From 9251853fdd488b5b62a36a80577e6f060a67be04 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 3 Feb 2025 21:09:43 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .gitlab/ci/frontend.gitlab-ci.yml             |   4 +-
 .rubocop_todo/gettext/static_identifier.yml   |   1 -
 .rubocop_todo/gitlab/bounded_contexts.yml     |   3 -
 .rubocop_todo/layout/line_length.yml          |   1 -
 GITLAB_KAS_VERSION                            |   2 +-
 Gemfile                                       |   2 +-
 Gemfile.checksum                              |   4 +-
 Gemfile.lock                                  |   8 +-
 Gemfile.next.checksum                         |   4 +-
 Gemfile.next.lock                             |   8 +-
 .../graphql_shared/possible_types.json        |   4 +-
 .../projects/new_v2/components/app.vue        |  58 +++++--
 .../components/project_destination_select.vue |  15 +-
 .../javascripts/projects/new_v2/index.js      |   8 +-
 .../components/blob_content_viewer.vue        |  11 +-
 .../repository/mixins/highlight_mixin.js      |   1 +
 .../command_palette/constants.js              |   4 +
 .../components/global_search.vue              |  75 ++++++---
 .../todos/components/todo_item.vue            |   2 +-
 .../todos/components/todos_app.vue            |   2 +-
 .../todos/components/todos_pagination.vue     |   4 +-
 .../allowlist_entry.fragment.graphql          |   2 +-
 app/controllers/application_controller.rb     |  21 ---
 .../concerns/sessionless_authentication.rb    |  31 ++--
 app/controllers/graphql_controller.rb         |  34 +---
 .../ci/job_token_accessible_project_type.rb   |  41 +++++
 .../types/ci/job_token_auth_log_type.rb       |   2 +-
 .../types/ci/job_token_scope/target_type.rb   |   4 +-
 app/graphql/types/ci/job_token_scope_type.rb  |   2 +-
 .../concerns/integrations/base/confluence.rb  |  89 ++++++++++
 app/models/integrations/confluence.rb         |  71 +-------
 .../integrations/instance/confluence.rb       |   2 +-
 app/validators/json_schema_validator.rb       |   4 -
 app/views/projects/new.html.haml              |   5 +-
 ...=> ci_merge_request_variables_preload.yml} |  12 +-
 .../ops/graphql_minimal_auth_methods.yml      |   9 -
 config/sidekiq_queues.yml                     |   2 +
 ...t_user_details_bot_namespace_migration.yml |   2 +-
 db/docs/board_assignees.yml                   |   6 +-
 .../requirements_management_test_reports.yml  |  15 +-
 ...194127_add_board_assignees_sharding_key.rb |  10 ++
 ...ot_user_details_bot_namespace_migration.rb |  23 +++
 ...ackfill_sharding_key_on_board_assignees.rb |  33 ++++
 ...00_add_board_assignees_project_id_index.rb |  16 ++
 ...5500_add_board_assignees_group_id_index.rb |  16 ++
 ...ignees_sharding_key_not_null_constraint.rb |  14 ++
 ...3202635_add_board_assignees_group_id_fk.rb |  20 +++
 ...02841_add_board_assignees_project_id_fk.rb |  20 +++
 db/schema_migrations/20250121193138           |   1 +
 db/schema_migrations/20250123194127           |   1 +
 db/schema_migrations/20250123195300           |   1 +
 db/schema_migrations/20250123195400           |   1 +
 db/schema_migrations/20250123195500           |   1 +
 db/schema_migrations/20250123201951           |   1 +
 db/schema_migrations/20250123202635           |   1 +
 db/schema_migrations/20250123202841           |   1 +
 db/structure.sql                              |  15 +-
 doc/.vale/gitlab_base/Substitutions.yml       |   4 +-
 doc/administration/admin_area.md              |   2 +-
 .../supported_llm_serving_platforms.md        |  15 +-
 ...ported_models_and_hardware_requirements.md |  55 ++++++-
 doc/api/alert_management_alerts.md            |   2 +-
 doc/api/dora/metrics.md                       |   2 +-
 doc/api/get_started/get_started_extending.md  |   2 +-
 doc/api/graphql/assign_gitlab_duo_seats.md    |   2 +-
 doc/api/graphql/audit_report.md               |   2 +-
 doc/api/graphql/branch_rules.md               |   2 +-
 doc/api/graphql/custom_emoji.md               |   2 +-
 .../epic_work_items_api_migration_guide.md    |   8 +-
 doc/api/graphql/getting_started.md            |   2 +-
 doc/api/graphql/index.md                      |  11 +-
 .../graphql/reference/{index.md => _index.md} |  47 +++++-
 doc/api/graphql/sample_issue_boards.md        |   2 +-
 doc/api/graphql/users_example.md              |   2 +-
 doc/api/group_import_export.md                |   2 +-
 doc/api/group_service_accounts.md             |   2 +-
 doc/api/groups.md                             |  12 +-
 doc/api/member_roles.md                       |   2 +-
 doc/api/merge_request_approvals.md            |   2 +-
 doc/api/project_vulnerabilities.md            |   2 +-
 doc/api/rest/authentication.md                |   2 +-
 doc/api/rest/index.md                         |   2 +-
 doc/api/runners.md                            |  16 +-
 doc/api/settings.md                           |  36 ++--
 doc/api/vulnerabilities.md                    |  12 +-
 doc/api/vulnerability_findings.md             |   6 +-
 doc/ci/components/index.md                    |   2 +-
 doc/ci/jobs/ci_job_token.md                   |   4 +-
 doc/development/api_graphql_styleguide.md     |   4 +-
 .../documentation/graphql_styleguide.md       |   2 +-
 .../site_architecture/automation.md           |   2 +-
 .../documentation/testing/index.md            |   2 +-
 doc/development/fe_guide/graphql.md           |   2 +-
 doc/development/graphql_guide/monitoring.md   |   2 +-
 doc/development/rake_tasks.md                 |   2 +-
 doc/development/work_items_widgets.md         |   2 +-
 doc/editor_extensions/jetbrains_ide/setup.md  |   2 +-
 doc/editor_extensions/neovim/setup.md         |   2 +-
 doc/integration/arkose.md                     |   2 +-
 doc/integration/clickhouse.md                 |   2 +-
 doc/integration/gitpod.md                     |   4 +-
 doc/integration/jenkins.md                    |   2 +-
 doc/integration/jira/connect-app.md           |   2 +-
 doc/integration/jira/troubleshooting.md       |   2 +-
 doc/integration/saml.md                       |   6 +-
 doc/integration/sourcegraph.md                |   4 +-
 doc/operations/feature_flags.md               |   8 +-
 doc/operations/incident_management/slack.md   |   2 +-
 doc/security/user_file_uploads.md             |   2 +-
 doc/update/versions/gitlab_15_changes.md      |   2 +-
 doc/user/analytics/ai_impact_analytics.md     |   2 +-
 doc/user/analytics/dora_metrics.md            |   2 +-
 doc/user/analytics/value_streams_dashboard.md |   2 +-
 .../configuration/index.md                    |   2 +-
 .../security_dashboard/index.md               |   2 +-
 doc/user/crm/index.md                         |  14 +-
 doc/user/custom_roles.md                      |   8 +-
 doc/user/gitlab_duo/turn_on_off.md            |   2 +-
 doc/user/group/compliance_frameworks.md       |   2 +-
 .../group/contribution_analytics/index.md     |   2 +-
 doc/user/group/epics/epic_work_items.md       |   2 +-
 doc/user/group/moderate_users.md              |   2 +-
 doc/user/group/saml_sso/troubleshooting.md    |   2 +-
 .../infrastructure/iac/terraform_state.md     |   2 +-
 doc/user/markdown.md                          |   2 +-
 .../reduce_dependency_proxy_storage.md        |   2 +-
 doc/user/packages/maven_repository/index.md   |   2 +-
 doc/user/packages/nuget_repository/index.md   |   4 +-
 .../terraform_module_registry/index.md        |   2 +-
 doc/user/profile/achievements.md              |  18 +-
 doc/user/project/quick_actions.md             |   1 +
 doc/user/project/time_tracking.md             |  16 +-
 doc/user/project/use_project_as_go_package.md |   2 +-
 doc/user/workspace/index.md                   |   4 +-
 lefthook.yml                                  |   8 +-
 lib/gitlab/auth/request_authenticator.rb      |   8 +-
 lib/gitlab/ci/variables/builder/pipeline.rb   |   4 +
 .../ci/variables/preloader/merge_request.rb   |  30 ++++
 lib/tasks/gitlab/graphql.rake                 |   2 +-
 locale/gitlab.pot                             |  21 +++
 .../frontend/check_jest_vue3_quarantine.js    |   8 +-
 .../projects/new_v2/components/app_spec.js    |  45 ++++-
 .../components/blob_content_viewer_spec.js    |  47 +++---
 spec/frontend/repository/mock_data.js         |   2 +
 .../components/global_search_spec.js          |  66 ++++++--
 .../job_token_accessible_project_type_spec.rb |  13 ++
 .../types/ci/job_token_auth_log_type_spec.rb  |  22 ++-
 .../ci/job_token_scope/target_type_spec.rb    |   4 +-
 .../types/ci/job_token_scope_type_spec.rb     |  12 +-
 ...ll_sharding_key_on_board_assignees_spec.rb |  52 ++++++
 spec/models/integrations/confluence_spec.rb   |  86 +---------
 .../integrations/instance/confluence_spec.rb  |   7 +
 .../job_token_scope/allowlist_query_spec.rb   |   2 +-
 .../add_group_or_project_spec.rb              |   2 +-
 .../ci/job_token_scope/add_project_spec.rb    |   2 +-
 .../ci/job_token_scope/remove_project_spec.rb |   2 +-
 .../update_job_token_policies_spec.rb         |   2 +-
 spec/requests/api/graphql_spec.rb             | 154 ------------------
 .../base/confluence_shared_examples.rb        |  89 ++++++++++
 spec/tooling/danger/project_helper_spec.rb    |   2 +-
 spec/tooling/graphql/docs/renderer_spec.rb    |  87 ++++++----
 tooling/graphql/docs/helper.rb                |   1 +
 tooling/graphql/docs/renderer.rb              |   2 +-
 .../graphql/docs/templates/default.md.haml    |   2 -
 164 files changed, 1176 insertions(+), 781 deletions(-)
 create mode 100644 app/graphql/types/ci/job_token_accessible_project_type.rb
 create mode 100644 app/models/concerns/integrations/base/confluence.rb
 rename config/feature_flags/gitlab_com_derisk/{fix_graphql_csrf.yml => ci_merge_request_variables_preload.yml} (66%)
 delete mode 100644 config/feature_flags/ops/graphql_minimal_auth_methods.yml
 create mode 100644 db/migrate/20250123194127_add_board_assignees_sharding_key.rb
 create mode 100644 db/post_migrate/20250121193138_finalize_project_bot_user_details_bot_namespace_migration.rb
 create mode 100644 db/post_migrate/20250123195300_backfill_sharding_key_on_board_assignees.rb
 create mode 100644 db/post_migrate/20250123195400_add_board_assignees_project_id_index.rb
 create mode 100644 db/post_migrate/20250123195500_add_board_assignees_group_id_index.rb
 create mode 100644 db/post_migrate/20250123201951_add_board_assignees_sharding_key_not_null_constraint.rb
 create mode 100644 db/post_migrate/20250123202635_add_board_assignees_group_id_fk.rb
 create mode 100644 db/post_migrate/20250123202841_add_board_assignees_project_id_fk.rb
 create mode 100644 db/schema_migrations/20250121193138
 create mode 100644 db/schema_migrations/20250123194127
 create mode 100644 db/schema_migrations/20250123195300
 create mode 100644 db/schema_migrations/20250123195400
 create mode 100644 db/schema_migrations/20250123195500
 create mode 100644 db/schema_migrations/20250123201951
 create mode 100644 db/schema_migrations/20250123202635
 create mode 100644 db/schema_migrations/20250123202841
 rename doc/api/graphql/reference/{index.md => _index.md} (99%)
 create mode 100644 lib/gitlab/ci/variables/preloader/merge_request.rb
 create mode 100644 spec/graphql/types/ci/job_token_accessible_project_type_spec.rb
 create mode 100644 spec/migrations/20250123195300_backfill_sharding_key_on_board_assignees_spec.rb
 create mode 100644 spec/models/integrations/instance/confluence_spec.rb
 create mode 100644 spec/support/shared_examples/models/concerns/integrations/base/confluence_shared_examples.rb

diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index 85085509e46..199808ddf50 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -443,19 +443,19 @@ jest vue3 check quarantined predictive:
     - "detect-tests"
   script:
     - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "./scripts/frontend/check_jest_vue3_quarantine.js"; fi
-  parallel: 1
+  parallel: 4
   artifacts:
     name: quarantined_tests_output
     expire_in: 31d
     when: always
     paths:
-      - tmp/tests/frontend/jest_stdout
       - tmp/tests/frontend/jest_stderr
       - tmp/tests/frontend/jest_results.json
 
 jest-with-fixtures vue3 check quarantined predictive:
   extends:
     - jest vue3 check quarantined predictive
+  parallel: 1
   variables:
     JEST_FIXTURE_JOBS_ONLY: 1
 
diff --git a/.rubocop_todo/gettext/static_identifier.yml b/.rubocop_todo/gettext/static_identifier.yml
index 3a5c43c78df..7ba845d3118 100644
--- a/.rubocop_todo/gettext/static_identifier.yml
+++ b/.rubocop_todo/gettext/static_identifier.yml
@@ -2,7 +2,6 @@
 Gettext/StaticIdentifier:
   Exclude:
     - 'app/graphql/types/project_type.rb'
-    - 'app/models/integrations/confluence.rb'
     - 'app/services/import/fogbugz_service.rb'
     - 'app/services/issues/set_crm_contacts_service.rb'
     - 'app/services/projects/create_from_template_service.rb'
diff --git a/.rubocop_todo/gitlab/bounded_contexts.yml b/.rubocop_todo/gitlab/bounded_contexts.yml
index 9b1f404a785..0e227a6fcbe 100644
--- a/.rubocop_todo/gitlab/bounded_contexts.yml
+++ b/.rubocop_todo/gitlab/bounded_contexts.yml
@@ -3081,9 +3081,6 @@ Gitlab/BoundedContexts:
     - 'ee/app/services/dashboard/projects/create_service.rb'
     - 'ee/app/services/dashboard/projects/list_service.rb'
     - 'ee/app/services/dependencies/create_export_service.rb'
-    - 'ee/app/services/dependencies/export_serializers/group_dependencies_service.rb'
-    - 'ee/app/services/dependencies/export_serializers/organization_dependencies_service.rb'
-    - 'ee/app/services/dependencies/export_serializers/project_dependencies_service.rb'
     - 'ee/app/services/dependencies/export_serializers/sbom/pipeline_service.rb'
     - 'ee/app/services/dependencies/export_service.rb'
     - 'ee/app/services/deployments/approval_service.rb'
diff --git a/.rubocop_todo/layout/line_length.yml b/.rubocop_todo/layout/line_length.yml
index 89323556471..5ca780ab5b3 100644
--- a/.rubocop_todo/layout/line_length.yml
+++ b/.rubocop_todo/layout/line_length.yml
@@ -125,7 +125,6 @@ Layout/LineLength:
     - 'app/models/integrations/chat_message/note_message.rb'
     - 'app/models/integrations/chat_message/pipeline_message.rb'
     - 'app/models/integrations/chat_message/wiki_page_message.rb'
-    - 'app/models/integrations/confluence.rb'
     - 'app/models/integrations/datadog.rb'
     - 'app/models/integrations/discord.rb'
     - 'app/models/integrations/drone_ci.rb'
diff --git a/GITLAB_KAS_VERSION b/GITLAB_KAS_VERSION
index 80c4807200a..1eaec0f2abc 100644
--- a/GITLAB_KAS_VERSION
+++ b/GITLAB_KAS_VERSION
@@ -1 +1 @@
-bb5dd9c7ced8de9cf7f5405a34836e6fb7f8e8a4
+c7429ee9944f2d6eaa868a67209049abe04252e2
diff --git a/Gemfile b/Gemfile
index df18ac259b0..60837bbd2a0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -182,7 +182,7 @@ gem 'gitlab-duo-workflow-service-client', '~> 0.1',
   feature_category: :duo_workflow
 
 # Generate Fake data
-gem 'ffaker', '~> 2.23', feature_category: :shared
+gem 'ffaker', '~> 2.24', feature_category: :shared
 
 gem 'hashie', '~> 5.0.0', feature_category: :shared
 
diff --git a/Gemfile.checksum b/Gemfile.checksum
index c636da278ec..d662efb9638 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -175,7 +175,7 @@
 {"name":"fast_blank","version":"1.0.1","platform":"java","checksum":"90d82106b0e4aa19ac24ba1604c79a0c5a4c471601e800c9b2b072938a6d9a92"},
 {"name":"fast_blank","version":"1.0.1","platform":"ruby","checksum":"269fc30414fed4e6403bc4a49081e1ea539f8b9226e59276ed1efaefabaa17ea"},
 {"name":"fast_gettext","version":"2.3.0","platform":"ruby","checksum":"0253e26423ccab68061c42387827e3b99243a1b15ad614df1c800ba870d64f84"},
-{"name":"ffaker","version":"2.23.0","platform":"ruby","checksum":"9d2dfb5cc284a92c8571bddcbe0c573127a2f3238f4b0aa56e08ccf3e4858498"},
+{"name":"ffaker","version":"2.24.0","platform":"ruby","checksum":"43e3f8c12d602fbc70398be8bd1ac841a031eabdc12af01507e76a8d675a5d52"},
 {"name":"ffi","version":"1.17.1","platform":"aarch64-linux-gnu","checksum":"c5d22cb545a3a691d46060f1343c461d1a8d38c3fd71b96b4cbbe6906bf1fd38"},
 {"name":"ffi","version":"1.17.1","platform":"aarch64-linux-musl","checksum":"88b9d6ae905d21142df27c94bb300042c1aae41b67291885f600eaad16326b1d"},
 {"name":"ffi","version":"1.17.1","platform":"arm-linux-gnu","checksum":"fe14f5ece94082f3b0e651a09008113281f2764e7ea95f522b64e2fe32e11504"},
@@ -536,7 +536,7 @@
 {"name":"pry","version":"0.14.2","platform":"java","checksum":"fd780670977ba04ff7ee32dabd4d02fe4bf02e977afe8809832d5dca1412862e"},
 {"name":"pry","version":"0.14.2","platform":"ruby","checksum":"c4fe54efedaca1d351280b45b8849af363184696fcac1c72e0415f9bdac4334d"},
 {"name":"pry-byebug","version":"3.10.1","platform":"ruby","checksum":"c8f975c32255bfdb29e151f5532130be64ff3d0042dc858d0907e849125581f8"},
-{"name":"pry-rails","version":"0.3.9","platform":"ruby","checksum":"468662575abb6b67f4a9831219f99290d5eae7bf186e64dd810d0a3e4a8cc4b1"},
+{"name":"pry-rails","version":"0.3.11","platform":"ruby","checksum":"a69e28e24a34d75d1f60bcf241192a54253f8f7ef8a62cba1e75750a9653593d"},
 {"name":"pry-shell","version":"0.6.4","platform":"ruby","checksum":"ad024882d29912b071a7de65ebea538b242d2dc1498c60c7c2352ef94769f208"},
 {"name":"public_suffix","version":"6.0.1","platform":"ruby","checksum":"61d44e1cab5cbbbe5b31068481cf16976dd0dc1b6b07bd95617ef8c5e3e00c6f"},
 {"name":"puma","version":"6.5.0","platform":"java","checksum":"a58eea585d291aa33796add9884208bc1591da5d8e61886f8ac74d080b298c40"},
diff --git a/Gemfile.lock b/Gemfile.lock
index 4de7979c451..cea50b86c19 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -628,7 +628,7 @@ GEM
       faraday (>= 2.0, < 3)
     fast_blank (1.0.1)
     fast_gettext (2.3.0)
-    ffaker (2.23.0)
+    ffaker (2.24.0)
     ffi (1.17.1)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
@@ -1469,8 +1469,8 @@ GEM
     pry-byebug (3.10.1)
       byebug (~> 11.0)
       pry (>= 0.13, < 0.15)
-    pry-rails (0.3.9)
-      pry (>= 0.10.4)
+    pry-rails (0.3.11)
+      pry (>= 0.13.0)
     pry-shell (0.6.4)
       pry (>= 0.13.0)
       tty-markdown
@@ -2070,7 +2070,7 @@ DEPENDENCIES
   faraday-typhoeus (~> 1.1)
   faraday_middleware-aws-sigv4 (~> 1.0.1)
   fast_blank (~> 1.0.1)
-  ffaker (~> 2.23)
+  ffaker (~> 2.24)
   ffi (~> 1.17)
   flipper (~> 0.26.2)
   flipper-active_record (~> 0.26.2)
diff --git a/Gemfile.next.checksum b/Gemfile.next.checksum
index f3bc7fdab7d..011bfa801b8 100644
--- a/Gemfile.next.checksum
+++ b/Gemfile.next.checksum
@@ -175,7 +175,7 @@
 {"name":"fast_blank","version":"1.0.1","platform":"java","checksum":"90d82106b0e4aa19ac24ba1604c79a0c5a4c471601e800c9b2b072938a6d9a92"},
 {"name":"fast_blank","version":"1.0.1","platform":"ruby","checksum":"269fc30414fed4e6403bc4a49081e1ea539f8b9226e59276ed1efaefabaa17ea"},
 {"name":"fast_gettext","version":"2.3.0","platform":"ruby","checksum":"0253e26423ccab68061c42387827e3b99243a1b15ad614df1c800ba870d64f84"},
-{"name":"ffaker","version":"2.23.0","platform":"ruby","checksum":"9d2dfb5cc284a92c8571bddcbe0c573127a2f3238f4b0aa56e08ccf3e4858498"},
+{"name":"ffaker","version":"2.24.0","platform":"ruby","checksum":"43e3f8c12d602fbc70398be8bd1ac841a031eabdc12af01507e76a8d675a5d52"},
 {"name":"ffi","version":"1.17.1","platform":"aarch64-linux-gnu","checksum":"c5d22cb545a3a691d46060f1343c461d1a8d38c3fd71b96b4cbbe6906bf1fd38"},
 {"name":"ffi","version":"1.17.1","platform":"aarch64-linux-musl","checksum":"88b9d6ae905d21142df27c94bb300042c1aae41b67291885f600eaad16326b1d"},
 {"name":"ffi","version":"1.17.1","platform":"arm-linux-gnu","checksum":"fe14f5ece94082f3b0e651a09008113281f2764e7ea95f522b64e2fe32e11504"},
@@ -541,7 +541,7 @@
 {"name":"pry","version":"0.14.2","platform":"java","checksum":"fd780670977ba04ff7ee32dabd4d02fe4bf02e977afe8809832d5dca1412862e"},
 {"name":"pry","version":"0.14.2","platform":"ruby","checksum":"c4fe54efedaca1d351280b45b8849af363184696fcac1c72e0415f9bdac4334d"},
 {"name":"pry-byebug","version":"3.10.1","platform":"ruby","checksum":"c8f975c32255bfdb29e151f5532130be64ff3d0042dc858d0907e849125581f8"},
-{"name":"pry-rails","version":"0.3.9","platform":"ruby","checksum":"468662575abb6b67f4a9831219f99290d5eae7bf186e64dd810d0a3e4a8cc4b1"},
+{"name":"pry-rails","version":"0.3.11","platform":"ruby","checksum":"a69e28e24a34d75d1f60bcf241192a54253f8f7ef8a62cba1e75750a9653593d"},
 {"name":"pry-shell","version":"0.6.4","platform":"ruby","checksum":"ad024882d29912b071a7de65ebea538b242d2dc1498c60c7c2352ef94769f208"},
 {"name":"psych","version":"5.2.3","platform":"java","checksum":"3e5425b9e8a2f41cc2707d5ef14fdc1ae908abbafb12fe45727bd63900056585"},
 {"name":"psych","version":"5.2.3","platform":"ruby","checksum":"84a54bb952d14604fea22d99938348814678782f58b12648fcdfa4d2fce859ee"},
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 8c1a5379b08..f0cd86d44d7 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -640,7 +640,7 @@ GEM
       faraday (>= 2.0, < 3)
     fast_blank (1.0.1)
     fast_gettext (2.3.0)
-    ffaker (2.23.0)
+    ffaker (2.24.0)
     ffi (1.17.1)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
@@ -1489,8 +1489,8 @@ GEM
     pry-byebug (3.10.1)
       byebug (~> 11.0)
       pry (>= 0.13, < 0.15)
-    pry-rails (0.3.9)
-      pry (>= 0.10.4)
+    pry-rails (0.3.11)
+      pry (>= 0.13.0)
     pry-shell (0.6.4)
       pry (>= 0.13.0)
       tty-markdown
@@ -2105,7 +2105,7 @@ DEPENDENCIES
   faraday-typhoeus (~> 1.1)
   faraday_middleware-aws-sigv4 (~> 1.0.1)
   fast_blank (~> 1.0.1)
-  ffaker (~> 2.23)
+  ffaker (~> 2.24)
   ffi (~> 1.17)
   flipper (~> 0.26.2)
   flipper-active_record (~> 0.26.2)
diff --git a/app/assets/javascripts/graphql_shared/possible_types.json b/app/assets/javascripts/graphql_shared/possible_types.json
index 8e8b7980277..8b889bb5a4c 100644
--- a/app/assets/javascripts/graphql_shared/possible_types.json
+++ b/app/assets/javascripts/graphql_shared/possible_types.json
@@ -28,8 +28,8 @@
     "Note"
   ],
   "CiJobTokenScopeTarget": [
-    "Group",
-    "Project"
+    "CiJobTokenAccessibleProject",
+    "Group"
   ],
   "CiRunnerCloudProvisioning": [
     "CiRunnerGkeProvisioning",
diff --git a/app/assets/javascripts/projects/new_v2/components/app.vue b/app/assets/javascripts/projects/new_v2/components/app.vue
index d198166a733..91b3551c237 100644
--- a/app/assets/javascripts/projects/new_v2/components/app.vue
+++ b/app/assets/javascripts/projects/new_v2/components/app.vue
@@ -1,6 +1,6 @@
 <script>
-import { GlButton, GlButtonGroup, GlFormGroup, GlIcon } from '@gitlab/ui';
-import { s__ } from '~/locale';
+import { GlButton, GlButtonGroup, GlFormGroup, GlIcon, GlAlert } from '@gitlab/ui';
+import { s__, sprintf } from '~/locale';
 import SafeHtml from '~/vue_shared/directives/safe_html';
 import MultiStepFormTemplate from '~/vue_shared/components/multi_step_form_template.vue';
 import SingleChoiceSelector from '~/vue_shared/components/single_choice_selector.vue';
@@ -63,6 +63,7 @@ export default {
     GlButtonGroup,
     GlFormGroup,
     GlIcon,
+    GlAlert,
     MultiStepFormTemplate,
     SingleChoiceSelector,
     SingleChoiceSelectorItem,
@@ -72,6 +73,7 @@ export default {
   directives: {
     SafeHtml,
   },
+  inject: ['userNamespaceId', 'canCreateProject'],
   props: {
     rootPath: {
       type: String,
@@ -106,12 +108,17 @@ export default {
     canImportProjects: {
       type: Boolean,
       required: false,
-      default: true,
+      default: false,
     },
     importSourcesEnabled: {
       type: Boolean,
       required: false,
-      default: true,
+      default: false,
+    },
+    canSelectNamespace: {
+      type: Boolean,
+      required: false,
+      default: false,
     },
     namespaceFullPath: {
       type: String,
@@ -123,16 +130,15 @@ export default {
       required: false,
       default: null,
     },
-    userNamespaceId: {
-      type: String,
-      required: false,
-      default: null,
-    },
     trackLabel: {
       type: String,
       required: false,
       default: null,
     },
+    userProjectLimit: {
+      type: Number,
+      required: true,
+    },
     newProjectGuidelines: {
       type: String,
       required: false,
@@ -141,7 +147,8 @@ export default {
   },
   data() {
     return {
-      selectedNamespace: this.namespaceId ? this.namespaceId : this.userNamespaceId,
+      selectedNamespace:
+        this.namespaceId && this.canSelectNamespace ? this.namespaceId : this.userNamespaceId,
       rootUrl: this.rootPath,
     };
   },
@@ -149,6 +156,25 @@ export default {
     isPersonalProject() {
       return this.selectedNamespace === this.userNamespaceId;
     },
+    canChooseOption() {
+      if (!this.isPersonalProject) return true;
+      return this.canCreateProject && this.userProjectLimit > 0;
+    },
+    errorMessage() {
+      if (this.userProjectLimit === 0) {
+        return s__(
+          'ProjectsNew|You cannot create projects in your personal namespace. Contact your GitLab administrator.',
+        );
+      }
+      return sprintf(
+        s__(
+          "ProjectsNew|You've reached your limit of %{limit} projects created. Contact your GitLab administrator.",
+        ),
+        {
+          limit: this.userProjectLimit,
+        },
+      );
+    },
   },
   methods: {
     choosePersonalNamespace() {
@@ -165,7 +191,10 @@ export default {
 <template>
   <multi-step-form-template :title="__('Create new project')" :current-step="1">
     <template #form>
-      <gl-form-group :label="s__('ProjectNew|What do you want to create?')">
+      <gl-form-group
+        v-if="canSelectNamespace"
+        :label="s__('ProjectNew|What do you want to create?')"
+      >
         <gl-button-group class="gl-w-full">
           <gl-button
             category="primary"
@@ -196,14 +225,14 @@ export default {
         <new-project-destination-select
           :namespace-full-path="namespaceFullPath"
           :namespace-id="namespaceId"
-          :user-namespace-id="userNamespaceId"
           :track-label="trackLabel"
           :root-url="rootUrl"
+          :groups-only="true"
           data-testid="group-selector"
         />
       </gl-form-group>
 
