From ae9f43a2c4bda0ee7dae59ea9a7d412068f6f7ff Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Thu, 2 Feb 2023 12:07:33 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .gitlab/ci/frontend.gitlab-ci.yml             |   6 +-
 .../ci/package-and-test/main.gitlab-ci.yml    |   4 +-
 .gitlab/ci/review-apps/qa.gitlab-ci.yml       |   2 +-
 .gitlab/ci/rules.gitlab-ci.yml                |   1 +
 .../performance/concurrent_monotonic_time.yml |   6 -
 GITALY_SERVER_VERSION                         |   2 +-
 .../admin_new_runner/admin_new_runner_app.vue |  48 ++++++
 .../ci/runner/admin_new_runner/index.js       |  32 ++++
 .../components/table/cells/actions_cell.vue   |   9 +-
 .../jobs/components/table/constants.js        |   2 +
 .../components/details/version_row.vue        |  13 +-
 .../components/list/package_list_row.vue      |   4 -
 .../queries/get_package_details.query.graphql |   3 +
 .../pages/admin/runners/new/index.js          |   3 +
 .../javascripts/pages/users/show/index.js     |  16 ++
 .../pipelines/components/graph/job_item.vue   |  11 +-
 .../pipeline_mini_graph/job_item.vue          |  15 +-
 .../profile/components/activity_tab.vue       |  17 ++
 .../components/contributed_projects_tab.vue   |  17 ++
 .../profile/components/followers_tab.vue      |  17 ++
 .../profile/components/following_tab.vue      |  17 ++
 .../profile/components/groups_tab.vue         |  17 ++
 .../profile/components/overview_tab.vue       |  17 ++
 .../components/personal_projects_tab.vue      |  17 ++
 .../profile/components/profile_tabs.vue       |  72 ++++++++
 .../profile/components/snippets_tab.vue       |  17 ++
 .../components/starred_projects_tab.vue       |  17 ++
 app/assets/javascripts/profile/index.js       |  16 ++
 app/controllers/users_controller.rb           |   3 +
 app/graphql/types/ci/job_token_scope_type.rb  |   2 +-
 app/models/ci/job_token/project_scope_link.rb |   7 +-
 app/models/ci/job_token/scope.rb              |  56 ++++--
 app/policies/project_policy.rb                |   2 +-
 .../ci/parse_dotenv_artifact_service.rb       |   5 +
 app/views/admin/runners/new.html.haml         |   7 +-
 app/views/users/show.html.haml                | 160 +++++++++---------
 .../development/ci_multi_doc_yaml.yml         |   8 +
 .../development/profile_tabs_vue.yml          |   8 +
 danger/documentation/Dangerfile               |   2 +-
 doc/administration/gitaly/praefect.md         |  51 ------
 doc/administration/gitaly/recovery.md         |  51 ++++++
 doc/administration/integration/mailgun.md     |   2 +-
 .../ci_pipeline_components/index.md           |   2 +
 doc/ci/services/index.md                      |   6 +
 .../styleguide/img/admin_access_level.png     | Bin 9821 -> 8291 bytes
 .../documentation/styleguide/word_list.md     |   2 +-
 doc/development/pipelines/index.md            |  12 +-
 doc/security/img/unlock_user_v14_7.png        | Bin 31666 -> 0 bytes
 doc/security/unlock_user.md                   |   4 +-
 doc/subscriptions/gitlab_dedicated/index.md   |   4 +-
 .../packages/debian_package_endpoints.rb      |   2 +
 lib/gitlab/ci/config.rb                       |   3 +-
 lib/gitlab/ci/config/yaml.rb                  |  11 +-
 lib/gitlab/config/loader/multi_doc_yaml.rb    |  64 +++++++
 lib/gitlab/database/connection_timer.rb       |   2 +-
 lib/gitlab/encoding_helper.rb                 |   5 +
 locale/gitlab.pot                             |  12 ++
 spec/features/calendar_spec.rb                |   1 +
 .../dashboard/datetime_on_tooltips_spec.rb    |   4 +
 .../profiles/user_visits_profile_spec.rb      |   1 +
 spec/features/users/overview_spec.rb          |   1 +
 spec/features/users/show_spec.rb              |  59 ++++++-
 spec/features/users/snippets_spec.rb          |   4 +
 ...user_browses_projects_on_user_page_spec.rb |   4 +
 .../build_artifacts/dotenv_utf16_le.txt       | Bin 0 -> 62 bytes
 .../admin_new_runner_app_spec.js              |  53 ++++++
 spec/frontend/fixtures/jobs.rb                |   1 +
 .../table/cells/actions_cell_spec.js          |  19 ++-
 .../components/details/version_row_spec.js    |  23 ++-
 .../components/list/package_list_row_spec.js  |  33 ++--
 .../package_registry/mock_data.js             |  15 +-
 .../package_registry/pages/details_spec.js    |   3 +-
 .../frontend/pipelines/graph/job_item_spec.js |  14 +-
 spec/frontend/pipelines/graph/mock_data.js    |  22 +++
 .../profile/components/activity_tab_spec.js   |  19 +++
 .../contributed_projects_tab_spec.js          |  21 +++
 .../profile/components/followers_tab_spec.js  |  19 +++
 .../profile/components/following_tab_spec.js  |  19 +++
 .../profile/components/groups_tab_spec.js     |  19 +++
 .../profile/components/overview_tab_spec.js   |  19 +++
 .../components/personal_projects_tab_spec.js  |  21 +++
 .../profile/components/profile_tabs_spec.js   |  36 ++++
 .../profile/components/snippets_tab_spec.js   |  19 +++
 .../components/starred_projects_tab_spec.js   |  21 +++
 .../ci/job_token_scope/add_project_spec.rb    |   2 +-
 .../ci/job_token_scope_resolver_spec.rb       |   8 +-
 spec/lib/gitlab/ci/config/yaml_spec.rb        | 105 ++++++++++++
 .../config/loader/multi_doc_yaml_spec.rb      |  99 +++++++++++
 spec/lib/gitlab/config/loader/yaml_spec.rb    |   2 +-
 spec/lib/gitlab/encoding_helper_spec.rb       |   8 +
 spec/models/ci/job_token/allowlist_spec.rb    |  19 ++-
 .../ci/job_token/project_scope_link_spec.rb   |   5 +-
 spec/models/ci/job_token/scope_spec.rb        | 148 +++++++++++-----
 spec/policies/project_policy_spec.rb          |   5 +-
 spec/requests/api/ci/job_artifacts_spec.rb    |  14 +-
 .../api/debian_group_packages_spec.rb         |  12 ++
 .../api/debian_project_packages_spec.rb       |  12 ++
 .../ci/job_token_scope/add_project_spec.rb    |   2 +-
 .../ci/job_token_scope/remove_project_spec.rb |  10 +-
 spec/requests/api/project_packages_spec.rb    |  14 +-
 spec/requests/api/release/links_spec.rb       |  12 +-
 spec/requests/git_http_spec.rb                |  39 ++---
 .../ci/parse_dotenv_artifact_service_spec.rb  |  14 +-
 .../helpers/ci/job_token_scope_helpers.rb     |  51 ++++++
 .../models/ci/job_token_scope.rb              |  34 ++--
 .../api/conan_packages_shared_context.rb      |   2 +-
 .../services/packages_shared_examples.rb      |   2 +-
 tooling/lib/tooling/parallel_rspec_runner.rb  |  70 ++++++--
 workhorse/internal/badgateway/roundtripper.go |  10 +-
 .../internal/badgateway/roundtripper_test.go  |  35 ++++
 110 files changed, 1746 insertions(+), 369 deletions(-)
 delete mode 100644 .rubocop_todo/performance/concurrent_monotonic_time.yml
 create mode 100644 app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
 create mode 100644 app/assets/javascripts/ci/runner/admin_new_runner/index.js
 create mode 100644 app/assets/javascripts/pages/admin/runners/new/index.js
 create mode 100644 app/assets/javascripts/pages/users/show/index.js
 create mode 100644 app/assets/javascripts/profile/components/activity_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/contributed_projects_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/followers_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/following_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/groups_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/overview_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/personal_projects_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/profile_tabs.vue
 create mode 100644 app/assets/javascripts/profile/components/snippets_tab.vue
 create mode 100644 app/assets/javascripts/profile/components/starred_projects_tab.vue
 create mode 100644 app/assets/javascripts/profile/index.js
 create mode 100644 config/feature_flags/development/ci_multi_doc_yaml.yml
 create mode 100644 config/feature_flags/development/profile_tabs_vue.yml
 delete mode 100644 doc/security/img/unlock_user_v14_7.png
 create mode 100644 lib/gitlab/config/loader/multi_doc_yaml.rb
 create mode 100644 spec/fixtures/build_artifacts/dotenv_utf16_le.txt
 create mode 100644 spec/frontend/ci/runner/admin_new_runner_app/admin_new_runner_app_spec.js
 create mode 100644 spec/frontend/profile/components/activity_tab_spec.js
 create mode 100644 spec/frontend/profile/components/contributed_projects_tab_spec.js
 create mode 100644 spec/frontend/profile/components/followers_tab_spec.js
 create mode 100644 spec/frontend/profile/components/following_tab_spec.js
 create mode 100644 spec/frontend/profile/components/groups_tab_spec.js
 create mode 100644 spec/frontend/profile/components/overview_tab_spec.js
 create mode 100644 spec/frontend/profile/components/personal_projects_tab_spec.js
 create mode 100644 spec/frontend/profile/components/profile_tabs_spec.js
 create mode 100644 spec/frontend/profile/components/snippets_tab_spec.js
 create mode 100644 spec/frontend/profile/components/starred_projects_tab_spec.js
 create mode 100644 spec/lib/gitlab/ci/config/yaml_spec.rb
 create mode 100644 spec/lib/gitlab/config/loader/multi_doc_yaml_spec.rb
 create mode 100644 spec/support/helpers/ci/job_token_scope_helpers.rb

diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index fb1b9dacb66..2e0d83187cf 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -129,7 +129,7 @@ rspec-all frontend_fixture:
   needs:
     - !reference [.frontend-fixtures-base, needs]
     - "compile-test-assets"
-  parallel: 5
+  parallel: 7
 
