OR operator (**is one of: `||`**)
diff --git a/doc/user/group/issues_analytics/index.md b/doc/user/group/issues_analytics/index.md
index 2c091af0f5c..ad0732be8a4 100644
--- a/doc/user/group/issues_analytics/index.md
+++ b/doc/user/group/issues_analytics/index.md
@@ -46,13 +46,13 @@ shows a total of 15 months for the chart in the GitLab.org group.
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/233905/) in GitLab 16.3 [with a flag](../../../administration/feature_flags.md) named `issues_completed_analytics_feature_flag`. Disabled by default.
 > - [Enabled on GitLab.com and self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/437542) in GitLab 16.8.
 
 FLAG:
-On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `issues_completed_analytics_feature_flag`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `issues_completed_analytics_feature_flag`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Enhanced issue analytics display the additional metric "Issues closed", which represents the total number of resolved issues in your group over a selected period.
 You can use this metric to improve the overall turn-around time and value delivered to your customers.
diff --git a/doc/user/group/reporting/git_abuse_rate_limit.md b/doc/user/group/reporting/git_abuse_rate_limit.md
index 3bb2227947c..47964aaf651 100644
--- a/doc/user/group/reporting/git_abuse_rate_limit.md
+++ b/doc/user/group/reporting/git_abuse_rate_limit.md
@@ -8,12 +8,12 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/8066) in GitLab 15.2 [with a flag](../../../administration/feature_flags.md) named `limit_unique_project_downloads_per_namespace_user`. Disabled by default.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `limit_unique_project_downloads_per_namespace_user`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `limit_unique_project_downloads_per_namespace_user`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 This is the group-level documentation. For self-managed instances, see the [administration documentation](../../../administration/reporting/git_abuse_rate_limit.md).
 
diff --git a/doc/user/group/ssh_certificates.md b/doc/user/group/ssh_certificates.md
index 5972de3e4e9..b651cf1fe53 100644
--- a/doc/user/group/ssh_certificates.md
+++ b/doc/user/group/ssh_certificates.md
@@ -22,7 +22,7 @@ To temporarily grant Git access to your projects, you can use SSH certificates.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/424501) in GitLab 16.9.
 
 FLAG:
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Prerequisites:
 
@@ -69,7 +69,7 @@ The user certificates can only be used to access the projects within the top-lev
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/426235) in GitLab 16.9.
 
 FLAG:
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 You can enforce usage of SSH certificates and forbid users from authenticating using SSH
 keys and access tokens.
diff --git a/doc/user/group/value_stream_analytics/index.md b/doc/user/group/value_stream_analytics/index.md
index 43c7d7790ef..bdc02cd3442 100644
--- a/doc/user/group/value_stream_analytics/index.md
+++ b/doc/user/group/value_stream_analytics/index.md
@@ -207,7 +207,7 @@ Keep in mind the following observations related to this example:
 FLAG:
 On self-managed GitLab, by default this feature is available.
 To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `enable_vsa_cumulative_label_duration_calculation`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 With this feature, value stream analytics measures the duration of repetitive events for label-based stages. You should configure label removal or addition events for both start and end events.
 
diff --git a/doc/user/okrs.md b/doc/user/okrs.md
index 9db9a3d644b..f184f24c5f6 100644
--- a/doc/user/okrs.md
+++ b/doc/user/okrs.md
@@ -352,7 +352,7 @@ To reorder them, drag them around.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `okr_checkin_reminders`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 Schedule check-in reminders to remind your team to provide status updates on the key results you care
@@ -489,7 +489,7 @@ system note in the OKR's comments, for example:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `work_items_beta`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 You can prevent public comments in an OKR.
@@ -514,7 +514,7 @@ If an OKR is closed with a locked discussion, then you cannot reopen it until th
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `work_items_mvc_2`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 When enabled, OKRs use a two-column layout, similar to issues.
@@ -531,7 +531,7 @@ or assignees, on the right.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../administration/feature_flags.md) named `linked_work_items`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Linked items are a bi-directional relationship and appear in a block below
 the Child objectives and key results. You can link an objective, key result, or a task in the same project with each other.
diff --git a/doc/user/organization/index.md b/doc/user/organization/index.md
index 923c5ad928e..00459a64d24 100644
--- a/doc/user/organization/index.md
+++ b/doc/user/organization/index.md
@@ -11,7 +11,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 FLAG:
 This feature is not ready for production use.
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `ui_for_organizations`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 DISCLAIMER:
 This page contains information related to upcoming products, features, and functionality.
diff --git a/doc/user/packages/composer_repository/index.md b/doc/user/packages/composer_repository/index.md
index e530cf0e929..35ba7627da1 100644
--- a/doc/user/packages/composer_repository/index.md
+++ b/doc/user/packages/composer_repository/index.md
@@ -345,7 +345,7 @@ You can install from source by pulling the Git repository directly. To do so, ei
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature per project, an administrator can
 [disable the feature flag](../../../administration/feature_flags.md) named `composer_use_ssh_source_urls`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 When you install from source, the `composer` configures an
 access to the project's Git repository.
diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index 1e917f3d050..a3d985b2777 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -332,7 +332,7 @@ The following table lists group permissions available for each role:
 | Use [security dashboard](application_security/security_dashboard/index.md)              |       |          | ✓         | ✓          | ✓     |       |
 | View group Audit Events                                                                 |       |          | ✓         | ✓          | ✓     | Developers and Maintainers can only view events based on their individual actions. |
 | Delete [group wiki](project/wiki/group.md) pages                                        |       |          | ✓         | ✓          | ✓     |       |
-| Create subgroup                                                                         |       |          |           | ✓          | ✓     | Maintainers: Only if users with the Maintainer role are [allowed to create subgroups](group/subgroups/index.md#change-who-can-create-subgroups).
+| Create subgroup                                                                         |       |          |           | ✓          | ✓     | Maintainers: Only if users with the Maintainer role are [allowed to create subgroups](group/subgroups/index.md#change-who-can-create-subgroups). |
 | Create/edit/delete [Maven and generic package duplicate settings](packages/generic_packages/index.md#do-not-allow-duplicate-generic-packages) |  |  |  | ✓ | ✓ |       |
 | Create/edit/delete dependency proxy [cleanup policies](packages/dependency_proxy/reduce_dependency_proxy_storage.md#cleanup-policies)         |  |  |  | ✓ | ✓ |       |
 | Delete [packages](packages/index.md)                                                    |       |          |           | ✓          | ✓     |       |
diff --git a/doc/user/profile/account/delete_account.md b/doc/user/profile/account/delete_account.md
index 35bc473e145..acc020a27cc 100644
--- a/doc/user/profile/account/delete_account.md
+++ b/doc/user/profile/account/delete_account.md
@@ -23,7 +23,7 @@ Deleting a user deletes all projects in that user namespace.
 > - Delay between a user deleting their own account and deletion of the user record introduced in GitLab 16.0 [with a flag](../../../administration/feature_flags.md) named `delay_delete_own_user`. Enabled by default on GitLab.com.
 