-      <single-choice-selector checked="blank_project">
+      <single-choice-selector v-if="canChooseOption" checked="blank_project">
         <single-choice-selector-item v-bind="$options.OPTIONS.blank" />
         <single-choice-selector-item v-bind="$options.OPTIONS.template" />
         <single-choice-selector-item
@@ -221,6 +250,9 @@ export default {
         </single-choice-selector-item>
         <single-choice-selector-item v-bind="$options.OPTIONS.transfer" :disabled="true" />
       </single-choice-selector>
+      <gl-alert v-else variant="danger" :dismissible="false">
+        {{ errorMessage }}
+      </gl-alert>
     </template>
     <template #footer>
       <div v-if="newProjectGuidelines" v-safe-html="newProjectGuidelines" class="gl-mb-6"></div>
diff --git a/app/assets/javascripts/projects/new_v2/components/project_destination_select.vue b/app/assets/javascripts/projects/new_v2/components/project_destination_select.vue
index 7c5a0269aef..65f7f6f5164 100644
--- a/app/assets/javascripts/projects/new_v2/components/project_destination_select.vue
+++ b/app/assets/javascripts/projects/new_v2/components/project_destination_select.vue
@@ -32,6 +32,7 @@ export default {
       debounce: DEBOUNCE_DELAY,
     },
   },
+  inject: ['userNamespaceId', 'canCreateProject'],
   props: {
     namespaceFullPath: {
       type: String,
@@ -43,16 +44,16 @@ export default {
       required: false,
       default: '',
     },
-    userNamespaceId: {
-      type: String,
-      required: false,
-      default: '',
-    },
     trackLabel: {
       type: String,
       required: false,
       default: '',
     },
+    groupsOnly: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
   data() {
     return {
@@ -91,7 +92,9 @@ export default {
       );
     },
     items() {
-      return this.namespaceItems.concat(this.groupsItems);
+      if (this.groupsOnly) return this.groupsItems;
+      if (this.canCreateProject) return this.namespaceItems.concat(this.groupsItems);
+      return this.groupsItems;
     },
     groupsItems() {
       if (this.hasGroupMatches) {
diff --git a/app/assets/javascripts/projects/new_v2/index.js b/app/assets/javascripts/projects/new_v2/index.js
index 8552f8346d6..1e039e3a44b 100644
--- a/app/assets/javascripts/projects/new_v2/index.js
+++ b/app/assets/javascripts/projects/new_v2/index.js
@@ -26,6 +26,9 @@ export function initNewProjectForm() {
     namespaceId,
     userNamespaceId,
     trackLabel,
+    canSelectNamespace,
+    canCreateProject,
+    userProjectLimit,
     newProjectGuidelines,
   } = el.dataset;
 
@@ -40,12 +43,15 @@ export function initNewProjectForm() {
     importSourcesEnabled: parseBoolean(importSourcesEnabled),
     namespaceFullPath,
     namespaceId,
-    userNamespaceId,
     trackLabel,
+    canSelectNamespace: parseBoolean(canSelectNamespace),
+    userProjectLimit: parseInt(userProjectLimit, 10),
     newProjectGuidelines,
   };
 
   const provide = {
+    userNamespaceId,
+    canCreateProject: parseBoolean(canCreateProject),
     projectHelpPath,
     pushToCreateProjectCommand,
   };
diff --git a/app/assets/javascripts/repository/components/blob_content_viewer.vue b/app/assets/javascripts/repository/components/blob_content_viewer.vue
index 193eb03ddc6..1cf8d55450f 100644
--- a/app/assets/javascripts/repository/components/blob_content_viewer.vue
+++ b/app/assets/javascripts/repository/components/blob_content_viewer.vue
@@ -86,7 +86,7 @@ export default {
         const urlHash = getLocationHash(); // If there is a code line hash in the URL we render with the simple viewer
         const useSimpleViewer = usePlain || urlHash?.startsWith('L') || !this.hasRichViewer;
 
-        if (this.isTooLarge) return;
+        if (this.isUnsupportedLanguage(this.blobInfo.language) && this.isTooLarge) return;
         this.initHighlightWorker(this.blobInfo, this.isUsingLfs);
         this.switchViewer(useSimpleViewer ? SIMPLE_BLOB_VIEWER : RICH_BLOB_VIEWER); // By default, if present, use the rich viewer to render
       },
@@ -161,8 +161,13 @@ export default {
       return Boolean(this.viewer.renderError);
     },
     isTooLarge() {
-      const { tooLarge, renderError } = this.viewer || {};
-      return tooLarge || renderError === 'collapsed';
+      if (this.isUnsupportedLanguage(this.blobInfo.language)) {
+        // If the languages is not supported by HLJS then check if the backend indicated the file is too large
+        const { tooLarge, renderError } = this.viewer || {};
+        return tooLarge || renderError === 'collapsed';
+      }
+
+      return this.blobInfo.size >= this.$options.HLJS_MAX_SIZE;
     },
     blobViewer() {
       const { fileType } = this.viewer;
diff --git a/app/assets/javascripts/repository/mixins/highlight_mixin.js b/app/assets/javascripts/repository/mixins/highlight_mixin.js
index 233cb23f65a..1ee15d8c95f 100644
--- a/app/assets/javascripts/repository/mixins/highlight_mixin.js
+++ b/app/assets/javascripts/repository/mixins/highlight_mixin.js
@@ -15,6 +15,7 @@ import { TEXT_FILE_TYPE } from '../constants';
  * This mixin is intended to be used as an interface between our highlight worker and Vue components
  */
 export default {
+  HLJS_MAX_SIZE: 2000000, // 2MB
   mixins: [Tracking.mixin()],
   inject: {
     highlightWorker: { default: null },
diff --git a/app/assets/javascripts/super_sidebar/components/global_search/command_palette/constants.js b/app/assets/javascripts/super_sidebar/components/global_search/command_palette/constants.js
index e2fef6c838d..368db5ae297 100644
--- a/app/assets/javascripts/super_sidebar/components/global_search/command_palette/constants.js
+++ b/app/assets/javascripts/super_sidebar/components/global_search/command_palette/constants.js
@@ -6,6 +6,10 @@ export const PROJECT_HANDLE = ':';
 export const ISSUE_HANDLE = '#';
 export const PATH_HANDLE = '~';
 
+export const COMMANDS_TOGGLE_KEYBINDING = 'mod+k';
+export const COMMANDS_SKIP_NEXT_KEYBINDING = ['ctrl+n', 'command+n', 'alt+mod+n'];
+export const COMMANDS_SKIP_PREV_KEYBINDING = ['ctrl+p', 'command+p', 'alt+mod+p'];
+
 export const TRACKING_ACTIVATE_COMMAND_PALETTE = 'activate_command_palette';
 export const TRACKING_CLICK_COMMAND_PALETTE_ITEM = 'click_command_palette_item';
 export const TRACKING_HANDLE_LABEL_MAP = {
diff --git a/app/assets/javascripts/super_sidebar/components/global_search/components/global_search.vue b/app/assets/javascripts/super_sidebar/components/global_search/components/global_search.vue
index da3c987cef9..1cbdb3915c1 100644
--- a/app/assets/javascripts/super_sidebar/components/global_search/components/global_search.vue
+++ b/app/assets/javascripts/super_sidebar/components/global_search/components/global_search.vue
@@ -4,6 +4,7 @@ import { GlSearchBoxByType, GlModal } from '@gitlab/ui';
 import { mapState, mapActions, mapGetters } from 'vuex';
 import { debounce, clamp } from 'lodash';
 import { InternalEvents } from '~/tracking';
+import { Mousetrap, addStopCallback } from '~/lib/mousetrap';
 import { visitUrl } from '~/lib/utils/url_utility';
 import { DEFAULT_DEBOUNCE_AND_THROTTLE_MS } from '~/lib/utils/constants';
 import { s__, sprintf } from '~/locale';
@@ -44,7 +45,6 @@ import {
   SEARCH_RESULTS_DESCRIPTION,
   SEARCH_SHORTCUTS_MIN_CHARACTERS,
   SEARCH_MODAL_ID,
-  KEY_K,
   KEY_N,
   KEY_P,
   SEARCH_INPUT_SELECTOR,
@@ -62,6 +62,7 @@ import {
   MODAL_CLOSE_ESC,
   MODAL_CLOSE_BACKGROUND,
   MODAL_CLOSE_HEADERCLOSE,
+  COMMANDS_TOGGLE_KEYBINDING,
 } from '../command_palette/constants';
 import CommandPaletteLottery from '../command_palette/command_palette_lottery.vue';
 import CommandsOverviewDropdown from '../command_palette/command_overview_dropdown.vue';
@@ -170,6 +171,9 @@ export default {
       this.highlightFirstCommand();
     },
   },
+  created() {
+    addStopCallback(this.allowMousetrapBindingOnSearchInput);
+  },
   methods: {
     ...mapActions(['setSearch', 'setCommand', 'fetchAutocompleteOptions', 'clearAutocomplete']),
     getAutocompleteOptions: debounce(function debouncedSearch(searchTerm) {
@@ -205,11 +209,12 @@ export default {
       }
     },
     onKeydown(event) {
-      const { code, target } = event;
+      const { code, ctrlKey, target } = event;
 
       let stop = true;
       const isSearchInput = target && target?.matches(SEARCH_INPUT_SELECTOR);
       const elements = this.getFocusableOptions();
+      this.getListItemsAndFocusIndex();
 
       switch (code) {
         case ENTER_KEY:
@@ -250,6 +255,26 @@ export default {
           this.focusNextItem(event, elements, 1);
           break;
 
+        case KEY_P:
+          if (!ctrlKey) {
+            return;
+          }
+
+          this.focusIndex =
+            this.focusIndex > 0 ? this.focusIndex - 1 : this.childListItems.length - 1;
+          this.childListItems[this.focusIndex]?.focus();
+          break;
+
+        case KEY_N:
+          if (!ctrlKey) {
+            return;
+          }
+
+          this.focusIndex =
+            this.focusIndex < this.childListItems.length - 1 ? this.focusIndex + 1 : 0;
+          this.childListItems[this.focusIndex]?.focus();
+          break;
+
         case ESC_KEY:
           this.$refs.modal.close();
           break;
@@ -263,38 +288,36 @@ export default {
         event.preventDefault();
       }
     },
-    onKeyComboDown(event) {
-      const { code, metaKey, ctrlKey } = event;
-
-      this.getListItemsAndFocusIndex();
-
-      if (code === KEY_P && ctrlKey) {
-        this.focusIndex =
-          this.focusIndex > 0 ? this.focusIndex - 1 : this.childListItems.length - 1;
-        this.childListItems[this.focusIndex]?.focus();
+    onKeyComboToggleDropdown(event) {
+      if (event.preventDefault) {
+        event.preventDefault();
       }
 
-      if (code === KEY_N && ctrlKey) {
-        this.focusIndex =
-          this.focusIndex < this.childListItems.length - 1 ? this.focusIndex + 1 : 0;
-        this.childListItems[this.focusIndex]?.focus();
+      if (!this.commandPaletteDropdownOpen) {
+        this.$refs.commandDropdown.open();
+        this.commandPaletteDropdownOpen = true;
+      } else {
+        this.$refs.commandDropdown.close();
+        this.commandPaletteDropdownOpen = false;
+      }
+    },
+    allowMousetrapBindingOnSearchInput(event, element, combo) {
+      if (combo !== COMMANDS_TOGGLE_KEYBINDING) {
+        return undefined;
       }
 
-      if (code === KEY_K && metaKey) {
-        if (!this.commandPaletteDropdownOpen) {
-          this.$refs.commandDropdown.open();
-          this.commandPaletteDropdownOpen = true;
-        } else {
-          this.$refs.commandDropdown.close();
-          this.commandPaletteDropdownOpen = false;
-        }
+      const search = this.$refs.searchInput.$el;
+      if (search?.contains(element)) {
+        return false;
       }
+
+      return undefined;
     },
     handleClosing() {
       this.commandPaletteDropdownOpen = false;
     },
     focusSearchInput() {
-      this.$refs.searchInput.$el.querySelector('input')?.focus();
+      this.$refs?.searchInput?.$el?.querySelector('input')?.focus();
     },
     focusNextItem(event, elements, offset) {
       const { target } = event;
@@ -324,13 +347,13 @@ export default {
     onSearchModalShown() {
       this.$emit('shown');
 
-      window.addEventListener('keydown', this.onKeyComboDown);
+      Mousetrap.bind(COMMANDS_TOGGLE_KEYBINDING, this.onKeyComboToggleDropdown);
     },
     onSearchModalHidden({ trigger } = {}) {
       this.searchText = '';
       this.$emit('hidden');
 
-      window.removeEventListener('keydown', this.onKeyComboDown);
+      Mousetrap.unbind(COMMANDS_TOGGLE_KEYBINDING);
 
       switch (trigger) {
         case this.$options.MODAL_CLOSE_ESC:
diff --git a/app/assets/javascripts/todos/components/todo_item.vue b/app/assets/javascripts/todos/components/todo_item.vue
index 872529823da..9d1d8a575d8 100644
--- a/app/assets/javascripts/todos/components/todo_item.vue
+++ b/app/assets/javascripts/todos/components/todo_item.vue
@@ -113,7 +113,7 @@ export default {
 
 <template>
   <li
-    class="gl-border-t gl-border-b gl-relative -gl-mt-px gl-flex gl-gap-3 gl-px-5 gl-py-3 hover:gl-z-1 hover:gl-border-blue-200 hover:gl-bg-blue-50"
+    class="gl-border-t gl-border-b gl-relative -gl-mt-px gl-flex gl-gap-3 gl-px-5 gl-py-3 hover:gl-z-1 has-[>a:hover]:gl-border-blue-200 has-[>a:hover]:gl-bg-blue-50"
     :data-testid="`todo-item-${todo.id}`"
     :class="{ 'gl-bg-subtle': isDone }"
   >
diff --git a/app/assets/javascripts/todos/components/todos_app.vue b/app/assets/javascripts/todos/components/todos_app.vue
index f68729badd2..6dc39b5b769 100644
--- a/app/assets/javascripts/todos/components/todos_app.vue
+++ b/app/assets/javascripts/todos/components/todos_app.vue
@@ -332,7 +332,7 @@ export default {
             name="todos"
             tag="ol"
             data-testid="todo-item-list"
-            class="gl-m-0 gl-border-collapse gl-list-none gl-p-0"
+            class="gl-m-0 gl-list-none gl-p-0"
           >
             <todo-item
               v-for="todo in todos"
diff --git a/app/assets/javascripts/todos/components/todos_pagination.vue b/app/assets/javascripts/todos/components/todos_pagination.vue
index ddff0a21354..339dbad9e7f 100644
--- a/app/assets/javascripts/todos/components/todos_pagination.vue
+++ b/app/assets/javascripts/todos/components/todos_pagination.vue
@@ -95,12 +95,12 @@ export default {
 </script>
 
 <template>
-  <div class="gl-relative gl-mt-6 gl-flex gl-justify-between md:!gl-justify-center">
+  <div class="gl-relative gl-mt-6 gl-flex gl-justify-between md:gl-justify-center">
     <gl-keyset-pagination v-bind="$props" @prev="prevPage" @next="nextPage" />
 
     <page-size-selector
       :value="pageSize"
-      class="gl-relative gl-right-0 md:gl-absolute"
+      class="gl-right-0 md:gl-absolute"
       @input="handlePageSizeChange"
     />
   </div>
diff --git a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
index 916561d81eb..1b9fdf1f0fa 100644
--- a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
+++ b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
@@ -10,7 +10,7 @@ fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
       avatarUrl
       webUrl
     }
-    ... on Project {
+    ... on CiJobTokenAccessibleProject {
       id
       name
       fullPath
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 89ca78c131d..0d6187edcd6 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -188,27 +188,6 @@ class ApplicationController < BaseActionController
   end
   strong_memoize_attr :auth_user
 
-  # Devise defines current_user to be:
-  #
-  # def current_user
-  #   @current_user ||= warden.authenticate(scope: mapping)
-  # end
-  #
-  # That means whenever current_user is called and `@current_user` is
-  # nil, Warden will attempt to authenticate a user. To avoid
-  # reauthenticating anonymous users, we may need to invalidate
-  # the user.
-  def reset_auth_user!
-    return if strong_memoized?(:auth_user) && auth_user
-
-    # Controllers usually call auth_user first, but for some controllers
-    # authenticate_sessionless_user! is called after that. If we relied
-    # on the memoized auth_user, the value would always be nil for
-    # sessionless users.
-    clear_memoization(:auth_user)
-    auth_user
-  end
-
   def log_exception(exception)
     # At this point, the controller already exits set_current_context around
     # block. To maintain the context while handling error exception, we need to
diff --git a/app/controllers/concerns/sessionless_authentication.rb b/app/controllers/concerns/sessionless_authentication.rb
index 3cb6325ac9e..abd630ede8f 100644
--- a/app/controllers/concerns/sessionless_authentication.rb
+++ b/app/controllers/concerns/sessionless_authentication.rb
@@ -16,33 +16,22 @@ module SessionlessAuthentication
   end
 
   def sessionless_user?
-    if Feature.enabled?(:fix_graphql_csrf, Feature.current_request)
-      current_user && @sessionless_sign_in # rubocop:disable Gitlab/ModuleWithInstanceVariables -- This is only used within this module
-    else
-      current_user && !session.key?('warden.user.user.key')
-    end
+    current_user && @sessionless_sign_in # rubocop:disable Gitlab/ModuleWithInstanceVariables -- This is only used within this module
   end
 
   def sessionless_sign_in(user)
     @sessionless_sign_in = true # rubocop:disable Gitlab/ModuleWithInstanceVariables -- This is only used within this module
 
-    signed_in_user =
-      if user.can_log_in_with_non_expired_password?
-        # Notice we are passing store false, so the user is not
-        # actually stored in the session and a token is needed
-        # for every request. If you want the token to work as a
-        # sign in token, you can simply remove store: false.
-        sign_in(user, store: false, message: :sessionless_sign_in)
-      elsif request_authenticator.can_sign_in_bot?(user)
-        # we suppress callbacks to avoid redirecting the bot
-        sign_in(user, store: false, message: :sessionless_sign_in, run_callbacks: false)
-      end
-
-    if respond_to?(:reset_auth_user!, true) && Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
-      reset_auth_user!
+    if user.can_log_in_with_non_expired_password?
+      # Notice we are passing store false, so the user is not
+      # actually stored in the session and a token is needed
+      # for every request. If you want the token to work as a
+      # sign in token, you can simply remove store: false.
+      sign_in(user, store: false, message: :sessionless_sign_in)
+    elsif request_authenticator.can_sign_in_bot?(user)
+      # we suppress callbacks to avoid redirecting the bot
+      sign_in(user, store: false, message: :sessionless_sign_in, run_callbacks: false)
     end
-
-    signed_in_user
   end
 
   def sessionless_bypass_admin_mode!(&block)
diff --git a/app/controllers/graphql_controller.rb b/app/controllers/graphql_controller.rb
index 194dd7d9015..2bdaff21811 100644
--- a/app/controllers/graphql_controller.rb
+++ b/app/controllers/graphql_controller.rb
@@ -11,12 +11,9 @@ class GraphqlController < ApplicationController
   # Also, we allow anonymous users to access the API without a CSRF token so that it is easier for users
   # to get started with our GraphQL API.
   skip_before_action :verify_authenticity_token, if: -> {
-    Feature.enabled?(:fix_graphql_csrf, Feature.current_request) &&
-      (current_user.nil? || sessionless_user? || !any_mutating_query?)
-  }
-  skip_before_action :check_two_factor_requirement, if: -> {
-    Feature.enabled?(:fix_graphql_csrf, Feature.current_request) && sessionless_user?
+    current_user.nil? || sessionless_user? || !any_mutating_query?
   }
+  skip_before_action :check_two_factor_requirement, if: -> { sessionless_user? }
 
   # Header can be passed by tests to disable SQL query limits.
   DISABLE_SQL_QUERY_LIMIT_HEADER = 'HTTP_X_GITLAB_DISABLE_SQL_QUERY_LIMIT'
@@ -28,33 +25,8 @@ class GraphqlController < ApplicationController
   CACHED_INTROSPECTION_QUERY_STRING = CachedIntrospectionQuery.query_string
   INTROSPECTION_QUERY_OPERATION_NAME = 'IntrospectionQuery'
 
-  # If a user is using their session to access GraphQL, we need to have session
-  # storage, since the admin-mode check is session wide.
-  # We can't enable this for anonymous users because that would cause users using
-  # enforced SSO from using an auth token to access the API.
-  skip_around_action :set_session_storage, if: -> {
-    Feature.disabled?(:fix_graphql_csrf, Feature.current_request) && current_user.nil?
-  }
-
-  # Allow missing CSRF tokens, this would mean that if a CSRF is invalid or missing,
-  # the user won't be authenticated but can proceed as an anonymous user.
-  #
-  # If a CSRF is valid, the user is authenticated. This makes it easier to play
-  # around in GraphiQL.
-  prepend_before_action do
-    if Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
-      self.forgery_protection_strategy = ProtectionMethods::NullSession
-    end
-  end
-
   # must come first: current_user is set up here
-  prepend_before_action(if: -> {
-    Feature.enabled?(:fix_graphql_csrf, Feature.current_request)
-  }) { authenticate_sessionless_user!(:graphql_api) }
-
-  before_action(if: -> {
-    Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
-  }) { authenticate_sessionless_user!(:graphql_api) }
+  prepend_before_action { authenticate_sessionless_user!(:graphql_api) }
 
   before_action :authorize_access_api!
   before_action :set_user_last_activity
diff --git a/app/graphql/types/ci/job_token_accessible_project_type.rb b/app/graphql/types/ci/job_token_accessible_project_type.rb
new file mode 100644
index 00000000000..7e464eaf9e0
--- /dev/null
+++ b/app/graphql/types/ci/job_token_accessible_project_type.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Types
+  # rubocop: disable Graphql/AuthorizeTypes -- this type does not need authorization
+  module Ci
+    class JobTokenAccessibleProjectType < BaseObject
+      graphql_name 'CiJobTokenAccessibleProject'
+      description 'Project that can access the current project by authenticating with a CI/CD job token.'
+
+      field :id, GraphQL::Types::ID,
+        null: false,
+        description: 'ID of the project.'
+
+      field :name, GraphQL::Types::String,
+        null: false,
+        description: 'Name of the project (without namespace).'
+
+      field :path, GraphQL::Types::String,
+        null: false,
+        description: 'Path of the project.'
+
+      field :full_path, GraphQL::Types::ID,
+        null: false,
+        description: 'Full path of the project.'
+
+      field :web_url, GraphQL::Types::String,
+        null: true,
+        description: 'Web URL of the project.'
+
+      field :avatar_url, GraphQL::Types::String,
+        null: true,
+        calls_gitaly: true,
+        description: 'URL to avatar image file of the project.'
+
+      def avatar_url
+        object.avatar_url(only_path: false)
+      end
+    end
+  end
+  # rubocop: enable Graphql/AuthorizeTypes
+end
diff --git a/app/graphql/types/ci/job_token_auth_log_type.rb b/app/graphql/types/ci/job_token_auth_log_type.rb
index f647566db38..8f0f6d00a14 100644
--- a/app/graphql/types/ci/job_token_auth_log_type.rb
+++ b/app/graphql/types/ci/job_token_auth_log_type.rb
@@ -7,7 +7,7 @@ module Types
       graphql_name 'CiJobTokenAuthLog'
       connection_type_class Types::CountableConnectionType
 
-      field :origin_project, Types::ProjectType,
+      field :origin_project, Types::Ci::JobTokenAccessibleProjectType,
         null: false,
         experiment: { milestone: '17.6' },
         description: 'Origin project.'
diff --git a/app/graphql/types/ci/job_token_scope/target_type.rb b/app/graphql/types/ci/job_token_scope/target_type.rb
index cbe93049d78..bfaac6b4bde 100644
--- a/app/graphql/types/ci/job_token_scope/target_type.rb
+++ b/app/graphql/types/ci/job_token_scope/target_type.rb
@@ -7,12 +7,12 @@ module Types
         graphql_name 'CiJobTokenScopeTarget'
         description 'Represents an object that is the target of a CI_JOB_TOKEN allowlist entry'
 
-        possible_types Types::ProjectType, Types::GroupType
+        possible_types Types::Ci::JobTokenAccessibleProjectType, Types::GroupType
 
         def self.resolve_type(object, _context)
           case object
           when Project
-            Types::ProjectType
+            Types::Ci::JobTokenAccessibleProjectType
           when Group
             Types::GroupType
           else
diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index 2fed56ad739..14dc88d3160 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -25,7 +25,7 @@ module Types
         method: :outbound_projects
 
       field :inbound_allowlist,
-        Types::ProjectType.connection_type,
+        Types::Ci::JobTokenAccessibleProjectType.connection_type,
         null: false,
         description: "Allowlist of projects that can access the current project " \
           "by authenticating with a CI/CD job token.",
diff --git a/app/models/concerns/integrations/base/confluence.rb b/app/models/concerns/integrations/base/confluence.rb
new file mode 100644
index 00000000000..2d46e97cd50
--- /dev/null
+++ b/app/models/concerns/integrations/base/confluence.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Integrations
+  module Base
+    module Confluence
+      extend ActiveSupport::Concern
+      include Base::ThirdPartyWiki
+
+      VALID_SCHEME_MATCH = Gitlab::UntrustedRegexp.new('^https?$')
+      VALID_HOST_MATCH = Gitlab::UntrustedRegexp.new('^.+\\.atlassian\\.net$')
+      VALID_PATH_MATCH = Gitlab::UntrustedRegexp.new('^/wiki(/|$)')
+
+      class_methods do
+        def to_param
+          'confluence'
+        end
+
+        def title
+          s_('ConfluenceService|Confluence Workspace')
+        end
+
+        def description
+          s_('ConfluenceService|Link to a Confluence Workspace from the sidebar.')
+        end
+      end
+
+      included do
+        validates :confluence_url, presence: true, if: :activated?
+        validate :validate_confluence_url_is_cloud, if: :activated?
+
+        field :confluence_url,
+          title: -> { _('Confluence Workspace URL') },
+          description: -> { _("URL of the Confluence Workspace hosted on `atlassian.net`.") },
+          placeholder: 'https://example.atlassian.net/wiki',
+          required: true
+      end
+
+      def avatar_url
+        ActionController::Base.helpers.image_path('confluence.svg')
+      end
+
+      def help
+        return unless project&.wiki_enabled?
+
+        if activated?
+          wiki_url = project.wiki.web_url
+
+          docs_link = ActionController::Base.helpers.link_to('', wiki_url, target: '_blank', rel: 'noopener noreferrer')
+          tag_pair_docs_link = tag_pair(docs_link, :link_start, :link_end)
+
+          safe_format(
+            s_("'ConfluenceService|Your GitLab wiki is still available at %{link_start}%{wiki_url}%{link_end}. " \
+              "To re-enable the link to the GitLab wiki, disable this integration."), tag_pair_docs_link, wiki_url:)
+        else
+          s_('ConfluenceService|Link to a Confluence Workspace from the sidebar. Enabling this integration replaces ' \
+            'the "Wiki" sidebar link with a link to the Confluence Workspace. The GitLab wiki is still available at ' \
+            'the original URL.')
+        end
+      end
+
+      def testable?
+        false
+      end
+
+      private
+
+      def validate_confluence_url_is_cloud
+        return if confluence_uri_valid?
+
+        errors.add(:confluence_url, 'URL must be to a Confluence Cloud Workspace hosted on atlassian.net')
+      end
+
+      def confluence_uri_valid?
+        return false unless confluence_url
+
+        uri = URI.parse(confluence_url)
+
+        (
+          VALID_SCHEME_MATCH.match?(uri.scheme) &&
+          VALID_HOST_MATCH.match?(uri.host) &&
+          VALID_PATH_MATCH.match?(uri.path)
+        ).present?
+
+      rescue URI::InvalidURIError
+        false
+      end
+    end
+  end
+end
diff --git a/app/models/integrations/confluence.rb b/app/models/integrations/confluence.rb
index 24656a0d767..0148775baff 100644
--- a/app/models/integrations/confluence.rb
+++ b/app/models/integrations/confluence.rb
@@ -2,75 +2,6 @@
 
 module Integrations
   class Confluence < Integration
-    include Base::ThirdPartyWiki
-
-    VALID_SCHEME_MATCH = %r{\Ahttps?\Z}
-    VALID_HOST_MATCH = %r{\A.+\.atlassian\.net\Z}
-    VALID_PATH_MATCH = %r{\A/wiki(/|\Z)}
-
-    validates :confluence_url, presence: true, if: :activated?
-    validate :validate_confluence_url_is_cloud, if: :activated?
-
-    field :confluence_url,
-      title: -> { _('Confluence Workspace URL') },
-      description: -> { _("URL of the Confluence Workspace hosted on `atlassian.net`.") },
-      placeholder: 'https://example.atlassian.net/wiki',
-      required: true
-
-    def avatar_url
-      ActionController::Base.helpers.image_path('confluence.svg')
-    end
-
-    def self.to_param
-      'confluence'
-    end
-
-    def self.title
-      s_('ConfluenceService|Confluence Workspace')
-    end
-
-    def self.description
-      s_('ConfluenceService|Link to a Confluence Workspace from the sidebar.')
-    end
-
-    def help
-      return unless project&.wiki_enabled?
-
-      if activated?
-        wiki_url = project.wiki.web_url
-
-        docs_link = ActionController::Base.helpers.link_to('', wiki_url, target: '_blank', rel: 'noopener noreferrer')
-        tag_pair_docs_link = tag_pair(docs_link, :link_start, :link_end)
-
-        safe_format(s_("'ConfluenceService|Your GitLab wiki is still available at %{link_start}#{wiki_url}%{link_end}. To re-enable the link to the GitLab wiki, disable this integration."), tag_pair_docs_link)
-      else
-        s_('ConfluenceService|Link to a Confluence Workspace from the sidebar. Enabling this integration replaces the "Wiki" sidebar link with a link to the Confluence Workspace. The GitLab wiki is still available at the original URL.')
-      end
-    end
-
-    def testable?
-      false
-    end
-
-    private
-
-    def validate_confluence_url_is_cloud
-      unless confluence_uri_valid?
-        errors.add(:confluence_url, 'URL must be to a Confluence Cloud Workspace hosted on atlassian.net')
-      end
-    end
-
-    def confluence_uri_valid?
-      return false unless confluence_url
-
-      uri = URI.parse(confluence_url)
-
-      (uri.scheme&.match(VALID_SCHEME_MATCH) &&
-        uri.host&.match(VALID_HOST_MATCH) &&
-        uri.path&.match(VALID_PATH_MATCH)).present?
-
-    rescue URI::InvalidURIError
-      false
-    end
+    include Integrations::Base::Confluence
   end
 end
diff --git a/app/models/integrations/instance/confluence.rb b/app/models/integrations/instance/confluence.rb
index 7ba86a78198..69735b690f8 100644
--- a/app/models/integrations/instance/confluence.rb
+++ b/app/models/integrations/instance/confluence.rb
@@ -3,7 +3,7 @@
 module Integrations
   module Instance
     class Confluence < Integration
-      # To be updated as part of https://gitlab.com/gitlab-org/gitlab/-/issues/474809
+      include Integrations::Base::Confluence
     end
   end
 end
diff --git a/app/validators/json_schema_validator.rb b/app/validators/json_schema_validator.rb
index bae3ba21fcf..bbaadecb806 100644
--- a/app/validators/json_schema_validator.rb
+++ b/app/validators/json_schema_validator.rb
@@ -84,10 +84,6 @@ class JsonSchemaValidator < ActiveModel::EachValidator
     "#{options[:filename]}.json"
   end
 