 # Builds FOSS fixtures in the EE project, with the `ee/` folder removed (due to `as-if-foss`).
 rspec-all frontend_fixture as-if-foss:
@@ -200,7 +200,7 @@ jest:
       - tmp/tests/frontend/
     reports:
       junit: junit_jest.xml
-  parallel: 5
+  parallel: 7
 
 jest predictive:
   extends:
@@ -218,7 +218,7 @@ jest as-if-foss:
     - .frontend:rules:jest:as-if-foss
     - .as-if-foss
   needs: ["rspec-all frontend_fixture as-if-foss"]
-  parallel: 2
+  parallel: 4
 
 jest predictive as-if-foss:
   extends:
diff --git a/.gitlab/ci/package-and-test/main.gitlab-ci.yml b/.gitlab/ci/package-and-test/main.gitlab-ci.yml
index 44b28d28734..884c792ebb2 100644
--- a/.gitlab/ci/package-and-test/main.gitlab-ci.yml
+++ b/.gitlab/ci/package-and-test/main.gitlab-ci.yml
@@ -620,7 +620,7 @@ e2e-test-report:
     - .rules:report:allure-report
   stage: report
   variables:
-    GITLAB_AUTH_TOKEN: $GITLAB_QA_MR_ALLURE_REPORT_TOKEN
+    GITLAB_AUTH_TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE
     ALLURE_PROJECT_PATH: $CI_PROJECT_PATH
     ALLURE_MERGE_REQUEST_IID: $CI_MERGE_REQUEST_IID
     ALLURE_JOB_NAME: e2e-package-and-test
@@ -654,7 +654,7 @@ relate-test-failures:
   variables:
     QA_FAILURES_REPORTING_PROJECT: gitlab-org/gitlab
     QA_FAILURES_MAX_DIFF_RATIO: "0.15"
-    GITLAB_QA_ACCESS_TOKEN: $GITLAB_QA_PRODUCTION_ACCESS_TOKEN
+    GITLAB_QA_ACCESS_TOKEN: $QA_GITLAB_CI_TOKEN
   when: on_failure
   script:
     - |
diff --git a/.gitlab/ci/review-apps/qa.gitlab-ci.yml b/.gitlab/ci/review-apps/qa.gitlab-ci.yml
index 912df0ede29..b04c42d1b16 100644
--- a/.gitlab/ci/review-apps/qa.gitlab-ci.yml
+++ b/.gitlab/ci/review-apps/qa.gitlab-ci.yml
@@ -143,7 +143,7 @@ e2e-test-report:
     ALLURE_PROJECT_PATH: $CI_PROJECT_PATH
     ALLURE_RESULTS_GLOB: qa/tmp/allure-results
     ALLURE_MERGE_REQUEST_IID: $CI_MERGE_REQUEST_IID
-    GITLAB_AUTH_TOKEN: $GITLAB_QA_MR_ALLURE_REPORT_TOKEN
+    GITLAB_AUTH_TOKEN: $PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE
     GIT_STRATEGY: none
   allow_failure: true
   when: always
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index c26dd45ae93..ebc8cd49968 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -559,6 +559,7 @@
   - "{,ee/,jh/}Gemfile.lock"  # This should include gitlab-styles, rubocop itself, and any plugins we might be using
   - "lib/gitlab_edition.rb"  # This is required in RuboCop::CodeReuseHelpers
   - ".gitlab/ci/static-analysis.gitlab-ci.yml"
+  - "config/feature_categories.yml"  # Used by RSpec/InvalidFeatureCategory
 
 .danger-patterns: &danger-patterns
   - "Dangerfile"
diff --git a/.rubocop_todo/performance/concurrent_monotonic_time.yml b/.rubocop_todo/performance/concurrent_monotonic_time.yml
deleted file mode 100644
index 0e55eaf4a18..00000000000
--- a/.rubocop_todo/performance/concurrent_monotonic_time.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-# Cop supports --autocorrect.
-Performance/ConcurrentMonotonicTime:
-  Details: grace period
-  Exclude:
-    - 'lib/gitlab/database/connection_timer.rb'
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index cd471c37947..097cbd127df 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-ed85386e4a808bab0023c28b9b1d7e103b50050e
+54a1400cccb31b1869a7a9b735bad1cfb047d3bb
diff --git a/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue b/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
new file mode 100644
index 00000000000..293fbfcf7a7
--- /dev/null
+++ b/app/assets/javascripts/ci/runner/admin_new_runner/admin_new_runner_app.vue
@@ -0,0 +1,48 @@
+<script>
+import { GlSprintf, GlLink, GlModalDirective } from '@gitlab/ui';
+import RunnerInstructionsModal from '~/vue_shared/components/runner_instructions/runner_instructions_modal.vue';
+
+export default {
+  name: 'AdminNewRunnerApp',
+  components: {
+    GlLink,
+    GlSprintf,
+    RunnerInstructionsModal,
+  },
+  directives: {
+    GlModal: GlModalDirective,
+  },
+  props: {
+    legacyRegistrationToken: {
+      type: String,
+      required: true,
+    },
+  },
+  modalId: 'runners-legacy-registration-instructions-modal',
+};
+</script>
+
+<template>
+  <div>
+    <h1 class="gl-font-size-h2">{{ s__('Runners|New instance runner') }}</h1>
+    <p>
+      <gl-sprintf
+        :message="
+          s__(
+            'Runners|Create an instance runner to generate a command that registers the runner with all its configurations. %{linkStart}Prefer to use a registration token to create a runner?%{linkEnd}',
+          )
+        "
+      >
+        <template #link="{ content }">
+          <gl-link v-gl-modal="$options.modalId" data-testid="legacy-instructions-link">{{
+            content
+          }}</gl-link>
+          <runner-instructions-modal
+            :modal-id="$options.modalId"
+            :registration-token="legacyRegistrationToken"
+          />
+        </template>
+      </gl-sprintf>
+    </p>
+  </div>
+</template>
diff --git a/app/assets/javascripts/ci/runner/admin_new_runner/index.js b/app/assets/javascripts/ci/runner/admin_new_runner/index.js
new file mode 100644
index 00000000000..502d9d33b4d
--- /dev/null
+++ b/app/assets/javascripts/ci/runner/admin_new_runner/index.js
@@ -0,0 +1,32 @@
+import Vue from 'vue';
+import VueApollo from 'vue-apollo';
+import createDefaultClient from '~/lib/graphql';
+import AdminNewRunnerApp from './admin_new_runner_app.vue';
+
+Vue.use(VueApollo);
+
+export const initAdminNewRunner = (selector = '#js-admin-new-runner') => {
+  const el = document.querySelector(selector);
+
+  if (!el) {
+    return null;
+  }
+
+  const { legacyRegistrationToken } = el.dataset;
+
+  const apolloProvider = new VueApollo({
+    defaultClient: createDefaultClient(),
+  });
+
+  return new Vue({
+    el,
+    apolloProvider,
+    render(h) {
+      return h(AdminNewRunnerApp, {
+        props: {
+          legacyRegistrationToken,
+        },
+      });
+    },
+  });
+};
diff --git a/app/assets/javascripts/jobs/components/table/cells/actions_cell.vue b/app/assets/javascripts/jobs/components/table/cells/actions_cell.vue
index 6f351d91165..17766b4d162 100644
--- a/app/assets/javascripts/jobs/components/table/cells/actions_cell.vue
+++ b/app/assets/javascripts/jobs/components/table/cells/actions_cell.vue
@@ -8,9 +8,11 @@ import {
   ACTIONS_UNSCHEDULE,
   ACTIONS_PLAY,
   ACTIONS_RETRY,
+  ACTIONS_RUN_AGAIN,
   CANCEL,
   GENERIC_ERROR,
   JOB_SCHEDULED,
+  JOB_SUCCESS,
   PLAY_JOB_CONFIRMATION_MESSAGE,
   RUN_JOB_NOW_HEADER_TITLE,
   FILE_TYPE_ARCHIVE,
@@ -107,6 +109,9 @@ export default {
     shouldDisplayArtifacts() {
       return this.canReadArtifacts && this.hasArtifacts;
     },
+    retryButtonTitle() {
+      return this.job.status === JOB_SUCCESS ? ACTIONS_RUN_AGAIN : ACTIONS_RETRY;
+    },
   },
   methods: {
     async postJobAction(name, mutation, redirect = false) {
@@ -223,8 +228,8 @@ export default {
         <gl-button
           v-else-if="isRetryable"
           icon="retry"
-          :title="$options.ACTIONS_RETRY"
-          :aria-label="$options.ACTIONS_RETRY"
+          :title="retryButtonTitle"
+          :aria-label="retryButtonTitle"
           :method="currentJobMethod"
           :disabled="retryBtnDisabled"
           data-testid="retry"
diff --git a/app/assets/javascripts/jobs/components/table/constants.js b/app/assets/javascripts/jobs/components/table/constants.js
index f73241aed6b..41ce6e4d64d 100644
--- a/app/assets/javascripts/jobs/components/table/constants.js
+++ b/app/assets/javascripts/jobs/components/table/constants.js
@@ -9,6 +9,7 @@ export const RAW_TEXT_WARNING = s__(
 