 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `delay_delete_own_user`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `delay_delete_own_user`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 As a user, to delete your own account:
 
diff --git a/doc/user/profile/account/two_factor_authentication.md b/doc/user/profile/account/two_factor_authentication.md
index eeb1da7c771..6285909a8e4 100644
--- a/doc/user/profile/account/two_factor_authentication.md
+++ b/doc/user/profile/account/two_factor_authentication.md
@@ -304,7 +304,7 @@ On GitLab.com, WebAuthn devices are available.
 
 FLAG:
 On self-managed GitLab, by default, optional one-time password authentication for WebAuthn devices is not available. To enable the feature, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `webauthn_without_totp`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 WebAuthn is [supported by](https://caniuse.com/#search=webauthn) the following:
 
diff --git a/doc/user/project/import/bitbucket_server.md b/doc/user/project/import/bitbucket_server.md
index 36854c8cb1e..f64f31eef41 100644
--- a/doc/user/project/import/bitbucket_server.md
+++ b/doc/user/project/import/bitbucket_server.md
@@ -90,7 +90,7 @@ The following items are changed when they are imported:
 FLAG:
 On self-managed GitLab, matching user mentions with GitLab users is not available. To make it available per user,
 an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `bitbucket_server_import_stage_import_users`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 When issues and pull requests are importing, the importer tries to find the author's email address
 with a confirmed email address in the GitLab user database. If no such user is available, the
diff --git a/doc/user/project/integrations/beyond_identity.md b/doc/user/project/integrations/beyond_identity.md
index ab716c12115..6f350849016 100644
--- a/doc/user/project/integrations/beyond_identity.md
+++ b/doc/user/project/integrations/beyond_identity.md
@@ -8,7 +8,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** Self-managed, GitLab Dedicated
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/431433) in GitLab 16.9.
 
diff --git a/doc/user/project/integrations/git_guardian.md b/doc/user/project/integrations/git_guardian.md
index 50c160b435c..4ac9c689edf 100644
--- a/doc/user/project/integrations/git_guardian.md
+++ b/doc/user/project/integrations/git_guardian.md
@@ -8,13 +8,13 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/435706) in GitLab 16.9 [with a flag](../../../administration/feature_flags.md) named `git_guardian_integration`. Enabled by default. Disabled on GitLab.com.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, ask an administrator to [disable the feature flag](../../../administration/feature_flags.md) named `git_guardian_integration`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 [GitGuardian](https://www.gitguardian.com/) is a cybersecurity service that detects sensitive data such as API keys
 and passwords in source code repositories.
diff --git a/doc/user/project/integrations/webhook_events.md b/doc/user/project/integrations/webhook_events.md
index 0d4a5d94aa0..b9818ae061f 100644
--- a/doc/user/project/integrations/webhook_events.md
+++ b/doc/user/project/integrations/webhook_events.md
@@ -1910,7 +1910,7 @@ Payload example:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can
-[disable the feature flag](../../../administration/feature_flags.md) named `emoji_webhooks`. On GitLab.com, this feature is available.
+[disable the feature flag](../../../administration/feature_flags.md) named `emoji_webhooks`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 NOTE:
 To have the `emoji_webhooks` flag enabled on GitLab.com, see [issue 417288](https://gitlab.com/gitlab-org/gitlab/-/issues/417288).
diff --git a/doc/user/project/integrations/webhooks.md b/doc/user/project/integrations/webhooks.md
index cc7434ca640..35c7e947b04 100644
--- a/doc/user/project/integrations/webhooks.md
+++ b/doc/user/project/integrations/webhooks.md
@@ -113,7 +113,7 @@ You can define URL variables directly using the REST API.
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can
 [disable the feature flag](../../../administration/feature_flags.md) named `custom_webhook_template`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 You can set a custom payload template in the webhook configuration. The request body is rendered from the template
 with the data for the current event. The template must render as valid JSON.
@@ -175,7 +175,7 @@ For GitLab self-managed, an administrator can [change the webhook timeout limit]
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `auto_disabling_web_hooks`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Project or group webhooks that fail four consecutive times are disabled automatically.
 
diff --git a/doc/user/project/issue_board.md b/doc/user/project/issue_board.md
index f2331a8aa24..41c4118d538 100644
--- a/doc/user/project/issue_board.md
+++ b/doc/user/project/issue_board.md
@@ -674,7 +674,7 @@ and the target list.
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, ask an
 administrator to [enable the feature flag](../../administration/feature_flags.md) named `board_multi_select`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 You can select multiple issue cards, then drag the group to another position within the list, or to
diff --git a/doc/user/project/issues/managing_issues.md b/doc/user/project/issues/managing_issues.md
index 49d9341d0a8..afd5229b16d 100644
--- a/doc/user/project/issues/managing_issues.md
+++ b/doc/user/project/issues/managing_issues.md
@@ -493,7 +493,7 @@ To filter the list of issues:
 FLAG:
 On self-managed GitLab, by default this feature is available.
 To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `or_issuable_queries`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 When this feature is enabled, you can use the OR operator (**is one of: `||`**)
 when you [filter the list of issues](#filter-the-list-of-issues) by:
diff --git a/doc/user/project/merge_requests/approvals/settings.md b/doc/user/project/merge_requests/approvals/settings.md
index bfd8c8731c7..fcbde7bd643 100644
--- a/doc/user/project/merge_requests/approvals/settings.md
+++ b/doc/user/project/merge_requests/approvals/settings.md
@@ -123,7 +123,7 @@ When this field is changed, it can affect all open merge requests depending on t
 
 FLAG:
 On self-managed GitLab, by default requiring re-authentication by using SAML authentication is available. To hide the feature, an administrator can
-[disable the feature flag](../../../../administration/feature_flags.md) named `ff_require_saml_auth_to_approve`. On GitLab.com, this feature is available.
+[disable the feature flag](../../../../administration/feature_flags.md) named `ff_require_saml_auth_to_approve`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 You can force potential approvers to first authenticate with either:
 
diff --git a/doc/user/project/merge_requests/changes.md b/doc/user/project/merge_requests/changes.md
index 0d218c6310d..e4b3ae69b01 100644
--- a/doc/user/project/merge_requests/changes.md
+++ b/doc/user/project/merge_requests/changes.md
@@ -68,13 +68,13 @@ Files with many changes are collapsed to improve performance. GitLab displays th
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To disable it,
 an administrator can [disable the feature flag](../../../administration/feature_flags.md)
 named `collapse_generated_diff_files`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 To help reviewers focus on the files needed to perform a code review, GitLab collapses
 several common types of generated files. These files are collapsed by default, because
diff --git a/doc/user/project/merge_requests/index.md b/doc/user/project/merge_requests/index.md
index f43fe78075a..50d50adabdc 100644
--- a/doc/user/project/merge_requests/index.md
+++ b/doc/user/project/merge_requests/index.md
@@ -413,14 +413,14 @@ Threads on lines that don't change and top-level resolvable threads are not reso
 
 DETAILs:
 **Tier:** Free, Premium, Ultimate
-**Offering:** Self-managed, GitLab Dedicated
+**Offering:** Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/132678) in GitLab 16.5 [with a flag](../../../administration/feature_flags.md) named `notifications_todos_buttons`. Disabled by default.
 > - [Issues, incidents](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133474), and [epics](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133881) also updated.
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `notifications_todos_buttons`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 When this feature flag is enabled, the notifications and to-do item buttons are moved to the upper right corner of the page.
 