-  def draft_version
-    options[:draft] || JSON_VALIDATOR_MAX_DRAFT_VERSION
-  end
-
   def error_message
     options[:message] || _('must be a valid json schema')
   end
diff --git a/app/views/projects/new.html.haml b/app/views/projects/new.html.haml
index 50771c19ced..653a05c1837 100644
--- a/app/views/projects/new.html.haml
+++ b/app/views/projects/new.html.haml
@@ -21,7 +21,10 @@
     is_ci_cd_available: remote_mirror_setting_enabled?.to_s,
     can_import_projects: params[:namespace_id].presence ? current_user.can?(:import_projects, @namespace).to_s : 'true',
     import_sources_enabled: import_sources_enabled?.to_s,
-    track_label: local_assigns.fetch(:track_label, 'blank_project') } }
+    track_label: local_assigns.fetch(:track_label, 'blank_project'),
+    can_select_namespace: current_user.can_select_namespace?.to_s,
+    can_create_project: current_user.can_create_project?.to_s,
+    user_project_limit: current_user.projects_limit } }
 - else
   .project-edit-container
     .project-edit-errors
diff --git a/config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml b/config/feature_flags/gitlab_com_derisk/ci_merge_request_variables_preload.yml
similarity index 66%
rename from config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml
rename to config/feature_flags/gitlab_com_derisk/ci_merge_request_variables_preload.yml
index e2a20884d4c..3dc6179535a 100644
--- a/config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml
+++ b/config/feature_flags/gitlab_com_derisk/ci_merge_request_variables_preload.yml
@@ -1,9 +1,9 @@
 ---
-name: fix_graphql_csrf
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/379326
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173972
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/508617
-milestone: '17.7'
-group: group::project management
+name: ci_merge_request_variables_preload
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/515980
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/179811
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/515982
+milestone: '17.9'
+group: group::pipeline authoring
 type: gitlab_com_derisk
 default_enabled: false
diff --git a/config/feature_flags/ops/graphql_minimal_auth_methods.yml b/config/feature_flags/ops/graphql_minimal_auth_methods.yml
deleted file mode 100644
index aaac24332c7..00000000000
--- a/config/feature_flags/ops/graphql_minimal_auth_methods.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: graphql_minimal_auth_methods
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/438462
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150407
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/444929
-milestone: '17.0'
-group: group::authentication
-type: ops
-default_enabled: true
\ No newline at end of file
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index dcb056eb704..277a42f0e56 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -881,6 +881,8 @@
   - 2
 - - security_scans_purge_by_job_id
   - 1
+- - security_sync_pipeline_execution_policy_metadata
+  - 1
 - - security_sync_policy
   - 1
 - - security_sync_policy_event
diff --git a/db/docs/batched_background_migrations/project_bot_user_details_bot_namespace_migration.yml b/db/docs/batched_background_migrations/project_bot_user_details_bot_namespace_migration.yml
index 3b7bd89821f..60e1665e46d 100644
--- a/db/docs/batched_background_migrations/project_bot_user_details_bot_namespace_migration.yml
+++ b/db/docs/batched_background_migrations/project_bot_user_details_bot_namespace_migration.yml
@@ -5,4 +5,4 @@ feature_category: system_access
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/171326
 milestone: '17.6'
 queued_migration_version: 20241031160728
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250121193138
diff --git a/db/docs/board_assignees.yml b/db/docs/board_assignees.yml
index 836caad528b..5a2c79a0583 100644
--- a/db/docs/board_assignees.yml
+++ b/db/docs/board_assignees.yml
@@ -8,6 +8,8 @@ description: Used by issue boards to filter issues by assignee as part of the de
   scope
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/2912
 milestone: '10.2'
-gitlab_schema: gitlab_main
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/514603
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  group_id: namespaces
+  project_id: projects
 table_size: small
diff --git a/db/docs/requirements_management_test_reports.yml b/db/docs/requirements_management_test_reports.yml
index 11112453809..3f844162847 100644
--- a/db/docs/requirements_management_test_reports.yml
+++ b/db/docs/requirements_management_test_reports.yml
@@ -8,6 +8,17 @@ description: Information related to Test Reports, which relate historical test o
   to Requirements
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/31643
 milestone: '13.0'
-gitlab_schema: gitlab_main
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/465553
+gitlab_schema: gitlab_main_cell
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+desired_sharding_key:
+  project_id:
+    references: projects
+    backfill_via:
+      parent:
+        foreign_key: issue_id
+        table: issues
+        sharding_key: project_id
+        belongs_to: requirement_issue
 table_size: small
+
diff --git a/db/migrate/20250123194127_add_board_assignees_sharding_key.rb b/db/migrate/20250123194127_add_board_assignees_sharding_key.rb
new file mode 100644
index 00000000000..a5cbcc42987
--- /dev/null
+++ b/db/migrate/20250123194127_add_board_assignees_sharding_key.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesShardingKey < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  def change
+    add_column :board_assignees, :group_id, :bigint
+    add_column :board_assignees, :project_id, :bigint
+  end
+end
diff --git a/db/post_migrate/20250121193138_finalize_project_bot_user_details_bot_namespace_migration.rb b/db/post_migrate/20250121193138_finalize_project_bot_user_details_bot_namespace_migration.rb
new file mode 100644
index 00000000000..af495d16d09
--- /dev/null
+++ b/db/post_migrate/20250121193138_finalize_project_bot_user_details_bot_namespace_migration.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class FinalizeProjectBotUserDetailsBotNamespaceMigration < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main_clusterwide
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: "ProjectBotUserDetailsBotNamespaceMigration",
+      table_name: :users,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250123195300_backfill_sharding_key_on_board_assignees.rb b/db/post_migrate/20250123195300_backfill_sharding_key_on_board_assignees.rb
new file mode 100644
index 00000000000..b997c9cbf9e
--- /dev/null
+++ b/db/post_migrate/20250123195300_backfill_sharding_key_on_board_assignees.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+class BackfillShardingKeyOnBoardAssignees < Gitlab::Database::Migration[2.2]
+  BATCH_SIZE = 100
+
+  disable_ddl_transaction!
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  milestone '17.9'
+
+  def up
+    each_batch(:board_assignees, of: BATCH_SIZE) do |batch|
+      connection.execute(
+        <<~SQL
+          UPDATE
+            "board_assignees"
+          SET
+            "group_id" = "boards"."group_id",
+            "project_id" = "boards"."project_id"
+          FROM
+            "boards"
+          WHERE
+            "board_assignees"."board_id" = "boards"."id"
+            AND "board_assignees"."id" IN (#{batch.select(:id).to_sql})
+        SQL
+      )
+    end
+  end
+
+  def down
+    # no-op
+  end
+end
diff --git a/db/post_migrate/20250123195400_add_board_assignees_project_id_index.rb b/db/post_migrate/20250123195400_add_board_assignees_project_id_index.rb
new file mode 100644
index 00000000000..8904bbc8344
--- /dev/null
+++ b/db/post_migrate/20250123195400_add_board_assignees_project_id_index.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesProjectIdIndex < Gitlab::Database::Migration[2.2]
+  INDEX_NAME = 'index_board_assignees_on_project_id'
+
+  disable_ddl_transaction!
+  milestone '17.9'
+
+  def up
+    add_concurrent_index :board_assignees, :project_id, name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index :board_assignees, :project_id, name: INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250123195500_add_board_assignees_group_id_index.rb b/db/post_migrate/20250123195500_add_board_assignees_group_id_index.rb
new file mode 100644
index 00000000000..29ad3ccc2b0
--- /dev/null
+++ b/db/post_migrate/20250123195500_add_board_assignees_group_id_index.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesGroupIdIndex < Gitlab::Database::Migration[2.2]
+  INDEX_NAME = 'index_board_assignees_on_group_id'
+
+  disable_ddl_transaction!
+  milestone '17.9'
+
+  def up
+    add_concurrent_index :board_assignees, :group_id, name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index :board_assignees, :group_id, name: INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250123201951_add_board_assignees_sharding_key_not_null_constraint.rb b/db/post_migrate/20250123201951_add_board_assignees_sharding_key_not_null_constraint.rb
new file mode 100644
index 00000000000..816a76579aa
--- /dev/null
+++ b/db/post_migrate/20250123201951_add_board_assignees_sharding_key_not_null_constraint.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesShardingKeyNotNullConstraint < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.9'
+
+  def up
+    add_multi_column_not_null_constraint(:board_assignees, :group_id, :project_id)
+  end
+
+  def down
+    remove_multi_column_not_null_constraint(:board_assignees, :group_id, :project_id)
+  end
+end
diff --git a/db/post_migrate/20250123202635_add_board_assignees_group_id_fk.rb b/db/post_migrate/20250123202635_add_board_assignees_group_id_fk.rb
new file mode 100644
index 00000000000..28a5a8a27c0
--- /dev/null
+++ b/db/post_migrate/20250123202635_add_board_assignees_group_id_fk.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesGroupIdFk < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.9'
+
+  def up
+    add_concurrent_foreign_key :board_assignees,
+      :namespaces,
+      column: :group_id,
+      target_column: :id,
+      reverse_lock_order: true
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key_if_exists :board_assignees, column: :group_id
+    end
+  end
+end
diff --git a/db/post_migrate/20250123202841_add_board_assignees_project_id_fk.rb b/db/post_migrate/20250123202841_add_board_assignees_project_id_fk.rb
new file mode 100644
index 00000000000..6ae5a7da626
--- /dev/null
+++ b/db/post_migrate/20250123202841_add_board_assignees_project_id_fk.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class AddBoardAssigneesProjectIdFk < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.9'
+
+  def up
+    add_concurrent_foreign_key :board_assignees,
+      :projects,
+      column: :project_id,
+      target_column: :id,
+      reverse_lock_order: true
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key_if_exists :board_assignees, column: :project_id
+    end
+  end
+end
diff --git a/db/schema_migrations/20250121193138 b/db/schema_migrations/20250121193138
new file mode 100644
index 00000000000..e69178f2d83
--- /dev/null
+++ b/db/schema_migrations/20250121193138
@@ -0,0 +1 @@
+3dda1880ee20b8d7c9a02db6c5fd1a34e70fa62e249aab236b1f2b11ead04282
\ No newline at end of file
diff --git a/db/schema_migrations/20250123194127 b/db/schema_migrations/20250123194127
new file mode 100644
index 00000000000..cfa65b08b18
--- /dev/null
+++ b/db/schema_migrations/20250123194127
@@ -0,0 +1 @@
+dd61b7388f7b41ec30ae87eb30f900c717e440affbb0a843a817453759c893ff
\ No newline at end of file
diff --git a/db/schema_migrations/20250123195300 b/db/schema_migrations/20250123195300
new file mode 100644
index 00000000000..6f1b125744b
--- /dev/null
+++ b/db/schema_migrations/20250123195300
@@ -0,0 +1 @@
+19b415bfd61c7f2d64f71e129490c2283c93bac7d295879e7dc4b451b7a04ed0
\ No newline at end of file
diff --git a/db/schema_migrations/20250123195400 b/db/schema_migrations/20250123195400
new file mode 100644
index 00000000000..83267d9c42a
--- /dev/null
+++ b/db/schema_migrations/20250123195400
@@ -0,0 +1 @@
+bb55a393c82125013ebaaf13e91a51daaa4a4ff2aad015f97383d33fbe1db3a4
\ No newline at end of file
diff --git a/db/schema_migrations/20250123195500 b/db/schema_migrations/20250123195500
new file mode 100644
index 00000000000..5b29260bf56
--- /dev/null
+++ b/db/schema_migrations/20250123195500
@@ -0,0 +1 @@
+9820c0c7b88c3454ad3482f0af37f83c28e795618f0172cff6533c49ac17b7ee
\ No newline at end of file
diff --git a/db/schema_migrations/20250123201951 b/db/schema_migrations/20250123201951
new file mode 100644
index 00000000000..d0c3f60bc9f
--- /dev/null
+++ b/db/schema_migrations/20250123201951
@@ -0,0 +1 @@
+13ac6fc0f2cbee82eb4fda9b27c9c92a47abde9fc8512b1d3a9ec2d8e2e813d7
\ No newline at end of file
diff --git a/db/schema_migrations/20250123202635 b/db/schema_migrations/20250123202635
new file mode 100644
index 00000000000..6e773f25c1b
--- /dev/null
+++ b/db/schema_migrations/20250123202635
@@ -0,0 +1 @@
+8aa07ff2b7917401b35fe69967c19444e49f2858af9ea390e8b1475b426adb5c
\ No newline at end of file
diff --git a/db/schema_migrations/20250123202841 b/db/schema_migrations/20250123202841
new file mode 100644
index 00000000000..03d10168135
--- /dev/null
+++ b/db/schema_migrations/20250123202841
@@ -0,0 +1 @@
+1d22128d9daaf82a9ab7144e8a2b71724bc3c75bcbe5c46adce1b6373c561770
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index b75323ba2ed..cb55bdb0bc8 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -9037,7 +9037,10 @@ ALTER SEQUENCE batched_background_migrations_id_seq OWNED BY batched_background_
 CREATE TABLE board_assignees (
     id bigint NOT NULL,
     board_id bigint NOT NULL,
-    assignee_id bigint NOT NULL
+    assignee_id bigint NOT NULL,
+    group_id bigint,
+    project_id bigint,
+    CONSTRAINT check_b56ef26337 CHECK ((num_nonnulls(group_id, project_id) = 1))
 );
 
 CREATE SEQUENCE board_assignees_id_seq
@@ -31018,6 +31021,10 @@ CREATE INDEX index_board_assignees_on_assignee_id ON board_assignees USING btree
 
 CREATE UNIQUE INDEX index_board_assignees_on_board_id_and_assignee_id ON board_assignees USING btree (board_id, assignee_id);
 
+CREATE INDEX index_board_assignees_on_group_id ON board_assignees USING btree (group_id);
+
+CREATE INDEX index_board_assignees_on_project_id ON board_assignees USING btree (project_id);
+
 CREATE INDEX index_board_group_recent_visits_on_board_id ON board_group_recent_visits USING btree (board_id);
 
 CREATE INDEX index_board_group_recent_visits_on_group_id ON board_group_recent_visits USING btree (group_id);
@@ -37901,6 +37908,9 @@ ALTER TABLE ONLY deployment_approvals
 ALTER TABLE ONLY project_pages_metadata
     ADD CONSTRAINT fk_0fd5b22688 FOREIGN KEY (pages_deployment_id) REFERENCES pages_deployments(id) ON DELETE SET NULL;
 
+ALTER TABLE ONLY board_assignees
+    ADD CONSTRAINT fk_105c1d6d08 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY audit_events_streaming_event_type_filters
     ADD CONSTRAINT fk_107946dffb FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
@@ -38354,6 +38364,9 @@ ALTER TABLE ONLY approval_group_rules_protected_branches
 ALTER TABLE ONLY project_compliance_standards_adherence
     ADD CONSTRAINT fk_4fd1d9d9b0 FOREIGN KEY (namespace_id) REFERENCES namespaces(id) ON DELETE SET NULL;
 
+ALTER TABLE ONLY board_assignees
+    ADD CONSTRAINT fk_50159bc755 FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY approval_group_rules_groups
     ADD CONSTRAINT fk_50edc8134e FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
diff --git a/doc/.vale/gitlab_base/Substitutions.yml b/doc/.vale/gitlab_base/Substitutions.yml
index 0ead491c422..5f5b534a85c 100644
--- a/doc/.vale/gitlab_base/Substitutions.yml
+++ b/doc/.vale/gitlab_base/Substitutions.yml
@@ -61,8 +61,8 @@ swap:
   reporter permission: the Reporter role
   reporter permissions: the Reporter role
   rubocop: RuboCop
-  self hosted GitLab: GitLab self-managed # https://docs.gitlab.com/ee/development/documentation/styleguide/word_list.html#gitlab-self-managed
-  self-hosted GitLab: GitLab self-managed # https://docs.gitlab.com/ee/development/documentation/styleguide/word_list.html#gitlab-self-managed
+  self hosted GitLab: GitLab Self-Managed # https://docs.gitlab.com/ee/development/documentation/styleguide/word_list.html#gitlab-self-managed
+  self-hosted GitLab: GitLab Self-Managed # https://docs.gitlab.com/ee/development/documentation/styleguide/word_list.html#gitlab-self-managed
   styleguide: style guide
   the administrator access level: administrator access
   to login: to log in
diff --git a/doc/administration/admin_area.md b/doc/administration/admin_area.md
index 9d14a69a5a5..f4168c21868 100644
--- a/doc/administration/admin_area.md
+++ b/doc/administration/admin_area.md
@@ -167,7 +167,7 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** GitLab Self-Managed, GitLab Dedicated
 
-An administrator can export user permissions for all users in the GitLab instance from the **Admin** area's Users page.
+An administrator can export user permissions for all active users in the GitLab instance from the **Admin** area's Users page.
 The export lists direct membership the users have in groups and projects.
 
 The export process exports the first 100,000 users, and includes this data:
diff --git a/doc/administration/self_hosted_models/supported_llm_serving_platforms.md b/doc/administration/self_hosted_models/supported_llm_serving_platforms.md
index e5423bd335b..047602496d2 100644
--- a/doc/administration/self_hosted_models/supported_llm_serving_platforms.md
+++ b/doc/administration/self_hosted_models/supported_llm_serving_platforms.md
@@ -31,18 +31,12 @@ For more information on:
 
 - vLLM supported models, see the [vLLM Supported Models documentation](https://docs.vllm.ai/en/latest/models/supported_models.html).
 - Available options when using vLLM to run a model, see the [vLLM documentation on engine arguments](https://docs.vllm.ai/en/stable/usage/engine_args.html).
+- The hardware needed for the models, see the [Supported models and Hardware requirements documentation](supported_llm_serving_platforms.md).
 
 Examples:
 
 #### Mistral-7B-Instruct-v0.2
 
-Mistral-7B-Instruct-v0.3 requires at least:
-
-- 55GB of disk memory for storage
-- 35 GB of GPU vRAM for serving.
-
-With a `a2-highgpu-2g` machine on GCP or equivalent (2x Nvidia A100 40GB - 150 GB vRAM), the model is expected to infer requests at the rate of 250 tokens per second.
-
 1. Download the model from HuggingFace:
 
    ```shell
@@ -63,13 +57,6 @@ With a `a2-highgpu-2g` machine on GCP or equivalent (2x Nvidia A100 40GB - 150 G
 
 #### Mixtral-8x7B-Instruct-v0.1
 
-Mistral-7B-Instruct-v0.3 requires at least:
-
-- 355 GB of disk memory for storage
-- 210 GB of GPU vRAM for serving.
-
-You should at least a `a2-highgpu-4g` machine on GCP or equivalent (4x Nvidia A100 40GB - 340 GB vRAM). With this configuration, the model is expected to infer requests at the rate of 25 tokens per second.
-
 1. Download the model from HuggingFace:
 
    ```shell
diff --git a/doc/administration/self_hosted_models/supported_models_and_hardware_requirements.md b/doc/administration/self_hosted_models/supported_models_and_hardware_requirements.md
index 0e5ef43373b..2cd331563b5 100644
--- a/doc/administration/self_hosted_models/supported_models_and_hardware_requirements.md
+++ b/doc/administration/self_hosted_models/supported_models_and_hardware_requirements.md
@@ -73,12 +73,55 @@ The following hardware specifications are the minimum requirements for running s
 
 ### GPU requirements by model size
 
-| Model size | Minimum GPU configuration | Minimum VRAM required |
-|------------|------------------------------|---------------------|
-| 7B models<br>(for example, Mistral 7B) | 1x NVIDIA A100 (40GB) | 24 GB |
-| 22B models<br>(for example, Codestral 22B) | 2x NVIDIA A100 (80GB) | 90 GB |
-| Mixtral 8x7B | 2x NVIDIA A100 (80GB) | 100 GB |
-| Mixtral 8x22B | 8x NVIDIA A100 (80GB) | 300 GB |
+| Model size                                 | Minimum GPU configuration | Minimum VRAM required |
+|--------------------------------------------|---------------------------|-----------------------|
+| 7B models<br>(for example, Mistral 7B)     | 1x NVIDIA A100 (40GB)     | 35 GB                 |
+| 22B models<br>(for example, Codestral 22B) | 2x NVIDIA A100 (80GB)     | 110 GB                |
+| Mixtral 8x7B                               | 2x NVIDIA A100 (80GB)     | 220 GB                |
+| Mixtral 8x22B                              | 8x NVIDIA A100 (80GB)     | 526 GB                |
+
+Use [Hugging Face's memory utility](https://huggingface.co/spaces/hf-accelerate/model-memory-usage) to verify memory requirements.
+
+### Response time by model size and GPU
+
+#### Small machine
+
+With a `a2-highgpu-2g` (2x Nvidia A100 40 GB - 150 GB vRAM) or equivalent:
+
+| Model name               | Number of requests | Average time per request (sec) | Average tokens in response | Average tokens per second per request | Total time for requests | Total TPS |
+|--------------------------|--------------------|------------------------------|----------------------------|---------------------------------------|-------------------------|-----------|
+| Mistral-7B-Instruct-v0.3 | 1                  | 7.09                         | 717.0                      | 101.19                                | 7.09                    | 101.17    |
+| Mistral-7B-Instruct-v0.3 | 10                 | 8.41                         | 764.2                      | 90.35                                 | 13.70                   | 557.80    |
+| Mistral-7B-Instruct-v0.3 | 100                | 13.97                        | 693.23                     | 49.17                                 | 20.81                   | 3331.59   |
+
+#### Medium machine
+
+With a `a2-ultragpu-4g` (4x Nvidia A100 40 GB - 340 GB vRAM) machine on GCP or equivalent:
+
+| Model name                 | Number of requests | Average time per request (sec) | Average tokens in response | Average tokens per second per request | Total time for requests | Total TPS |
+|----------------------------|--------------------|------------------------------|----------------------------|---------------------------------------|-------------------------|-----------|
+| Mistral-7B-Instruct-v0.3   | 1                  | 3.80                         | 499.0                      | 131.25                                | 3.80                    | 131.23    |
+| Mistral-7B-Instruct-v0.3   | 10                 | 6.00                         | 740.6                      | 122.85                                | 8.19                    | 904.22    |
+| Mistral-7B-Instruct-v0.3   | 100                | 11.71                        | 695.71                     | 59.06                                 | 15.54                   | 4477.34   |
+| Mixtral-8x7B-Instruct-v0.1 | 1                  | 6.50                         | 400.0                      | 61.55                                 | 6.50                    | 61.53     |
+| Mixtral-8x7B-Instruct-v0.1 | 10                 | 16.58                        | 768.9                      | 40.33                                 | 32.56                   | 236.13    |
+| Mixtral-8x7B-Instruct-v0.1 | 100                | 25.90                        | 767.38                     | 26.87                                 | 55.57                   | 1380.68   |
+
+#### Large machine
+
+With a `a2-ultragpu-8g` (8 x NVIDIA A100 80 GB - 1360 GB vRAM) machine on GCP or equivalent:
+
+| Model name                  | Number of requests | Average time per request (sec) | Average tokens in response | Average tokens per second per request | Total time for requests (sec) | Total TPS |
+|-----------------------------|--------------------|------------------------------|----------------------------|---------------------------------------|-----------------------------|-----------|
+| Mistral-7B-Instruct-v0.3    | 1                  | 3.23                         | 479.0                      | 148.41                                | 3.22                        | 148.36    |
+| Mistral-7B-Instruct-v0.3    | 10                 | 4.95                         | 678.3                      | 135.98                                | 6.85                        | 989.11    |
+| Mistral-7B-Instruct-v0.3    | 100                | 10.14                        | 713.27                     | 69.63                                 | 13.96                       | 5108.75   |
+| Mixtral-8x7B-Instruct-v0.1  | 1                  | 6.08                         | 709.0                      | 116.69                                | 6.07                        | 116.64    |
+| Mixtral-8x7B-Instruct-v0.1  | 10                 | 9.95                         | 645.0                      | 63.68                                 | 13.40                       | 481.06    |
+| Mixtral-8x7B-Instruct-v0.1  | 100                | 13.83                        | 585.01                     | 41.80                                 | 20.38                       | 2869.12   |
+| Mixtral-8x22B-Instruct-v0.1 | 1                  | 14.39                        | 828.0                      | 57.56                                 | 14.38                       | 57.55     |
+| Mixtral-8x22B-Instruct-v0.1 | 10                 | 20.57                        | 629.7                      | 30.24                                 | 28.02                       | 224.71    |
+| Mixtral-8x22B-Instruct-v0.1 | 100                | 27.58                        | 592.49                     | 21.34                                 | 36.80                       | 1609.85   |
 
 ### AI Gateway Hardware Requirements
 
diff --git a/doc/api/alert_management_alerts.md b/doc/api/alert_management_alerts.md
index 9d8e4f053a9..ae688e9f05a 100644
--- a/doc/api/alert_management_alerts.md
+++ b/doc/api/alert_management_alerts.md
@@ -11,7 +11,7 @@ DETAILS:
 **Offering:** GitLab.com, GitLab Self-Managed, GitLab Dedicated
 
 The Alert Management alerts API is limited to metric images. For more API endpoints, see the
-[GraphQL API](graphql/reference/index.md#alertmanagementalert).
+[GraphQL API](graphql/reference/_index.md#alertmanagementalert).
 
 ## Upload metric image
 
diff --git a/doc/api/dora/metrics.md b/doc/api/dora/metrics.md
index 7da99f1d6d1..eb95432775a 100644
--- a/doc/api/dora/metrics.md
+++ b/doc/api/dora/metrics.md
@@ -10,7 +10,7 @@ DETAILS:
 **Tier:** Ultimate
 **Offering:** GitLab.com, GitLab Self-Managed, GitLab Dedicated
 
-You can also retrieve [DORA metrics](../../user/analytics/dora_metrics.md) with the [GraphQL API](../../api/graphql/reference/index.md).
+You can also retrieve [DORA metrics](../../user/analytics/dora_metrics.md) with the [GraphQL API](../../api/graphql/reference/_index.md).
 
 All methods require at least the Reporter role.
 
diff --git a/doc/api/get_started/get_started_extending.md b/doc/api/get_started/get_started_extending.md
index 8c8dbbf0ca3..25f40bc69cb 100644
--- a/doc/api/get_started/get_started_extending.md
+++ b/doc/api/get_started/get_started_extending.md
@@ -68,7 +68,7 @@ Then use the API to automate tasks, like creating projects and adding members to
 For more information, see:
 
 - [The REST API](../api_resources.md)
-- [The GraphQL API](../graphql/reference/index.md)
+- [The GraphQL API](../graphql/reference/_index.md)
 
 ## Step 4: Use the GitLab CLI
 
diff --git a/doc/api/graphql/assign_gitlab_duo_seats.md b/doc/api/graphql/assign_gitlab_duo_seats.md
index b850d495e5c..da526733267 100644
--- a/doc/api/graphql/assign_gitlab_duo_seats.md
+++ b/doc/api/graphql/assign_gitlab_duo_seats.md
@@ -89,5 +89,5 @@ You can use [GraphiQL](https://gitlab.com/-/graphql-explorer) to assign seats to
 
 ## Related topics
 
-- [GraphQL API Resources](reference/index.md)
+- [GraphQL API Resources](reference/_index.md)
 - [GraphQL specific entities, like fragments and interfaces](https://graphql.org/learn/)
diff --git a/doc/api/graphql/audit_report.md b/doc/api/graphql/audit_report.md
index 3ba63f27cfa..249eefdad7e 100644
--- a/doc/api/graphql/audit_report.md
+++ b/doc/api/graphql/audit_report.md
@@ -113,5 +113,5 @@ the output includes:
 
 ## Related topics
 
-- [GraphQL API reference](reference/index.md)
+- [GraphQL API reference](reference/_index.md)
 - [GraphQL-specific entities, like fragments and interfaces](https://graphql.org/learn/)
diff --git a/doc/api/graphql/branch_rules.md b/doc/api/graphql/branch_rules.md
index 70dcf38de70..64bd28c251b 100644
--- a/doc/api/graphql/branch_rules.md
+++ b/doc/api/graphql/branch_rules.md
@@ -134,4 +134,4 @@ Instead of requesting access, it may be easier for you to run the query in the
 
 ## Related topics
 
-- [GraphQL API reference](reference/index.md)
+- [GraphQL API reference](reference/_index.md)
diff --git a/doc/api/graphql/custom_emoji.md b/doc/api/graphql/custom_emoji.md
index 43b8bb3c971..3a89713beb7 100644
--- a/doc/api/graphql/custom_emoji.md
+++ b/doc/api/graphql/custom_emoji.md
@@ -72,5 +72,5 @@ You can use GraphiQL to query the emoji for a group.
 
 ## Related topics
 
-- [GraphQL API reference](reference/index.md)
+- [GraphQL API reference](reference/_index.md)
 - [GraphQL-specific entities, like fragments and interfaces](https://graphql.org/learn/)
diff --git a/doc/api/graphql/epic_work_items_api_migration_guide.md b/doc/api/graphql/epic_work_items_api_migration_guide.md
index 36bc67199e0..5c72c3aa6e6 100644
--- a/doc/api/graphql/epic_work_items_api_migration_guide.md
+++ b/doc/api/graphql/epic_work_items_api_migration_guide.md
@@ -12,7 +12,7 @@ DETAILS:
 **Status:** Beta
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/9290) in GitLab 17.2 [with a flag](../../administration/feature_flags.md) named `work_item_epics`. Disabled by default. Your administrator must have [enabled the new look for epics](../../user/group/epics/epic_work_items.md). This feature is in [beta](../../policy/development_stages_support.md#beta).
-> - Listing epics using the [GraphQL API](reference/index.md) [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12852) in GitLab 17.4.
+> - Listing epics using the [GraphQL API](reference/_index.md) [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12852) in GitLab 17.4.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/470685) in GitLab 17.6.
 > - [Enabled by default on GitLab Self-Managed and GitLab Dedicated](https://gitlab.com/gitlab-org/gitlab/-/issues/468310) in GitLab 17.7.
 
@@ -20,7 +20,7 @@ In GitLab 17.2, we introduced [epics as work items](../../user/group/epics/epic_
 
 To ensure that your integrations continue working:
 
-- If you use the [Epic GraphQL API](reference/index.md#epic), migrate to the Work Item API before GitLab 18.0, when the Epic GraphQL API is removed.
+- If you use the [Epic GraphQL API](reference/_index.md#epic), migrate to the Work Item API before GitLab 18.0, when the Epic GraphQL API is removed.
 - If you use the [REST API](../epics.md), you can continue using it, but you should migrate to future-proof your integrations.
 - For new features (such as assignees, health status, linked items with other types), you must
   use the `WorkItem` GraphQL API.
@@ -45,7 +45,7 @@ The `WorkItem` GraphQL API:
 - Will be [generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/500620) before GitLab 18.0
 - Is planned to exit [experimental status](https://gitlab.com/gitlab-org/gitlab/-/issues/500620) before GitLab 18.0.
 
-The [Epic GraphQL API](reference/index.md#epic) is planned for removal in GitLab 18.0.
+The [Epic GraphQL API](reference/_index.md#epic) is planned for removal in GitLab 18.0.
 
 ## Migrate to the Work Item API
 
@@ -277,7 +277,7 @@ The following example demonstrates how to query an epic's:
 - Health status
 - Start and due dates
 
-For all available widgets, see [Work Item widget reference](reference/index.md#workitemwidget).
+For all available widgets, see [Work Item widget reference](reference/_index.md#workitemwidget).
 