 /* Job Status Constants */
 export const JOB_SCHEDULED = 'SCHEDULED';
+export const JOB_SUCCESS = 'SUCCESS';
 
 /* Artifact file types */
 export const FILE_TYPE_ARCHIVE = 'ARCHIVE';
@@ -19,6 +20,7 @@ export const ACTIONS_START_NOW = s__('DelayedJobs|Start now');
 export const ACTIONS_UNSCHEDULE = s__('DelayedJobs|Unschedule');
 export const ACTIONS_PLAY = __('Play');
 export const ACTIONS_RETRY = __('Retry');
+export const ACTIONS_RUN_AGAIN = __('Run again');
 
 export const CANCEL = __('Cancel');
 export const GENERIC_ERROR = __('An error occurred while making the request.');
diff --git a/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue b/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
index 57ff3cd2a83..9b5c8f63814 100644
--- a/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
+++ b/app/assets/javascripts/packages_and_registries/package_registry/components/details/version_row.vue
@@ -8,7 +8,7 @@ import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 import { PACKAGE_DEFAULT_STATUS } from '../../constants';
 
 export default {
-  name: 'PackageListRow',
+  name: 'PackageVersionRow',
   components: {
     GlLink,
     GlSprintf,
@@ -25,6 +25,9 @@ export default {
     },
   },
   computed: {
+    containsWebPathLink() {
+      return Boolean(this.packageEntity?._links?.webPath);
+    },
     packageLink() {
       return `${getIdFromGraphQLId(this.packageEntity.id)}`;
     },
@@ -39,9 +42,15 @@ export default {
   <list-item :disabled="disabledRow">
     <template #left-primary>
       <div class="gl-display-flex gl-align-items-center gl-mr-3 gl-min-w-0">
-        <gl-link :href="packageLink" class="gl-text-body gl-min-w-0" :disabled="disabledRow">
+        <gl-link
+          v-if="containsWebPathLink"
+          class="gl-text-body gl-min-w-0"
+          :disabled="disabledRow"
+          :href="packageLink"
+        >
           <gl-truncate :text="packageEntity.name" />
         </gl-link>
+        <gl-truncate v-else :text="packageEntity.name" />
 
         <package-tags
           v-if="packageEntity.tags.nodes && packageEntity.tags.nodes.length"
diff --git a/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue b/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
index 970cb15f8a0..332ebf4892d 100644
--- a/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
+++ b/app/assets/javascripts/packages_and_registries/package_registry/components/list/package_list_row.vue
@@ -78,9 +78,6 @@ export default {
     nonDefaultRow() {
       return this.packageEntity.status && this.packageEntity.status !== PACKAGE_DEFAULT_STATUS;
     },
-    routerLinkEvent() {
-      return this.nonDefaultRow ? '' : 'click';
-    },
     errorPackageStyle() {
       return {
         'gl-text-red-500': this.errorStatusRow,
@@ -117,7 +114,6 @@ export default {
           class="gl-text-body gl-min-w-0"
           data-testid="details-link"
           data-qa-selector="package_link"
-          :event="routerLinkEvent"
           :to="{ name: 'details', params: { id: packageId } }"
         >
           <gl-truncate :text="packageEntity.name" />
diff --git a/app/assets/javascripts/packages_and_registries/package_registry/graphql/queries/get_package_details.query.graphql b/app/assets/javascripts/packages_and_registries/package_registry/graphql/queries/get_package_details.query.graphql
index 9153906a38c..31579cb4c72 100644
--- a/app/assets/javascripts/packages_and_registries/package_registry/graphql/queries/get_package_details.query.graphql
+++ b/app/assets/javascripts/packages_and_registries/package_registry/graphql/queries/get_package_details.query.graphql
@@ -69,6 +69,9 @@ query getPackageDetails(
         createdAt
         version
         status
+        _links {
+          webPath
+        }
         tags(first: 1) {
           nodes {
             id
diff --git a/app/assets/javascripts/pages/admin/runners/new/index.js b/app/assets/javascripts/pages/admin/runners/new/index.js
new file mode 100644
index 00000000000..5048ad7b57a
--- /dev/null
+++ b/app/assets/javascripts/pages/admin/runners/new/index.js
@@ -0,0 +1,3 @@
+import { initAdminNewRunner } from '~/ci/runner/admin_new_runner';
+
+initAdminNewRunner();
diff --git a/app/assets/javascripts/pages/users/show/index.js b/app/assets/javascripts/pages/users/show/index.js
new file mode 100644
index 00000000000..f1b4e00c810
--- /dev/null
+++ b/app/assets/javascripts/pages/users/show/index.js
@@ -0,0 +1,16 @@
+import { s__ } from '~/locale';
+import { createAlert } from '~/flash';
+
+if (window.gon.features?.profileTabsVue) {
+  import('~/profile')
+    .then(({ initProfileTabs }) => {
+      initProfileTabs();
+    })
+    .catch(() => {
+      createAlert({
+        message: s__(
+          'UserProfile|An error occurred loading the profile. Please refresh the page to try again.',
+        ),
+      });
+    });
+}
diff --git a/app/assets/javascripts/pipelines/components/graph/job_item.vue b/app/assets/javascripts/pipelines/components/graph/job_item.vue
index 19f2a37c5ff..992e3d2f552 100644
--- a/app/assets/javascripts/pipelines/components/graph/job_item.vue
+++ b/app/assets/javascripts/pipelines/components/graph/job_item.vue
@@ -50,6 +50,7 @@ export default {
       actionPrimary: { text: __('Retry') },
       actionCancel: { text: __('Cancel') },
     },
+    runAgainTooltipText: __('Run again'),
   },
   hoverClass: 'gl-shadow-x0-y0-b3-s1-blue-500',
   components: {
@@ -246,6 +247,14 @@ export default {
     withConfirmationModal() {
       return this.isRetryableBridge && !this.skipRetryModal;
     },
+    jobActionTooltipText() {
+      const { group } = this.status;
+      const { title, icon } = this.status.action;
+
+      return icon === 'retry' && group === 'success'
+        ? this.$options.i18n.runAgainTooltipText
+        : title;
+    },
   },
   watch: {
     skipRetryModal(val) {
@@ -334,7 +343,7 @@ export default {
 
     <action-component
       v-if="hasAction"
-      :tooltip-text="status.action.title"
+      :tooltip-text="jobActionTooltipText"
       :link="status.action.path"
       :action-icon="status.action.icon"
       class="gl-mr-1"
diff --git a/app/assets/javascripts/pipelines/components/pipeline_mini_graph/job_item.vue b/app/assets/javascripts/pipelines/components/pipeline_mini_graph/job_item.vue
index 51b46f25048..66bf5068149 100644
--- a/app/assets/javascripts/pipelines/components/pipeline_mini_graph/job_item.vue
+++ b/app/assets/javascripts/pipelines/components/pipeline_mini_graph/job_item.vue
@@ -2,7 +2,7 @@
 import { GlTooltipDirective, GlLink } from '@gitlab/ui';
 import delayedJobMixin from '~/jobs/mixins/delayed_job_mixin';
 import { BV_HIDE_TOOLTIP } from '~/lib/utils/constants';
-import { sprintf } from '~/locale';
+import { __, sprintf } from '~/locale';
 import { reportToSentry } from '../../utils';
 import ActionComponent from '../jobs_shared/action_component.vue';
 import JobNameComponent from '../jobs_shared/job_name_component.vue';
@@ -33,6 +33,9 @@ import JobNameComponent from '../jobs_shared/job_name_component.vue';
  */
 
 export default {
+  i18n: {
+    runAgainTooltipText: __('Run again'),
+  },
   hoverClass: 'gl-shadow-x0-y0-b3-s1-blue-500',
   components: {
     ActionComponent,
@@ -129,6 +132,14 @@ export default {
         ? `${this.$options.hoverClass} ${this.cssClassJobName}`
         : this.cssClassJobName;
     },
+    jobActionTooltipText() {
+      const { group } = this.status;
+      const { title, icon } = this.status.action;
+
+      return icon === 'retry' && group === 'success'
+        ? this.$options.i18n.runAgainTooltipText
+        : title;
+    },
   },
   errorCaptured(err, _vm, info) {
     reportToSentry('pipelines_job_item', `pipelines_job_item error: ${err}, info: ${info}`);
@@ -177,7 +188,7 @@ export default {
 