diff --git a/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md b/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
index 281babc1527..8a431e2af16 100644
--- a/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
+++ b/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
@@ -67,7 +67,7 @@ author can either retry any failed jobs, or push new commits to fix the failure:
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10874) in GitLab 16.5 [with two flags](../../../administration/feature_flags.md) named `merge_when_checks_pass` and `additional_merge_when_checks_ready`. Disabled by default.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/412995) in GitLab 16.9.
@@ -76,7 +76,7 @@ FLAG:
 On self-managed GitLab, by default this feature is not available. To enable the feature,
 an administrator can [enable the feature flags](../../../administration/feature_flags.md)
 named `merge_when_checks_pass` and `additional_merge_when_checks_ready`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 In GitLab 16.9 and later, **Merge when checks pass** adds more checks to the auto-merge
 process. When set to auto-merge, all of these checks must pass for a merge request to merge:
diff --git a/doc/user/project/pages/index.md b/doc/user/project/pages/index.md
index eefca8b0003..c33baedf18f 100644
--- a/doc/user/project/pages/index.md
+++ b/doc/user/project/pages/index.md
@@ -171,7 +171,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available,
 an administrator can [enable the feature flag](../../../administration/feature_flags.md) named
-`pages_multiple_versions_setting`. On GitLab.com, this feature is not available. This feature is not ready for production use.
+`pages_multiple_versions_setting`. On GitLab.com and GitLab Dedicated, this feature is not available. This feature is not ready for production use.
 
 Use the [`pages.path_prefix`](../../../ci/yaml/index.md#pagespagespath_prefix) CI/CD option to configure a prefix for the GitLab Pages URL. A prefix allows you
 to differentiate between multiple GitLab Pages deployments.
diff --git a/doc/user/project/pages/redirects.md b/doc/user/project/pages/redirects.md
index 08ff2695a6f..e727993b4ca 100644
--- a/doc/user/project/pages/redirects.md
+++ b/doc/user/project/pages/redirects.md
@@ -131,7 +131,7 @@ rewrite the URL.
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can [enable the feature flag](../../../administration/pages/index.md#use-environment-variables) named `FF_ENABLE_DOMAIN_REDIRECT`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 To create a domain-level redirect, add a domain-level path (beginning with `http://`
 or `https://`) to either:
diff --git a/doc/user/project/protected_branches.md b/doc/user/project/protected_branches.md
index 6f01a152b5d..08461d2a2ab 100644
--- a/doc/user/project/protected_branches.md
+++ b/doc/user/project/protected_branches.md
@@ -124,7 +124,7 @@ The protected branch displays in the list of protected branches.
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/106532) in GitLab 15.9 [with a flag](../../administration/feature_flags.md) named `group_protected_branches`. Disabled by default.
 
@@ -132,7 +132,7 @@ FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can
 [enable the feature flag](../../administration/feature_flags.md)
-named `group_protected_branches`. On GitLab.com, this feature is not available.
+named `group_protected_branches`. On GitLab.com and GitLab Dedicated, this feature is not available.
 
 Group owners can create protected branches for a group. These settings are inherited
 by all projects in the group and can't be overridden by project settings. If a
diff --git a/doc/user/project/remote_development/connect_machine.md b/doc/user/project/remote_development/connect_machine.md
index eadb11305e0..6c3736597a4 100644
--- a/doc/user/project/remote_development/connect_machine.md
+++ b/doc/user/project/remote_development/connect_machine.md
@@ -8,14 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/95169) in GitLab 15.4 [with a flag](../../../administration/feature_flags.md) named `vscode_web_ide`. Disabled by default.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/371084) in GitLab 15.7.
 > - [Enabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/115741) in GitLab 15.11.
 
 FLAG:
-On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available. The feature is not ready for production use.
+On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available. The feature is not ready for production use.
 
 This tutorial shows you how to:
 
diff --git a/doc/user/project/remote_development/index.md b/doc/user/project/remote_development/index.md
index e991d1b7b37..6bbf6457abe 100644
--- a/doc/user/project/remote_development/index.md
+++ b/doc/user/project/remote_development/index.md
@@ -8,14 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/95169) in GitLab 15.4 [with a flag](../../../administration/feature_flags.md) named `vscode_web_ide`. Disabled by default.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/371084) in GitLab 15.7.
 > - [Enabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/115741) in GitLab 15.11.
 
 FLAG:
-On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available. The feature is not ready for production use.
+On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available. The feature is not ready for production use.
 
 You can use remote development to write and compile code hosted on GitLab.
 With remote development, you can:
diff --git a/doc/user/project/repository/branches/index.md b/doc/user/project/repository/branches/index.md
index 86b8aba4ad6..cc15a798fcd 100644
--- a/doc/user/project/repository/branches/index.md
+++ b/doc/user/project/repository/branches/index.md
@@ -141,7 +141,7 @@ On this page, you can:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../feature_flags.md) named `branch_rules`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Branches in your repository can be [protected](../../protected_branches.md) in multiple ways. You can:
 
diff --git a/doc/user/project/service_desk/using_service_desk.md b/doc/user/project/service_desk/using_service_desk.md
index 5ddb914d611..671a96d26d3 100644
--- a/doc/user/project/service_desk/using_service_desk.md
+++ b/doc/user/project/service_desk/using_service_desk.md
@@ -153,7 +153,7 @@ In GitLab 15.9 and earlier, uploads to a comment are sent as links in the email.
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per group,
 an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `convert_to_ticket_quick_action`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Use the quick action `/convert_to_ticket external-issue-author@example.com` to convert any regular issue
 into a Service Desk ticket. This assigns the provided email address as the external author of the ticket
diff --git a/doc/user/project/time_tracking.md b/doc/user/project/time_tracking.md
index 6b91106e12d..67e37b91551 100644
--- a/doc/user/project/time_tracking.md
+++ b/doc/user/project/time_tracking.md
@@ -179,7 +179,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../../administration/feature_flags.md) named `global_time_tracking_report`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 View a report of time spent in issues and merge requests across all of GitLab.
diff --git a/doc/user/project/web_ide/index.md b/doc/user/project/web_ide/index.md
index b089f5892d8..595ff33dab5 100644
--- a/doc/user/project/web_ide/index.md
+++ b/doc/user/project/web_ide/index.md
@@ -8,14 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/95169) in GitLab 15.7 [with a flag](../../../administration/feature_flags.md) named `vscode_web_ide`. Disabled by default.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/371084) in GitLab 15.7.
 > - [Enabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/115741) in GitLab 15.11.
 
 FLAG:
-On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available.
+On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../../../administration/feature_flags.md) named `vscode_web_ide`. On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 The Web IDE is an advanced editor with commit staging.
 You can use the Web IDE to make changes to multiple files directly from the GitLab UI.
diff --git a/doc/user/search/exact_code_search.md b/doc/user/search/exact_code_search.md
index 51832ad6fcc..d2e675bce1e 100644
--- a/doc/user/search/exact_code_search.md
+++ b/doc/user/search/exact_code_search.md
@@ -8,7 +8,7 @@ info: "To determine the technical writer assigned to the Stage/Group associated
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 **Status:** Beta
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/105049) in GitLab 15.9 [with flags](../../administration/feature_flags.md) named `index_code_with_zoekt` and `search_code_with_zoekt`. Disabled by default.
@@ -16,7 +16,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available.
 To make it available, an administrator can [enable the feature flags](../../administration/feature_flags.md) named `index_code_with_zoekt` and `search_code_with_zoekt`.
-On GitLab.com, this feature is available. The feature is not ready for production use.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available. The feature is not ready for production use.
 