 To query epics with widgets:
 
diff --git a/doc/api/graphql/getting_started.md b/doc/api/graphql/getting_started.md
index f705af6f7b5..f763a0b509d 100644
--- a/doc/api/graphql/getting_started.md
+++ b/doc/api/graphql/getting_started.md
@@ -106,7 +106,7 @@ In the GitLab GraphQL API, `id` refers to a
 which is an object identifier in the format of `"gid://gitlab/Issue/123"`.
 For more information, see [Global IDs](index.md#global-ids).
 
-[GitLab GraphQL Schema](reference/index.md) outlines which objects and fields are
+[GitLab GraphQL Schema](reference/_index.md) outlines which objects and fields are
 available for clients to query and their corresponding data types.
 
 Example: Get only the names of all the projects the currently authenticated user can
diff --git a/doc/api/graphql/index.md b/doc/api/graphql/index.md
index 68e84382c66..10771344ff5 100644
--- a/doc/api/graphql/index.md
+++ b/doc/api/graphql/index.md
@@ -24,7 +24,7 @@ The GraphQL API is [versionless](https://graphql.org/learn/best-practices/#versi
 
 If you're new to the GitLab GraphQL API, see [Get started with GitLab GraphQL API](getting_started.md).
 
-You can view the available resources in the [GraphQL API reference](reference/index.md).
+You can view the available resources in the [GraphQL API reference](reference/_index.md).
 
 The GitLab GraphQL API endpoint is located at `/api/graphql`.
 
@@ -66,9 +66,6 @@ If the authentication information is not valid, GitLab returns an error message
 
 #### Token authentication
 
-> - Authentication method restrictions [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150407) in GitLab 17.0 [with a flag](../../administration/feature_flags.md) named `graphql_minimal_auth_methods` and backported to GitLab 17.0.3 and GitLab 16.11.5. Disabled by default in 17.0.
-> - Flag enabled by default in 17.0.3 and 16.11.5, therefore restrictions are enforced in these versions and later.
-
 Use any of the following tokens to authenticate with the GraphQL API:
 
 - [OAuth 2.0 tokens](../../api/oauth2.md)
@@ -190,7 +187,7 @@ You should not expect that a cached Global ID will be valid beyond the time of a
 
 ## Available top-level queries
 
-The top-level entry points for all queries are defined in the [`Query` type](reference/index.md#query-type) in the
+The top-level entry points for all queries are defined in the [`Query` type](reference/_index.md#query-type) in the
 GraphQL reference.
 
 ### Multiplex queries
@@ -218,7 +215,7 @@ For GitLab Self-Managed, [downgrading](../../downgrade_ee_to_ce/index.md) from a
 
 ### Breaking change exemptions
 
-Schema items labeled as experiments in the [GraphQL API reference](reference/index.md)
+Schema items labeled as experiments in the [GraphQL API reference](reference/_index.md)
 are exempt from the deprecation process. These items can be removed or changed at any
 time without notice.
 
@@ -252,7 +249,7 @@ removed entirely during the next `XX.0` major release.
 Items are marked as deprecated in:
 
 - The [schema](https://spec.graphql.org/October2021/#sec--deprecated).
-- The [GraphQL API reference](reference/index.md).
+- The [GraphQL API reference](reference/_index.md).
 - The [deprecation feature removal schedule](../../update/deprecations.md), which is linked from release posts.
 - Introspection queries of the GraphQL API.
 
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/_index.md
similarity index 99%
rename from doc/api/graphql/reference/index.md
rename to doc/api/graphql/reference/_index.md
index aee3983c204..d9962dffcdd 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/_index.md
@@ -2,6 +2,7 @@
 stage: Foundations
 group: Import and Integrate
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+title: GraphQL API resources
 ---
 
 <!--
@@ -14,8 +15,6 @@ info: To determine the technical writer assigned to the Stage/Group associated w
   or check the `compile_docs` task in `lib/tasks/gitlab/graphql.rake`.
 -->
 
-# GraphQL API resources
-
 This documentation is self-generated based on GitLab current GraphQL schema.
 
 The API can be explored using the [interactive GraphQL explorer](../index.md#interactive-graphql-explorer). Developers can also [generate a machine-readable GraphQL schema in IDL and JSON formats](../../../development/rake_tasks.md#update-machine-readable-schema-files).
@@ -13175,6 +13174,29 @@ The edge type for [`CiJob`](#cijob).
 | <a id="cijobedgecursor"></a>`cursor` | [`String!`](#string) | A cursor for use in pagination. |
 | <a id="cijobedgenode"></a>`node` | [`CiJob`](#cijob) | The item at the end of the edge. |
 
+#### `CiJobTokenAccessibleProjectConnection`
+
+The connection type for [`CiJobTokenAccessibleProject`](#cijobtokenaccessibleproject).
+
+##### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="cijobtokenaccessibleprojectconnectionedges"></a>`edges` | [`[CiJobTokenAccessibleProjectEdge]`](#cijobtokenaccessibleprojectedge) | A list of edges. |
+| <a id="cijobtokenaccessibleprojectconnectionnodes"></a>`nodes` | [`[CiJobTokenAccessibleProject]`](#cijobtokenaccessibleproject) | A list of nodes. |
+| <a id="cijobtokenaccessibleprojectconnectionpageinfo"></a>`pageInfo` | [`PageInfo!`](#pageinfo) | Information to aid in pagination. |
+
+#### `CiJobTokenAccessibleProjectEdge`
+
+The edge type for [`CiJobTokenAccessibleProject`](#cijobtokenaccessibleproject).
+
+##### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="cijobtokenaccessibleprojectedgecursor"></a>`cursor` | [`String!`](#string) | A cursor for use in pagination. |
+| <a id="cijobtokenaccessibleprojectedgenode"></a>`node` | [`CiJobTokenAccessibleProject`](#cijobtokenaccessibleproject) | The item at the end of the edge. |
+
 #### `CiJobTokenAuthLogConnection`
 
 The connection type for [`CiJobTokenAuthLog`](#cijobtokenauthlog).
@@ -21236,6 +21258,21 @@ CI/CD variables for a GitLab instance.
 | <a id="cijobartifactname"></a>`name` | [`String`](#string) | File name of the artifact. |
 | <a id="cijobartifactsize"></a>`size` | [`BigInt!`](#bigint) | Size of the artifact in bytes. |
 
+### `CiJobTokenAccessibleProject`
+
+Project that can access the current project by authenticating with a CI/CD job token.
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="cijobtokenaccessibleprojectavatarurl"></a>`avatarUrl` | [`String`](#string) | URL to avatar image file of the project. |
+| <a id="cijobtokenaccessibleprojectfullpath"></a>`fullPath` | [`ID!`](#id) | Full path of the project. |
+| <a id="cijobtokenaccessibleprojectid"></a>`id` | [`ID!`](#id) | ID of the project. |
+| <a id="cijobtokenaccessibleprojectname"></a>`name` | [`String!`](#string) | Name of the project (without namespace). |
+| <a id="cijobtokenaccessibleprojectpath"></a>`path` | [`String!`](#string) | Path of the project. |
+| <a id="cijobtokenaccessibleprojectweburl"></a>`webUrl` | [`String`](#string) | Web URL of the project. |
+
 ### `CiJobTokenAuthLog`
 
 #### Fields
@@ -21243,7 +21280,7 @@ CI/CD variables for a GitLab instance.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cijobtokenauthloglastauthorizedat"></a>`lastAuthorizedAt` **{warning-solid}** | [`Time!`](#time) | **Introduced** in GitLab 17.6. **Status**: Experiment. Last authorization date time. |
-| <a id="cijobtokenauthlogoriginproject"></a>`originProject` **{warning-solid}** | [`Project!`](#project) | **Introduced** in GitLab 17.6. **Status**: Experiment. Origin project. |
+| <a id="cijobtokenauthlogoriginproject"></a>`originProject` **{warning-solid}** | [`CiJobTokenAccessibleProject!`](#cijobtokenaccessibleproject) | **Introduced** in GitLab 17.6. **Status**: Experiment. Origin project. |
 
 ### `CiJobTokenScopeAllowlist`
 
@@ -21280,7 +21317,7 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 | <a id="cijobtokenscopetypegroupallowlistautopopulatedids"></a>`groupAllowlistAutopopulatedIds` | [`[GroupID!]!`](#groupid) | List of IDs of groups which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allowlist of groups that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypegroupsallowlistcount"></a>`groupsAllowlistCount` | [`Int!`](#int) | Count of groups that can access the current project by authenticating with a CI/CD job token. The count does not include subgroups. |
-| <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`CiJobTokenAccessibleProjectConnection!`](#cijobtokenaccessibleprojectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypeinboundallowlistautopopulatedids"></a>`inboundAllowlistAutopopulatedIds` | [`[ProjectID!]!`](#projectid) | List of IDs of projects which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypeinboundallowlistcount"></a>`inboundAllowlistCount` | [`Int!`](#int) | Count of projects that can access the current project by authenticating with a CI/CD job token. The count does not include nested projects. |
 | <a id="cijobtokenscopetypeoutboundallowlist"></a>`outboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allow list of projects that are accessible using the current project's CI Job tokens. (see [Connections](#connections)) |
@@ -44112,8 +44149,8 @@ Represents an object that is the target of a CI_JOB_TOKEN allowlist entry.
 
 One of:
 
+- [`CiJobTokenAccessibleProject`](#cijobtokenaccessibleproject)
 - [`Group`](#group)
-- [`Project`](#project)
 
 #### `CiRunnerCloudProvisioning`
 
diff --git a/doc/api/graphql/sample_issue_boards.md b/doc/api/graphql/sample_issue_boards.md
index df4c26a27b8..ea774e1e26a 100644
--- a/doc/api/graphql/sample_issue_boards.md
+++ b/doc/api/graphql/sample_issue_boards.md
@@ -55,4 +55,4 @@ https://gitlab.com/gitlab-org/gitlab-docs/-/boards/105011
 
 ## Related topics
 
-- [GraphQL API reference](reference/index.md)
+- [GraphQL API reference](reference/_index.md)
diff --git a/doc/api/graphql/users_example.md b/doc/api/graphql/users_example.md
index 6f40b7b8aba..ee744188bbf 100644
--- a/doc/api/graphql/users_example.md
+++ b/doc/api/graphql/users_example.md
@@ -103,5 +103,5 @@ the output includes:
 
 ## Related topics
 
-- [GraphQL API reference](reference/index.md)
+- [GraphQL API reference](reference/_index.md)
 - [GraphQL-specific entities, like fragments and interfaces](https://graphql.org/learn/)
diff --git a/doc/api/group_import_export.md b/doc/api/group_import_export.md
index f9bd05dd9f5..874a4a3481b 100644
--- a/doc/api/group_import_export.md
+++ b/doc/api/group_import_export.md
@@ -94,7 +94,7 @@ returns either:
 
 ## Import a file
 
-The maximum import file size can be set by the Administrator on self-managed instances (default is `0` (unlimited)).
+The maximum import file size can be set by the Administrator on GitLab Self-Managed (default is `0` (unlimited)).
 As an administrator, you can modify the maximum import file size either:
 
 - In the [**Admin** area](../administration/settings/import_and_export_settings.md).
diff --git a/doc/api/group_service_accounts.md b/doc/api/group_service_accounts.md
index 3536b9f1c8f..f5a28e59d62 100644
--- a/doc/api/group_service_accounts.md
+++ b/doc/api/group_service_accounts.md
@@ -14,7 +14,7 @@ Use this API to interact with service accounts for your groups. For more informa
 
 Prerequisites:
 
-- You must have administrator access to the self-managed instance, or have the Owner role for the GitLab.com group.
+- You must have administrator access to the instance, or have the Owner role for the GitLab.com group.
 
 ## List all service account users
 
diff --git a/doc/api/groups.md b/doc/api/groups.md
index 5ef2ef79679..75bc18a218e 100644
--- a/doc/api/groups.md
+++ b/doc/api/groups.md
@@ -1276,8 +1276,8 @@ Parameters:
 | `two_factor_grace_period`            | integer | no       | Time before Two-factor authentication is enforced (in hours). |
 | `visibility`                         | string  | no       | The group's visibility. Can be `private`, `internal`, or `public`. |
 | `membership_lock`                    | boolean | no       | Users cannot be added to projects in this group. Premium and Ultimate only. |
-| `extra_shared_runners_minutes_limit` | integer | no       | Can be set by administrators only. Additional compute minutes for this group. Self-managed, Premium and Ultimate only. |
-| `shared_runners_minutes_limit`       | integer | no       | Can be set by administrators only. Maximum number of monthly compute minutes for this group. Can be `nil` (default; inherit system default), `0` (unlimited), or `> 0`. Self-managed, Premium and Ultimate only. |
+| `extra_shared_runners_minutes_limit` | integer | no       | Can be set by administrators only. Additional compute minutes for this group. GitLab Self-Managed, Premium and Ultimate only. |
+| `shared_runners_minutes_limit`       | integer | no       | Can be set by administrators only. Maximum number of monthly compute minutes for this group. Can be `nil` (default; inherit system default), `0` (unlimited), or `> 0`. GitLab Self-Managed, Premium and Ultimate only. |
 | `wiki_access_level`                  | string  | no       | The wiki access level. Can be `disabled`, `private`, or `enabled`. Premium and Ultimate only. |
 | `duo_availability` | string | no | Duo availability setting. Valid values are: `default_on`, `default_off`, `never_on`. Note: In the UI, `never_on` is displayed as "Always Off". |
 | `experiment_features_enabled` | boolean | no | Enable experiment features for this group. |
@@ -1378,11 +1378,11 @@ PUT /groups/:id
 | `subgroup_creation_level`                            | string            | no       | Allowed to [create subgroups](../user/group/subgroups/index.md#create-a-subgroup). Can be `owner` (Owners), or `maintainer` (users with the Maintainer role). |
 | `two_factor_grace_period`                            | integer           | no       | Time before Two-factor authentication is enforced (in hours). |
 | `visibility`                                         | string            | no       | The visibility level of the group. Can be `private`, `internal`, or `public`. |
-| `extra_shared_runners_minutes_limit`                 | integer           | no       | Can be set by administrators only. Additional compute minutes for this group. Self-managed, Premium and Ultimate only. |
+| `extra_shared_runners_minutes_limit`                 | integer           | no       | Can be set by administrators only. Additional compute minutes for this group. GitLab Self-Managed, Premium and Ultimate only. |
 | `file_template_project_id`                           | integer           | no       | The ID of a project to load custom file templates from. Premium and Ultimate only. |
 | `membership_lock`                                    | boolean           | no       | Users cannot be added to projects in this group. Premium and Ultimate only. |
 | `prevent_forking_outside_group`                      | boolean           | no       | When enabled, users can **not** fork projects from this group to external namespaces. Premium and Ultimate only. |
-| `shared_runners_minutes_limit`                       | integer           | no       | Can be set by administrators only. Maximum number of monthly compute minutes for this group. Can be `nil` (default; inherit system default), `0` (unlimited), or `> 0`. Self-managed, Premium and Ultimate only. |
+| `shared_runners_minutes_limit`                       | integer           | no       | Can be set by administrators only. Maximum number of monthly compute minutes for this group. Can be `nil` (default; inherit system default), `0` (unlimited), or `> 0`. GitLab Self-Managed, Premium and Ultimate only. |
 | `unique_project_download_limit`                      | integer           | no       | Maximum number of unique projects a user can download in the specified time period before they are banned. Available only on top-level groups. Default: 0, Maximum: 10,000. Ultimate only. |
 | `unique_project_download_limit_interval_in_seconds`  | integer           | no       | Time period during which a user can download a maximum amount of projects before they are banned. Available only on top-level groups. Default: 0, Maximum: 864,000 seconds (10 days). Ultimate only. |
 | `unique_project_download_limit_allowlist`            | array of strings  | no       | List of usernames excluded from the unique project download limit. Available only on top-level groups. Default: `[]`, Maximum: 100 usernames. Ultimate only. |
@@ -1395,8 +1395,8 @@ PUT /groups/:id
 | `experiment_features_enabled`                        | boolean | no | Enable experiment features for this group. |
 | `math_rendering_limits_enabled`                      | boolean           | no       | Indicates if math rendering limits are used for this group. |
 | `lock_math_rendering_limits_enabled`                 | boolean           | no       | Indicates if math rendering limits are locked for all descendent groups. |
-| `duo_features_enabled`                               | boolean           | no       | Indicates whether GitLab Duo features are enabled for this group. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. Self-managed, Premium and Ultimate only. |
-| `lock_duo_features_enabled`                          | boolean           | no       | Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. Self-managed, Premium and Ultimate only. |
+| `duo_features_enabled`                               | boolean           | no       | Indicates whether GitLab Duo features are enabled for this group. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
+| `lock_duo_features_enabled`                          | boolean           | no       | Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
 | `max_artifacts_size`                                 | integer           | No       | The maximum file size in megabytes for individual job artifacts. |
 
 NOTE:
diff --git a/doc/api/member_roles.md b/doc/api/member_roles.md
index 1d2408bda35..8a0e9c27660 100644
--- a/doc/api/member_roles.md
+++ b/doc/api/member_roles.md
@@ -27,7 +27,7 @@ DETAILS:
 > - Allow to create and remove an instance-wide custom role on GitLab Self-Managed [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/141562) in GitLab 16.9.
 > - [Admin security testing introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/176628) in GitLab 17.9 [with a flag](../administration/feature_flags.md) named `custom_ability_admin_security_testing`. Disabled by default.
 
-Use this API to interact with member roles for your GitLab.com groups or entire self-managed instance.
+Use this API to interact with member roles for your GitLab.com groups or entire GitLab Self-Managed instance.
 
 ## Manage instance member roles
 
diff --git a/doc/api/merge_request_approvals.md b/doc/api/merge_request_approvals.md
index 2d5a6bd4ae2..1e8efc5ffcc 100644
--- a/doc/api/merge_request_approvals.md
+++ b/doc/api/merge_request_approvals.md
@@ -1391,7 +1391,7 @@ Supported attributes:
 | Attribute           | Type              | Required | Description |
 |---------------------|-------------------|----------|-------------|
 | `id`                | integer or string | Yes      | The ID or [URL-encoded path of a project](rest/index.md#namespaced-paths). |
-| `approval_password` | string            | No       | Current user's password. Required if [**Require user re-authentication to approve**](../user/project/merge_requests/approvals/settings.md#require-user-re-authentication-to-approve) is enabled in the project settings. Always fails if the group or self-managed instance is configured to force SAML authentication. |
+| `approval_password` | string            | No       | Current user's password. Required if [**Require user re-authentication to approve**](../user/project/merge_requests/approvals/settings.md#require-user-re-authentication-to-approve) is enabled in the project settings. Always fails if the group or GitLab Self-Managed instance is configured to force SAML authentication. |
 | `merge_request_iid` | integer           | Yes      | The IID of the merge request. |
 | `sha`               | string            | No       | The `HEAD` of the merge request. |
 
diff --git a/doc/api/project_vulnerabilities.md b/doc/api/project_vulnerabilities.md
index 240463aeaf9..f43ad28a0d2 100644
--- a/doc/api/project_vulnerabilities.md
+++ b/doc/api/project_vulnerabilities.md
@@ -20,7 +20,7 @@ WARNING:
 This API is in the process of being deprecated and considered unstable.
 The response payload may be subject to change or breakage
 across GitLab releases. Use the
-[GraphQL API](graphql/reference/index.md#queryvulnerabilities)
+[GraphQL API](graphql/reference/_index.md#queryvulnerabilities)
 instead.
 
 Every API call to vulnerabilities must be [authenticated](rest/authentication.md).
diff --git a/doc/api/rest/authentication.md b/doc/api/rest/authentication.md
index 36db2657644..eaa577ae51e 100644
--- a/doc/api/rest/authentication.md
+++ b/doc/api/rest/authentication.md
@@ -23,7 +23,7 @@ You can authenticate with the GitLab REST API in several ways:
 
 Project access tokens are supported by:
 
-- Self-managed: Free, Premium, and Ultimate.
+- GitLab Self-Managed: Free, Premium, and Ultimate.
 - GitLab.com: Premium and Ultimate.
 
 If you are an administrator, you or your application can authenticate as a specific user, using
diff --git a/doc/api/rest/index.md b/doc/api/rest/index.md
index 6a070c8e3b4..4402ee01c9f 100644
--- a/doc/api/rest/index.md
+++ b/doc/api/rest/index.md
@@ -292,7 +292,7 @@ curl --request GET --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab
 ```
 
 NOTE:
-There is a [max offset allowed limit](../../administration/instance_limits.md#max-offset-allowed-by-the-rest-api-for-offset-based-pagination) for offset pagination. You can change the limit in self-managed instances.
+There is a [max offset allowed limit](../../administration/instance_limits.md#max-offset-allowed-by-the-rest-api-for-offset-based-pagination) for offset pagination. You can change the limit in GitLab Self-Managed instances.
 
 #### Pagination `Link` header
 
diff --git a/doc/api/runners.md b/doc/api/runners.md
index 728a0d8df4b..e4b2e2d0376 100644
--- a/doc/api/runners.md
+++ b/doc/api/runners.md
@@ -90,7 +90,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -173,7 +173,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -269,7 +269,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 NOTE:
 The `version`, `revision`, `platform`, and `architecture` attributes in the response were deprecated
@@ -277,7 +277,7 @@ The `version`, `revision`, `platform`, and `architecture` attributes in the resp
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 These attributes will start returning an empty string in GitLab 18.0.
 The same attributes can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -364,7 +364,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -630,7 +630,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -693,7 +693,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
@@ -779,7 +779,7 @@ The `ip_address` attribute in the response was deprecated
 [a future version of the REST API](https://gitlab.com/gitlab-org/gitlab/-/issues/351109).
 This attribute will start returning an empty string in GitLab 17.0.
 The `ipAddress` attribute can be found inside the respective runner manager, currently only available through the GraphQL
-[`CiRunnerManager` type](graphql/reference/index.md#cirunnermanager).
+[`CiRunnerManager` type](graphql/reference/_index.md#cirunnermanager).
 
 Example response:
 
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 5966a440b11..bf9700ab88f 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -459,9 +459,9 @@ to configure other related settings. These requirements are
 | `default_projects_limit`                 | integer          | no                                   | Project limit per user. Default is `100000`. |
 | `default_snippet_visibility`             | string           | no                                   | What visibility level new snippets receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. |
 | `default_syntax_highlighting_theme`      | integer          | no                                   | Default syntax highlighting theme for users who are new or not signed in. See [IDs of available themes](https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/themes.rb#L16). |
-| `default_project_deletion_protection`    | boolean          | no                                   | Enable default project deletion protection so only administrators can delete projects. Default is `false`. Self-managed, Premium and Ultimate only. |
-| `delete_unconfirmed_users`               | boolean          | no                                   | Specifies whether users who have not confirmed their email should be deleted. Default is `false`. When set to `true`, unconfirmed users are deleted after `unconfirmed_users_delete_after_days` days. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352514) in GitLab 16.1. Self-managed, Premium and Ultimate only. |
-| `deletion_adjourned_period`              | integer          | no                                   | Number of days to wait before deleting a project or group that is marked for deletion. Value must be between `1` and `90`. Defaults to `7`. Self-managed, Premium and Ultimate only. |
+| `default_project_deletion_protection`    | boolean          | no                                   | Enable default project deletion protection so only administrators can delete projects. Default is `false`. GitLab Self-Managed, Premium and Ultimate only. |
+| `delete_unconfirmed_users`               | boolean          | no                                   | Specifies whether users who have not confirmed their email should be deleted. Default is `false`. When set to `true`, unconfirmed users are deleted after `unconfirmed_users_delete_after_days` days. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352514) in GitLab 16.1. GitLab Self-Managed, Premium and Ultimate only. |
+| `deletion_adjourned_period`              | integer          | no                                   | Number of days to wait before deleting a project or group that is marked for deletion. Value must be between `1` and `90`. Defaults to `7`. GitLab Self-Managed, Premium and Ultimate only. |
 | `diagramsnet_enabled`                    | boolean          | no                                   | (If enabled, requires `diagramsnet_url`) Enable [Diagrams.net integration](../administration/integration/diagrams_net.md). Default is `true`. |
 | `diagramsnet_url`                        | string           | required by: `diagramsnet_enabled`   | The Diagrams.net instance URL for integration. |
 | `diff_max_patch_bytes`                   | integer          | no                                   | Maximum [diff patch size](../administration/diff_limits.md), in bytes. |
@@ -469,7 +469,7 @@ to configure other related settings. These requirements are
 | `diff_max_lines`                         | integer          | no                                   | Maximum [lines in a diff](../administration/diff_limits.md). |
 | `disable_admin_oauth_scopes`             | boolean          | no                                   | Stops administrators from connecting their GitLab accounts to non-trusted OAuth 2.0 applications that have the `api`, `read_api`, `read_repository`, `write_repository`, `read_registry`, `write_registry`, or `sudo` scopes. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/375043) in GitLab 15.6. |
 | `disable_feed_token`                     | boolean          | no                                   | Disable display of RSS/Atom and calendar feed tokens. |
-| `disable_personal_access_tokens`          | boolean          | no                                   | Disable personal access tokens. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/384201) in GitLab 15.7. Self-managed, Premium and Ultimate only. There is no method available to enable a personal access token that's been disabled through the API. This is a [known issue](https://gitlab.com/gitlab-org/gitlab/-/issues/399233). For more information about available workarounds, see [Workaround](https://gitlab.com/gitlab-org/gitlab/-/issues/399233#workaround).      |
+| `disable_personal_access_tokens`          | boolean          | no                                   | Disable personal access tokens. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/384201) in GitLab 15.7. GitLab Self-Managed, Premium and Ultimate only. There is no method available to enable a personal access token that's been disabled through the API. This is a [known issue](https://gitlab.com/gitlab-org/gitlab/-/issues/399233). For more information about available workarounds, see [Workaround](https://gitlab.com/gitlab-org/gitlab/-/issues/399233#workaround).      |
 | `disabled_oauth_sign_in_sources`         | array of strings | no                                   | Disabled OAuth sign-in sources. |
 | `dns_rebinding_protection_enabled`       | boolean          | no                                   | Enforce DNS-rebinding attack protection. |
 | `domain_denylist_enabled`                | boolean          | no                                   | (**If enabled, requires:** `domain_denylist`) Allows blocking sign-ups from emails from specific domains. |
@@ -528,8 +528,8 @@ to configure other related settings. These requirements are
 | `file_template_project_id`               | integer          | no                                   | The ID of a project to load custom file templates from. Premium and Ultimate only. |
 | `first_day_of_week`                      | integer          | no                                   | Start day of the week for calendar views and date pickers. Valid values are `0` (default) for Sunday, `1` for Monday, and `6` for Saturday. |
 | `globally_allowed_ips`                   | string           | no                                   | Comma-separated list of IP addresses and CIDRs always allowed for inbound traffic. For example, `1.1.1.1, 2.2.2.0/24`. |
-| `geo_node_allowed_ips`                   | string           | yes                                  | Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. Self-managed, Premium and Ultimate only. |
-| `geo_status_timeout`                     | integer          | no                                   | The amount of seconds after which a request to get a secondary node status times out. Self-managed, Premium and Ultimate only. |
+| `geo_node_allowed_ips`                   | string           | yes                                  | Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, `1.1.1.1, 2.2.2.0/24`. GitLab Self-Managed, Premium and Ultimate only. |
+| `geo_status_timeout`                     | integer          | no                                   | The amount of seconds after which a request to get a secondary node status times out. GitLab Self-Managed, Premium and Ultimate only. |
 | `git_two_factor_session_expiry`          | integer          | no                                   | Maximum duration (in minutes) of a session for Git operations when 2FA is enabled. Premium and Ultimate only. |
 | `gitaly_timeout_default`                 | integer          | no                                   | Default Gitaly timeout, in seconds. This timeout is not enforced for Git fetch/push operations or Sidekiq jobs. Set to `0` to disable timeouts. |
 | `gitaly_timeout_fast`                    | integer          | no                                   | Gitaly fast operation timeout, in seconds. Some Gitaly operations are expected to be fast. If they exceed this threshold, there may be a problem with a storage shard and 'failing fast' can help maintain the stability of the GitLab instance. Set to `0` to disable timeouts. |
@@ -540,7 +540,7 @@ to configure other related settings. These requirements are
 | `grafana_enabled`                        | boolean          | no                                   | Enable Grafana. |
 | `grafana_url`                            | string           | no                                   | Grafana URL. |
 | `gravatar_enabled`                       | boolean          | no                                   | Enable Gravatar. |
-| `group_owners_can_manage_default_branch_protection` | boolean | no                                 | Prevent overrides of default branch protection. Self-managed, Premium and Ultimate only.|
+| `group_owners_can_manage_default_branch_protection` | boolean | no                                 | Prevent overrides of default branch protection. GitLab Self-Managed, Premium and Ultimate only.|
 | `hashed_storage_enabled`                 | boolean          | no                                   | Create new projects using hashed storage paths: Enable immutable, hash-based paths and repository names to store repositories on disk. This prevents repositories from having to be moved or renamed when the Project URL changes and may improve disk I/O performance. (Always enabled in GitLab versions 13.0 and later, configuration is scheduled for removal in 14.0) |
 | `help_page_hide_commercial_content`      | boolean          | no                                   | Hide marketing-related entries from help. |
 | `help_page_support_url`                  | string           | no                                   | Alternate support URL for help page and help dropdown list. |
@@ -574,17 +574,17 @@ to configure other related settings. These requirements are
 | `max_import_remote_file_size`            | integer          | no                                   | Maximum remote file size for imports from external object storages. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/384976) in GitLab 16.3. |
 | `max_login_attempts`                     | integer          | no                                   | Maximum number of sign-in attempts before locking out the user. |
 | `max_pages_size`                         | integer          | no                                   | Maximum size of pages repositories in MB. |
-| `max_personal_access_token_lifetime`     | integer          | no                                   | Maximum allowable lifetime for access tokens in days. When left blank, default value of 365 is applied. When set, value must be 365 or less. When changed, existing access tokens with an expiration date beyond the maximum allowable lifetime are revoked. Self-managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be [extended to 400 days](https://gitlab.com/gitlab-org/gitlab/-/issues/461901) by enabling a [feature flag](../administration/feature_flags.md) named `buffered_token_expiration_limit`.|
-| `max_ssh_key_lifetime`                   | integer          | no                                   | Maximum allowable lifetime for SSH keys in days. Self-managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be [extended to 400 days](https://gitlab.com/gitlab-org/gitlab/-/issues/461901) by enabling a [feature flag](../administration/feature_flags.md) named `buffered_token_expiration_limit`.|
+| `max_personal_access_token_lifetime`     | integer          | no                                   | Maximum allowable lifetime for access tokens in days. When left blank, default value of 365 is applied. When set, value must be 365 or less. When changed, existing access tokens with an expiration date beyond the maximum allowable lifetime are revoked. GitLab Self-Managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be [extended to 400 days](https://gitlab.com/gitlab-org/gitlab/-/issues/461901) by enabling a [feature flag](../administration/feature_flags.md) named `buffered_token_expiration_limit`.|
+| `max_ssh_key_lifetime`                   | integer          | no                                   | Maximum allowable lifetime for SSH keys in days. GitLab Self-Managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be [extended to 400 days](https://gitlab.com/gitlab-org/gitlab/-/issues/461901) by enabling a [feature flag](../administration/feature_flags.md) named `buffered_token_expiration_limit`.|
 | `max_terraform_state_size_bytes`         | integer          | no                                   | Maximum size in bytes of the [Terraform state](../administration/terraform_state.md) files. Set this to 0 for unlimited file size. |
 | `metrics_method_call_threshold`          | integer          | no                                   | A method call is only tracked when it takes longer than the given amount of milliseconds. |
-| `max_number_of_repository_downloads`     | integer          | no                                   | Maximum number of unique repositories a user can download in the specified time period before they are banned. Default: 0, Maximum: 10,000 repositories. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87980) in GitLab 15.1. Self-managed, Ultimate only. |
-| `max_number_of_repository_downloads_within_time_period` | integer | no                             | Reporting time period (in seconds). Default: 0, Maximum: 864000 seconds (10 days). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87980) in GitLab 15.1. Self-managed, Ultimate only. |
+| `max_number_of_repository_downloads`     | integer          | no                                   | Maximum number of unique repositories a user can download in the specified time period before they are banned. Default: 0, Maximum: 10,000 repositories. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87980) in GitLab 15.1. GitLab Self-Managed, Ultimate only. |
+| `max_number_of_repository_downloads_within_time_period` | integer | no                             | Reporting time period (in seconds). Default: 0, Maximum: 864000 seconds (10 days). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87980) in GitLab 15.1. GitLab Self-Managed, Ultimate only. |
 | `max_yaml_depth`                         | integer          | no                                   | The maximum depth of nested CI/CD configuration added with the [`include` keyword](../ci/yaml/index.md#include). Default: `100`. |
 | `max_yaml_size_bytes`                    | integer          | no                                   | The maximum size in bytes of a single CI/CD configuration file. Default: `2097152`. |
-| `git_rate_limit_users_allowlist`         | array of strings  | no                                  | List of usernames excluded from Git anti-abuse rate limits. Default: `[]`, Maximum: 100 usernames. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/90815) in GitLab 15.2. Self-managed, Ultimate only. |
-| `git_rate_limit_users_alertlist`         | array of integers | no                                  | List of user IDs that are emailed when the Git abuse rate limit is exceeded. Default: `[]`, Maximum: 100 user IDs. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/110201) in GitLab 15.9. Self-managed, Ultimate only. |
-| `auto_ban_user_on_excessive_projects_download` | boolean    | no                                   | When enabled, users will get automatically banned from the application when they download more than the maximum number of unique projects in the time period specified by `max_number_of_repository_downloads` and `max_number_of_repository_downloads_within_time_period` respectively. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/94153) in GitLab 15.4. Self-managed, Ultimate only. |
+| `git_rate_limit_users_allowlist`         | array of strings  | no                                  | List of usernames excluded from Git anti-abuse rate limits. Default: `[]`, Maximum: 100 usernames. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/90815) in GitLab 15.2. GitLab Self-Managed, Ultimate only. |
+| `git_rate_limit_users_alertlist`         | array of integers | no                                  | List of user IDs that are emailed when the Git abuse rate limit is exceeded. Default: `[]`, Maximum: 100 user IDs. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/110201) in GitLab 15.9. GitLab Self-Managed, Ultimate only. |
+| `auto_ban_user_on_excessive_projects_download` | boolean    | no                                   | When enabled, users will get automatically banned from the application when they download more than the maximum number of unique projects in the time period specified by `max_number_of_repository_downloads` and `max_number_of_repository_downloads_within_time_period` respectively. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/94153) in GitLab 15.4. GitLab Self-Managed, Ultimate only. |
 | `mirror_available`                       | boolean          | no                                   | Allow repository mirroring to configured by project Maintainers. If disabled, only Administrators can configure repository mirroring. |
 | `mirror_capacity_threshold`              | integer          | no                                   | Minimum capacity to be available before scheduling more mirrors preemptively. Premium and Ultimate only. |
 | `mirror_max_capacity`                    | integer          | no                                   | Maximum number of mirrors that can be synchronizing at the same time. Premium and Ultimate only. |
@@ -594,7 +594,7 @@ to configure other related settings. These requirements are
 | `pypi_package_requests_forwarding`       | boolean          | no                                   | Use pypi.org as a default remote repository when the package is not found in the GitLab Package Registry for PyPI. Premium and Ultimate only. |
 | `outbound_local_requests_whitelist`      | array of strings | no                                   | Define a list of trusted domains or IP addresses to which local requests are allowed when local requests for webhooks and integrations are disabled. |
 | `package_registry_allow_anyone_to_pull_option` | boolean    | no                                   | Enable to [allow anyone to pull from Package Registry](../user/packages/package_registry/index.md#allow-anyone-to-pull-from-package-registry) visible and changeable. |
-| `package_metadata_purl_types`            | array of integers | no                                  | List of [package registry metadata to sync](../administration/settings/security_and_compliance.md#choose-package-registry-metadata-to-sync). See [the list](https://gitlab.com/gitlab-org/gitlab/-/blob/ace16c20d5da7c4928dd03fb139692638b557fe3/app/models/concerns/enums/package_metadata.rb#L5) of the available values. Self-managed, Ultimate only. |
+| `package_metadata_purl_types`            | array of integers | no                                  | List of [package registry metadata to sync](../administration/settings/security_and_compliance.md#choose-package-registry-metadata-to-sync). See [the list](https://gitlab.com/gitlab-org/gitlab/-/blob/ace16c20d5da7c4928dd03fb139692638b557fe3/app/models/concerns/enums/package_metadata.rb#L5) of the available values. GitLab Self-Managed, Ultimate only. |
 | `pages_domain_verification_enabled`       | boolean         | no                                   | Require users to prove ownership of custom domains. Domain verification is an essential security measure for public GitLab sites. Users are required to demonstrate they control a domain before it is enabled. |
 | `password_authentication_enabled_for_git` | boolean         | no                                   | Enable authentication for Git over HTTP(S) via a GitLab account password. Default is `true`. |
 | `password_authentication_enabled_for_web` | boolean         | no                                   | Enable authentication for the web interface via a GitLab account password. Default is `true`. |
@@ -708,7 +708,7 @@ to configure other related settings. These requirements are
 | `throttle_unauthenticated_web_requests_per_period`        | integer | required by:<br>`throttle_unauthenticated_web_enabled`          | Max requests per period per IP. |
 | `time_tracking_limit_to_hours`           | boolean          | no                                   | Limit display of time tracking units to hours. Default is `false`. |
 | `two_factor_grace_period`                | integer          | required by: `require_two_factor_authentication` | Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication. |
-| `unconfirmed_users_delete_after_days`    | integer          | no                                   | Specifies how many days after sign-up to delete users who have not confirmed their email. Only applicable if `delete_unconfirmed_users` is set to `true`. Must be `1` or greater. Default is `7`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352514) in GitLab 16.1. Self-managed, Premium and Ultimate only. |
+| `unconfirmed_users_delete_after_days`    | integer          | no                                   | Specifies how many days after sign-up to delete users who have not confirmed their email. Only applicable if `delete_unconfirmed_users` is set to `true`. Must be `1` or greater. Default is `7`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/352514) in GitLab 16.1. GitLab Self-Managed, Premium and Ultimate only. |
 | `unique_ips_limit_enabled`               | boolean          | no                                   | (**If enabled, requires:** `unique_ips_limit_per_user` and `unique_ips_limit_time_window`) Limit sign in from multiple IPs. |
 | `unique_ips_limit_per_user`              | integer          | required by: `unique_ips_limit_enabled` | Maximum number of IPs per user. |
 | `unique_ips_limit_time_window`           | integer          | required by: `unique_ips_limit_enabled` | How many seconds an IP is counted towards the limit. |
@@ -729,8 +729,8 @@ to configure other related settings. These requirements are
 | `bulk_import_concurrent_pipeline_batch_limit` | integer     | no                                   | Maximum simultaneous direct transfer batch exports to process. |
 | `concurrent_relation_batch_export_limit` | integer          | no                                   | Maximum number of simultaneous batch export jobs to process. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169122) in GitLab 17.6. |
 | `asciidoc_max_includes`                  | integer          | no                                   | Maximum limit of AsciiDoc include directives being processed in any one document. Default: 32. Maximum: 64. |
-| `duo_features_enabled`                   | boolean          | no                                   | Indicates whether GitLab Duo features are enabled for this instance. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. Self-managed, Premium and Ultimate only. |
-| `lock_duo_features_enabled`              | boolean          | no                                   | Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. Self-managed, Premium and Ultimate only. |
+| `duo_features_enabled`                   | boolean          | no                                   | Indicates whether GitLab Duo features are enabled for this instance. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
+| `lock_duo_features_enabled`              | boolean          | no                                   | Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
 | `nuget_skip_metadata_url_validation` | boolean     | no                                   | Indicates whether to skip metadata URL validation for the NuGet package. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/145887) in GitLab 17.0. |
 | `require_admin_two_factor_authentication` | boolean         | no | Allow administrators to require 2FA for all administrators on the instance. |
 | `pre_receive_secret_detection_enabled` | boolean         | no | Allow projects to enable secret push protection. This does not enable secret push protection. When you enable this feature, you accept the [GitLab Testing Agreement](https://handbook.gitlab.com/handbook/legal/testing-agreement/). Ultimate only. |
diff --git a/doc/api/vulnerabilities.md b/doc/api/vulnerabilities.md
index b505f0f5634..61cc104588b 100644
--- a/doc/api/vulnerabilities.md
+++ b/doc/api/vulnerabilities.md
@@ -26,7 +26,7 @@ WARNING:
 This API is in the process of being deprecated and considered unstable.
 The response payload may be subject to change or breakage
 across GitLab releases. Use the
-[GraphQL API](graphql/reference/index.md#queryvulnerabilities) instead. For more information, see [GraphQL examples](#replace-vulnerability-rest-api-with-graphql).
+[GraphQL API](graphql/reference/_index.md#queryvulnerabilities) instead. For more information, see [GraphQL examples](#replace-vulnerability-rest-api-with-graphql).
 
 Every API call to vulnerabilities must be [authenticated](rest/authentication.md).
 
@@ -263,7 +263,7 @@ with the GraphQL API.
 
 ### GraphQL - Single vulnerability
 
-Use [`Query.vulnerability`](graphql/reference/index.md#queryvulnerability).
+Use [`Query.vulnerability`](graphql/reference/_index.md#queryvulnerability).
 