     <action-component
       v-if="hasAction"
-      :tooltip-text="status.action.title"
+      :tooltip-text="jobActionTooltipText"
       :link="status.action.path"
       :action-icon="status.action.icon"
       data-qa-selector="action_button"
diff --git a/app/assets/javascripts/profile/components/activity_tab.vue b/app/assets/javascripts/profile/components/activity_tab.vue
new file mode 100644
index 00000000000..aae5c489e88
--- /dev/null
+++ b/app/assets/javascripts/profile/components/activity_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Activity'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/contributed_projects_tab.vue b/app/assets/javascripts/profile/components/contributed_projects_tab.vue
new file mode 100644
index 00000000000..e490643e57a
--- /dev/null
+++ b/app/assets/javascripts/profile/components/contributed_projects_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Contributed projects'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/followers_tab.vue b/app/assets/javascripts/profile/components/followers_tab.vue
new file mode 100644
index 00000000000..47651c33eb8
--- /dev/null
+++ b/app/assets/javascripts/profile/components/followers_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Followers'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/following_tab.vue b/app/assets/javascripts/profile/components/following_tab.vue
new file mode 100644
index 00000000000..6d9631c5e89
--- /dev/null
+++ b/app/assets/javascripts/profile/components/following_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Following'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/groups_tab.vue b/app/assets/javascripts/profile/components/groups_tab.vue
new file mode 100644
index 00000000000..6c4847872a7
--- /dev/null
+++ b/app/assets/javascripts/profile/components/groups_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Groups'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/overview_tab.vue b/app/assets/javascripts/profile/components/overview_tab.vue
new file mode 100644
index 00000000000..e884c2d7083
--- /dev/null
+++ b/app/assets/javascripts/profile/components/overview_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Overview'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/personal_projects_tab.vue b/app/assets/javascripts/profile/components/personal_projects_tab.vue
new file mode 100644
index 00000000000..285f01930e7
--- /dev/null
+++ b/app/assets/javascripts/profile/components/personal_projects_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Personal projects'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/profile_tabs.vue b/app/assets/javascripts/profile/components/profile_tabs.vue
new file mode 100644
index 00000000000..2425d56c52a
--- /dev/null
+++ b/app/assets/javascripts/profile/components/profile_tabs.vue
@@ -0,0 +1,72 @@
+<script>
+import { GlTabs } from '@gitlab/ui';
+
+import OverviewTab from './overview_tab.vue';
+import ActivityTab from './activity_tab.vue';
+import GroupsTab from './groups_tab.vue';
+import ContributedProjectsTab from './contributed_projects_tab.vue';
+import PersonalProjectsTab from './personal_projects_tab.vue';
+import StarredProjectsTab from './starred_projects_tab.vue';
+import SnippetsTab from './snippets_tab.vue';
+import FollowersTab from './followers_tab.vue';
+import FollowingTab from './following_tab.vue';
+
+export default {
+  components: {
+    GlTabs,
+    OverviewTab,
+    ActivityTab,
+    GroupsTab,
+    ContributedProjectsTab,
+    PersonalProjectsTab,
+    StarredProjectsTab,
+    SnippetsTab,
+    FollowersTab,
+    FollowingTab,
+  },
+  tabs: [
+    {
+      key: 'overview',
+      component: OverviewTab,
+    },
+    {
+      key: 'activity',
+      component: ActivityTab,
+    },
+    {
+      key: 'groups',
+      component: GroupsTab,
+    },
+    {
+      key: 'contributedProjects',
+      component: ContributedProjectsTab,
+    },
+    {
+      key: 'personalProjects',
+      component: PersonalProjectsTab,
+    },
+    {
+      key: 'starredProjects',
+      component: StarredProjectsTab,
+    },
+    {
+      key: 'snippets',
+      component: SnippetsTab,
+    },
+    {
+      key: 'followers',
+      component: FollowersTab,
+    },
+    {
+      key: 'following',
+      component: FollowingTab,
+    },
+  ],
+};
+</script>
+
+<template>
+  <gl-tabs>
+    <component :is="component" v-for="{ key, component } in $options.tabs" :key="key" />
+  </gl-tabs>
+</template>
diff --git a/app/assets/javascripts/profile/components/snippets_tab.vue b/app/assets/javascripts/profile/components/snippets_tab.vue
new file mode 100644
index 00000000000..d64c5b900a5
--- /dev/null
+++ b/app/assets/javascripts/profile/components/snippets_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Snippets'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/components/starred_projects_tab.vue b/app/assets/javascripts/profile/components/starred_projects_tab.vue
new file mode 100644
index 00000000000..b9ef1e6e713
--- /dev/null
+++ b/app/assets/javascripts/profile/components/starred_projects_tab.vue
@@ -0,0 +1,17 @@
+<script>
+import { GlTab } from '@gitlab/ui';
+import { s__ } from '~/locale';
+
+export default {
+  i18n: {
+    title: s__('UserProfile|Starred projects'),
+  },
+  components: { GlTab },
+};
+</script>
+
+<template>
+  <gl-tab :title="$options.i18n.title">
+    <!-- placeholder -->
+  </gl-tab>
+</template>
diff --git a/app/assets/javascripts/profile/index.js b/app/assets/javascripts/profile/index.js
new file mode 100644
index 00000000000..5378ed3d743
--- /dev/null
+++ b/app/assets/javascripts/profile/index.js
@@ -0,0 +1,16 @@
+import Vue from 'vue';
+
+import ProfileTabs from './components/profile_tabs.vue';
+
+export const initProfileTabs = () => {
+  const el = document.getElementById('js-profile-tabs');
+
+  if (!el) return false;
+
+  return new Vue({
+    el,
+    render(createElement) {
+      return createElement(ProfileTabs);
+    },
+  });
+};
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 327d05681f4..9546f71cd37 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -26,6 +26,9 @@ class UsersController < ApplicationController
   before_action only: [:exists] do
     check_rate_limit!(:username_exists, scope: request.ip)
   end
+  before_action only: [:show] do
+    push_frontend_feature_flag(:profile_tabs_vue, current_user)
+  end
 
   feature_category :user_profile, [:show, :activity, :groups, :projects, :contributed, :starred,
                             :followers, :following, :calendar, :calendar_activities,
diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index 37c0af944a7..9c9c7ccb8d1 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -11,7 +11,7 @@ module Types
             Types::ProjectType.connection_type,
             null: false,
             description: 'Allow list of projects that can be accessed by CI Job tokens created by this project.',
-            method: :all_projects
+            method: :outbound_projects
     end
   end
   # rubocop: enable Graphql/AuthorizeTypes
diff --git a/app/models/ci/job_token/project_scope_link.rb b/app/models/ci/job_token/project_scope_link.rb
index b784f93651a..4fb577f58bc 100644
--- a/app/models/ci/job_token/project_scope_link.rb
+++ b/app/models/ci/job_token/project_scope_link.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-# The connection between a source project (which defines the job token scope)
-# and a target project which is the one allowed to be accessed by the job token.
+# The connection between a source project (which the job token scope's allowlist applies too)
+# and a target project which is added to the scope's allowlist.
 
 module Ci
   module JobToken
@@ -9,6 +9,7 @@ module Ci
       self.table_name = 'ci_job_token_project_scope_links'
 
       belongs_to :source_project, class_name: 'Project'
+      # the project added to the scope's allowlist
       belongs_to :target_project, class_name: 'Project'
       belongs_to :added_by, class_name: 'User'
 
@@ -19,6 +20,8 @@ module Ci
       validates :target_project, presence: true
       validate :not_self_referential_link
 
+      # When outbound the target project is allowed to be accessed by the source job token.
+      # When inbound the source project is allowed to be accessed by the target job token.
       enum direction: {
         outbound: 0,
         inbound: 1
diff --git a/app/models/ci/job_token/scope.rb b/app/models/ci/job_token/scope.rb
index e320c0f92d1..93bfa35f5c6 100644
--- a/app/models/ci/job_token/scope.rb
+++ b/app/models/ci/job_token/scope.rb
@@ -2,18 +2,17 @@
 
 # This model represents the scope of access for a CI_JOB_TOKEN.
 #
-# A scope is initialized with a project.
+# A scope is initialized with a current project.
 #
 # Projects can be added to the scope by adding ScopeLinks to
 # create an allowlist of projects in either access direction (inbound, outbound).
 #
-# Currently, projects in the outbound allowlist can be accessed via the token
-# in the source project.
+# Projects in the outbound allowlist can be accessed via the current project's job token.
 #
-# TODO(Issue #346298) Projects in the inbound allowlist can use their token to access
-# the source project.
+# Projects in the inbound allowlist can use their project's job token to
+# access the current project.
 #
-# CI_JOB_TOKEN should be considered untrusted without these features enabled.
+# CI_JOB_TOKEN should be considered untrusted without a scope enabled.
 #
 
 module Ci
@@ -25,34 +24,61 @@ module Ci
         @current_project = current_project
       end
 