 WARNING:
 This feature is in [Beta](../../policy/experiment-beta-support.md#beta) and subject to change without notice.
@@ -42,7 +42,7 @@ searches.
 FLAG:
 On self-managed GitLab, by default this feature is available.
 To hide the feature, an administrator can [disable the feature flag](../../administration/feature_flags.md) named `zoekt_search_api`.
-On GitLab.com, this feature is not available. The feature is not ready for production use.
+On GitLab.com and GitLab Dedicated, this feature is not available. The feature is not ready for production use.
 
 By default, the Zoekt search API is disabled on GitLab.com to avoid breaking changes.
 
diff --git a/doc/user/tasks.md b/doc/user/tasks.md
index e738042512d..e15f8b30a8a 100644
--- a/doc/user/tasks.md
+++ b/doc/user/tasks.md
@@ -8,7 +8,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/334812) in GitLab 14.5 [with a flag](../administration/feature_flags.md) named `work_items`. Disabled by default.
 > - [Creating, editing, and deleting tasks](https://gitlab.com/groups/gitlab-org/-/epics/7169) introduced in GitLab 15.0.
@@ -23,7 +23,7 @@ For the latest updates, check the [Tasks Roadmap](https://gitlab.com/groups/gitl
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature,
 an administrator can [disable the feature flags](../administration/feature_flags.md) named `work_items`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Use tasks to track steps needed for the [issue](project/issues/index.md) to be closed.
 
@@ -324,7 +324,7 @@ To set issue weight of a task:
 
 DETAILS:
 **Tier:** Premium, Ultimate
-**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/367456) in GitLab 15.5 [with a flag](../administration/feature_flags.md) named `work_items_mvc_2`. Disabled by default.
 > - [Moved](https://gitlab.com/gitlab-org/gitlab/-/issues/367456) to feature flag named `work_items_mvc` in GitLab 15.7. Disabled by default.
@@ -332,7 +332,7 @@ DETAILS:
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../administration/feature_flags.md) named `work_items_mvc`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 You can add a task to an [iteration](group/iterations/index.md).
 You can see the iteration title and period only when you view a task.
@@ -496,7 +496,7 @@ system note in the task's comments, for example:
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `work_items_beta`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 You can prevent public comments in a task.
@@ -521,7 +521,7 @@ If a task is closed with a locked discussion, then you cannot reopen it until th
 
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available, an administrator can [enable the feature flag](../administration/feature_flags.md) named `work_items_mvc_2`.
-On GitLab.com, this feature is not available.
+On GitLab.com and GitLab Dedicated, this feature is not available.
 This feature is not ready for production use.
 
 When enabled, tasks use a two-column layout, similar to issues.
@@ -538,7 +538,7 @@ or assignees, on the right.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can [disable the feature flag](../administration/feature_flags.md) named `linked_work_items`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 
 Linked items are a bi-directional relationship and appear in a block below
 the emoji reactions section. You can link an objective, key result, or a task in the same project with each other.
diff --git a/doc/user/todos.md b/doc/user/todos.md
index aea2cd850c4..f8001fbd8c2 100644
--- a/doc/user/todos.md
+++ b/doc/user/todos.md
@@ -68,7 +68,7 @@ To-do items aren't affected by [GitLab notification email settings](profile/noti
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
-**Offering:** Self-managed, GitLab Dedicated
+**Offering:** GitLab.com, Self-managed
 
 <!-- When the feature flag is removed, integrate this topic into the one above. -->
 
@@ -79,7 +79,7 @@ DETAILS:
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per user,
 an administrator can [enable the feature flag](../administration/feature_flags.md) named `multiple_todos`.
-On GitLab.com, this feature is available.
+On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
 The feature is not ready for production use.
 
 When you enable this feature:
diff --git a/lib/api/groups.rb b/lib/api/groups.rb
index 347094e1046..268cf02c0b5 100644
--- a/lib/api/groups.rb
+++ b/lib/api/groups.rb
@@ -305,7 +305,7 @@ module API
       end
       delete ":id", feature_category: :groups_and_projects, urgency: :low do
         group = find_group!(params[:id])
-        authorize! :admin_group, group
+        authorize! :remove_group, group
         check_subscription! group
 
         delete_group(group)
diff --git a/lib/api/import_github.rb b/lib/api/import_github.rb
index 95b830e182c..b589e9064d9 100644
--- a/lib/api/import_github.rb
+++ b/lib/api/import_github.rb
@@ -36,9 +36,8 @@ module API
     end
     post 'import/github' do
       result = Import::GithubService.new(client, current_user, params).execute(access_params, provider)
-
       if result[:status] == :success
-        present ProjectSerializer.new.represent(result[:project])
+        present ProjectSerializer.new.represent(result[:project], { serializer: :import, warning: result[:warning] })
       else
         status result[:http_status]
         { errors: result[:message] }
diff --git a/lib/gitlab/github_import.rb b/lib/gitlab/github_import.rb
index 31fe2461e86..c63487fa2a1 100644
--- a/lib/gitlab/github_import.rb
+++ b/lib/gitlab/github_import.rb
@@ -2,6 +2,10 @@
 
 module Gitlab
   module GithubImport
+    def self.fine_grained_token?(token)
+      token&.start_with?('github_pat')
+    end
+
     def self.refmap
       [:heads, :tags, '+refs/pull/*/head:refs/merge-requests/*/head']
     end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e52740cf390..078987ad94c 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1029,6 +1029,9 @@ msgstr ""
 msgid "%{policy_link} (notifying after %{elapsed_time} minutes unless %{status})"
 msgstr ""
 
+msgid "%{projectLength} %{projects}:"
+msgstr ""
+
 msgid "%{project_name}"
 msgstr ""
 
@@ -14485,6 +14488,9 @@ msgstr ""
 msgid "Could not upload your designs as one or more files uploaded are not supported."
 msgstr ""
 
+msgid "Couldn't add issue due to an internal error."
+msgstr ""
+
 msgid "Couldn't assign policy to project or group"
 msgstr ""
 
@@ -22775,15 +22781,15 @@ msgstr ""
 msgid "Gitea import"
 msgstr ""
 
+msgid "GithubImporter|%{code_start}read:org%{code_end} (optional): Used to import collaborators from GitHub repositories."
+msgstr ""
+
 msgid "GithubImporter|%{code_start}repo%{code_end}: Used to display a list of your public and private repositories that are available to connect to."
 msgstr ""
 
 msgid "GithubImporter|%{code_start}repo%{code_end}: Used to display a list of your public and private repositories that are available to import from."
 msgstr ""
 
-msgid "GithubImporter|%{code_start}repo.org%{code_end} (optional): Used to import collaborators from GitHub repositories."
-msgstr ""
-
 msgid "GithubImporter|%{noteable_type} comment %{note_id}"
 msgstr ""
 