 ```graphql
 {
@@ -319,7 +319,7 @@ Example response:
 
 ### GraphQL - Confirm vulnerability
 
-Use [`Mutation.vulnerabilityConfirm`](graphql/reference/index.md#mutationvulnerabilityconfirm).
+Use [`Mutation.vulnerabilityConfirm`](graphql/reference/_index.md#mutationvulnerabilityconfirm).
 
 ```graphql
 mutation {
@@ -349,7 +349,7 @@ Example response:
 
 ### GraphQL - Resolve vulnerability
 
-Use [`Mutation.vulnerabilityResolve`](graphql/reference/index.md#mutationvulnerabilityresolve).
+Use [`Mutation.vulnerabilityResolve`](graphql/reference/_index.md#mutationvulnerabilityresolve).
 
 ```graphql
 mutation {
@@ -379,7 +379,7 @@ Example response:
 
 ### GraphQL - Dismiss vulnerability
 
-Use [`Mutation.vulnerabilityDismiss`](graphql/reference/index.md#mutationvulnerabilitydismiss).
+Use [`Mutation.vulnerabilityDismiss`](graphql/reference/_index.md#mutationvulnerabilitydismiss).
 
 ```graphql
 mutation {
@@ -409,7 +409,7 @@ Example response:
 
 ### GraphQL - Revert vulnerability to detected state
 
-Use [`Mutation.vulnerabilityRevertToDetected`](graphql/reference/index.md#mutationvulnerabilityreverttodetected).
+Use [`Mutation.vulnerabilityRevertToDetected`](graphql/reference/_index.md#mutationvulnerabilityreverttodetected).
 
 ```graphql
 mutation {
diff --git a/doc/api/vulnerability_findings.md b/doc/api/vulnerability_findings.md
index 51d04752f8d..06592507f79 100644
--- a/doc/api/vulnerability_findings.md
+++ b/doc/api/vulnerability_findings.md
@@ -26,7 +26,7 @@ WARNING:
 This API is in the process of being deprecated and considered unstable.
 The response payload may be subject to change or breakage
 across GitLab releases. Use the
-[GraphQL API](graphql/reference/index.md#queryvulnerabilities) instead. For more information, see [GraphQL examples](../api/vulnerabilities.md#replace-vulnerability-rest-api-with-graphql)
+[GraphQL API](graphql/reference/_index.md#queryvulnerabilities) instead. For more information, see [GraphQL examples](../api/vulnerabilities.md#replace-vulnerability-rest-api-with-graphql)
 
 ## Vulnerability findings pagination
 
@@ -139,7 +139,7 @@ with the GraphQL API.
 