-      def allows?(accessed_project)
-        self_referential?(accessed_project) || outbound_allows?(accessed_project)
+      def accessible?(accessed_project)
+        self_referential?(accessed_project) || (
+          outbound_accessible?(accessed_project) &&
+          inbound_accessible?(accessed_project)
+        )
       end
 
       def outbound_projects
         outbound_allowlist.projects
       end
 
-      # Deprecated: use outbound_projects, TODO(Issue #346298) remove references to all_project
-      def all_projects
-        outbound_projects
+      def inbound_projects
+        inbound_allowlist.projects
       end
 
       private
 
-      def outbound_allows?(accessed_project)
+      def outbound_accessible?(accessed_project)
         # if the setting is disabled any project is considered to be in scope.
-        return true unless @current_project.ci_outbound_job_token_scope_enabled?
+        return true unless current_project.ci_outbound_job_token_scope_enabled?
 
         outbound_allowlist.includes?(accessed_project)
       end
 
+      def inbound_accessible?(accessed_project)
+        # if the flag or setting is disabled any project is considered to be in scope.
+        return true unless Feature.enabled?(:ci_inbound_job_token_scope, current_project)
+        return true unless current_project.ci_inbound_job_token_scope_enabled?
+
+        inbound_linked_as_accessible?(accessed_project)
+      end
+
+      # We don't check the inbound allowlist here. That is because
+      # the access check starts from the current project but the inbound
+      # allowlist contains projects that can access the current project.
+      def inbound_linked_as_accessible?(accessed_project)
+        inbound_accessible_projects(accessed_project).includes?(current_project)
+      end
+
+      def inbound_accessible_projects(accessed_project)
+        Ci::JobToken::Allowlist.new(accessed_project, direction: :inbound)
+      end
+
+      # User created list of projects allowed to access the current project
+      def inbound_allowlist
+        Ci::JobToken::Allowlist.new(current_project, direction: :inbound)
+      end
+
+      # User created list of projects that can be accessed from the current project
       def outbound_allowlist
-        Ci::JobToken::Allowlist.new(@current_project, direction: :outbound)
+        Ci::JobToken::Allowlist.new(current_project, direction: :outbound)
       end
 
       def self_referential?(accessed_project)
-        @current_project.id == accessed_project.id
+        current_project.id == accessed_project.id
       end
     end
   end
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index 34c5be7d972..eb9d13cc9a3 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -121,7 +121,7 @@ class ProjectPolicy < BasePolicy
 
   desc "If user is authenticated via CI job token then the target project should be in scope"
   condition(:project_allowed_for_job_token) do
-    !@user&.from_ci_job_token? || @user.ci_job_token_scope.allows?(project)
+    !@user&.from_ci_job_token? || @user.ci_job_token_scope.accessible?(project)
   end
 
   with_scope :subject
diff --git a/app/services/ci/parse_dotenv_artifact_service.rb b/app/services/ci/parse_dotenv_artifact_service.rb
index 14e8dc41cf5..d4d5acef44e 100644
--- a/app/services/ci/parse_dotenv_artifact_service.rb
+++ b/app/services/ci/parse_dotenv_artifact_service.rb
@@ -3,6 +3,7 @@
 module Ci
   class ParseDotenvArtifactService < ::BaseService
     include ::Gitlab::Utils::StrongMemoize
+    include ::Gitlab::EncodingHelper
 
     SizeLimitError = Class.new(StandardError)
     ParserError = Class.new(StandardError)
@@ -36,6 +37,10 @@ module Ci
       variables = {}
 
       artifact.each_blob do |blob|
+        # Windows powershell may output UTF-16LE files, so convert the whole file
+        # to UTF-8 before proceeding.
+        blob = strip_bom(encode_utf8_with_replacement_character(blob))
+
         blob.each_line do |line|
           key, value = scan_line!(line)
 
diff --git a/app/views/admin/runners/new.html.haml b/app/views/admin/runners/new.html.haml
index ebaf67bfdb6..12a569862e6 100644
--- a/app/views/admin/runners/new.html.haml
+++ b/app/views/admin/runners/new.html.haml
@@ -1,4 +1,5 @@
-- title = s_('Runners|Create an instance runner')
-
 - add_to_breadcrumbs _('Runners'), admin_runners_path
-- page_title title
+- breadcrumb_title s_('Runner|New')
+- page_title s_('Runners|Create an instance runner')
+
+#js-admin-new-runner{ data: { legacy_registration_token: Gitlab::CurrentSettings.runners_registration_token } }
diff --git a/app/views/users/show.html.haml b/app/views/users/show.html.haml
index af29de6b0c4..ed76960d3d7 100644
--- a/app/views/users/show.html.haml
+++ b/app/views/users/show.html.haml
@@ -125,94 +125,98 @@
               = @user.bio
 
     - unless profile_tabs.empty?
-      .scrolling-tabs-container
-        .fade-left= sprite_icon('chevron-lg-left', size: 12)
-        .fade-right= sprite_icon('chevron-lg-right', size: 12)
-        %ul.nav-links.user-profile-nav.scrolling-tabs.nav.nav-tabs
-          - if profile_tab?(:overview)
-            %li.js-overview-tab
-              = link_to user_path, data: { target: 'div#js-overview', action: 'overview', toggle: 'tab' } do
-                = s_('UserProfile|Overview')
-          - if profile_tab?(:activity)
-            %li.js-activity-tab
-              = link_to user_activity_path, data: { target: 'div#activity', action: 'activity', toggle: 'tab' } do
-                = s_('UserProfile|Activity')
-          - unless Feature.enabled?(:security_auto_fix) && @user.bot?
-            - if profile_tab?(:groups)
-              %li.js-groups-tab
-                = link_to user_groups_path, data: { target: 'div#groups', action: 'groups', toggle: 'tab', endpoint: user_groups_path(format: :json) } do
-                  = s_('UserProfile|Groups')
-            - if profile_tab?(:contributed)
-              %li.js-contributed-tab
-                = link_to user_contributed_projects_path, data: { target: 'div#contributed', action: 'contributed', toggle: 'tab', endpoint: user_contributed_projects_path(format: :json) } do
-                  = s_('UserProfile|Contributed projects')
-            - if profile_tab?(:projects)
-              %li.js-projects-tab
-                = link_to user_projects_path, data: { target: 'div#projects', action: 'projects', toggle: 'tab', endpoint: user_projects_path(format: :json) } do
-                  = s_('UserProfile|Personal projects')
-            - if profile_tab?(:starred)
-              %li.js-starred-tab
-                = link_to user_starred_projects_path, data: { target: 'div#starred', action: 'starred', toggle: 'tab', endpoint: user_starred_projects_path(format: :json) } do
-                  = s_('UserProfile|Starred projects')
-            - if profile_tab?(:snippets)
-              %li.js-snippets-tab
-                = link_to user_snippets_path, data: { target: 'div#snippets', action: 'snippets', toggle: 'tab', endpoint: user_snippets_path(format: :json) } do
-                  = s_('UserProfile|Snippets')
-            - if profile_tab?(:followers)
-              %li.js-followers-tab
-                = link_to user_followers_path, data: { target: 'div#followers', action: 'followers', toggle: 'tab', endpoint: user_followers_path(format: :json) } do
-                  = s_('UserProfile|Followers')
-            - if profile_tab?(:following)
-              %li.js-following-tab
-                = link_to user_following_path, data: { target: 'div#following', action: 'following', toggle: 'tab', endpoint: user_following_path(format: :json) } do
-                  = s_('UserProfile|Following')
+      - if Feature.enabled?(:profile_tabs_vue, current_user)
+        #js-profile-tabs
+      - else
+        .scrolling-tabs-container
+          .fade-left= sprite_icon('chevron-lg-left', size: 12)
+          .fade-right= sprite_icon('chevron-lg-right', size: 12)
+          %ul.nav-links.user-profile-nav.scrolling-tabs.nav.nav-tabs
+            - if profile_tab?(:overview)
+              %li.js-overview-tab
+                = link_to user_path, data: { target: 'div#js-overview', action: 'overview', toggle: 'tab' } do
+                  = s_('UserProfile|Overview')
+            - if profile_tab?(:activity)
+              %li.js-activity-tab
+                = link_to user_activity_path, data: { target: 'div#activity', action: 'activity', toggle: 'tab' } do
+                  = s_('UserProfile|Activity')
+            - unless Feature.enabled?(:security_auto_fix) && @user.bot?
+              - if profile_tab?(:groups)
+                %li.js-groups-tab
+                  = link_to user_groups_path, data: { target: 'div#groups', action: 'groups', toggle: 'tab', endpoint: user_groups_path(format: :json) } do
+                    = s_('UserProfile|Groups')
+              - if profile_tab?(:contributed)
+                %li.js-contributed-tab
+                  = link_to user_contributed_projects_path, data: { target: 'div#contributed', action: 'contributed', toggle: 'tab', endpoint: user_contributed_projects_path(format: :json) } do
+                    = s_('UserProfile|Contributed projects')
+              - if profile_tab?(:projects)
+                %li.js-projects-tab
+                  = link_to user_projects_path, data: { target: 'div#projects', action: 'projects', toggle: 'tab', endpoint: user_projects_path(format: :json) } do
+                    = s_('UserProfile|Personal projects')
+              - if profile_tab?(:starred)
+                %li.js-starred-tab
+                  = link_to user_starred_projects_path, data: { target: 'div#starred', action: 'starred', toggle: 'tab', endpoint: user_starred_projects_path(format: :json) } do
+                    = s_('UserProfile|Starred projects')
+              - if profile_tab?(:snippets)
+                %li.js-snippets-tab
+                  = link_to user_snippets_path, data: { target: 'div#snippets', action: 'snippets', toggle: 'tab', endpoint: user_snippets_path(format: :json) } do
+                    = s_('UserProfile|Snippets')
+              - if profile_tab?(:followers)
+                %li.js-followers-tab
+                  = link_to user_followers_path, data: { target: 'div#followers', action: 'followers', toggle: 'tab', endpoint: user_followers_path(format: :json) } do
+                    = s_('UserProfile|Followers')
+              - if profile_tab?(:following)
+                %li.js-following-tab
+                  = link_to user_following_path, data: { target: 'div#following', action: 'following', toggle: 'tab', endpoint: user_following_path(format: :json) } do
+                    = s_('UserProfile|Following')
 