@@ -22865,6 +22871,9 @@ msgstr ""
 msgid "GithubImport|Create and provide your GitHub %{link_start}personal access token%{link_end}. You must select the following scopes:"
 msgstr ""
 
+msgid "GithubImport|Fine-grained personal access tokens are not officially supported. It is recommended to use a classic token instead."
+msgstr ""
+
 msgid "GithubImport|Import failed due to a GitHub error: %{original} (HTTP %{code})"
 msgstr ""
 
@@ -22883,6 +22892,15 @@ msgstr ""
 msgid "GithubImport|You are not allowed to import projects in this namespace."
 msgstr ""
 
+msgid "GithubImport|Your GitHub access token does not have the correct scope to import collaborators. Please use a token with the '%{scope}' scope."
+msgstr ""
+
+msgid "GithubImport|Your GitHub access token does not have the correct scope to import. Please use a token with the '%{repo}' scope, and with the '%{read_org}' scope if importing collaborators."
+msgstr ""
+
+msgid "GithubImport|Your GitHub access token does not have the correct scope to import. Please use a token with the '%{scope}' scope."
+msgstr ""
+
 msgid "GithubIntegration|Create a %{token_link_start}personal access token%{token_link_end} with %{status_html} access granted and paste it here."
 msgstr ""
 
@@ -23365,6 +23383,9 @@ msgstr ""
 msgid "GoogleArtifactRegistry|Configure in settings"
 msgstr ""
 
+msgid "GoogleArtifactRegistry|Copy digest"
+msgstr ""
+
 msgid "GoogleArtifactRegistry|Copy image URI"
 msgstr ""
 
@@ -23395,7 +23416,7 @@ msgstr ""
 msgid "GoogleArtifactRegistry|Open in Google Cloud"
 msgstr ""
 
-msgid "GoogleArtifactRegistry|Project"
+msgid "GoogleArtifactRegistry|Project ID"
 msgstr ""
 
 msgid "GoogleArtifactRegistry|Project ID: %{projectId}"
@@ -25709,6 +25730,9 @@ msgstr ""
 msgid "ImportProjects|Update of imported projects with realtime changes failed"
 msgstr ""
 
+msgid "ImportProjects|Your fine-grained personal access token may not support collaborator import. Please use a classic token with %{codeStart}read:org%{codeEnd} scope to import collaborators. See the %{linkStart}documentation%{linkEnd} for further details."
+msgstr ""
+
 msgid "Imported requirements"
 msgstr ""
 
@@ -42635,6 +42659,9 @@ msgstr ""
 msgid "Runners|An upgrade is recommended for this runner"
 msgstr ""
 
+msgid "Runners|Apply the Terraform script"
+msgstr ""
+
 msgid "Runners|Arch/Platform"
 msgstr ""
 
@@ -43196,6 +43223,9 @@ msgstr ""
 msgid "Runners|Runs untagged jobs"
 msgstr ""
 
+msgid "Runners|Save the Terraform script to a file"
+msgstr ""
+
 msgid "Runners|Search description..."
 msgstr ""
 
@@ -44707,6 +44737,11 @@ msgstr ""
 msgid "SecurityOrchestration|%{licenses} and %{lastLicense}"
 msgstr ""
 
+msgid "SecurityOrchestration|%{projects} which has compliance framework:"
+msgid_plural "SecurityOrchestration|%{projects} which have compliance framework:"
+msgstr[0] ""
+msgstr[1] ""
+
 msgid "SecurityOrchestration|%{scanners}"
 msgstr ""
 
@@ -45207,9 +45242,6 @@ msgstr ""
 msgid "SecurityOrchestration|This %{namespaceType} is not linked to a security policy project"
 msgstr ""
 
-msgid "SecurityOrchestration|This applies to %{projects} associated with following compliance frameworks:"
-msgstr ""
-
 msgid "SecurityOrchestration|This applies to following compliance frameworks:"
 msgstr ""
 
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index 1bf9c8b4809..745335fdab6 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -224,8 +224,9 @@ GEM
     parallel (1.24.0)
     parallel_tests (4.4.0)
       parallel
-    parser (3.2.2.1)
+    parser (3.3.0.5)
       ast (~> 2.4.1)
+      racc
     proc_to_ast (0.1.0)
       coderay
       parser
diff --git a/qa/qa/tools/long_running_spec_reporter.rb b/qa/qa/tools/long_running_spec_reporter.rb
index 82015d024fb..9e8af51bb46 100644
--- a/qa/qa/tools/long_running_spec_reporter.rb
+++ b/qa/qa/tools/long_running_spec_reporter.rb
@@ -9,7 +9,6 @@ module QA
       SLACK_CHANNEL = "#quality-reports"
       PROJECT = "gitlab-qa-resources"
       BUCKET = "knapsack-reports"
-      REPORT_NAME = "ee-instance-parallel.json"
       RUNTIME_THRESHOLD = 300
 
       class << self
@@ -48,14 +47,23 @@ module QA
       #
       # @return [Hash]
       def long_running_specs
-        @long_running_specs ||= latest_report.select { |k, v| v > RUNTIME_THRESHOLD }
+        @long_running_specs ||= latest_report.select { |_k, v| v > RUNTIME_THRESHOLD }
       end
 
       # Latest knapsack report
       #
       # @return [Hash]
       def latest_report
-        @latest_report ||= JSON.parse(client.get_object(BUCKET, REPORT_NAME)[:body])
+        @latest_report ||= reports.each_with_object({}) do |report, hash|
+          hash.merge!(JSON.parse(client.get_object(BUCKET, report)[:body]))
+        end
+      end
+
+      # All knapsack reports in a bucket
+      #
+      # @return [Array<String>]
+      def reports
+        @reports ||= client.list_objects(BUCKET).items.map(&:name)
       end
 
       # Slack notifier
diff --git a/qa/spec/tools/long_running_spec_reporter_spec.rb b/qa/spec/tools/long_running_spec_reporter_spec.rb
index 1bf520c53af..42e22aa5143 100644
--- a/qa/spec/tools/long_running_spec_reporter_spec.rb
+++ b/qa/spec/tools/long_running_spec_reporter_spec.rb
@@ -5,8 +5,14 @@ RSpec.describe QA::Tools::LongRunningSpecReporter do
 
   subject(:reporter) { described_class.execute }
 
-  let(:gcs_client) { double("Fog::Storage::GoogleJSON", get_object: report) }
+  let(:gcs_client) { double("Fog::Storage::GoogleJSON", list_objects: reports, get_object: report) }
   let(:slack_notifier) { double("Slack::Notifier", post: nil) }
+  let(:reports) do
+    double("Google::Apis::StorageV1::Objects", items: [
+      double("Google::Apis::StorageV1::Object", name: "test"),
+      double("Google::Apis::StorageV1::Object", name: "test_2")
+    ])
+  end
 
   before do
     stub_env("SLACK_WEBHOOK", "slack_url")
diff --git a/spec/controllers/import/github_controller_spec.rb b/spec/controllers/import/github_controller_spec.rb
index 3d6b35a5c26..5cc2595684b 100644
--- a/spec/controllers/import/github_controller_spec.rb
+++ b/spec/controllers/import/github_controller_spec.rb
@@ -125,8 +125,10 @@ RSpec.describe Import::GithubController, feature_category: :importers do
         end
 