 ### GraphQL - Project vulnerability findings
 
-Use [`Pipeline.securityReportFindings`](graphql/reference/index.md#pipelinesecurityreportfindings).
+Use [`Pipeline.securityReportFindings`](graphql/reference/_index.md#pipelinesecurityreportfindings).
 
 ```graphql
 query VulnerabilityFindings {
@@ -174,7 +174,7 @@ query VulnerabilityFindings {
                 vulnerableMethod
                 blobPath
               }
-              
+
               ... on VulnerabilityLocationContainerScanning {
                 dependency {
                   package {
diff --git a/doc/ci/components/index.md b/doc/ci/components/index.md
index 0232b02ccb9..c0f27a6cd14 100644
--- a/doc/ci/components/index.md
+++ b/doc/ci/components/index.md
@@ -611,7 +611,7 @@ To set the project as a catalog project:
 
 The project only becomes findable in the catalog after you publish a new release.
 
-To use automation to enable this setting, you can use the [`mutationcatalogresourcescreate`](../../api/graphql/reference/index.md#mutationcatalogresourcescreate)
+To use automation to enable this setting, you can use the [`mutationcatalogresourcescreate`](../../api/graphql/reference/_index.md#mutationcatalogresourcescreate)
 GraphQL endpoint. [Issue 463043](https://gitlab.com/gitlab-org/gitlab/-/issues/463043)
 proposes to expose this in the REST API as well.
 
diff --git a/doc/ci/jobs/ci_job_token.md b/doc/ci/jobs/ci_job_token.md
index 1d2a8f6ad15..9e2985597dc 100644
--- a/doc/ci/jobs/ci_job_token.md
+++ b/doc/ci/jobs/ci_job_token.md
@@ -128,7 +128,7 @@ To add a group or project to the allowlist:
 1. Select **Add group or project**.
 1. Input the path to the group or project to add to the allowlist, and select **Add**.
 
-You can also add a group or project to the allowlist [with the API](../../api/graphql/reference/index.md#mutationcijobtokenscopeaddgrouporproject).
+You can also add a group or project to the allowlist [with the API](../../api/graphql/reference/_index.md#mutationcijobtokenscopeaddgrouporproject).
 
 ### Limit job token scope for public or internal projects
 
@@ -186,7 +186,7 @@ To disable the job token scope allowlist:
 1. Toggle **Authorized groups and projects** to disabled.
    Enabled by default in new projects.
 
-You can also enable and disable the setting with the [GraphQL](../../api/graphql/reference/index.md#mutationprojectcicdsettingsupdate) (`inboundJobTokenScopeEnabled`) and [REST](../../api/project_job_token_scopes.md#patch-a-projects-cicd-job-token-access-settings) API.
+You can also enable and disable the setting with the [GraphQL](../../api/graphql/reference/_index.md#mutationprojectcicdsettingsupdate) (`inboundJobTokenScopeEnabled`) and [REST](../../api/project_job_token_scopes.md#patch-a-projects-cicd-job-token-access-settings) API.
 
 ### Allow Git push requests to your project repository
 
diff --git a/doc/development/api_graphql_styleguide.md b/doc/development/api_graphql_styleguide.md
index 2cddc4cb28c..ece2b325a32 100644
--- a/doc/development/api_graphql_styleguide.md
+++ b/doc/development/api_graphql_styleguide.md
@@ -1073,7 +1073,7 @@ field :closed_at, Types::TimeType, description: 'Timestamp of when the issue was
 You can view descriptions of fields and arguments in:
 
 - The [GraphiQL explorer](#graphiql).
-- The [static GraphQL API reference](../api/graphql/reference/index.md).
+- The [static GraphQL API reference](../api/graphql/reference/_index.md).
 
 ### Description style guide
 
@@ -2554,7 +2554,7 @@ More about complexity:
 ## Documentation and schema
 
 Our schema is located at `app/graphql/gitlab_schema.rb`.
-See the [schema reference](../api/graphql/reference/index.md) for details.
+See the [schema reference](../api/graphql/reference/_index.md) for details.
 
 This generated GraphQL documentation needs to be updated when the schema changes.
 For information on generating GraphQL documentation and schema files, see
diff --git a/doc/development/documentation/graphql_styleguide.md b/doc/development/documentation/graphql_styleguide.md
index 36a48acebcc..6fd7432b47e 100644
--- a/doc/development/documentation/graphql_styleguide.md
+++ b/doc/development/documentation/graphql_styleguide.md
@@ -8,7 +8,7 @@ description: "Writing styles, markup, formatting, and other standards for GraphQ
 # Creating a GraphQL example page
 
 GraphQL APIs are different from [RESTful APIs](restful_api_styleguide.md). Reference
-information is generated in our [GraphQL API resources](../../api/graphql/reference/index.md) page.
+information is generated in our [GraphQL API resources](../../api/graphql/reference/_index.md) page.
 
 However, it's helpful to include examples for how to use GraphQL for different
 use cases, with samples that readers can use directly in the GraphQL explorer, called
diff --git a/doc/development/documentation/site_architecture/automation.md b/doc/development/documentation/site_architecture/automation.md
index 9f68ec7098a..e4c1430b5c2 100644
--- a/doc/development/documentation/site_architecture/automation.md
+++ b/doc/development/documentation/site_architecture/automation.md
@@ -46,7 +46,7 @@ that are coded across multiple repositories.
 | [GitLab Runner Kubernetes API settings](https://docs.gitlab.com/runner/executors/kubernetes/) | Generated with [mage](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/main/.gitlab/ci/qa.gitlab-ci.yml#L133) | [Runner](https://handbook.gitlab.com/handbook/engineering/development/ops/verify/runner/) |
 | [Deprecations and removals by version](../../../update/deprecations.md) | [Update the deprecations and removals documentation](../../deprecation_guidelines/index.md#update-the-deprecations-and-removals-documentation) |  |
 | [Breaking change windows](../../../update/breaking_windows.md) | [Update the breaking change windows documentation](../../deprecation_guidelines/index.md#update-the-breaking-change-windows-documentation) |  |
-| [GraphQL API resources](../../../api/graphql/reference/index.md) | [GraphQL API style guide](../../api_graphql_styleguide.md#documentation-and-schema) | [Import and Integrate](https://handbook.gitlab.com/handbook/engineering/development/dev/foundations/import-and-integrate/) |
+| [GraphQL API resources](../../../api/graphql/reference/_index.md) | [GraphQL API style guide](../../api_graphql_styleguide.md#documentation-and-schema) | [Import and Integrate](https://handbook.gitlab.com/handbook/engineering/development/dev/foundations/import-and-integrate/) |
 | [Audit event types](../../../user/compliance/audit_event_types.md) | [Audit event development guidelines](../../audit_event_guide/index.md) | [Compliance](https://handbook.gitlab.com/handbook/engineering/development/sec/govern/compliance/) |
 | [Available custom role permissions](../../../user/custom_roles/abilities.md) | [Generated by Rake task](https://gitlab.com/gitlab-org/gitlab/-/blob/master/tooling/custom_roles/docs/templates/custom_abilities.md.erb) | [Authorization](https://handbook.gitlab.com/handbook/product/categories/#authorization-group)|
 | [Application settings analysis](../../cells/application_settings_analysis.md) | [Generated by Ruby script](https://gitlab.com/gitlab-org/gitlab/-/blob/2bb2910c84fad965bde473aa2881d88358b6e96e/scripts/cells/application-settings-analysis.rb#L353) | |
diff --git a/doc/development/documentation/testing/index.md b/doc/development/documentation/testing/index.md
index db48dfe35de..0c424ba00a5 100644
--- a/doc/development/documentation/testing/index.md
+++ b/doc/development/documentation/testing/index.md
@@ -29,7 +29,7 @@ Merge requests containing changes to Markdown (`.md`) files run these CI/CD jobs
 A few files are generated from scripts. A CI/CD job fails when either the source code files
 or the documentation files are updated without following the correct process:
 
-- `graphql-verify`: Fails when `doc/api/graphql/reference/index.md` is not updated
+- `graphql-verify`: Fails when `doc/api/graphql/reference/_index.md` is not updated
   with the [update process](../../rake_tasks.md#update-graphql-documentation-and-schema-definitions).
 - `docs-lint deprecations-and-removals`: Fails when `doc/update/deprecations.md` is
   not updated with the [update process](../../deprecation_guidelines/index.md#update-the-deprecations-and-removals-documentation).
diff --git a/doc/development/fe_guide/graphql.md b/doc/development/fe_guide/graphql.md
index c83e6fa6559..693fab0de75 100644
--- a/doc/development/fe_guide/graphql.md
+++ b/doc/development/fe_guide/graphql.md
@@ -80,7 +80,7 @@ the GraphQL extension, follow these steps:
 
 Our GraphQL API can be explored via GraphiQL at your instance's
 `/-/graphql-explorer` or at [GitLab.com](https://gitlab.com/-/graphql-explorer). Consult the
-[GitLab GraphQL API Reference documentation](../../api/graphql/reference/index.md)
+[GitLab GraphQL API Reference documentation](../../api/graphql/reference/_index.md)
 where needed.
 
 To check all existing queries and mutations, on the right side of GraphiQL, select **Documentation explorer**.
diff --git a/doc/development/graphql_guide/monitoring.md b/doc/development/graphql_guide/monitoring.md
index e9cf6472259..3d4969bf7ea 100644
--- a/doc/development/graphql_guide/monitoring.md
+++ b/doc/development/graphql_guide/monitoring.md
@@ -56,7 +56,7 @@ Filter logs by queries that used a particular field:
    1. Filter: `json.query_analysis.used_fields`
    1. Operator: `is`
    1. Value: `Type.myField`, where `Type.myField` is the type name and field name as it
-      appears in [our GraphQL API resources documentation](../../api/graphql/reference/index.md).
+      appears in [our GraphQL API resources documentation](../../api/graphql/reference/_index.md).
 1. Select **Refresh**.
 
 #### Queries that used a deprecated field
diff --git a/doc/development/rake_tasks.md b/doc/development/rake_tasks.md
index eab06121fda..8bc5bb8d8a4 100644
--- a/doc/development/rake_tasks.md
+++ b/doc/development/rake_tasks.md
@@ -486,7 +486,7 @@ bundle exec rake gitlab:graphql:compile_docs
 In its current state, the Rake task:
 
 - Generates output for GraphQL objects.
-- Places the output at `doc/api/graphql/reference/index.md`.
+- Places the output at `doc/api/graphql/reference/_index.md`.
 
 This uses some features from `graphql-docs` gem like its schema parser and helper methods.
 The docs generator code comes from our side giving us more flexibility, like using Haml templates and generating Markdown files.
diff --git a/doc/development/work_items_widgets.md b/doc/development/work_items_widgets.md
index 6f95d7c2c3b..cbe9a1a9dc4 100644
--- a/doc/development/work_items_widgets.md
+++ b/doc/development/work_items_widgets.md
@@ -173,7 +173,7 @@ Since create view is almost identical to detail view, and we wanted to store in
 
 For example , when we initialise the create view , we have a function `setNewWorkItemCache` [in work items cache utils](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/assets/javascripts/work_items/graphql/cache_utils) which is called in both [create view work item modal](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/assets/javascripts/work_items/components/create_work_item_modal.vue) and also [create work item component](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/assets/javascripts/work_items/components/create_work_item.vue)
 
-You can include the create work item view in any vue file depending on usage. If you pass the `workItemType` of the create view , it will only include the applicable work item widgets which are fetched from [work item types query](../api/graphql/reference/index.md#workitemtype) and only showing the ones in [widget definitions](../api/graphql/reference/index.md#workitemwidgetdefinition)
+You can include the create work item view in any vue file depending on usage. If you pass the `workItemType` of the create view , it will only include the applicable work item widgets which are fetched from [work item types query](../api/graphql/reference/_index.md#workitemtype) and only showing the ones in [widget definitions](../api/graphql/reference/_index.md#workitemwidgetdefinition)
 
 We have a [local mutation](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/assets/javascripts/work_items/graphql/update_new_work_item.mutation.graphql) to update the work item draft data in create view
 
diff --git a/doc/editor_extensions/jetbrains_ide/setup.md b/doc/editor_extensions/jetbrains_ide/setup.md
index 5cf80d845cc..7ef58321d0d 100644
--- a/doc/editor_extensions/jetbrains_ide/setup.md
+++ b/doc/editor_extensions/jetbrains_ide/setup.md
@@ -52,7 +52,7 @@ After you configure the plugin in your IDE, connect it to your GitLab account:
 1. On the left sidebar, expand **Tools**, then select **GitLab Duo**.
 1. Select an authentication method:
    - For GitLab.com, use `OAuth`.
-   - For self-managed and GitLab Dedicated, use `Personal access token`.
+   - For GitLab Self-Managed and GitLab Dedicated, use `Personal access token`.
 1. Provide the **URL to GitLab instance**. For GitLab.com, use `https://gitlab.com`.
 1. For **GitLab Personal Access Token**, paste in the personal access token you created.
    The token is not displayed, nor is it accessible to others.
diff --git a/doc/editor_extensions/neovim/setup.md b/doc/editor_extensions/neovim/setup.md
index fbf25292d85..f2b5f1aebee 100644
--- a/doc/editor_extensions/neovim/setup.md
+++ b/doc/editor_extensions/neovim/setup.md
@@ -9,7 +9,7 @@ description: "Connect and use GitLab Duo in Neovim."
 
 Prerequisites:
 
-- For both GitLab.com and self-managed, you have GitLab version 16.1 or later.
+- For both GitLab.com and GitLab Self-Managed, you have GitLab version 16.1 or later.
   While many extension features might work with earlier versions, they are unsupported.
   - The GitLab Duo Code Suggestions feature requires GitLab version 16.8 or later.
 - You have [Neovim](https://neovim.io/) version 0.9 or later.
diff --git a/doc/integration/arkose.md b/doc/integration/arkose.md
index 9a99338ff08..0c8ec517168 100644
--- a/doc/integration/arkose.md
+++ b/doc/integration/arkose.md
@@ -9,7 +9,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 WARNING:
 Arkose Protect is used on GitLab.com and is not supported for GitLab Self-Managed
 instances. The following documents the internal requirements for maintaining
-Arkose Protect on GitLab.com. While this feature is theoretically usable in self-managed instances, it
+Arkose Protect on GitLab.com. While this feature is theoretically usable in GitLab Self-Managed instances, it
 is not recommended at the moment.
 
 GitLab integrates [Arkose Protect](https://www.arkoselabs.com/arkose-bot-manager/) to guard against
diff --git a/doc/integration/clickhouse.md b/doc/integration/clickhouse.md
index cd26d996d7d..d7af7241947 100644
--- a/doc/integration/clickhouse.md
+++ b/doc/integration/clickhouse.md
@@ -25,7 +25,7 @@ To set up ClickHouse as the GitLab data storage:
 
 The most straightforward way to run ClickHouse is with [ClickHouse Cloud](https://console.clickhouse.cloud/).
 You can also [run ClickHouse on your own server](https://clickhouse.com/docs/en/install). Refer to the ClickHouse
-documentation regarding [recommendations for self-managed instances](https://clickhouse.com/docs/en/install#recommendations-for-self-managed-clickhouse).
+documentation regarding [recommendations for GitLab Self-Managed](https://clickhouse.com/docs/en/install#recommendations-for-self-managed-clickhouse).
 
 When you run ClickHouse on a hosted server, various data points might impact the resource consumption, like the number
 of builds that run on your instance each month, the selected hardware, the data center choice to host ClickHouse, and more.
diff --git a/doc/integration/gitpod.md b/doc/integration/gitpod.md
index 6b02b298ad0..8a26f752dfb 100644
--- a/doc/integration/gitpod.md
+++ b/doc/integration/gitpod.md
@@ -24,7 +24,7 @@ To use the GitLab Gitpod integration, you must enable it for your GitLab instanc
 
 - GitLab.com can use it immediately after it's [enabled in their user preferences](#enable-gitpod-in-your-user-preferences).
 - GitLab Self-Managed instances can use it after:
-  1. It's [enabled and configured by a GitLab administrator](#configure-a-self-managed-instance).
+  1. It's [enabled and configured by a GitLab administrator](#configure-a-gitlab-self-managed-instance).
   1. It's [enabled in their user settings](#enable-gitpod-in-your-user-preferences).
 
 For more information about Gitpod, see the Gitpod [features](https://www.gitpod.io/) and
@@ -39,7 +39,7 @@ With the Gitpod integration enabled for your GitLab instance, to enable it for y
 1. Under **Preferences**, locate the **Integrations** section.
 1. Select the **Enable Gitpod integration** checkbox and select **Save changes**.
 
-## Configure a self-managed instance
+## Configure a GitLab Self-Managed instance
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
diff --git a/doc/integration/jenkins.md b/doc/integration/jenkins.md
index a6a2156a7bf..ee4ce8036fd 100644
--- a/doc/integration/jenkins.md
+++ b/doc/integration/jenkins.md
@@ -179,7 +179,7 @@ This issue has multiple possible causes and solutions:
 
 | Cause                                                            | Workaround  |
 |------------------------------------------------------------------|-------------|
-| GitLab is unable to reach your Jenkins instance at the address.  | If your GitLab instance is self-managed, ping the Jenkins instance at the domain provided on the GitLab instance.  |
+| GitLab is unable to reach your Jenkins instance at the address.  | For GitLab Self-Managed, ping the Jenkins instance at the domain provided on the GitLab instance.  |
 | The Jenkins instance is at a local address and is not included in the [GitLab installation's allowlist](../security/webhooks.md#allow-outbound-requests-to-certain-ip-addresses-and-domains).| Add the instance to the GitLab installation's allowlist.  |
 | The credentials for the Jenkins instance do not have sufficient access or are invalid.| Grant the credentials sufficient access or create valid credentials.  |
 |The **Enable authentication for `/project` end-point** checkbox is not selected in your [Jenkins plugin configuration](#configure-the-jenkins-server)| Select the checkbox.  |
diff --git a/doc/integration/jira/connect-app.md b/doc/integration/jira/connect-app.md
index 297785fefca..668d85a506d 100644
--- a/doc/integration/jira/connect-app.md
+++ b/doc/integration/jira/connect-app.md
@@ -274,7 +274,7 @@ GitLab receives a [lifecycle event](https://developer.atlassian.com/cloud/jira/p
 The event includes a [token](#gitlab-access-to-jira) to verify subsequent lifecycle events and to authenticate when [sending data to Jira](#data-sent-from-gitlab-to-jira).
 Lifecycle event requests from Jira are [verified](https://developer.atlassian.com/cloud/jira/platform/security-for-connect-apps/#validating-installation-lifecycle-requests).
 
-For self-managed instances that use the GitLab for Jira Cloud app from the Atlassian Marketplace, GitLab.com handles lifecycle events and forwards them to the self-managed instance. For more information, see [GitLab.com handling of app lifecycle events](../../administration/settings/jira_cloud_app.md#gitlabcom-handling-of-app-lifecycle-events).
+For GitLab Self-Managed instances that use the GitLab for Jira Cloud app from the Atlassian Marketplace, GitLab.com handles lifecycle events and forwards them to the GitLab Self-Managed instance. For more information, see [GitLab.com handling of app lifecycle events](../../administration/settings/jira_cloud_app.md#gitlabcom-handling-of-app-lifecycle-events).
 
 ### Data stored by Jira
 
diff --git a/doc/integration/jira/troubleshooting.md b/doc/integration/jira/troubleshooting.md
index 6ea39e92f72..7ab9c2b6022 100644
--- a/doc/integration/jira/troubleshooting.md
+++ b/doc/integration/jira/troubleshooting.md
@@ -31,7 +31,7 @@ If GitLab cannot comment on a Jira issue, ensure the Jira user you created for t
 - Transition the Jira issue.
 
 When the [GitLab issue tracker](../../integration/external-issue-tracker.md) is disabled, Jira issue references and comments do not work.
-If you [restrict IP addresses for Jira access](https://support.atlassian.com/security-and-access-policies/docs/specify-ip-addresses-for-product-access/), ensure you add your self-managed IP addresses or [GitLab IP addresses](../../user/gitlab_com/index.md#ip-range) to the allowlist in Jira.
+If you [restrict IP addresses for Jira access](https://support.atlassian.com/security-and-access-policies/docs/specify-ip-addresses-for-product-access/), ensure you add your GitLab Self-Managed IP addresses or [GitLab IP addresses](../../user/gitlab_com/index.md#ip-range) to the allowlist in Jira.
 
 For the root cause, check the [`integrations_json.log`](../../administration/logs/index.md#integrations_jsonlog) file. When GitLab tries to comment on a Jira issue, an `Error sending message` log entry might appear.
 
diff --git a/doc/integration/saml.md b/doc/integration/saml.md
index 41603f0c248..3a2e25d8286 100644
--- a/doc/integration/saml.md
+++ b/doc/integration/saml.md
@@ -3100,14 +3100,14 @@ For more information, see [Configure SAML support in GitLab](#configure-saml-sup
 A user can manually link their SAML identity to an existing GitLab account. For more information,
 see [Enable OmniAuth for an existing user](omniauth.md#enable-omniauth-for-an-existing-user).
 
-## Configure group SAML SSO on a self-managed instance
+## Configure group SAML SSO on GitLab Self-Managed
 
 DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** GitLab Self-Managed, GitLab Dedicated
 
 Use group SAML SSO if you have to allow access through multiple SAML IdPs on your
-self-managed instance.
+GitLab Self-Managed instance.
 
 To configure group SAML SSO:
 
@@ -3214,7 +3214,7 @@ To configure group SAML SSO:
 
 ::EndTabs
 
-As a multi-tenant solution, group SAML on a self-managed instance is limited compared
+As a multi-tenant solution, group SAML on GitLab Self-Managed is limited compared
 to the recommended [instance-wide SAML](../integration/saml.md). Use
 instance-wide SAML to take advantage of:
 
diff --git a/doc/integration/sourcegraph.md b/doc/integration/sourcegraph.md
index 9fefd702d90..9c709648d21 100644
--- a/doc/integration/sourcegraph.md
+++ b/doc/integration/sourcegraph.md
@@ -76,7 +76,7 @@ Prerequisites:
 
 ## Enable Sourcegraph in user preferences
 
-Users on self-managed instances must also configure their user settings to use the
+Users on GitLab Self-Managed must also configure their user settings to use the
 Sourcegraph integration.
 
 On GitLab.com, the integration is available for all public projects.
@@ -84,7 +84,7 @@ Private projects are not supported.
 
 Prerequisites:
 
-- If on a self-managed instance, Sourcegraph must be enabled.
+- For GitLab Self-Managed, Sourcegraph must be enabled.
 
 To enable this feature in your GitLab user preferences:
 
diff --git a/doc/operations/feature_flags.md b/doc/operations/feature_flags.md
index 42ea82e7791..bfe0f37170e 100644
--- a/doc/operations/feature_flags.md
+++ b/doc/operations/feature_flags.md
@@ -58,9 +58,9 @@ next to any feature flag in the list.
 ## Maximum number of feature flags
 
 The maximum number of feature flags per project on GitLab Self-Managed
-is 200. For GitLab SaaS, the maximum number is determined by [tier](https://about.gitlab.com/pricing/):
+is 200. For GitLab.com, the maximum number is determined by [tier](https://about.gitlab.com/pricing/):
 
-| Tier     | Feature flags per project (SaaS) | Feature flags per project (self-managed) |
+| Tier     | Feature flags per project (GitLab.com) | Feature flags per project (GitLab Self-Managed) |
 |----------|----------------------------------|------------------------------------------|
 | Free     | 50                               | 200                                      |
 | Premium  | 150                              | 200                                      |
@@ -426,9 +426,9 @@ Read the documentation in a SDK project for more information.
 
 ### GitLab Self-Managed
 
-Functionality-wise, there are no differences. Both SaaS and self-managed behave the same.
+Functionality-wise, there are no differences. Both GitLab.com and GitLab Self-Managed behave the same.
 
 In terms of scalability, it's up to the spec of the GitLab instance.
-For example, GitLab.com uses HA architecture so it can handle many concurrent requests. However, self-managed instances on underpowered machines won't deliver comparable performance.
+For example, GitLab.com uses HA architecture so it can handle many concurrent requests. However, GitLab Self-Managed instances on underpowered machines won't deliver comparable performance.
 See [Reference architectures](../administration/reference_architectures/index.md)
 for more information.
diff --git a/doc/operations/incident_management/slack.md b/doc/operations/incident_management/slack.md
index e483a44ba85..a5cd95ed01c 100644
--- a/doc/operations/incident_management/slack.md
+++ b/doc/operations/incident_management/slack.md
@@ -27,7 +27,7 @@ Use the GitLab for Slack app to:
 
 Incident management for Slack is only available for GitLab.com. Some of the functionality
 described might be available for
-[the self-managed Slack app](../../user/project/integrations/slack_slash_commands.md).
+[the GitLab Self-Managed Slack app](../../user/project/integrations/slack_slash_commands.md).
 
 To stay up to date, follow [epic 1211](https://gitlab.com/groups/gitlab-org/-/epics/1211).
 
diff --git a/doc/security/user_file_uploads.md b/doc/security/user_file_uploads.md
index 474154b682d..87c2cf422ad 100644
--- a/doc/security/user_file_uploads.md
+++ b/doc/security/user_file_uploads.md
@@ -69,7 +69,7 @@ You cannot select this option for public projects.
 
 You should delete an uploaded file when that file contains sensitive or confidential information. When you have deleted that file, users cannot access the file and the direct URL returns a 404 error.
 
-Project Owners and Maintainers can use the [interactive GraphQL explorer](../api/graphql/index.md#interactive-graphql-explorer) to access a [GraphQL endpoint](../api/graphql/reference/index.md#mutationuploaddelete) and delete an uploaded file.
+Project Owners and Maintainers can use the [interactive GraphQL explorer](../api/graphql/index.md#interactive-graphql-explorer) to access a [GraphQL endpoint](../api/graphql/reference/_index.md#mutationuploaddelete) and delete an uploaded file.
 
 For example:
 
diff --git a/doc/update/versions/gitlab_15_changes.md b/doc/update/versions/gitlab_15_changes.md
index ea299536506..d87fbd69b1d 100644
--- a/doc/update/versions/gitlab_15_changes.md
+++ b/doc/update/versions/gitlab_15_changes.md
@@ -892,7 +892,7 @@ DETAILS:
         ```
 
   1. Only then, continue to upgrade to later versions of GitLab.
-- Unauthenticated requests to the [`ciConfig` GraphQL field](../../api/graphql/reference/index.md#queryciconfig) are no longer supported.
+- Unauthenticated requests to the [`ciConfig` GraphQL field](../../api/graphql/reference/_index.md#queryciconfig) are no longer supported.
   Before you upgrade to GitLab 15.1, add an [access token](../../api/rest/authentication.md) to your requests.
   The user creating the token must have [permission](../../user/permissions.md) to create pipelines in the project.
 
diff --git a/doc/user/analytics/ai_impact_analytics.md b/doc/user/analytics/ai_impact_analytics.md
index ce305a45811..705e6d3bc03 100644
--- a/doc/user/analytics/ai_impact_analytics.md
+++ b/doc/user/analytics/ai_impact_analytics.md
@@ -72,5 +72,5 @@ Prerequisites:
 1. Select **Analyze > Analytics Dashboards**.
 1. Select **AI impact analytics**.
 
-To retrieve AI impact metrics, you can also use the `AiMetrics`, `AiUserMetrics`, and `AiUsageData` [GraphQL APIs](../../api/graphql/reference/index.md).
+To retrieve AI impact metrics, you can also use the `AiMetrics`, `AiUserMetrics`, and `AiUsageData` [GraphQL APIs](../../api/graphql/reference/_index.md).
 For an overview and sample queries, see [issue 512931](https://gitlab.com/gitlab-org/gitlab/-/issues/512931).
diff --git a/doc/user/analytics/dora_metrics.md b/doc/user/analytics/dora_metrics.md
index 51de912626e..c5aff7525f1 100644
--- a/doc/user/analytics/dora_metrics.md
+++ b/doc/user/analytics/dora_metrics.md
@@ -200,7 +200,7 @@ record.save!
 
 ## Retrieve DORA metrics data
 
-To retrieve DORA data, use the [GraphQL](../../api/graphql/reference/index.md) or the [REST](../../api/dora/metrics.md) APIs.
+To retrieve DORA data, use the [GraphQL](../../api/graphql/reference/_index.md) or the [REST](../../api/dora/metrics.md) APIs.
 
 The following example uses the GraphQL API to retrieve the monthly deployment frequency for a given time period:
 
diff --git a/doc/user/analytics/value_streams_dashboard.md b/doc/user/analytics/value_streams_dashboard.md
index 3fbbaf6325a..4fc1beb9d2b 100644
--- a/doc/user/analytics/value_streams_dashboard.md
+++ b/doc/user/analytics/value_streams_dashboard.md
@@ -198,7 +198,7 @@ To enable or disable the overview count aggregation for the Value Streams Dashbo
 1. Select **Settings > Analytics**.
 1. In **Value Streams Dashboard**, select or clear the **Enable overview background aggregation for Value Streams Dashboard** checkbox.
 
-To retrieve aggregated usage counts in the group, use the [GraphQL API](../../api/graphql/reference/index.md#groupvaluestreamdashboardusageoverview).
+To retrieve aggregated usage counts in the group, use the [GraphQL API](../../api/graphql/reference/_index.md#groupvaluestreamdashboardusageoverview).
 
 ## View the Value Streams Dashboard
 
diff --git a/doc/user/application_security/configuration/index.md b/doc/user/application_security/configuration/index.md
index 71536fd3e4e..7e79f2ab9ac 100644
--- a/doc/user/application_security/configuration/index.md
+++ b/doc/user/application_security/configuration/index.md
@@ -30,7 +30,7 @@ If GitLab does not find a CI/CD pipeline, then it considers all security scanner
 
 Failed pipelines and jobs are included in this process. If a scanner is configured but the job fails,
 that scanner is still considered enabled. This process also determines the scanners and statuses
-returned through the [API](../../../api/graphql/reference/index.md#securityscanners).
+returned through the [API](../../../api/graphql/reference/_index.md#securityscanners).
 
 If the latest pipeline uses [Auto DevOps](../../../topics/autodevops/index.md),
 all security features are configured by default.
diff --git a/doc/user/application_security/security_dashboard/index.md b/doc/user/application_security/security_dashboard/index.md
index d149eae43aa..b438a479669 100644
--- a/doc/user/application_security/security_dashboard/index.md
+++ b/doc/user/application_security/security_dashboard/index.md
@@ -101,7 +101,7 @@ To view group security dashboard:
 1. Select **Security > Security dashboard**.
 1. Hover over the **Vulnerabilities over time** chart to get more details about vulnerabilities.
    - You can display the vulnerability trends over a 30, 60, or 90-day time frame (the default is 90 days).
-   - To view aggregated data beyond a 90-day time frame, use the [VulnerabilitiesCountByDay GraphQL API](../../../api/graphql/reference/index.md#vulnerabilitiescountbyday). GitLab retains the data for 365 days.
+   - To view aggregated data beyond a 90-day time frame, use the [VulnerabilitiesCountByDay GraphQL API](../../../api/graphql/reference/_index.md#vulnerabilitiescountbyday). GitLab retains the data for 365 days.
 
 1. Select the arrows under the **Project security status** section to see the what projects fall under a particular letter-grade rating:
    - You can see how many vulnerabilities of a particular severity are found in a project
diff --git a/doc/user/crm/index.md b/doc/user/crm/index.md
index c355e1ed8e0..066f2caaffa 100644
--- a/doc/user/crm/index.md
+++ b/doc/user/crm/index.md
@@ -102,7 +102,7 @@ To create a contact:
 1. Complete all required fields.
 1. Select **Create new contact**.
 
-You can also [create](../../api/graphql/reference/index.md#mutationcustomerrelationscontactcreate)
+You can also [create](../../api/graphql/reference/_index.md#mutationcustomerrelationscontactcreate)
 contacts using the GraphQL API.
 
 ### Edit a contact
@@ -119,7 +119,7 @@ To edit an existing contact:
 1. Edit the required fields.
 1. Select **Save changes**.
 
-You can also [edit](../../api/graphql/reference/index.md#mutationcustomerrelationscontactupdate)
+You can also [edit](../../api/graphql/reference/_index.md#mutationcustomerrelationscontactupdate)
 contacts using the GraphQL API.
 
 #### Change the state of a contact
@@ -168,7 +168,7 @@ To create an organization:
 1. Complete all required fields.
 1. Select **Create new organization**.
 
-You can also [create](../../api/graphql/reference/index.md#mutationcustomerrelationsorganizationcreate)
+You can also [create](../../api/graphql/reference/_index.md#mutationcustomerrelationsorganizationcreate)
 organizations using the GraphQL API.
 
 ### Edit an organization
@@ -186,7 +186,7 @@ To edit an existing organization:
 1. Edit the required fields.
 1. Select **Save changes**.
 
-You can also [edit](../../api/graphql/reference/index.md#mutationcustomerrelationsorganizationupdate)
+You can also [edit](../../api/graphql/reference/_index.md#mutationcustomerrelationsorganizationupdate)
 organizations using the GraphQL API.
 
 ## Issues
@@ -232,7 +232,7 @@ To view a contact's details, hover over the contact's name.
 ![Issue contacts](issue_crm_contacts_v14_6.png)
 
 You can also view issue contacts using the
-[GraphQL](../../api/graphql/reference/index.md#mutationcustomerrelationsorganizationcreate)
+[GraphQL](../../api/graphql/reference/_index.md#mutationcustomerrelationsorganizationcreate)
 API.
 
 ### Add contacts to an issue
@@ -245,7 +245,7 @@ To add [active](#change-the-state-of-a-contact) contacts to an issue use the `/a
 [quick action](../project/quick_actions.md).
 
 You can also add, remove, or replace issue contacts using the
-[GraphQL](../../api/graphql/reference/index.md#mutationissuesetcrmcontacts)
+[GraphQL](../../api/graphql/reference/_index.md#mutationissuesetcrmcontacts)
 API.
 
 ### Remove contacts from an issue
@@ -258,7 +258,7 @@ To remove contacts from an issue use the `/remove_contacts [contact:address@exam
 [quick action](../project/quick_actions.md).
 
 You can also add, remove, or replace issue contacts using the
-[GraphQL](../../api/graphql/reference/index.md#mutationissuesetcrmcontacts)
+[GraphQL](../../api/graphql/reference/_index.md#mutationissuesetcrmcontacts)
 API.
 
 ## Autocomplete contacts
diff --git a/doc/user/custom_roles.md b/doc/user/custom_roles.md
index 587bfa544e7..3fb87f79822 100644
--- a/doc/user/custom_roles.md
+++ b/doc/user/custom_roles.md
@@ -90,7 +90,7 @@ In **Settings > Roles and permissions**, the list of all custom roles displays t
 - Base role that the custom role uses as a template.
 - Permissions.
 
-To create a custom role, you can also [use the API](../api/graphql/reference/index.md#mutationmemberrolecreate).
+To create a custom role, you can also [use the API](../api/graphql/reference/_index.md#mutationmemberrolecreate).
 
 ## Edit a custom role
 
@@ -126,7 +126,7 @@ Prerequisites:
 1. Modify the role as needed.
 1. Select **Save role** to update the role.
 
-To edit a custom role, you can also [use the API](../api/graphql/reference/index.md#mutationmemberroleupdate).
+To edit a custom role, you can also [use the API](../api/graphql/reference/_index.md#mutationmemberroleupdate).
 
 ## Delete a custom role
 
@@ -143,7 +143,7 @@ You can't remove a custom role from a group if there are members assigned that r
 1. Select **Custom Roles**.
 1. In the **Actions** column, select **Delete role** (**{remove}**) and confirm.
 
-You can also [use the API](../api/graphql/reference/index.md#mutationmemberroledelete) to delete a custom role. To use the API, you must provide the `id` of the custom role. If you do not know this `id`, you can find it by making an [API request on the group](../api/graphql/reference/index.md#groupmemberroles) or an [API request on the instance](../api/graphql/reference/index.md#querymemberroles).
+You can also [use the API](../api/graphql/reference/_index.md#mutationmemberroledelete) to delete a custom role. To use the API, you must provide the `id` of the custom role. If you do not know this `id`, you can find it by making an [API request on the group](../api/graphql/reference/_index.md#groupmemberroles) or an [API request on the instance](../api/graphql/reference/_index.md#querymemberroles).
 
 ## Add a user with a custom role to your group or project
 
@@ -329,7 +329,7 @@ Prerequisites:
 
 - You must be an administrator for the self-managed instance.
 
-You can use the API to [create](../api/graphql/reference/index.md#mutationmemberroleadmincreate) and [assign](../api/graphql/reference/index.md#mutationmemberroletouserassign) custom admin roles. These roles allow you to grant limited access to administrator resources.
+You can use the API to [create](../api/graphql/reference/_index.md#mutationmemberroleadmincreate) and [assign](../api/graphql/reference/_index.md#mutationmemberroletouserassign) custom admin roles. These roles allow you to grant limited access to administrator resources.
 
 For information on available permissions, see [custom permissions](custom_roles/abilities.md).
 
diff --git a/doc/user/gitlab_duo/turn_on_off.md b/doc/user/gitlab_duo/turn_on_off.md
index 804f94d6e64..5a2fb97b0e7 100644
--- a/doc/user/gitlab_duo/turn_on_off.md
+++ b/doc/user/gitlab_duo/turn_on_off.md
@@ -136,7 +136,7 @@ To turn off GitLab Duo for a project:
 In GitLab 17.3 and earlier, follow these instructions to turn off GitLab Duo for a project.
 
 1. Use the GitLab GraphQL API
-   [`projectSettingsUpdate`](../../api/graphql/reference/index.md#mutationprojectsettingsupdate)
+   [`projectSettingsUpdate`](../../api/graphql/reference/_index.md#mutationprojectsettingsupdate)
    mutation.
 1. Set the
    [`duo_features_enabled`](../../api/graphql/getting_started.md#update-project-settings)
diff --git a/doc/user/group/compliance_frameworks.md b/doc/user/group/compliance_frameworks.md
index 064faf3340f..a20705443b3 100644
--- a/doc/user/group/compliance_frameworks.md
+++ b/doc/user/group/compliance_frameworks.md
@@ -60,7 +60,7 @@ You can apply multiple compliance frameworks to a project but cannot apply compl
 To apply a compliance framework to a project, apply the compliance framework through the
 [Compliance projects report](../compliance/compliance_center/compliance_projects_report.md#apply-a-compliance-framework-to-projects-in-a-group).
 
-You can use the [GraphQL API](../../api/graphql/reference/index.md#mutationprojectsetcomplianceframework) to apply a
+You can use the [GraphQL API](../../api/graphql/reference/_index.md#mutationprojectsetcomplianceframework) to apply a
 compliance framework to a project.
 
 If you create compliance frameworks on subgroups with GraphQL, the framework is created on the root ancestor if the user
diff --git a/doc/user/group/contribution_analytics/index.md b/doc/user/group/contribution_analytics/index.md
index d3dea3f054e..6d287450b6a 100644
--- a/doc/user/group/contribution_analytics/index.md
+++ b/doc/user/group/contribution_analytics/index.md
@@ -37,7 +37,7 @@ Three bar charts and a table illustrate the number of contributions made by each
 
 ![Contribution analytics bar graphs](img/contribution_analytics_push_v17_7.png)
 
-To retrieve metrics for user contributions, you can also use the [GraphQL API](../../../api/graphql/reference/index.md#groupcontributions).
+To retrieve metrics for user contributions, you can also use the [GraphQL API](../../../api/graphql/reference/_index.md#groupcontributions).
 
 ### View a member's contributions
 
diff --git a/doc/user/group/epics/epic_work_items.md b/doc/user/group/epics/epic_work_items.md
index d1c7e7e8ce1..948f2bdb15a 100644
--- a/doc/user/group/epics/epic_work_items.md
+++ b/doc/user/group/epics/epic_work_items.md
@@ -12,7 +12,7 @@ DETAILS:
 **Status:** Beta
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/9290) in GitLab 17.2 [with a flag](../../../administration/feature_flags.md) named `work_item_epics`. Disabled by default. This feature is in [beta](../../../policy/development_stages_support.md#beta).
-> - Listing epics using the [GraphQL API](../../../api/graphql/reference/index.md) [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12852) in GitLab 17.4.
+> - Listing epics using the [GraphQL API](../../../api/graphql/reference/_index.md) [introduced](https://gitlab.com/groups/gitlab-org/-/epics/12852) in GitLab 17.4.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/470685) in GitLab 17.6.
 > - [Enabled by default on GitLab Self-Managed and GitLab Dedicated](https://gitlab.com/gitlab-org/gitlab/-/issues/468310) in GitLab 17.7.
 
diff --git a/doc/user/group/moderate_users.md b/doc/user/group/moderate_users.md
index a548d50c9e9..839c2062315 100644
--- a/doc/user/group/moderate_users.md
+++ b/doc/user/group/moderate_users.md
@@ -47,7 +47,7 @@ To manually ban a user:
 
 ### Unban a user
 
-To unban a user with the GraphQL API, see [`Mutation.namespaceBanDestroy`](../../api/graphql/reference/index.md#mutationnamespacebandestroy).
+To unban a user with the GraphQL API, see [`Mutation.namespaceBanDestroy`](../../api/graphql/reference/_index.md#mutationnamespacebandestroy).
 
 <i class="fa fa-youtube-play youtube" aria-hidden="true"></i>
 For a demo on unbanning a user at the group level, see [Namespace level ban - Unbanning a user](https://www.youtube.com/watch?v=mTQVbP3MQrs).
diff --git a/doc/user/group/saml_sso/troubleshooting.md b/doc/user/group/saml_sso/troubleshooting.md
index a9f6c992c25..5fd9405e135 100644
--- a/doc/user/group/saml_sso/troubleshooting.md
+++ b/doc/user/group/saml_sso/troubleshooting.md
@@ -209,7 +209,7 @@ You can use one of the following to troubleshoot SAML:
 - A [quick start guide to start a Docker container](../../../administration/troubleshooting/test_environments.md#saml)
   with a plug and play SAML 2.0 identity provider if you only require a SAML provider.
 - A local environment by
-  [enabling SAML for groups on a self-managed instance](../../../integration/saml.md#configure-group-saml-sso-on-a-self-managed-instance).
+  [enabling SAML for groups on a GitLab Self-Managed instance](../../../integration/saml.md#configure-group-saml-sso-on-gitlab-self-managed).
 
 ## Verify configuration
 
diff --git a/doc/user/infrastructure/iac/terraform_state.md b/doc/user/infrastructure/iac/terraform_state.md
index 5f351e66618..0c3128bc145 100644
--- a/doc/user/infrastructure/iac/terraform_state.md
+++ b/doc/user/infrastructure/iac/terraform_state.md
@@ -326,7 +326,7 @@ You can also use [CI/CD job token](../../../ci/jobs/ci_job_token.md) and basic a
 curl --user "gitlab-ci-token:$CI_JOB_TOKEN" --request DELETE "https://gitlab.example.com/api/v4/projects/<your_project_id>/terraform/state/<your_state_name>"
 ```
 
-You can also use [the GraphQL API](../../../api/graphql/reference/index.md#mutationterraformstatedelete).
+You can also use [the GraphQL API](../../../api/graphql/reference/_index.md#mutationterraformstatedelete).
 
 ## Related topics
 
diff --git a/doc/user/markdown.md b/doc/user/markdown.md
index 87a0392d941..147b85f5099 100644
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@@ -1051,7 +1051,7 @@ This syntax also works in AsciiDoc wikis and files using `:stem: latexmath`. For
 the [Asciidoctor user manual](https://asciidoctor.org/docs/user-manual/#activating-stem-support).
 
 To prevent malicious activity, GitLab renders only the first 50 inline math instances.
-You can disable this limit [for a group](../api/graphql/reference/index.md#mutationgroupupdate)
+You can disable this limit [for a group](../api/graphql/reference/_index.md#mutationgroupupdate)
 or for the entire [self-managed instance](../administration/instance_limits.md#math-rendering-limits).
 
 The number of math blocks is also limited based on render time. If the limit is exceeded,
diff --git a/doc/user/packages/dependency_proxy/reduce_dependency_proxy_storage.md b/doc/user/packages/dependency_proxy/reduce_dependency_proxy_storage.md
index 5e8c8f7d5bd..7c752ef8b17 100644
--- a/doc/user/packages/dependency_proxy/reduce_dependency_proxy_storage.md
+++ b/doc/user/packages/dependency_proxy/reduce_dependency_proxy_storage.md
@@ -43,7 +43,7 @@ freeing up additional storage space. The policies use time-to-live (TTL) logic:
 - The number of days is configured.
 - All cached dependency proxy files that have not been pulled in that many days are deleted.
 
-Use the [GraphQL API](../../../api/graphql/reference/index.md#mutationupdatedependencyproxyimagettlgrouppolicy)
+Use the [GraphQL API](../../../api/graphql/reference/_index.md#mutationupdatedependencyproxyimagettlgrouppolicy)
 to enable and configure cleanup policies:
 
 ```graphql
diff --git a/doc/user/packages/maven_repository/index.md b/doc/user/packages/maven_repository/index.md
index c166886b5d7..cf099ec9157 100644
--- a/doc/user/packages/maven_repository/index.md
+++ b/doc/user/packages/maven_repository/index.md
@@ -865,7 +865,7 @@ To delete older package versions, consider using the Packages API or the UI.
 > - Required role [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/350682) from Developer to Maintainer in GitLab 15.0.
 > - Required role [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/370471) from Maintainer to Owner in GitLab 17.0.
 
-To prevent users from publishing duplicate Maven packages, you can use the [GraphQl API](../../../api/graphql/reference/index.md#packagesettings) or the UI.
+To prevent users from publishing duplicate Maven packages, you can use the [GraphQl API](../../../api/graphql/reference/_index.md#packagesettings) or the UI.
 
 In the UI:
 
diff --git a/doc/user/packages/nuget_repository/index.md b/doc/user/packages/nuget_repository/index.md
index 2b64b177393..2ebc2f6c9ab 100644
--- a/doc/user/packages/nuget_repository/index.md
+++ b/doc/user/packages/nuget_repository/index.md
@@ -436,7 +436,7 @@ the existing package is overwritten.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/419078) in GitLab 16.6. Feature flag `nuget_duplicates_option` removed.
 > - Required role [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/370471) from Maintainer to Owner in GitLab 17.0.
 
-To prevent users from publishing duplicate NuGet packages, you can use the [GraphQl API](../../../api/graphql/reference/index.md#packagesettings) or the UI.
+To prevent users from publishing duplicate NuGet packages, you can use the [GraphQl API](../../../api/graphql/reference/_index.md#packagesettings) or the UI.
 
 In the UI:
 
@@ -593,7 +593,7 @@ so you can use the package registry as a symbol server.
 
 To use the symbol server:
 
-1. Enable the `nuget_symbol_server_enabled` namespace setting with the [GraphQl API](../../../api/graphql/reference/index.md#packagesettings).
+1. Enable the `nuget_symbol_server_enabled` namespace setting with the [GraphQl API](../../../api/graphql/reference/_index.md#packagesettings).
 1. Configure your debugger to use the symbol server.
    For example, to configure Visual Studio:
 
diff --git a/doc/user/packages/terraform_module_registry/index.md b/doc/user/packages/terraform_module_registry/index.md
index 8a0be892ab6..714215d9b39 100644
--- a/doc/user/packages/terraform_module_registry/index.md
+++ b/doc/user/packages/terraform_module_registry/index.md
@@ -175,7 +175,7 @@ To allow publishing duplicate module names:
 
 Your changes are automatically saved.
 
-You can also allow publishing duplicate names by enabling `terraform_module_duplicates_allowed` in the [GraphQL API](../../../api/graphql/reference/index.md#packagesettings).
+You can also allow publishing duplicate names by enabling `terraform_module_duplicates_allowed` in the [GraphQL API](../../../api/graphql/reference/_index.md#packagesettings).
 
 To allow duplicates with specific names:
 
diff --git a/doc/user/profile/achievements.md b/doc/user/profile/achievements.md
index 53e3081fbce..d587ac07442 100644
--- a/doc/user/profile/achievements.md
+++ b/doc/user/profile/achievements.md
@@ -70,7 +70,7 @@ To view a user's achievements:
    - Date when the achievement was awarded to the user
    - Namespace that awarded the achievement if the user is a member of the namespace or the namespace is public
 
-To retrieve a list of a user's achievements, query the [`user` GraphQL type](../../api/graphql/reference/index.md#user).
+To retrieve a list of a user's achievements, query the [`user` GraphQL type](../../api/graphql/reference/_index.md#user).
 
 ```graphql
 query {
@@ -108,7 +108,7 @@ To create an achievement:
   1. Optional. Enter a description and upload an avatar for the achievement.
   1. Select **Save changes**.
 