   %div{ class: container_class }
-    .tab-content
-      - if profile_tab?(:overview)
-        #js-overview.tab-pane
-          = render "users/overview"
+    - unless Feature.enabled?(:profile_tabs_vue, current_user)
+      .tab-content
+        - if profile_tab?(:overview)
+          #js-overview.tab-pane
+            = render "users/overview"
 
-      - if profile_tab?(:activity)
-        #activity.tab-pane
-          .flash-container
-          - if can?(current_user, :read_cross_project)
-            %h4.prepend-top-20
-              = s_('UserProfile|Most Recent Activity')
-            .content_list{ data: { href: user_activity_path } }
-            .loading
-              = gl_loading_icon(size: 'md')
-      - unless @user.bot?
-        - if profile_tab?(:groups)
-          #groups.tab-pane
-            -# This tab is always loaded via AJAX
+        - if profile_tab?(:activity)
+          #activity.tab-pane
+            .flash-container
+            - if can?(current_user, :read_cross_project)
+              %h4.prepend-top-20
+                = s_('UserProfile|Most Recent Activity')
+              .content_list{ data: { href: user_activity_path } }
+              .loading
+                = gl_loading_icon(size: 'md')
+        - unless @user.bot?
+          - if profile_tab?(:groups)
+            #groups.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:contributed)
-          #contributed.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:contributed)
+            #contributed.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:projects)
-          #projects.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:projects)
+            #projects.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:starred)
-          #starred.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:starred)
+            #starred.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:snippets)
-          #snippets.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:snippets)
+            #snippets.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:followers)
-          #followers.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:followers)
+            #followers.tab-pane
+              -# This tab is always loaded via AJAX
 
-        - if profile_tab?(:following)
-          #following.tab-pane
-            -# This tab is always loaded via AJAX
+          - if profile_tab?(:following)
+            #following.tab-pane
+              -# This tab is always loaded via AJAX
 
-    .loading.hide
-      .gl-spinner.gl-spinner-md
+      .loading.hide
+        .gl-spinner.gl-spinner-md
 
     - if profile_tabs.empty?
       .svg-content
diff --git a/config/feature_flags/development/ci_multi_doc_yaml.yml b/config/feature_flags/development/ci_multi_doc_yaml.yml
new file mode 100644
index 00000000000..4e6289abefa
--- /dev/null
+++ b/config/feature_flags/development/ci_multi_doc_yaml.yml
@@ -0,0 +1,8 @@
+---
+name: ci_multi_doc_yaml
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/109137
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/388836
+milestone: '15.9'
+type: development
+group: group::pipeline authoring
+default_enabled: false
diff --git a/config/feature_flags/development/profile_tabs_vue.yml b/config/feature_flags/development/profile_tabs_vue.yml
new file mode 100644
index 00000000000..95fd4bbde27
--- /dev/null
+++ b/config/feature_flags/development/profile_tabs_vue.yml
@@ -0,0 +1,8 @@
+---
+name: profile_tabs_vue
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/109422
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/388708
+milestone: '15.9'
+type: development
+group: group::organization
+default_enabled: false
diff --git a/danger/documentation/Dangerfile b/danger/documentation/Dangerfile
index 1e94af391c8..150109eff51 100644
--- a/danger/documentation/Dangerfile
+++ b/danger/documentation/Dangerfile
@@ -40,6 +40,6 @@ markdown(<<~MARKDOWN)
   The review does not need to block merging this merge request. See the:
 
   - [Metadata for the `*.md` files](https://docs.gitlab.com/ee/development/documentation/#metadata) that you've changed. The first few lines of each `*.md` file identify the stage and group most closely associated with your docs change.
-  - The [Technical Writer assigned](https://about.gitlab.com/handbook/engineering/technical-writing/#assignments) for that stage and group.
+  - The [Technical Writer assigned](https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments) for that stage and group.
   - [Documentation workflows](https://docs.gitlab.com/ee/development/documentation/workflow.html) for information on when to assign a merge request for review.
 MARKDOWN
diff --git a/doc/administration/gitaly/praefect.md b/doc/administration/gitaly/praefect.md
index f5c15f92f9d..abcd26cae1b 100644
--- a/doc/administration/gitaly/praefect.md
+++ b/doc/administration/gitaly/praefect.md
@@ -1201,57 +1201,6 @@ To get started quickly:
 Congratulations! You've configured an observable fault-tolerant Praefect
 cluster.
 
-### Manage Gitaly nodes on a Gitaly Cluster
-
-You can add and replace Gitaly nodes on a Gitaly Cluster.
-
-#### Add new Gitaly nodes
-
-To add a new Gitaly node to a Gitaly Cluster that has [replication factor](praefect.md#configure-replication-factor):
-
-- Set, set the [replication factor](praefect.md#configure-replication-factor) for each repository using `set-replication-factor` Praefect command. New repositories are
-  replicated based on [replication factor](praefect.md#configure-replication-factor). Praefect doesn't automatically replicate existing repositories to the new Gitaly node.
-- Not set, add the new node in your [Praefect configuration](praefect.md#praefect) under `praefect['virtual_storages']`. Praefect automatically replicates all data to any
-  new Gitaly node added to the configuration. 
-
-#### Replace an existing Gitaly node
-
-You can replace an existing Gitaly node with a new node with either the same name or a different name.
-
-##### With a node with the same name
-
-To use the same name for the replacement node, use [repository verifier](praefect.md#enable-deletions) to scan the storage and remove dangling metadata records.
-[Manually prioritize verification](praefect.md#prioritize-verification-manually) of the replaced storage to speed up the process.
-
-##### With a node with a different name
-
-To use a different name for the replacement node for a Gitaly Cluster that has [replication factor](praefect.md#configure-replication-factor):
-
-- Set, use [`praefect set-replication-factor`](praefect.md#configure-replication-factor) to set the replication factor per repository again to get new storage assigned.
-  For example:
-
-  ```shell
-  $ sudo /opt/gitlab/embedded/bin/praefect -config /var/opt/gitlab/praefect/config.toml set-replication-factor -virtual-storage default -repository @hashed/3f/db/3fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278.git -replication-factor 2
-
-  current assignments: gitaly-1, gitaly-2
-  ```
-
-  To reassign all repositories from the old storage to the new one, after configuring the new Gitaly node:
-
-  1. Connect to Praefect database:
-
-     ```shell
-     /opt/gitlab/embedded/bin/psql -h <psql host> -U <user> -d <database name>
-     ```
-
-  1. Update `repository_assignments` table to replace the old Gitaly node name (for example, `old-gitaly`) with the new Gitaly node name (for example, `new-gitaly`):
-
-     ```sql
-     UPDATE repository_assignments SET storage='new-gitaly' WHERE storage='old-gitaly';
-     ```
-
-- Not set, replace the node in the configuration. The old node's state remains in the Praefect database but it is ignored.
-
 ## Configure replication factor
 
 WARNING:
diff --git a/doc/administration/gitaly/recovery.md b/doc/administration/gitaly/recovery.md
index 56894f3e963..1207d7af3e7 100644
--- a/doc/administration/gitaly/recovery.md
+++ b/doc/administration/gitaly/recovery.md
@@ -9,6 +9,57 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 Gitaly Cluster can recover from primary-node failure and unavailable repositories. Gitaly Cluster can perform data
 recovery and has Praefect tracking database tools.
 