         get :status, params: params, format: :json
+        fine_grained = assigns(:fine_grained)
 
         expect(response).to have_gitlab_http_status(:ok)
+        expect(fine_grained).to be false
         expect(json_response['imported_projects'].size).to eq 0
         expect(json_response['provider_repos'].size).to eq 0
         expect(json_response['incompatible_repos'].size).to eq 0
@@ -151,6 +153,8 @@ RSpec.describe Import::GithubController, feature_category: :importers do
           allow_next_instance_of(Gitlab::GithubImport::ProjectRelationType) do |instance|
             allow(instance).to receive(:for).with('example/repo').and_return('owned')
           end
+        elsif client_scope_error
+          allow(proxy).to receive(:repos).and_raise(Octokit::Forbidden)
         else
           allow(proxy).to receive(:repos).and_raise(Octokit::Unauthorized)
         end
@@ -184,6 +188,7 @@ RSpec.describe Import::GithubController, feature_category: :importers do
 
     context 'with invalid access token' do
       let(:client_auth_success) { false }
+      let(:client_scope_error) { false }
 
       it "handles an invalid token" do
         get :status, format: :json
@@ -194,6 +199,46 @@ RSpec.describe Import::GithubController, feature_category: :importers do
       end
     end
 
+    context 'with invalid access token scope' do
+      let(:client_auth_success) { false }
+      let(:client_scope_error) { true }
+
+      it "handles the invalid scopes" do
+        get :status, format: :json
+
+        expect(session[:"#{provider}_access_token"]).to be_nil
+        expect(controller).to redirect_to(new_import_url)
+        expect(flash[:alert]).to eq("Your GitHub access token does not have the correct scope to import. " \
+                                    "Please use a token with the 'repo' scope, and with the 'read:org' " \
+                                    "scope if importing collaborators.")
+      end
+    end
+
+    context 'with fine_grained access token' do
+      let(:client_auth_success) { true }
+      let(:provider_token) { 'github_pat_23542334' }
+
+      it "detects the fine grained token" do
+        get :status, format: :json
+
+        expect(session[:"#{provider}_access_token"]).to be(provider_token)
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(assigns(:fine_grained)).to be true
+      end
+    end
+
+    context 'when a gitea import' do
+      let(:provider) { :gitea }
+      let(:provider_token) { 'github_pat_23542334' }
+
+      it 'skips fine_grained check' do
+        get :status, format: :json
+
+        expect(assigns(:fine_grained)).to be nil
+        expect(controller).not_to receive(:fine_grained?)
+      end
+    end
+
     context 'when user has few different repos' do
       let(:repo_struct) { Struct.new(:id, :login, :full_name, :name, :owner, keyword_init: true) }
       let(:provider_repos) do
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 1353142ac5f..53e24962ed7 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -130,6 +130,7 @@ RSpec.describe 'Database schema', feature_category: :database do
     users_star_projects: %w[user_id],
     vulnerability_identifiers: %w[external_id],
     vulnerability_scanners: %w[external_id],
+    vulnerability_occurrences: %w[initial_pipeline_id latest_pipeline_id], # loose FK will be added in https://gitlab.com/gitlab-org/gitlab/-/work_items/44328f4
     security_scans: %w[pipeline_id], # foreign key is not added as ci_pipeline table will be moved into different db soon
     dependency_list_exports: %w[pipeline_id], # foreign key is not added as ci_pipeline table is in different db
     vulnerability_reads: %w[cluster_agent_id],
diff --git a/spec/frontend/import_entities/import_projects/components/advanced_settings_spec.js b/spec/frontend/import_entities/import_projects/components/advanced_settings_spec.js
index 29af6dc946f..252f15af4a7 100644
--- a/spec/frontend/import_entities/import_projects/components/advanced_settings_spec.js
+++ b/spec/frontend/import_entities/import_projects/components/advanced_settings_spec.js
@@ -1,16 +1,17 @@
 import { mount } from '@vue/test-utils';
-import { GlFormCheckbox } from '@gitlab/ui';
-import AdvancedSettingsPanel from '~/import_entities/import_projects/components/advanced_settings.vue';
+import { GlAlert, GlFormCheckbox } from '@gitlab/ui';
+import AdvancedSettings from '~/import_entities/import_projects/components/advanced_settings.vue';
 
 describe('Import Advanced Settings', () => {
   let wrapper;
+
   const OPTIONAL_STAGES = [
     { name: 'stage1', label: 'Stage 1', selected: false },
     { name: 'stage2', label: 'Stage 2', details: 'Extra details', selected: false },
   ];
 
-  const createComponent = () => {
-    wrapper = mount(AdvancedSettingsPanel, {
+  const createComponent = ({ provide } = {}) => {
+    wrapper = mount(AdvancedSettings, {
       propsData: {
         stages: OPTIONAL_STAGES,
         value: {
@@ -18,31 +19,54 @@ describe('Import Advanced Settings', () => {
           stage2: false,
         },
       },
+      provide: {
+        isFineGrainedToken: false,
+        ...provide,
+      },
     });
   };
 
+  const findAlert = () => wrapper.findComponent(GlAlert);
+  const findAllCheckboxes = () => wrapper.findAllComponents(GlFormCheckbox);
+
   beforeEach(() => {
     createComponent();
   });
 
+  it('renders fine grained token message', () => {
+    createComponent({
+      provide: {
+        isFineGrainedToken: true,
+      },
+    });
+
+    expect(findAlert().text()).toMatchInterpolatedText(
+      'The more information you select, the longer it will take to import Your fine-grained personal access token may not support collaborator import. Please use a classic token with read:org scope to import collaborators. See the documentation for further details.',
+    );
+  });
+
+  it('does not render fine grained token message', () => {
+    expect(findAlert().text()).toMatchInterpolatedText(
+      'The more information you select, the longer it will take to import',
+    );
+  });
+
   it('renders GLFormCheckbox for each optional stage', () => {
-    expect(wrapper.findAllComponents(GlFormCheckbox)).toHaveLength(OPTIONAL_STAGES.length);
+    expect(findAllCheckboxes()).toHaveLength(OPTIONAL_STAGES.length);
   });
 
   it('renders label for each optional stage', () => {
-    wrapper.findAllComponents(GlFormCheckbox).wrappers.forEach((w, idx) => {
+    findAllCheckboxes().wrappers.forEach((w, idx) => {
       expect(w.text()).toContain(OPTIONAL_STAGES[idx].label);
     });
   });
 
   it('renders details for stage with details', () => {
-    expect(wrapper.findAllComponents(GlFormCheckbox).at(1).text()).toContain(
-      OPTIONAL_STAGES[1].details,
-    );
+    expect(findAllCheckboxes().at(1).text()).toContain(OPTIONAL_STAGES[1].details);
   });
 
   it('emits new stages selection state when checkbox is changed', () => {
-    const firstCheckbox = wrapper.findComponent(GlFormCheckbox);
+    const firstCheckbox = findAllCheckboxes().at(0);
 
     firstCheckbox.vm.$emit('change', true);
 