-- With the GraphQL API, call the [`achievementsCreate` GraphQL mutation](../../api/graphql/reference/index.md#mutationachievementscreate):
+- With the GraphQL API, call the [`achievementsCreate` GraphQL mutation](../../api/graphql/reference/_index.md#mutationachievementscreate):
 
   ```graphql
   mutation achievementsCreate($file: Upload!) {
@@ -155,7 +155,7 @@ Prerequisites:
 
 - You must have the Maintainer or Owner role for the namespace.
 
-To update an achievement, call the [`achievementsUpdate` GraphQL mutation](../../api/graphql/reference/index.md#mutationachievementsupdate).
+To update an achievement, call the [`achievementsUpdate` GraphQL mutation](../../api/graphql/reference/_index.md#mutationachievementsupdate).
 
 ```graphql
 mutation achievementsUpdate($file: Upload!) {
@@ -186,7 +186,7 @@ Prerequisites:
 
 - You must have the Maintainer or Owner role for the namespace.
 
-To award an achievement to a user, call the [`achievementsAward` GraphQL mutation](../../api/graphql/reference/index.md#mutationachievementsaward).
+To award an achievement to a user, call the [`achievementsAward` GraphQL mutation](../../api/graphql/reference/_index.md#mutationachievementsaward).
 
 ```graphql
 mutation {
@@ -217,7 +217,7 @@ Prerequisites:
 
 - You must have the Maintainer or Owner role for the namespace.
 
-To revoke an achievement, call the [`achievementsRevoke` GraphQL mutation](../../api/graphql/reference/index.md#mutationachievementsrevoke).
+To revoke an achievement, call the [`achievementsRevoke` GraphQL mutation](../../api/graphql/reference/_index.md#mutationachievementsrevoke).
 
 ```graphql
 mutation {
@@ -248,7 +248,7 @@ Prerequisites:
 
 - You must have the Owner role for the namespace.
 
-To delete an awarded achievement, call the [`userAchievementsDelete` GraphQL mutation](../../api/graphql/reference/index.md#mutationuserachievementsdelete).
+To delete an awarded achievement, call the [`userAchievementsDelete` GraphQL mutation](../../api/graphql/reference/_index.md#mutationuserachievementsdelete).
 
 ```graphql
 mutation {
@@ -279,7 +279,7 @@ Prerequisites:
 
 - You must have the Maintainer or Owner role for the namespace.
 
-To delete an achievement, call the [`achievementsDelete` GraphQL mutation](../../api/graphql/reference/index.md#mutationachievementsdelete).
+To delete an achievement, call the [`achievementsDelete` GraphQL mutation](../../api/graphql/reference/_index.md#mutationachievementsdelete).
 
 ```graphql
 mutation {
@@ -309,7 +309,7 @@ If you don't want to display achievements on your profile, you can opt out. To d
 
 If you don't want to display all achievements on your profile, you can change the visibility of specific achievements.
 
-To hide one of your achievements, call the [`userAchievementsUpdate` GraphQL mutation](../../api/graphql/reference/index.md#mutationuserachievementsupdate).
+To hide one of your achievements, call the [`userAchievementsUpdate` GraphQL mutation](../../api/graphql/reference/_index.md#mutationuserachievementsupdate).
 
 ```graphql
 mutation {
@@ -332,7 +332,7 @@ To show one of your achievements again, call the same mutation with the value `t
 
 By default, achievements on your profile are displayed in ascending order by awarded date.
 
-To change the order of your achievements, call the [`userAchievementPrioritiesUpdate` GraphQL mutation](../../api/graphql/reference/index.md#mutationuserachievementprioritiesupdate)
+To change the order of your achievements, call the [`userAchievementPrioritiesUpdate` GraphQL mutation](../../api/graphql/reference/_index.md#mutationuserachievementprioritiesupdate)
 with an ordered list of all prioritized achievements.
 
 ```graphql
diff --git a/doc/user/project/quick_actions.md b/doc/user/project/quick_actions.md
index 3d7264fcf84..a156bcc5883 100644
--- a/doc/user/project/quick_actions.md
+++ b/doc/user/project/quick_actions.md
@@ -163,6 +163,7 @@ To auto-format this table, use the VS Code Markdown Table formatter: `https://do
 | `/clear_weight`                                               | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Clear weight. |
 | `/close`                                                      | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Close. |
 | `/confidential`                                               | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Mark work item as confidential.  [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/412276) in GitLab 16.4. |
+| `/copy_metadata <work_item>`                                  | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Copy labels and milestone from another work item in the same namespace. The `<work_item>` value should be in the format of `#item` or a URL to a work item. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/509076) in GitLab 17.9. |
 | `/done`                                                       | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Mark to-do item as done. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/412277) in GitLab 16.2. |
 | `/due <date>`                                                 | **{check-circle}** Yes | **{dotted-circle}** No | **{check-circle}** Yes | Set due date. Examples of valid `<date>` include `in 2 days`, `this Friday` and `December 31st`. |
 | `/health_status <value>`                                      | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Set [health status](issues/managing_issues.md#health-status). Valid options for `<value>` are `on_track`, `needs_attention`, or `at_risk`. |
diff --git a/doc/user/project/time_tracking.md b/doc/user/project/time_tracking.md
index 02dc92bc981..bb39f1c11fa 100644
--- a/doc/user/project/time_tracking.md
+++ b/doc/user/project/time_tracking.md
@@ -155,7 +155,7 @@ Prerequisites:
 To delete a timelog, either:
 
 - In the time tracking report, on the right of a timelog entry, select **Delete time spent** (**{remove}**).
-- Use the [GraphQL API](../../api/graphql/reference/index.md#mutationtimelogdelete).
+- Use the [GraphQL API](../../api/graphql/reference/_index.md#mutationtimelogdelete).
 
 ### Delete all the time spent
 
@@ -244,10 +244,10 @@ With this option enabled, `75h` is displayed instead of `1w 4d 3h`.
 ## Related topics
 
 - Time tracking GraphQL references:
-  - [Connection](../../api/graphql/reference/index.md#timelogconnection)
-  - [Edge](../../api/graphql/reference/index.md#timelogedge)
-  - [Fields](../../api/graphql/reference/index.md#timelog)
-  - [Timelogs](../../api/graphql/reference/index.md#querytimelogs)
-  - [Group timelogs](../../api/graphql/reference/index.md#grouptimelogs)
-  - [Project Timelogs](../../api/graphql/reference/index.md#projecttimelogs)
-  - [User Timelogs](../../api/graphql/reference/index.md#usertimelogs)
+  - [Connection](../../api/graphql/reference/_index.md#timelogconnection)
+  - [Edge](../../api/graphql/reference/_index.md#timelogedge)
+  - [Fields](../../api/graphql/reference/_index.md#timelog)
+  - [Timelogs](../../api/graphql/reference/_index.md#querytimelogs)
+  - [Group timelogs](../../api/graphql/reference/_index.md#grouptimelogs)
+  - [Project Timelogs](../../api/graphql/reference/_index.md#projecttimelogs)
+  - [User Timelogs](../../api/graphql/reference/_index.md#usertimelogs)
diff --git a/doc/user/project/use_project_as_go_package.md b/doc/user/project/use_project_as_go_package.md
index 1437f1b6eed..93c55762da0 100644
--- a/doc/user/project/use_project_as_go_package.md
+++ b/doc/user/project/use_project_as_go_package.md
@@ -86,7 +86,7 @@ To disable fetching:
 
 - If the module name or its prefix is in `GOPRIVATE` or `GONOPROXY`, Go does not query module
   proxies.
-- If the module name or its prefix is in `GONOPRIVATE` or `GONOSUMDB`, Go does not query
+- If the module name or its prefix is in `GOPRIVATE` or `GONOSUMDB`, Go does not query
   Checksum databases.
 
 ## Authenticate Git requests to private subgroups
diff --git a/doc/user/workspace/index.md b/doc/user/workspace/index.md
index 8007a545517..acf4464059d 100644
--- a/doc/user/workspace/index.md
+++ b/doc/user/workspace/index.md
@@ -88,8 +88,8 @@ In deployments that contain multiple agents, you might want to identify an agent
 To identify an agent associated with a running workspace, use one of the following GraphQL endpoints:
 
 - `agent-id` to return the project the agent belongs to.
-- [`Query.workspaces`](../../api/graphql/reference/index.md#queryworkspaces) to return:
-  - The [cluster agent](../../api/graphql/reference/index.md#clusteragent) associated with the workspace.
+- [`Query.workspaces`](../../api/graphql/reference/_index.md#queryworkspaces) to return:
+  - The [cluster agent](../../api/graphql/reference/_index.md#clusteragent) associated with the workspace.
   - The project the agent belongs to.
 
 ## Devfile
diff --git a/lefthook.yml b/lefthook.yml
index c8fc56326f5..f6522fdb023 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -25,7 +25,7 @@ pre-push:
     markdownlint:
       tags: documentation style
       files: git diff --name-only --diff-filter=d $(git merge-base origin/master HEAD)..HEAD
-      exclude: 'doc/api/graphql/reference/index.md'
+      exclude: 'doc/api/graphql/reference/_index.md'
       glob: 'doc/*.md'
       run: yarn markdownlint {files}
     yamllint:
@@ -61,7 +61,7 @@ pre-push:
     vale: # Requires Vale: https://docs.gitlab.com/ee/development/documentation/testing/vale.html
       tags: documentation style
       files: git diff --name-only --diff-filter=d $(git merge-base origin/master HEAD)..HEAD
-      exclude: 'doc/api/graphql/reference/index.md'
+      exclude: 'doc/api/graphql/reference/_index.md'
       glob: 'doc/*.md'
       run: 'if [ $VALE_WARNINGS ]; then minWarnings=warning; else minWarnings=error; fi; if command -v vale > /dev/null 2>&1; then if ! vale --config .vale.ini --minAlertLevel $minWarnings {files}; then echo "ERROR: Fix any linting errors and make sure you are using the latest version of Vale."; exit 1; fi; else echo "ERROR: Vale not found. For more information, see https://vale.sh/docs/vale-cli/installation/."; exit 1; fi'
     gettext:
@@ -185,7 +185,7 @@ pre-commit:
     markdownlint:
       tags: documentation style
       files: git diff --name-only --diff-filter=d --staged
-      exclude: 'doc/api/graphql/reference/index.md'
+      exclude: 'doc/api/graphql/reference/_index.md'
       glob: 'doc/*.md'
       run: yarn markdownlint {files}
     mermaidlint:
@@ -196,7 +196,7 @@ pre-commit:
     vale: # Requires Vale: https://docs.gitlab.com/ee/development/documentation/testing/vale.html
       tags: documentation style
       files: git diff --name-only --diff-filter=d --staged
-      exclude: 'doc/api/graphql/reference/index.md'
+      exclude: 'doc/api/graphql/reference/_index.md'
       glob: 'doc/*.md'
       run: 'if [ $VALE_WARNINGS ]; then minWarnings=warning; else minWarnings=error; fi; if command -v vale > /dev/null 2>&1; then if ! vale --config .vale.ini --minAlertLevel $minWarnings {files}; then echo "ERROR: Fix any linting errors and make sure you are using the latest version of Vale."; exit 1; fi; else echo "ERROR: Vale not found. For more information, see https://vale.sh/docs/vale-cli/installation/."; exit 1; fi'
 
diff --git a/lib/gitlab/auth/request_authenticator.rb b/lib/gitlab/auth/request_authenticator.rb
index e20820a5118..df45264dda4 100644
--- a/lib/gitlab/auth/request_authenticator.rb
+++ b/lib/gitlab/auth/request_authenticator.rb
@@ -68,12 +68,8 @@ module Gitlab
       #
       # Overridden in EE
       def find_user_for_graphql_api_request
-        if Feature.enabled? :graphql_minimal_auth_methods # rubocop:disable Gitlab/FeatureFlagWithoutActor -- reverting MR
-          find_user_from_web_access_token(:api, scopes: graphql_authorization_scopes) ||
-            find_user_from_personal_access_token_for_api_or_git
-        else
-          find_user_from_any_authentication_method(:api)
-        end
+        find_user_from_web_access_token(:api, scopes: graphql_authorization_scopes) ||
+          find_user_from_personal_access_token_for_api_or_git
       end
 
       # Overridden in EE
diff --git a/lib/gitlab/ci/variables/builder/pipeline.rb b/lib/gitlab/ci/variables/builder/pipeline.rb
index 72f152fa6eb..d254c492c82 100644
--- a/lib/gitlab/ci/variables/builder/pipeline.rb
+++ b/lib/gitlab/ci/variables/builder/pipeline.rb
@@ -84,6 +84,10 @@ module Gitlab
           strong_memoize_attr :predefined_commit_tag_variables
 
           def predefined_merge_request_variables
+            if ::Feature.enabled?(:ci_merge_request_variables_preload, pipeline.project)
+              Preloader::MergeRequest.new(pipeline.merge_request).preload
+            end
+
             Gitlab::Ci::Variables::Collection.new.tap do |variables|
               variables.append(key: 'CI_MERGE_REQUEST_EVENT_TYPE', value: pipeline.merge_request_event_type.to_s)
               variables.append(key: 'CI_MERGE_REQUEST_SOURCE_BRANCH_SHA', value: pipeline.source_sha.to_s)
diff --git a/lib/gitlab/ci/variables/preloader/merge_request.rb b/lib/gitlab/ci/variables/preloader/merge_request.rb
new file mode 100644
index 00000000000..19adf35da06
--- /dev/null
+++ b/lib/gitlab/ci/variables/preloader/merge_request.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Variables
+      module Preloader
+        class MergeRequest
+          def initialize(merge_request)
+            @merge_request = merge_request
+          end
+
+          def preload
+            ActiveRecord::Associations::Preloader.new(
+              records: [@merge_request],
+              associations: preloads
+            ).call
+          end
+
+          private
+
+          def preloads
+            []
+          end
+        end
+      end
+    end
+  end
+end
+
+Gitlab::Ci::Variables::Preloader::MergeRequest.prepend_mod_with('Gitlab::Ci::Variables::Preloader::MergeRequest')
diff --git a/lib/tasks/gitlab/graphql.rake b/lib/tasks/gitlab/graphql.rake
index 46a81a2b0da..dbc0bfd180a 100644
--- a/lib/tasks/gitlab/graphql.rake
+++ b/lib/tasks/gitlab/graphql.rake
@@ -127,7 +127,7 @@ namespace :gitlab do
     task check_docs: [:environment, :enable_feature_flags] do
       renderer = Tooling::Graphql::Docs::Renderer.new(GitlabSchema, **render_options)
 
-      doc = File.read(Rails.root.join(OUTPUT_DIR, 'index.md'))
+      doc = File.read(Rails.root.join(OUTPUT_DIR, '_index.md'))
 
       if doc == renderer.contents
         puts "GraphQL documentation is up to date"
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index b9e46337d22..b558283377d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1630,6 +1630,9 @@ msgstr ""
 msgid "'%{value}' days of inactivity must be greater than or equal to 90"
 msgstr ""
 
+msgid "'ConfluenceService|Your GitLab wiki is still available at %{link_start}%{wiki_url}%{link_end}. To re-enable the link to the GitLab wiki, disable this integration."
+msgstr ""
+
 msgid "'allow: %{allow}' must be a string"
 msgstr ""
 
@@ -19498,6 +19501,18 @@ msgstr ""
 msgid "Dependency list"
 msgstr ""
 
+msgid "DependencyListExport|Location"
+msgstr ""
+
+msgid "DependencyListExport|Name"
+msgstr ""
+
+msgid "DependencyListExport|Packager"
+msgstr ""
+
+msgid "DependencyListExport|Version"
+msgstr ""
+
 msgid "DependencyProxy|%{docLinkStart}See the documentation%{docLinkEnd} for other ways to store Docker images in Dependency Proxy cache."
 msgstr ""
 
@@ -45781,6 +45796,12 @@ msgstr ""
 msgid "ProjectsNew|You can always change your URL later"
 msgstr ""
 
+msgid "ProjectsNew|You cannot create projects in your personal namespace. Contact your GitLab administrator."
+msgstr ""
+
+msgid "ProjectsNew|You've reached your limit of %{limit} projects created. Contact your GitLab administrator."
+msgstr ""
+
 msgid "ProjectsNew|Your project will be created at:"
 msgstr ""
 
diff --git a/scripts/frontend/check_jest_vue3_quarantine.js b/scripts/frontend/check_jest_vue3_quarantine.js
index a238caeb35a..24386137907 100755
--- a/scripts/frontend/check_jest_vue3_quarantine.js
+++ b/scripts/frontend/check_jest_vue3_quarantine.js
@@ -17,7 +17,6 @@ const FIXTURES_HELP_URL =
 const DIR = join(ROOT, 'tmp/tests/frontend');
 
 const JEST_JSON_OUTPUT = join(DIR, 'jest_results.json');
-const JEST_STDOUT = join(DIR, 'jest_stdout');
 const JEST_STDERR = join(DIR, 'jest_stderr');
 
 // Force basic color output in CI
@@ -67,7 +66,7 @@ Locally:
     )
     .option(
       '--stdio',
-      `Let Jest write to stdout/stderr as normal. By default, it writes to ${JEST_STDOUT} and ${JEST_STDERR}. Should not be used in CI, as it can exceed maximum job log size.`,
+      `Let Jest write to stderr as normal. By default, it writes to ${JEST_STDERR}. Should not be used in CI, as it can exceed maximum job log size.`,
     )
     .parse(process.argv);
 
@@ -249,11 +248,10 @@ async function getStdio() {
     return 'inherit';
   }
 
-  await mkdir(dirname(JEST_STDOUT), { recursive: true });
-  const jestStdout = (await open(JEST_STDOUT, 'w')).createWriteStream();
+  await mkdir(dirname(JEST_STDERR), { recursive: true });
   const jestStderr = (await open(JEST_STDERR, 'w')).createWriteStream();
 
-  return ['inherit', jestStdout, jestStderr];
+  return ['inherit', 'inherit', jestStderr];
 }
 
 async function main() {
diff --git a/spec/frontend/projects/new_v2/components/app_spec.js b/spec/frontend/projects/new_v2/components/app_spec.js
index 99300f8f300..f616fd06032 100644
--- a/spec/frontend/projects/new_v2/components/app_spec.js
+++ b/spec/frontend/projects/new_v2/components/app_spec.js
@@ -1,44 +1,73 @@
+import { GlAlert } from '@gitlab/ui';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import App from '~/projects/new_v2/components/app.vue';
 import CommandLine from '~/projects/new_v2/components/command_line.vue';
 import MultiStepFormTemplate from '~/vue_shared/components/multi_step_form_template.vue';
+import SingleChoiceSelector from '~/vue_shared/components/single_choice_selector.vue';
 
 describe('New project creation app', () => {
   let wrapper;
 
-  const createComponent = (props = {}) => {
+  const createComponent = (props = {}, provide = {}) => {
     wrapper = shallowMountExtended(App, {
       propsData: {
         rootPath: '/',
         projectsUrl: '/dashboard/projects',
-        userNamespaceId: '1',
+        userProjectLimit: 10000,
+        canSelectNamespace: true,
         ...props,
       },
+      provide: {
+        userNamespaceId: '1',
+        canCreateProject: true,
+        ...provide,
+      },
     });
   };
 
-  const findMultyStepForm = () => wrapper.findComponent(MultiStepFormTemplate);
+  const findMultiStepForm = () => wrapper.findComponent(MultiStepFormTemplate);
+  const findSingleChoiceSelector = () => wrapper.findComponent(SingleChoiceSelector);
+  const findAlert = () => wrapper.findComponent(GlAlert);
   const findCommandLine = () => wrapper.findComponent(CommandLine);
 
   it('renders a form', () => {
     createComponent();
 
-    expect(findMultyStepForm().exists()).toBe(true);
+    expect(findMultiStepForm().exists()).toBe(true);
+    expect(findAlert().exists()).toBe(false);
   });
 
   describe('personal namespace project', () => {
-    beforeEach(() => {
-      createComponent();
-    });
-
     it('starts with personal namespace when no namespaceId provided', () => {
+      createComponent();
+
       expect(wrapper.findByTestId('personal-namespace-button').props('selected')).toBe(true);
       expect(wrapper.findByTestId('group-namespace-button').props('selected')).toBe(false);
     });
 
     it('does not renders a group select', () => {
+      createComponent();
+
       expect(wrapper.findByTestId('group-selector').exists()).toBe(false);
     });
+
+    it('renders error when user reached a limit of projects', () => {
+      createComponent({}, { canCreateProject: false });
+
+      expect(findSingleChoiceSelector().exists()).toBe(false);
+      expect(findAlert().text()).toBe(
+        "You've reached your limit of 10000 projects created. Contact your GitLab administrator.",
+      );
+    });
+
+    it('renders error when user can not create personal projects', () => {
+      createComponent({ userProjectLimit: 0 }, { canCreateProject: false });
+
+      expect(findSingleChoiceSelector().exists()).toBe(false);
+      expect(findAlert().text()).toBe(
+        'You cannot create projects in your personal namespace. Contact your GitLab administrator.',
+      );
+    });
   });
 
   describe('with command line', () => {
diff --git a/spec/frontend/repository/components/blob_content_viewer_spec.js b/spec/frontend/repository/components/blob_content_viewer_spec.js
index 240603572d8..587ba159e9d 100644
--- a/spec/frontend/repository/components/blob_content_viewer_spec.js
+++ b/spec/frontend/repository/components/blob_content_viewer_spec.js
@@ -40,6 +40,7 @@ import {
   userPermissionsMock,
   propsMock,
   axiosMockResponse,
+  FILE_SIZE_3MB,
 } from '../mock_data';
 
 jest.mock('~/repository/components/blob_viewers');
@@ -405,36 +406,32 @@ describe('Blob content viewer component', () => {
       expect(findBlobContent().exists()).toBe(false);
     });
 
-    it.each`
-      viewer        | fileType      | storedExternally | tooLarge | renderError    | expectedTooLarge | loadViewerReturnValue
-      ${'empty'}    | ${'null'}     | ${false}         | ${false} | ${null}        | ${false}         | ${EmptyViewer}
-      ${'download'} | ${'download'} | ${false}         | ${false} | ${null}        | ${false}         | ${DownloadViewer}
-      ${'text'}     | ${'text'}     | ${false}         | ${false} | ${null}        | ${false}         | ${SourceViewer}
-      ${'unknown'}  | ${'unknown'}  | ${true}          | ${false} | ${null}        | ${false}         | ${LfsViewer}
-      ${'text'}     | ${'text'}     | ${false}         | ${true}  | ${null}        | ${true}          | ${TooLargeViewer}
-      ${'text'}     | ${'text'}     | ${true}          | ${true}  | ${null}        | ${true}          | ${TooLargeViewer}
-      ${'text'}     | ${'text'}     | ${false}         | ${false} | ${'collapsed'} | ${true}          | ${TooLargeViewer}
-    `(
-      'renders viewer component for $viewer files with storedExternally=$storedExternally, tooLarge=$tooLarge, and renderError=$renderError',
-      async ({
-        viewer,
-        fileType,
-        storedExternally,
-        tooLarge,
-        renderError,
-        expectedTooLarge,
-        loadViewerReturnValue,
-      }) => {
+    it.each([EmptyViewer, DownloadViewer, SourceViewer, LfsViewer, TooLargeViewer])(
+      'renders viewer component for %s files',
+      async (loadViewerReturnValue) => {
         loadViewer.mockReturnValue(loadViewerReturnValue);
+        await createComponent();
 
+        expect(wrapper.findComponent(loadViewerReturnValue).exists()).toBe(true);
+      },
+    );
+
+    it.each`
+      language  | size             | tooLarge | renderError    | expectedTooLarge
+      ${'ruby'} | ${100}           | ${false} | ${null}        | ${false}
+      ${'ruby'} | ${FILE_SIZE_3MB} | ${false} | ${null}        | ${true}
+      ${'nyan'} | ${null}          | ${true}  | ${null}        | ${true}
+      ${'nyan'} | ${null}          | ${false} | ${'collapsed'} | ${true}
+    `(
+      'correctly handles file size limits when language=$language, size=$size, tooLarge=$tooLarge, renderError=$renderError',
+      async ({ language, size, tooLarge, renderError, expectedTooLarge }) => {
         await createComponent({
           blob: {
             ...simpleViewerMock,
-            fileType,
-            storedExternally,
+            language,
+            size,
             simpleViewer: {
               ...simpleViewerMock.simpleViewer,
-              fileType: viewer,
               tooLarge,
               renderError,
             },
@@ -442,9 +439,7 @@ describe('Blob content viewer component', () => {
         });
 
         await waitForPromises();
-
-        expect(loadViewer).toHaveBeenCalledWith(viewer, storedExternally, expectedTooLarge);
-        expect(wrapper.findComponent(loadViewerReturnValue).exists()).toBe(true);
+        expect(loadViewer).toHaveBeenCalledWith('text', false, expectedTooLarge);
       },
     );
   });
diff --git a/spec/frontend/repository/mock_data.js b/spec/frontend/repository/mock_data.js
index 7c2682cc9f3..585c59ec34e 100644
--- a/spec/frontend/repository/mock_data.js
+++ b/spec/frontend/repository/mock_data.js
@@ -277,3 +277,5 @@ export const headerAppInjected = {
   ],
   isBinary: false,
 };
+
+export const FILE_SIZE_3MB = 3000000;
diff --git a/spec/frontend/super_sidebar/components/global_search/components/global_search_spec.js b/spec/frontend/super_sidebar/components/global_search/components/global_search_spec.js
index 7a207e0fa66..66e436d8b5e 100644
--- a/spec/frontend/super_sidebar/components/global_search/components/global_search_spec.js
+++ b/spec/frontend/super_sidebar/components/global_search/components/global_search_spec.js
@@ -1,7 +1,8 @@
 import { GlModal, GlSearchBoxByType } from '@gitlab/ui';
-import Vue from 'vue';
+import Vue, { nextTick } from 'vue';
 // eslint-disable-next-line no-restricted-imports
 import Vuex from 'vuex';
+import { Mousetrap } from '~/lib/mousetrap';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import { createMockDirective } from 'helpers/vue_mock_directive';
 import GlobalSearchModal from '~/super_sidebar/components/global_search/components/global_search.vue';
@@ -23,11 +24,11 @@ import {
   MODAL_CLOSE_ESC,
   MODAL_CLOSE_BACKGROUND,
   MODAL_CLOSE_HEADERCLOSE,
+  COMMANDS_TOGGLE_KEYBINDING,
 } from '~/super_sidebar/components/global_search/command_palette/constants';
 import {
   SEARCH_INPUT_DESCRIPTION,
   SEARCH_RESULTS_DESCRIPTION,
-  KEY_K,
   KEY_N,
   KEY_P,
 } from '~/super_sidebar/components/global_search/constants';
@@ -137,7 +138,7 @@ describe('GlobalSearchModal', () => {
 
   beforeEach(() => {
     handleClosingSpy = jest.spyOn(GlobalSearchModal.methods, 'handleClosing');
-    onKeyComboDownSpy = jest.spyOn(GlobalSearchModal.methods, 'onKeyComboDown');
+    onKeyComboDownSpy = jest.spyOn(GlobalSearchModal.methods, 'onKeyComboToggleDropdown');
   });
 
   afterEach(() => {
@@ -158,6 +159,8 @@ describe('GlobalSearchModal', () => {
   const findFakeSearchInput = () => wrapper.findComponent(FakeSearchInput);
   const findScrollScrim = () => wrapper.findComponent(ScrollScrim);
   const findCommandPaletteDropdown = () => wrapper.findComponent(CommandsOverviewDropdown);
+  const findCommandPaletteInput = () =>
+    findGlobalSearchInput().find('[data-testid="search-input-field"]');
 
   describe('template', () => {
     beforeEach(() => {
@@ -247,7 +250,7 @@ describe('GlobalSearchModal', () => {
       },
     );
 
-    describe('Command palette', () => {
+    describe('when using command palette', () => {
       const possibleHandles = [...COMMON_HANDLES];
 
       describe.each(possibleHandles)('when search handle is "%s"', (handle) => {
@@ -281,8 +284,28 @@ describe('GlobalSearchModal', () => {
             },
             stubs: {
               GlModal,
-              GlSearchBoxByType,
+              GlSearchBoxByType: {
+                props: {
+                  value: {
+                    type: String,
+                    default: '',
+                  },
+                },
+                template: `
+                  <div>
+                    <input
+                      :value="value"
+                      ref="input"
+                      v-bind="$attrs"
+                      v-on="$listeners"
+                      data-testid="search-input-field"
+                      @input="$emit('input', $event.target.value)"
+                    />
+                  </div>
+                `,
+              },
             },
+            attachTo: document.body,
           });
 
           findGlobalSearchInput().vm.$emit('click');
@@ -293,6 +316,12 @@ describe('GlobalSearchModal', () => {
 
           expect(actionSpies.setCommand).toHaveBeenCalledWith(expect.any(Object), handle);
         });
+
+        it('should focus search input', async () => {
+          await findCommandPaletteDropdown().vm.$emit('selected', handle);
+          await nextTick();
+          expect(document.activeElement).toBe(findCommandPaletteInput().element);
+        });
       });
     });
   });
@@ -437,6 +466,7 @@ describe('GlobalSearchModal', () => {
           stubs: {
             GlModal,
             GlSearchBoxByType,
+            GlobalSearchDefaultItems,
           },
         });
       });
@@ -455,8 +485,9 @@ describe('GlobalSearchModal', () => {
           wrapper.vm.$refs.commandDropdown.close = closeSpy;
 
           await findGlobalSearchModal().vm.$emit('shown');
-          await triggerKeydownEvent(window, KEY_K, true);
-          await triggerKeydownEvent(window, KEY_K, true);
+
+          Mousetrap.trigger(COMMANDS_TOGGLE_KEYBINDING);
+          Mousetrap.trigger(COMMANDS_TOGGLE_KEYBINDING);
 
           expect(openSpy).toHaveBeenCalledTimes(1);
           expect(closeSpy).toHaveBeenCalledTimes(1);
@@ -470,9 +501,9 @@ describe('GlobalSearchModal', () => {
           wrapper.vm.$refs.commandDropdown.close = closeSpy;
 
           await findGlobalSearchModal().vm.$emit('shown');
-          await triggerKeydownEvent(window, KEY_K, true);
+          Mousetrap.trigger(COMMANDS_TOGGLE_KEYBINDING);
           findCommandPaletteDropdown().vm.$emit('hidden');
-          await triggerKeydownEvent(window, KEY_K, true);
+          Mousetrap.trigger(COMMANDS_TOGGLE_KEYBINDING);
 
           expect(openSpy).toHaveBeenCalledTimes(2);
           expect(closeSpy).toHaveBeenCalledTimes(0);
@@ -691,37 +722,38 @@ describe('GlobalSearchModal', () => {
       });
 
       it('should focus the next item when Ctrl+N is pressed', () => {
-        triggerKeydownEvent(window, KEY_N, false, true);
+        findSearchInput().trigger('keydown', { code: KEY_N, ctrlKey: true });
 
         expect(document.activeElement).toBe(wrapper.findByTestId('test-result-1').element);
       });
 
       it('should focus the previous item when Ctrl+P is pressed', () => {
-        triggerKeydownEvent(window, KEY_N, false, true);
-        triggerKeydownEvent(window, KEY_N, false, true);
+        findSearchInput().trigger('keydown', { code: KEY_N, ctrlKey: true });
+        findSearchInput().trigger('keydown', { code: KEY_N, ctrlKey: true });
 
         expect(document.activeElement).toBe(wrapper.findByTestId('test-result-2').element);
 