+## Manage Gitaly nodes on a Gitaly Cluster
+
+You can add and replace Gitaly nodes on a Gitaly Cluster.
+
+### Add new Gitaly nodes
+
+To add a new Gitaly node to a Gitaly Cluster that has [replication factor](praefect.md#configure-replication-factor):
+
+- Set, set the [replication factor](praefect.md#configure-replication-factor) for each repository using `set-replication-factor` Praefect command. New repositories are
+  replicated based on [replication factor](praefect.md#configure-replication-factor). Praefect doesn't automatically replicate existing repositories to the new Gitaly node.
+- Not set, add the new node in your [Praefect configuration](praefect.md#praefect) under `praefect['virtual_storages']`. Praefect automatically replicates all data to any
+  new Gitaly node added to the configuration.
+
+### Replace an existing Gitaly node
+
+You can replace an existing Gitaly node with a new node with either the same name or a different name.
+
+#### With a node with the same name
+
+To use the same name for the replacement node, use [repository verifier](praefect.md#enable-deletions) to scan the storage and remove dangling metadata records.
+[Manually prioritize verification](praefect.md#prioritize-verification-manually) of the replaced storage to speed up the process.
+
+#### With a node with a different name
+
+To use a different name for the replacement node for a Gitaly Cluster that has [replication factor](praefect.md#configure-replication-factor):
+
+- Set, use [`praefect set-replication-factor`](praefect.md#configure-replication-factor) to set the replication factor per repository again to get new storage assigned.
+  For example:
+
+  ```shell
+  $ sudo /opt/gitlab/embedded/bin/praefect -config /var/opt/gitlab/praefect/config.toml set-replication-factor -virtual-storage default -repository @hashed/3f/db/3fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278.git -replication-factor 2
+
+  current assignments: gitaly-1, gitaly-2
+  ```
+
+  To reassign all repositories from the old storage to the new one, after configuring the new Gitaly node:
+
+  1. Connect to Praefect database:
+
+     ```shell
+     /opt/gitlab/embedded/bin/psql -h <psql host> -U <user> -d <database name>
+     ```
+
+  1. Update `repository_assignments` table to replace the old Gitaly node name (for example, `old-gitaly`) with the new Gitaly node name (for example, `new-gitaly`):
+
+     ```sql
+     UPDATE repository_assignments SET storage='new-gitaly' WHERE storage='old-gitaly';
+     ```
+
+- Not set, replace the node in the configuration. The old node's state remains in the Praefect database but it is ignored.
+
 ## Primary node failure
 
 > - Introduced in GitLab 13.0, Gitaly Cluster, elects the secondary with the least unreplicated writes from the primary to be the new primary. There can still be some unreplicated writes, so [data loss can occur](#check-for-data-loss).
diff --git a/doc/administration/integration/mailgun.md b/doc/administration/integration/mailgun.md
index d78cd9e1796..3beb380c48f 100644
--- a/doc/administration/integration/mailgun.md
+++ b/doc/administration/integration/mailgun.md
@@ -43,7 +43,7 @@ After configuring your Mailgun domain for the webhook endpoints,
 you're ready to enable the Mailgun integration:
 
 1. Sign in to GitLab as an [Administrator](../../user/permissions.md) user.
-1. On the top bar, select **Main menu >** **{admin}** **Admin**.
+1. On the top bar, select **Main menu > Admin**.
 1. On the left sidebar, go to **Settings > General** and expand the **Mailgun** section.
 1. Select the **Enable Mailgun** checkbox.
 1. Enter the Mailgun HTTP webhook signing key as described in
diff --git a/doc/architecture/blueprints/ci_pipeline_components/index.md b/doc/architecture/blueprints/ci_pipeline_components/index.md
index cc004a1bb78..29709cd98d8 100644
--- a/doc/architecture/blueprints/ci_pipeline_components/index.md
+++ b/doc/architecture/blueprints/ci_pipeline_components/index.md
@@ -337,6 +337,8 @@ spec:
     website: # by default all declared inputs are mandatory.
     environment:
       default: test # apply default if not provided. This makes the input optional.
+    flags:
+      default: null # make an input entirely optional with no value by default.
     test_run:
       options: # a choice must be made from the list since there is no default value.
         - unit
diff --git a/doc/ci/services/index.md b/doc/ci/services/index.md
index c33288772aa..8a08ba5450f 100644
--- a/doc/ci/services/index.md
+++ b/doc/ci/services/index.md
@@ -77,6 +77,12 @@ still succeeds even if that warning was printed. For example:
   as a volume under `/builds`). In that case, the service does its job, and
   because the job is not trying to connect to it, it does not fail.
 
+If the services start successfully, they start before the
+[`before_script`](../../ci/yaml/index.md#before_script) runs. This means you can
+write a `before_script` that queries the service.
+
+Services stop at the end of the job, even if the job fails.
+
 ## What services are not for
 