diff --git a/spec/graphql/types/ci/catalog/resource_type_spec.rb b/spec/graphql/types/ci/catalog/resource_type_spec.rb
index ae1aba65c12..26aa3a04f3a 100644
--- a/spec/graphql/types/ci/catalog/resource_type_spec.rb
+++ b/spec/graphql/types/ci/catalog/resource_type_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe Types::Ci::Catalog::ResourceType, feature_category: :pipeline_com
       latest_released_at
       verification_level
       star_count
+      starrers_path
       open_issues_count
       open_merge_requests_count
     ]
diff --git a/spec/lib/gitlab/github_import_spec.rb b/spec/lib/gitlab/github_import_spec.rb
index 1721f470b33..982fbc3071b 100644
--- a/spec/lib/gitlab/github_import_spec.rb
+++ b/spec/lib/gitlab/github_import_spec.rb
@@ -125,4 +125,11 @@ RSpec.describe Gitlab::GithubImport, feature_category: :importers do
       end
     end
   end
+
+  describe '.fine_grained_token?' do
+    it 'detects a fine-grained token' do
+      expect(described_class.fine_grained_token?('github_pat_235234')).to eq(true)
+      expect(described_class.fine_grained_token?('gh_235234ab234234')).to eq(false)
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/ci/catalog/resources_spec.rb b/spec/requests/api/graphql/ci/catalog/resources_spec.rb
index 82c680ae68c..d6fb481eef5 100644
--- a/spec/requests/api/graphql/ci/catalog/resources_spec.rb
+++ b/spec/requests/api/graphql/ci/catalog/resources_spec.rb
@@ -48,6 +48,7 @@ RSpec.describe 'Query.ciCatalogResources', feature_category: :pipeline_compositi
             verificationLevel
             latestReleasedAt
             starCount
+            starrersPath
           }
         }
       }
@@ -83,10 +84,11 @@ RSpec.describe 'Query.ciCatalogResources', feature_category: :pipeline_compositi
       a_graphql_entity_for(
         resource1, :name, :description,
         icon: project1.avatar_path,
-        webPath: "/#{project1.full_path}",
-        verificationLevel: "UNVERIFIED",
+        latestReleasedAt: resource1.latest_released_at,
         starCount: project1.star_count,
-        latestReleasedAt: resource1.latest_released_at
+        starrersPath: Gitlab::Routing.url_helpers.project_starrers_path(project1),
+        verificationLevel: 'UNVERIFIED',
+        webPath: "/#{project1.full_path}"
       ),
       a_graphql_entity_for(public_resource)
     )
diff --git a/spec/requests/api/import_github_spec.rb b/spec/requests/api/import_github_spec.rb
index f555f39ff74..eba728b82c0 100644
--- a/spec/requests/api/import_github_spec.rb
+++ b/spec/requests/api/import_github_spec.rb
@@ -35,6 +35,12 @@ RSpec.describe API::ImportGithub, feature_category: :importers do
   describe "POST /import/github" do
     let_it_be(:user) { create(:user) }
     let_it_be(:project) { create(:project) }
+    let(:scopes) { ["repo", "read:org"] }
+
+    before do
+      allow(client).to receive_message_chain(:octokit, :rate_limit)
+      allow(client).to receive_message_chain(:octokit, :scopes).and_return(scopes)
+    end
 
     it 'rejects requests when Github Importer is disabled' do
       stub_application_setting(import_sources: nil)
@@ -78,6 +84,7 @@ RSpec.describe API::ImportGithub, feature_category: :importers do
       expect(response).to have_gitlab_http_status(:created)
       expect(json_response).to be_a Hash
       expect(json_response['name']).to eq(project.name)
+      expect(json_response).not_to have_key('warning')
     end
 
     it 'returns 422 response when user can not create projects in the chosen namespace' do
@@ -133,6 +140,69 @@ RSpec.describe API::ImportGithub, feature_category: :importers do
         expect(response).to have_gitlab_http_status(:bad_request)
       end
     end
+
+    context 'with a fine-grained token' do
+      let(:token) { 'github_pat_asdasd12345' }
+
+      it 'proceeds with the import but returns a PAT warning' do
+        allow(Gitlab::LegacyGithubImport::ProjectCreator)
+          .to receive(:new).with(provider_repo, provider_repo[:name], user.namespace, user, type: provider, **access_params)
+          .and_return(double(execute: project))
+
+        post api("/import/github", user), params: {
+          target_namespace: user.namespace_path,
+          personal_access_token: token,
+          repo_id: non_existing_record_id,
+          optional_stages: { collaborators_import: true }
+        }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response).to be_a Hash
+        expect(json_response['name']).to eq(project.name)
+        expect(json_response['import_warning']).to eq("Fine-grained personal access tokens are not officially supported. It is recommended to use a classic token instead.")
+      end
+    end
+
+    context 'when collaborators_import option is not in params' do
+      context 'with minimum scope token' do
+        let(:scopes) { ['repo'] }
+
+        it 'proceeds with the import' do
+          allow(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, provider_repo[:name], user.namespace, user, type: provider, **access_params)
+            .and_return(double(execute: project))
+
+          post api("/import/github", user), params: {
+            target_namespace: user.namespace_path,
+            personal_access_token: token,
+            repo_id: non_existing_record_id
+          }
+
+          expect(response).to have_gitlab_http_status(:created)
+          expect(json_response).to be_a Hash
+          expect(json_response['name']).to eq(project.name)
+        end
+      end
+
+      context 'without minimum scope token' do
+        let(:scopes) { ['write:packages'] }
+
+        it 'raises an error' do
+          allow(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, provider_repo[:name], user.namespace, user, type: provider, **access_params)
+            .and_return(double(execute: project))
+
+          post api("/import/github", user), params: {
+            target_namespace: user.namespace_path,
+            personal_access_token: token,
+            repo_id: non_existing_record_id
+          }
+
+          expect(response).to have_gitlab_http_status(:unprocessable_entity)
+          expect(json_response['errors']).to eq("Your GitHub access token does not have the correct scope to import. Please use a token with the 'repo' scope.")
+        end
+      end
+    end
   end
 
   describe "POST /import/github/cancel" do
diff --git a/spec/services/import/github_service_spec.rb b/spec/services/import/github_service_spec.rb
index 9d59bb9f249..463af26800d 100644
--- a/spec/services/import/github_service_spec.rb
+++ b/spec/services/import/github_service_spec.rb
@@ -21,12 +21,16 @@ RSpec.describe Import::GithubService, feature_category: :importers do
     }
   end
 
+  let(:scopes) { ['repo', 'read:org'] }
   let(:client) { Gitlab::GithubImport::Client.new(token) }
   let(:project_double) { instance_double(Project, persisted?: true) }
 
   subject(:github_importer) { described_class.new(client, user, params) }
 
   before do
+    allow(client).to receive_message_chain(:octokit, :rate_limit, :limit)
+    allow(client).to receive_message_chain(:octokit, :rate_limit, :remaining).and_return(100)
+    allow(client).to receive_message_chain(:octokit, :scopes).and_return(scopes)
     allow(Gitlab::GithubImport::Settings).to receive(:new).with(project_double).and_return(settings)
     allow(settings)
       .to receive(:write)
@@ -38,7 +42,7 @@ RSpec.describe Import::GithubService, feature_category: :importers do
       )
   end
 