-        triggerKeydownEvent(window, KEY_P, false, true);
+        findSearchInput().trigger('keydown', { code: KEY_P, ctrlKey: true });
 
         expect(document.activeElement).toBe(wrapper.findByTestId('test-result-1').element);
       });
 
       it('should wrap to the last item when Ctrl+P is pressed at the first item', () => {
-        triggerKeydownEvent(window, KEY_P, false, true);
+        findSearchInput().trigger('keydown', { code: KEY_P, ctrlKey: true });
         expect(document.activeElement).toBe(wrapper.findByTestId('test-result-5').element);
       });
 
-      it('should wrap to the first item when Ctrl+N is pressed at the last item', () => {
+      it('should wrap to the first item when Ctrl+N is pressed at the last item', async () => {
         // triggers getListItemsAndFocusIndex() to grab the result items
-        triggerKeydownEvent(window, '', false, false);
+        findSearchInput().trigger('keydown', { code: '', ctrlKey: true });
+        await nextTick();
 
         const lastIndex = wrapper.vm.childListItems.length - 1;
 
         wrapper.vm.focusIndex = lastIndex;
         wrapper.vm.childListItems[lastIndex].focus();
 
-        triggerKeydownEvent(window, KEY_N, false, true);
+        findSearchInput().trigger('keydown', { code: KEY_N, ctrlKey: true });
 
         expect(document.activeElement).toBe(wrapper.findByTestId('test-result-1').element);
       });
diff --git a/spec/graphql/types/ci/job_token_accessible_project_type_spec.rb b/spec/graphql/types/ci/job_token_accessible_project_type_spec.rb
new file mode 100644
index 00000000000..b6d37934b3f
--- /dev/null
+++ b/spec/graphql/types/ci/job_token_accessible_project_type_spec.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['CiJobTokenAccessibleProject'], feature_category: :continuous_integration do
+  specify { expect(described_class.graphql_name).to eq('CiJobTokenAccessibleProject') }
+
+  it 'has the correct fields' do
+    expected_fields = [:id, :name, :path, :full_path, :web_url, :avatar_url]
+
+    expect(described_class).to have_graphql_fields(*expected_fields)
+  end
+end
diff --git a/spec/graphql/types/ci/job_token_auth_log_type_spec.rb b/spec/graphql/types/ci/job_token_auth_log_type_spec.rb
index 1076f2c3f0e..4d138cb4a74 100644
--- a/spec/graphql/types/ci/job_token_auth_log_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_auth_log_type_spec.rb
@@ -72,11 +72,21 @@ RSpec.describe GitlabSchema.types['CiJobTokenAuthLog'], feature_category: :conti
       context 'when multiple authorizations in the logs' do
         let_it_be(:origin_project_one) { create(:project, avatar: avatar_file) }
         let_it_be(:origin_project_two) { create(:project, avatar: avatar_file) }
+        let_it_be(:inaccessible_origin_project_three) { create(:project, avatar: avatar_file) }
+
+        let(:expected_authorizations_paths) do
+          [origin_project_one.path, origin_project_two.path,
+            inaccessible_origin_project_three.path]
+        end
+
+        let(:expected_authorizations_full_paths) do
+          [origin_project_one.full_path, origin_project_two.full_path,
+            inaccessible_origin_project_three.full_path]
+        end
 
-        let(:expected_authorizations_paths) { [origin_project_one.path, origin_project_two.path] }
-        let(:expected_authorizations_full_paths) { [origin_project_one.full_path, origin_project_two.full_path] }
         let(:expected_authorizations_avatar_urls) do
-          [origin_project_one.avatar_url(only_path: false), origin_project_two.avatar_url(only_path: false)]
+          [origin_project_one.avatar_url(only_path: false), origin_project_two.avatar_url(only_path: false),
+            inaccessible_origin_project_three.avatar_url(only_path: false)]
         end
 
         before do
@@ -90,9 +100,13 @@ RSpec.describe GitlabSchema.types['CiJobTokenAuthLog'], feature_category: :conti
           create(:ci_job_token_authorization,
             origin_project: origin_project_two,
             accessed_project: current_project)
+
+          create(:ci_job_token_authorization,
+            origin_project: inaccessible_origin_project_three,
+            accessed_project: current_project)
         end
 
-        it 'returns authorizations logs on current_project' do
+        it 'returns authorizations logs on current_project even from inaccessible origin projects' do
           expect(expected_authorizations_paths).to match_array(returned_origin_project_paths)
           expect(expected_authorizations_full_paths).to match_array(returned_origin_project_full_paths)
           expect(expected_authorizations_avatar_urls).to match_array(returned_origin_project_avatar_urls)
diff --git a/spec/graphql/types/ci/job_token_scope/target_type_spec.rb b/spec/graphql/types/ci/job_token_scope/target_type_spec.rb
index 6fb413dd5bb..82394d98ef6 100644
--- a/spec/graphql/types/ci/job_token_scope/target_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope/target_type_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe GitlabSchema.types['CiJobTokenScopeTarget'], feature_category: :secrets_management do
   it 'returns possible types' do
-    expect(described_class.possible_types).to include(Types::ProjectType)
+    expect(described_class.possible_types).to include(Types::Ci::JobTokenAccessibleProjectType)
     expect(described_class.possible_types).to include(Types::GroupType)
   end
 
@@ -12,7 +12,7 @@ RSpec.describe GitlabSchema.types['CiJobTokenScopeTarget'], feature_category: :s
     it 'resolves projects' do
       object = build(:project)
 
-      expect(described_class.resolve_type(object, {})).to eq(Types::ProjectType)
+      expect(described_class.resolve_type(object, {})).to eq(Types::Ci::JobTokenAccessibleProjectType)
     end
 
     it 'resolves groups' do
diff --git a/spec/graphql/types/ci/job_token_scope_type_spec.rb b/spec/graphql/types/ci/job_token_scope_type_spec.rb
index 0034aa57bf6..440a076bbba 100644
--- a/spec/graphql/types/ci/job_token_scope_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope_type_spec.rb
@@ -118,7 +118,11 @@ RSpec.describe GitlabSchema.types['CiJobTokenScopeType'], feature_category: :con
           it 'returns readable projects in scope' do
             expect(returned_project_paths).to contain_exactly(project.path)
             expect(returned_outbound_paths).to contain_exactly(project.path)
-            expect(returned_inbound_paths).to contain_exactly(project.path)
+          end
+
+          it 'returns even non readable projects in inbound allowlist' do
+            expect(returned_inbound_paths).to match_array([project.path, inbound_allowlist_project.path,
+              both_allowlists_project.path])
           end
         end
 
@@ -134,7 +138,11 @@ RSpec.describe GitlabSchema.types['CiJobTokenScopeType'], feature_category: :con
           it 'returns readable projects in scope' do
             expect(returned_project_paths).to contain_exactly(project.path)
             expect(returned_outbound_paths).to contain_exactly(project.path)
-            expect(returned_inbound_paths).to contain_exactly(project.path)
+          end
+
+          it 'returns even non readable projects in inbound allowlist' do
+            expect(returned_inbound_paths).to match_array([project.path, inbound_allowlist_project.path,
+              both_allowlists_project.path])
           end
         end
       end
diff --git a/spec/migrations/20250123195300_backfill_sharding_key_on_board_assignees_spec.rb b/spec/migrations/20250123195300_backfill_sharding_key_on_board_assignees_spec.rb
new file mode 100644
index 00000000000..ce1848db7cf
--- /dev/null
+++ b/spec/migrations/20250123195300_backfill_sharding_key_on_board_assignees_spec.rb
@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe BackfillShardingKeyOnBoardAssignees, migration: :gitlab_main, feature_category: :team_planning do
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: "namespace", path: "namespace", organization_id: organization.id) }
+  let(:project) do
+    table(:projects).create!(
+      namespace_id: namespace.id,
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
+  let(:board1) { table(:boards).create!(group_id: namespace.id) }
+  let(:board2) { table(:boards).create!(project_id: project.id) }
+  let(:user1) { table(:users).create!(username: 'user1', projects_limit: 2, email: 'user1@mail.com') }
+  let(:user2) { table(:users).create!(username: 'user2', projects_limit: 2, email: 'user2@mail.com') }
+
+  before do
+    [board1, board2].each do |board|
+      [user1, user2].each { |user| table(:board_assignees).create!(assignee_id: user.id, board_id: board.id) }
+    end
+
+    stub_const("#{described_class}::BATCH_SIZE", 2)
+  end
+
+  describe '#up' do
+    it 'updates records in batches' do
+      expect do
+        migrate!
+      end.to make_queries_matching(/UPDATE\s+"board_assignees"/, 2)
+    end
+
+    it 'sets group_id or project_id in every record' do
+      expect { migrate! }.to change {
+        table(:board_assignees).order(:id).pluck(:group_id, :project_id)
+      }.from(
+        Array.new(4) { [nil, nil] }
+      ).to(
+        [
+          [namespace.id, nil],
+          [namespace.id, nil],
+          [nil, project.id],
+          [nil, project.id]
+        ]
+      )
+    end
+  end
+end
diff --git a/spec/models/integrations/confluence_spec.rb b/spec/models/integrations/confluence_spec.rb
index a34b55c3c6b..fb64a9e1cc6 100644
--- a/spec/models/integrations/confluence_spec.rb
+++ b/spec/models/integrations/confluence_spec.rb
@@ -3,89 +3,5 @@
 require 'spec_helper'
 
 RSpec.describe Integrations::Confluence, feature_category: :integrations do
-  let_it_be(:project) { create(:project) }
-
-  describe 'Validations' do
-    before do
-      subject.active = active
-    end
-
-    context 'when integration is active' do
-      let(:active) { true }
-
-      it { is_expected.not_to allow_value('https://example.com').for(:confluence_url) }
-      it { is_expected.not_to allow_value('example.com').for(:confluence_url) }
-      it { is_expected.not_to allow_value('foo').for(:confluence_url) }
-      it { is_expected.not_to allow_value('ftp://example.atlassian.net/wiki').for(:confluence_url) }
-      it { is_expected.not_to allow_value('https://example.atlassian.net').for(:confluence_url) }
-      it { is_expected.not_to allow_value('https://.atlassian.net/wiki').for(:confluence_url) }
-      it { is_expected.not_to allow_value('https://example.atlassian.net/wikifoo').for(:confluence_url) }
-      it { is_expected.not_to allow_value('').for(:confluence_url) }
-      it { is_expected.not_to allow_value(nil).for(:confluence_url) }
-      it { is_expected.not_to allow_value('😊').for(:confluence_url) }
-      it { is_expected.to allow_value('https://example.atlassian.net/wiki').for(:confluence_url) }
-      it { is_expected.to allow_value('http://example.atlassian.net/wiki').for(:confluence_url) }
-      it { is_expected.to allow_value('https://example.atlassian.net/wiki/').for(:confluence_url) }
-      it { is_expected.to allow_value('http://example.atlassian.net/wiki/').for(:confluence_url) }
-      it { is_expected.to allow_value('https://example.atlassian.net/wiki/foo').for(:confluence_url) }
-
-      it { is_expected.to validate_presence_of(:confluence_url) }
-    end
-
-    context 'when integration is inactive' do
-      let(:active) { false }
-
-      it { is_expected.not_to validate_presence_of(:confluence_url) }
-      it { is_expected.to allow_value('foo').for(:confluence_url) }
-    end
-  end
-
-  describe '#help' do
-    it 'can correctly return a link to the project wiki when active' do
-      subject.project = project
-      subject.active = true
-
-      expect(subject.help).to include(Gitlab::Routing.url_helpers.project_wikis_url(project))
-    end
-
-    context 'when the project wiki is not enabled' do
-      before do
-        allow(project).to receive(:wiki_enabled?).and_return(false)
-      end
-
-      it 'returns nil when both active or inactive', :aggregate_failures do
-        [true, false].each do |active|
-          subject.active = active
-
-          expect(subject.help).to be_nil
-        end
-      end
-    end
-  end
-
-  describe '#avatar_url' do
-    it 'returns the avatar image path' do
-      expect(subject.avatar_url).to eq(ActionController::Base.helpers.image_path('confluence.svg'))
-    end
-  end
-
-  describe 'Caching has_confluence on project_settings' do
-    subject { project.project_setting.has_confluence? }
-
-    it 'sets the property to true when integration is active' do
-      create(:confluence_integration, project: project, active: true)
-
-      is_expected.to be(true)
-    end
-
-    it 'sets the property to false when integration is not active' do
-      create(:confluence_integration, project: project, active: false)
-
-      is_expected.to be(false)
-    end
-
-    it 'creates a project_setting record if one was not already created' do
-      expect { create(:confluence_integration) }.to change(ProjectSetting, :count).by(1)
-    end
-  end
+  it_behaves_like Integrations::Base::Confluence
 end
diff --git a/spec/models/integrations/instance/confluence_spec.rb b/spec/models/integrations/instance/confluence_spec.rb
new file mode 100644
index 00000000000..bf2901eaab2
--- /dev/null
+++ b/spec/models/integrations/instance/confluence_spec.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Integrations::Instance::Confluence, feature_category: :integrations do
+  it_behaves_like Integrations::Base::Confluence
+end
diff --git a/spec/requests/api/graphql/ci/job_token_scope/allowlist_query_spec.rb b/spec/requests/api/graphql/ci/job_token_scope/allowlist_query_spec.rb
index 484bc7637f7..905bf00b274 100644
--- a/spec/requests/api/graphql/ci/job_token_scope/allowlist_query_spec.rb
+++ b/spec/requests/api/graphql/ci/job_token_scope/allowlist_query_spec.rb
@@ -46,7 +46,7 @@ RSpec.describe 'Querying CI_JOB_TOKEN allowlist for a project', feature_category
                   fullPath
                 }
                 target {
-                  ... on Project {
+                  ... on CiJobTokenAccessibleProject {
                     fullPath
                   }
                 }
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
index cbf9f4a1883..a18fcc8858f 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
@@ -42,7 +42,7 @@ RSpec.describe 'CiJobTokenScopeAddGroupOrProject', feature_category: :continuous
             fullPath
           }
           target {
-            ... on Project {
+            ... on CiJobTokenAccessibleProject {
               fullPath
             }
             ... on Group {
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
index 2451401541f..933a98d472c 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
@@ -31,7 +31,7 @@ RSpec.describe 'CiJobTokenScopeAddProject', feature_category: :continuous_integr
             fullPath
           }
           target {
-            ... on Project {
+            ... on CiJobTokenAccessibleProject {
               fullPath
             }
           }
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
index df454bf0b13..4a18f0eaa4e 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
@@ -40,7 +40,7 @@ RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_int
             fullPath
           }
           target {
-            ... on Project {
+            ... on CiJobTokenAccessibleProject {
               fullPath
             }
           }
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/update_job_token_policies_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/update_job_token_policies_spec.rb
index 101428e322e..d240e712be5 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/update_job_token_policies_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/update_job_token_policies_spec.rb
@@ -27,7 +27,7 @@ RSpec.describe 'CiJobTokenScopeUpdatePolicies', feature_category: :continuous_in
             fullPath
           }
           target {
-            ... on Project {
+            ... on CiJobTokenAccessibleProject {
               fullPath
             }
             ... on Group {
diff --git a/spec/requests/api/graphql_spec.rb b/spec/requests/api/graphql_spec.rb
index 37988720433..425db1c296f 100644
--- a/spec/requests/api/graphql_spec.rb
+++ b/spec/requests/api/graphql_spec.rb
@@ -298,43 +298,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
           expect(json_response[1].dig('data', 'echoCreate', 'echoes')).to eq %w[hello world]
         end
       end
-
-      context 'when fix_graphql_csrf is disabled' do
-        before do
-          stub_feature_flags(fix_graphql_csrf: false)
-        end
-
-        it 'does not authenticate a user with an invalid CSRF' do
-          login_as(user)
-
-          stub_authentication_activity_metrics do |metrics|
-            expect(metrics)
-              .to increment(:user_authenticated_counter)
-              .and increment(:user_session_destroyed_counter)
-
-            expect(metrics.user_csrf_token_invalid_counter)
-              .to receive(:increment).with(controller: 'GraphqlController', auth: 'session')
-          end
-
-          post_graphql(query, headers: { 'X-CSRF-Token' => 'invalid' })
-
-          expect(graphql_data['echo']).to eq('nil says: Hello world')
-        end
-
-        it 'authenticates a user with a valid session token' do
-          # Create a session to get a CSRF token from
-          login_as(user)
-          get('/')
-
-          stub_authentication_activity_metrics do |metrics|
-            expect(metrics.user_csrf_token_invalid_counter).not_to receive(:increment)
-          end
-
-          post '/api/graphql', params: { query: query }, headers: { 'X-CSRF-Token' => session['_csrf_token'] }
-
-          expect(graphql_data['echo']).to eq("\"#{user.username}\" says: Hello world")
-        end
-      end
     end
 
     context 'with token authentication' do
@@ -365,18 +328,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
           expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
         end
-
-        context 'when fix_graphql_csrf is disabled' do
-          before do
-            stub_feature_flags(fix_graphql_csrf: false)
-          end
-
-          it 'does not enforce 2FA' do
-            post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token })
-
-            expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
-          end
-        end
       end
 
       context 'when user also has a valid session' do
@@ -400,49 +351,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
         end
       end
 
-      context 'when fix_graphql_csrf is disabled' do
-        before do
-          stub_feature_flags(fix_graphql_csrf: false)
-        end
-
-        it 'authenticates users with a PAT' do
-          stub_authentication_activity_metrics(debug: false) do |metrics|
-            expect(metrics)
-              .to increment(:user_authenticated_counter)
-              .and increment(:user_session_override_counter)
-              .and increment(:user_sessionless_authentication_counter)
-
-            expect(metrics.user_csrf_token_invalid_counter)
-              .to receive(:increment).with(controller: 'GraphqlController', auth: 'other')
-          end
-
-          post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token })
-
-          expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
-        end
-
-        context 'when user also has a valid session' do
-          let_it_be(:other_user) { create(:user) }
-
-          before do
-            login_as(other_user)
-            get('/')
-          end
-
-          it 'authenticates as session user' do
-            post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => session['_csrf_token'] })
-
-            expect(graphql_data['echo']).to eq("\"#{other_user.username}\" says: Hello world")
-          end
-
-          it 'authenticates as PAT user when CSRF token is invalid' do
-            post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => 'invalid' })
-
-            expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
-          end
-        end
-      end
-
       shared_examples 'valid token' do
         it 'accepts from header' do
           post_graphql(query, headers: { 'Authorization' => "Bearer #{token}" })
@@ -531,18 +439,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
             expect(graphql_data['currentUser']).to be_nil
           end
-
-          context 'when graphql_minimal_auth_methods FF is disabled' do
-            before do
-              stub_feature_flags(graphql_minimal_auth_methods: false)
-            end
-
-            it 'authenticates users with an LFS token' do
-              post '/api/graphql.git', params: { query: query }, headers: headers
-
-              expect(graphql_data['currentUser']['username']).to eq(user.username)
-            end
-          end
         end
 
         describe 'with job token' do
@@ -560,18 +456,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
             expect_graphql_errors_to_include(/Invalid token/)
           end
-
-          context 'when graphql_minimal_auth_methods FF is disabled' do
-            before do
-              stub_feature_flags(graphql_minimal_auth_methods: false)
-            end
-
-            it 'authenticates as the user' do
-              post '/api/graphql', params: { query: query, job_token: job_token }
-
-              expect(graphql_data['currentUser']['username']).to eq(user.username)
-            end
-          end
         end
 
         describe 'with static object token' do
@@ -590,25 +474,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
             expect_graphql_errors_to_include(/Invalid token/)
           end
-
-          # context is included to demonstrate that the FF code is not changing this behavior
-          context 'when graphql_minimal_auth_methods FF is disabled' do
-            before do
-              stub_feature_flags(graphql_minimal_auth_methods: false)
-            end
-
-            it 'does not authenticate user from header' do
-              post '/api/graphql', params: { query: query }, headers: headers
-
-              expect(graphql_data['currentUser']).to be_nil
-            end
-
-            it 'does not authenticate user from parameter' do
-              post "/api/graphql?token=#{user.static_object_token}", params: { query: query }
-
-              expect_graphql_errors_to_include(/Invalid token/)
-            end
-          end
         end
 
         describe 'with dependency proxy token' do
@@ -629,25 +494,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
             expect_graphql_errors_to_include(/Invalid token/)
           end
-
-          # context is included to demonstrate that the FF code is not changing this behavior
-          context 'when graphql_minimal_auth_methods FF is disabled' do
-            before do
-              stub_feature_flags(graphql_minimal_auth_methods: false)
-            end
-
-            it 'does not authenticate user from dependency proxy token in headers' do
-              post '/api/graphql', params: { query: query }, headers: headers
-
-              expect_graphql_errors_to_include(/Invalid token/)
-            end
-
-            it 'does not authenticate user from dependency proxy token in parameter' do
-              post "/api/graphql?access_token=#{token}", params: { query: query }
-
-              expect_graphql_errors_to_include(/Invalid token/)
-            end
-          end
         end
       end
 
diff --git a/spec/support/shared_examples/models/concerns/integrations/base/confluence_shared_examples.rb b/spec/support/shared_examples/models/concerns/integrations/base/confluence_shared_examples.rb
new file mode 100644
index 00000000000..29b7d4846c2
--- /dev/null
+++ b/spec/support/shared_examples/models/concerns/integrations/base/confluence_shared_examples.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples Integrations::Base::Confluence do
+  let_it_be(:project) { create(:project) }
+
+  describe 'Validations' do
+    before do
+      subject.active = active
+    end
+
+    context 'when integration is active' do
+      let(:active) { true }
+
+      it { is_expected.not_to allow_value('https://example.com').for(:confluence_url) }
+      it { is_expected.not_to allow_value('example.com').for(:confluence_url) }
+      it { is_expected.not_to allow_value('foo').for(:confluence_url) }
+      it { is_expected.not_to allow_value('ftp://example.atlassian.net/wiki').for(:confluence_url) }
+      it { is_expected.not_to allow_value('https://example.atlassian.net').for(:confluence_url) }
+      it { is_expected.not_to allow_value('https://.atlassian.net/wiki').for(:confluence_url) }
+      it { is_expected.not_to allow_value('https://example.atlassian.net/wikifoo').for(:confluence_url) }
+      it { is_expected.not_to allow_value('').for(:confluence_url) }
+      it { is_expected.not_to allow_value(nil).for(:confluence_url) }
+      it { is_expected.not_to allow_value('😊').for(:confluence_url) }
+      it { is_expected.to allow_value('https://example.atlassian.net/wiki').for(:confluence_url) }
+      it { is_expected.to allow_value('http://example.atlassian.net/wiki').for(:confluence_url) }
+      it { is_expected.to allow_value('https://example.atlassian.net/wiki/').for(:confluence_url) }
+      it { is_expected.to allow_value('http://example.atlassian.net/wiki/').for(:confluence_url) }
+      it { is_expected.to allow_value('https://example.atlassian.net/wiki/foo').for(:confluence_url) }
+
+      it { is_expected.to validate_presence_of(:confluence_url) }
+    end
+
+    context 'when integration is inactive' do
+      let(:active) { false }
+
+      it { is_expected.not_to validate_presence_of(:confluence_url) }
+      it { is_expected.to allow_value('foo').for(:confluence_url) }
+    end
+  end
+
+  describe '#help' do
+    it 'can correctly return a link to the project wiki when active' do
+      subject.project = project
+      subject.active = true
+
+      expect(subject.help).to include(Gitlab::Routing.url_helpers.project_wikis_url(project))
+    end
+
+    context 'when the project wiki is not enabled' do
+      before do
+        allow(project).to receive(:wiki_enabled?).and_return(false)
+      end
+
+      it 'returns nil when both active or inactive', :aggregate_failures do
+        [true, false].each do |active|
+          subject.active = active
+
+          expect(subject.help).to be_nil
+        end
+      end
+    end
+  end
+
+  describe '#avatar_url' do
+    it 'returns the avatar image path' do
+      expect(subject.avatar_url).to eq(ActionController::Base.helpers.image_path('confluence.svg'))
+    end
+  end
+
+  describe 'Caching has_confluence on project_settings' do
+    subject { project.project_setting.has_confluence? }
+
+    it 'sets the property to true when integration is active' do
+      create(:confluence_integration, project: project, active: true)
+
+      is_expected.to be(true)
+    end
+
+    it 'sets the property to false when integration is not active' do
+      create(:confluence_integration, project: project, active: false)
+
+      is_expected.to be(false)
+    end
+
+    it 'creates a project_setting record if one was not already created' do
+      expect { create(:confluence_integration) }.to change { ProjectSetting.count }.by(1)
+    end
+  end
+end
diff --git a/spec/tooling/danger/project_helper_spec.rb b/spec/tooling/danger/project_helper_spec.rb
index 76a01970859..43fd8ba3651 100644
--- a/spec/tooling/danger/project_helper_spec.rb
+++ b/spec/tooling/danger/project_helper_spec.rb
@@ -30,7 +30,7 @@ RSpec.describe Tooling::Danger::ProjectHelper, feature_category: :tooling do
     end
 
     where(:path, :expected_categories) do
-      'doc/api/graphql/reference/index.md'               | [:docs, :backend]
+      'doc/api/graphql/reference/_index.md'              | [:docs, :backend]
       'doc/api/graphql/reference/some_other_file.txt'    | [:docs, :backend]
       'doc/api/openapi/openapi.yaml'                     | [:docs, :backend]
       'doc/api/openapi/any_other_file.yaml'              | [:docs, :backend]
diff --git a/spec/tooling/graphql/docs/renderer_spec.rb b/spec/tooling/graphql/docs/renderer_spec.rb
index fc69b222ce1..c5a0d792e00 100644
--- a/spec/tooling/graphql/docs/renderer_spec.rb
+++ b/spec/tooling/graphql/docs/renderer_spec.rb
@@ -1,9 +1,38 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
 require_relative '../../../../tooling/graphql/docs/renderer'
 
 RSpec.describe Tooling::Graphql::Docs::Renderer do
+  let(:template) { Rails.root.join('tooling/graphql/docs/templates/default.md.haml') }
+  let(:field_description) { 'List of objects.' }
+  let(:type) { ::GraphQL::Types::Int }
+
+  let(:query_type) do
+    Class.new(Types::BaseObject) { graphql_name 'Query' }.tap do |t|
+      # this keeps type and field_description in scope.
+      t.field :foo, type, null: true, description: field_description do
+        argument :id, GraphQL::Types::ID, required: false, description: 'ID of the object.'
+      end
+    end
+  end
+
+  let(:mutation_root) do
+    Class.new(::Types::BaseObject) do
+      include ::Gitlab::Graphql::MountMutation
+      graphql_name 'Mutation'
+    end
+  end
+
+  let(:mock_schema) do
+    Class.new(GraphQL::Schema) do
+      def resolve_type(obj, ctx)
+        raise 'Not a real schema'
+      end
+    end
+  end
+
   describe '#contents' do
     shared_examples 'renders correctly as GraphQL documentation' do
       it 'contains the expected section' do
@@ -13,34 +42,6 @@ RSpec.describe Tooling::Graphql::Docs::Renderer do
       end
     end
 
-    let(:template) { Rails.root.join('tooling/graphql/docs/templates/default.md.haml') }
-    let(:field_description) { 'List of objects.' }
-    let(:type) { ::GraphQL::Types::Int }
-
-    let(:query_type) do
-      Class.new(Types::BaseObject) { graphql_name 'Query' }.tap do |t|
-        # this keeps type and field_description in scope.
-        t.field :foo, type, null: true, description: field_description do
-          argument :id, GraphQL::Types::ID, required: false, description: 'ID of the object.'
-        end
-      end
-    end
-
-    let(:mutation_root) do
-      Class.new(::Types::BaseObject) do
-        include ::Gitlab::Graphql::MountMutation
-        graphql_name 'Mutation'
-      end
-    end
-
-    let(:mock_schema) do
-      Class.new(GraphQL::Schema) do
-        def resolve_type(obj, ctx)
-          raise 'Not a real schema'
-        end
-      end
-    end
-
     subject(:contents) do
       mock_schema.query(query_type)
       mock_schema.mutation(mutation_root) if mutation_root.fields.any?
@@ -763,4 +764,34 @@ RSpec.describe Tooling::Graphql::Docs::Renderer do
       end
     end
   end
+
+  describe '#write' do
+    let(:output_dir) { Dir.mktmpdir }
+    let(:expected_file) { File.join(output_dir, '_index.md') }
+
+    before do
+      mock_schema.query(query_type)
+      mock_schema.mutation(mutation_root) if mutation_root.fields.any?
+    end
+
+    after do
+      FileUtils.remove_entry(output_dir)
+    end
+
+    it 'creates the output directory and writes contents to file' do
+      renderer = described_class.new(
+        mock_schema,
+        output_dir: output_dir,
+        template: template
+      )
+
+      expect(FileUtils).to receive(:mkdir_p).with(output_dir).and_call_original
+      expect(File).to receive(:write).with(expected_file, renderer.contents).and_call_original
+
+      renderer.write
+
+      expect(File.exist?(expected_file)).to be true
+      expect(File.read(expected_file)).to eq(renderer.contents)
+    end
+  end
 end
diff --git a/tooling/graphql/docs/helper.rb b/tooling/graphql/docs/helper.rb
index 1b2b6d87d94..2ca2d5acf40 100644
--- a/tooling/graphql/docs/helper.rb
+++ b/tooling/graphql/docs/helper.rb
@@ -58,6 +58,7 @@ module Tooling
             stage: Foundations
             group: Import and Integrate
             info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+            title: GraphQL API resources
             ---
 
             <!--
diff --git a/tooling/graphql/docs/renderer.rb b/tooling/graphql/docs/renderer.rb
index 811d5f0f770..6a26a4e605d 100644
--- a/tooling/graphql/docs/renderer.rb
+++ b/tooling/graphql/docs/renderer.rb
@@ -33,7 +33,7 @@ module Tooling
         end
 
         def write
-          filename = File.join(@output_dir, 'index.md')
+          filename = File.join(@output_dir, '_index.md')
 
           FileUtils.mkdir_p(@output_dir)
           File.write(filename, contents)
diff --git a/tooling/graphql/docs/templates/default.md.haml b/tooling/graphql/docs/templates/default.md.haml
index 46862d00b5b..c6be93e2e6c 100644
--- a/tooling/graphql/docs/templates/default.md.haml
+++ b/tooling/graphql/docs/templates/default.md.haml
@@ -3,8 +3,6 @@
 = auto_generated_comment
 
 :plain
-  # GraphQL API resources
-
   This documentation is self-generated based on GitLab current GraphQL schema.
 
   The API can be explored using the [interactive GraphQL explorer](../index.md#interactive-graphql-explorer). Developers can also [generate a machine-readable GraphQL schema in IDL and JSON formats](../../../development/rake_tasks.md#update-machine-readable-schema-files).