-  context 'do not raise an exception on input error' do
+  context 'with an input error' do
     let(:exception) { Octokit::ClientError.new(status: 404, body: 'Not Found') }
 
     before do
@@ -76,11 +80,12 @@ RSpec.describe Import::GithubService, feature_category: :importers do
     expect { subject.execute(access_params, :github) }.to raise_error(exception)
   end
 
-  context 'repository size validation' do
+  context 'when validating repository size' do
     let(:repository_double) { { name: 'repository', size: 99 } }
 
     before do
       allow(subject).to receive(:authorized?).and_return(true)
+      allow(subject).to receive(:validate_scopes).and_return(nil)
       expect(client).to receive(:repository).and_return(repository_double)
 
       allow_next_instance_of(Gitlab::LegacyGithubImport::ProjectCreator) do |creator|
@@ -115,7 +120,7 @@ RSpec.describe Import::GithubService, feature_category: :importers do
         params[:target_namespace] = group.full_path
       end
 
-      it 'succeeds when the repository is smaller than the limit' do
+      it 'succeeds if the repository is smaller than the limit' do
         expect(subject.execute(access_params, :github)).to include(status: :success)
         expect(settings)
           .to have_received(:write)
@@ -134,7 +139,7 @@ RSpec.describe Import::GithubService, feature_category: :importers do
         )
       end
 
-      it 'returns error when the repository is larger than the limit' do
+      it 'returns error if the repository is larger than the limit' do
         repository_double[:size] = 101
 
         expect(subject.execute(access_params, :github)).to include(
@@ -152,7 +157,7 @@ RSpec.describe Import::GithubService, feature_category: :importers do
       end
 
       context 'when application size limit is defined' do
-        it 'succeeds when the repository is smaller than the limit' do
+        it 'succeeds if the repository is smaller than the limit' do
           expect(subject.execute(access_params, :github)).to include(status: :success)
           expect(settings)
             .to have_received(:write)
@@ -171,7 +176,7 @@ RSpec.describe Import::GithubService, feature_category: :importers do
           )
         end
 
-        it 'returns error when the repository is larger than the limit' do
+        it 'returns error if the repository is larger than the limit' do
           repository_double[:size] = 101
 
           expect(subject.execute(access_params, :github)).to include(
@@ -266,6 +271,113 @@ RSpec.describe Import::GithubService, feature_category: :importers do
     end
   end
 
+  context 'when using personal access tokens' do
+    let(:repository_double) { { name: 'repository', size: 99 } }
+
+    before do
+      allow(subject).to receive(:authorized?).and_return(true)
+
+      allow_next_instance_of(Gitlab::LegacyGithubImport::ProjectCreator) do |creator|
+        allow(creator).to receive(:execute).and_return(project_double)
+      end
+    end
+
+    context 'when the caller is not a github import' do
+      let(:repository_double) do
+        {
+          name: 'vim',
+          description: 'test',
+          full_name: 'test/vim',
+          clone_url: 'http://repo.com/repo/repo.git',
+          private: false,
+          has_wiki?: false
+        }
+      end
+
+      before do
+        allow(subject).to receive(:repo).and_return(repository_double)
+      end
+
+      it 'does not validate scopes' do
+        expect(subject).not_to receive(:validate_scopes)
+
+        subject.execute(access_params, :gitea)
+      end
+    end
+
+    context 'when a fine-grained access token is used' do
+      let(:access_params) { { github_access_token: 'github_pat' } }
+
+      before do
+        allow(subject).to receive(:repo).and_return(repository_double)
+      end
+
+      it 'does not validate scopes' do
+        expect(subject).not_to receive(:validate_scopes)
+
+        subject.execute(access_params, :github)
+      end
+
+      it 'logs the event and returns a warning message' do
+        expect(Gitlab::Import::Logger).to receive(:info).with({
+          message: 'Fine grained GitHub personal access token used.'
+        }).and_call_original
+
+        expect(subject.execute(access_params, :github))
+          .to include(fine_grained_access_token_warning)
+      end
+    end
+
+    context 'when the collaborator import option is true' do
+      let(:optional_stages) { { collaborators_import: true } }
+      let(:scopes) { ['repo', 'read:user'] }
+
+      it 'returns an error if the scope is not adequate' do
+        expect(subject.execute(access_params, :github)).to include(collab_import_scope_error)
+      end
+    end
+
+    context 'when the collaborator import option is false' do
+      let(:optional_stages) { { collaborators_import: false } }
+
+      context 'with minimum scope token' do
+        let(:scopes) { ['repo', 'read:user'] }
+
+        it 'does not raise a validation error' do
+          allow(subject).to receive(:repo).and_return(repository_double)
+
+          expect(subject).to receive(:validate_scopes).and_return(nil)
+
+          subject.execute(access_params, :github)
+        end
+      end
+
+      context 'without minimum scope token' do
+        let(:scopes) { ['read:user'] }
+
+        it 'returns a mimimum scope error' do
+          expect(subject.execute(access_params, :github)).to include(minimum_scope_error)
+        end
+      end
+    end
+
+    context 'when validating empty scopes' do
+      let(:scopes) { [] }
+
+      it 'returns a minimum scope error' do
+        expect(subject.execute(access_params, :github)).to include(minimum_scope_error)
+      end
+    end
+
+    context 'when validating minimum scope' do
+      let(:scopes) { ['write:packages'] }
+
+      it 'returns an error if the scope is not adequate' do
+        expect(subject.execute(access_params, :github)).to include(minimum_scope_error)
+      end
+    end
+  end
+
   context 'when import source is disabled' do
     let(:repository_double) do
       {
@@ -308,9 +420,9 @@ RSpec.describe Import::GithubService, feature_category: :importers do
         allow(github_importer).to receive(:url).and_return(url)
 
         expect(Gitlab::Import::Logger).to receive(:error).with({
-                                                                 message: message,
-                                                                 error: error
-                                                               }).and_call_original
+          message: message,
+          error: error
+        }).and_call_original
         expect(github_importer.execute(access_params, :github)).to include(blocked_url_error(url))
       end
     end
@@ -363,6 +475,33 @@ RSpec.describe Import::GithubService, feature_category: :importers do
     }
   end
 
+  def minimum_scope_error
+    {
+      status: :error,
+      http_status: :unprocessable_entity,
+      message: "Your GitHub access token does not have the correct scope to import. " \
+               "Please use a token with the 'repo' scope."
+    }
+  end
+
+  def collab_import_scope_error
+    {
+      status: :error,
+      http_status: :unprocessable_entity,
+      message: "Your GitHub access token does not have the correct scope to import collaborators. " \
+               "Please use a token with the 'read:org' scope."
+    }
+  end
+
+  def fine_grained_access_token_warning
+    {
+      status: :success,
+      project: project_double,
+      warning: "Fine-grained personal access tokens are not officially supported. " \
+               "It is recommended to use a classic token instead."
+    }
+  end
+
   def blocked_url_error(url)
     {
       status: :error,
diff --git a/spec/support/shared_contexts/policies/group_policy_shared_context.rb b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
index 509bc413b8d..565de038f51 100644
--- a/spec/support/shared_contexts/policies/group_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
@@ -80,6 +80,8 @@ RSpec.shared_context 'GroupPolicy context' do
       destroy_issue
       admin_member_access_request
       update_git_access_protocol
+      remove_group
+      view_edit_page
     ]
   end