 As mentioned before, this feature is designed to provide **network accessible**
diff --git a/doc/development/documentation/styleguide/img/admin_access_level.png b/doc/development/documentation/styleguide/img/admin_access_level.png
index 191ba78cd6ca2fc36b0394531a6fd0cfc0808dcd..f31e4c65fe5a3fe2e98d58bf751b831cde95b6a2 100644
GIT binary patch
literal 8291
zcmZXaWl&sA*RFxV9fG?Dg1d*oHF$yq83Mr}xZB_wT!Op1ySrs@cN;Xg%gOV6?^ku+
zb5?cj)w`;9*VXsByZg@$Q&pD5KqWzifq}u0my=S5fq?`5?N=cK{yu3&Vm<yQcr)=&
z;xI5Z(P+;`2!G#U9o1zeU@9lc4*!m}Q&rNGetUZpaUQL!Ys^T`a&h*4eSLj-d2z6J
z<K_}@a`XiI1xH52dV7O|gTjl8$~-;%JluWC$||3qpP!zd!oz+ZA0IC-uloCk`1u7+
zPEOt5KO7uD(^9h@A0AImPJMj>YO3qc&o4GNw{CCmMn}fGx_Vk$+V}SlW@qM_n_3GC
zOY-xIZmw_U=NI?(_EVD6c6av@5>lcf<1Q{P`}+p3uCCKkGuKwv@9*y?#wUjcM<ypB
z9UWbFclV+q64q8frXbVP)3ax%XK`^!_4Q3jiNB7Hjz@;auCK3KTG|E%hPJl0rKRL=
zZf;^@60@>$CMF=YHTA!KWsHuFZ)|KHLJx0mZ+EtLb8`!mlTwF<M%LFiDk^H?;u3p$
z`kESBBEn-rf+MoBa_edvc6N5h#wOa@I_KsVrlw}Hv+|Y}mveFo=4R*X>lzOaj{*Zi
zFE6hK2Z!6*IzmGtySjQG9v-03Lsiw!mzS5lz5SIHwJ|>vii%2=KdE0_TvS%pg290s
z8yjb5=koH(CB@~P9bKKBU8}2WWu=urqvCse`&wH&N=nL?mscvvYs$;3<KvToo)Zqm
z8%Ch-r6m<BE34^gS$1|#3kyqYYwKTi4IdsJ`}ziKZS4Jg{oC6+_4PrC3CWHQE(;5b
zni@KHcXtK(#m>$i)6+9&XJ?CxOXjB5mKL_z1Baq6V^{ajqnp>#U`T9C{LRg6K|#^u
z<KuS|OHU7<%#3W~Z|1{8quO8eHr6*LCMH3K#%?a2K|!JA<&}|<F}^<FnVH$BsMv;v
z=HlYgFY)t`$*BPU;J|>8$cUe#qhq<b`QF}s%pAV+Ffin?@>1fOZp$a>5n39uB;8%S
z{J;Lp!%N_z51b?J)%b~AGlF1BSm(^~@w~QZ;983rJF)R2_K|fd8`Kp)*H=cAHOy-b
z=sRoKR4mThJh7kh^S8(Ylk>>d9Fx4d9LHCMxm^wJT+R03aQuvjg8%>Kj!@}T<u<|W
z(CRsuFc>LoZQCzc<vPOfJeD$@av?`b<MSJi(|Awh<B);7>h18FPcH?ofs5;;02+rA
z?26+lsLFDPn^;_)LF~?BQnnA_w}l_7N^WKb0xCBfHG!KQNjGP|RmQy{m9@Cn>`#>(
zqO~MgYZySIn9B~nel{z>?Tjt6X04Ep7C+m}4BQ)8v52H{!SDCp4XN|W12MozEU0-C
z^CLflsFnXmGXJE{PtIThV}$PS)?<Tcc8P@?qQYo+rU~0K#=ju|NLYn#AO+1jE30&S
zYUJX>y&-ULv#)iz8~2t-jlqnB>5Y&Ge|Qoui0}zA#B{#7pc_d+^SUm567tgJhJyja
z{0Q}~kSBz?UJvi`q=3WBI6lVwT?jj_1@6eWl%DdK8sa!h2Y+!0VGU7s*Xgt&H-jXJ
zi^K{fy8@H)3BEMIY`UbZEYC=6+7=o3n{6iLe2eYW8XAPwQ7GZ`W*5yT<#CVVQA!3S
zf5xC(J?xXU!(?A~2U_8)MXu+N@xOBPMJd8eX0u5C{nkypFZhcGQeO9N52aBtc}?`B
zL|=%gods!yo%aRDFBgHcR&n>lk#MXnOZHs;sL5JvX6hJyMdRN1{JOqAZ(d!{vc*C#
zd4-H<(V7$`?~}|)k)^){dLPIC(|&}ez5k)#<#W9Ii2}uxCH?sXizF*!w+3X8mG%4@
zBQAzu{I#vEZDm`wt?~pfn*3e5ugtjk8uWt7CF(NbM*X#qGx%1F`tL~o0JsVGuVM_f
zz;Woi7>3Cvep|0H@^p0kP&z@Z>WkX87h@q?p^y&AO!4zoB)QvqOSrW^(kh8KwW4W4
zPi`!IabHu#F6FqP^BiC$fHMTzSU53&4(*Y(c#r)X&Iitk>ockoNd+^enl7=2SZA*>
zagtv0@@kAM|L)XHHgL^GlCTC{`Fi?e@i8@-4=B&B8Q5sZbe85D5Bx3?#{xkH)7ik>
zRhN~a;hc@IstnqJLCYDH1|lkO_~&w$xVOEyNx?yv!h~b=g$7Iz>Mr1r7u-uIz&Xsd
z0Ql97&i&m>FT=9i78r$W0cw5V)GTU8kR1*0K)TzcDWAQfIwe2$l^w0W>Vn-jD#Xwp
zxpMPzFzS@hsNiXNz0KjB_hg;L@F%#Jm$bn@7Xj(fF$k!Cn4n!RRBE14cgs{2<Tds9
zRBgvS@t^2aPhlE;mEd^Yg$b{z4Vnog<7$9gV`ILFIHL<2Bfsgd|DZM9dUF`o#~SpY
z=DNeUV|o-A7A9@VewSTSacfQ?yc4gwJRlo1JB6;fgvmw_b3Z43|KF{j(ln4hJ3D)s
zKjlzAPU(3#qha&bR=HbF>O+y%vKzIaw!)>b{X5KvQMFVRj~YF%y+tLG$n!A1pK?Pc
zugHsoCfAG8TglDL&7|!9C~D!k#W<lKac^Kq+G^>Zz#M6DwEy;v8GOktE7eYTg$v$f
z9rwvYHSv-U(j6OY1JZ?|Z8~LICcPz_x^!0KeQ;5ohAsTy$OE2cmC*Sfn5ZDTOW{7J
zP=J{2%l&;=i*|toc3&`XPtk8b9GSOIz~sxZ<1^fvYiWo@kkW{Hf2v7wY3?wlRe7f2
zwhEl~mMSZ252RjLX2J?X6Gy#N1Nr+$JRa={9D7|U2I>4*Af?O)QYZrhFXQO?FDlO%
zPp=&9l06isvLz;yrEn`IU}ZWbZfVX#f6QDeKH-UqTwB7=uu|#9s(z-@qz8E261?}t
zEy6v9K53F`lE-F_KGk!D{X`8k>l?LPMWIX-zu}1A(SV9tz2>Pou`CBx3-crv#oHAX
zJ42J;c*FM&>2ssJstYqv$64sV_zl|}7ll4?D3WC*zGvuz-(pPFr7J9VO^NFCinaNQ
z?=V?lt5Ovmh^dCMnL;|ue(_$sX83uDUKe0gsH=__4_YWgW@?a4sWbaiO?REl*rF@-
zQ_^HeWACOeR|>ITCtaG}5-?1mgoiPgxV%pfVXbLQ8J%RTO=0$~D-()l<0VWgt_1o@
ztkBQWzL*|ac7<B%GLpR_Ns6lPD#=|WZqRY1mG+A@Fsc4<4iu;zCbpQ>C18I|?-ZAc
z)&i@Kp)vQ<30UTM#~5*&3_`fAiP&On$O{B(%~u(MSU%A~l*Aq9pSA5M5USI#rlP3G
zwWhvgJCurT$oMss;^bPvcH%t|gklO%5g=SDKFe=DBZ)TQuzG0I&I4HR_dM{a3oI2E
zJq`_94J9^k8B77Q2Wkr7_O&`*FvH^$@yR^AAITJ!YIY?iPBBilE*>;7s8R7GN#2pl
z6aduAXM>3Qxv8BpZ&+lT*+nU$<~IpR<Ef+QAk`<?;0c0Oe~?tc$&bR$BM0<Q!I#Gx
zFZ1b9nZH0lIBX<Mqg!xbMHZ11IG3E^2&|_@>Z>5$T-o1EitBp<)vV#gs!-d5{XVTy
z(HO&(lKZ%mZ%HntA*?i7`-0n5H1(RFvInM#<9!>?Q4)ZZS-PN_lM#{{sdwg8Z*ice
z@b61AhbQO3*}!nUI;mCz9l16jkGxjg&TbG0f)MvXINECON%#4E-ATv#5kU=oGg7TA
zs$_!&8N1QkWsSS6lzb$CU?Kf$tnw|&EG;fg;}1uKyZ%)9ukutoG|8oG@;IEA%crm2
z*3-5T9PrXBa&VtROYaIHYufBCI!WSGUHw@JG^1W$v3#}JUKy^+ue5M<OBo<J6PI$Q
zL^WXs-@(7VMRiJ1^1EQ++iogZzP{q?XO0~ZR;;`$zih~gyB_sFon}j+jWZi7LML$o
zCq0fP>^-Tc;xEB;%<bhen7ku*wabwUCGUbG&fsLw{-R=bfkqWiV7DkqTfqQVo&<Lq
z6e{Q8!$J)=hq?^gRt{3&lPGs5PFYaj)lB<CapqxY;6|mHjo=hte=}GpgOVzH{VYW_
zLMHujvTUx8&OWl&LZ%};Mx9zrk<Y6&Jt@w+iHTY&TT}e5lz}1`1rM5ZZA3Z2TP<l3
z+_Kwe!i3GL7Q>o*Gb*vNM~FN=WHA^qg`m4NmXnxu&g4Bl5sv}+nn7o^SnClnU%M!y
zqj)5+E>)F>|CA8A?7plAJ2U&pw6be^RXwd%90zQ9Gy0>Kl_oUF@v6*Xapz~vR2!*J
zW+?8*DS>F*J%CR*go#KB=ESxJ<ZO=np}1NiaV+3Teq-Zam1xGK%h&r@kTD&TA8(rC
zR5&y3TjJ??S59ZF8Y(=veh@(aN3hN8ZqD)cMCb5?y?sC0M0SVZ8xf<_rIn&QcIog`
zyY#MpG1XXj+c4e(@gN*I_gDE?3#zJ_*20b7NGvn*eo>zGzCM2<(h6fpgANvhkPNX9
z&R7K%e(q35s&93Qd1N!VL7z@{Tt<WsbZZ|&`LI{i4YdFKN-?2YV>v_8##yZKs+>Vi
z8%~nm2?X~JiQWB}Kjl0QLe!PM9Z#=Bn#v^KyHWnd(iOIv(i-Nx*bY}ZUrj@_*4jIQ
z&l?f5Josss>tuu9cXoXcNwRubW!TMy#>E7G{3S)YwL0*gb{seb0!^bzT#7aKDh1C7
zF^kf9CEPrDF2R&0M(JaDAeW2>Mc<pHBu|{_6Gp7DDFXI-6+&#@pLE`N(wNTAzUDHn
zI;~S<c9oVaJYYz*mr4>9NEq=6_msKdaD5dmBCw=7*y|DIuS?@<EPHcsz{*dfN55{<
z35+!MB-8FWt9>9U_QQDVowN0f^vL;pl&~PLnP<DAF#Yn2Hz^<N2|a<UnSVwGyVsgZ
zm)l*|5jv!+y=v=Mg_31iF*)C#UU<3sSX&%5ksCP6-|fkhx+N3UnR8EfkzVZK(;v9r
zEu^(8w#!#hKZJ*HC}#9G)f4rFhsnpg#e2+jK_L^kA4=68q)?xrR;F|fW-%Wm&v1<W
zowiZxcyld_uA+1$)f&Fm<%;~_n6UoY&vsZ*M=9hu^rdc^p~iOv{mC=a286Kw`<ZT0
z)ZUtxnTxq@digmX@!`XXLR3REdZSHJ;(x~+X+>#a%hvg7;RjNbGQ-@$o71R|hQ?2i
z45Vmf<2Uj_k80^v+wu7rFR|B#W6tDA_hSa6Jj_jRC3YKHbT{IJhgcS#8zXSg2NKYg
z4yhnB=c~>SC+^OhK>>3?n^${PK#(?O>s0Whf)ns`-}h98aCX_1XOfUkl5g;a+xr5Z
z9}-{QYpU=BFTJz9;uQ@Ro|SQkw6x88FwA@EBib05r%i}<vHSjLd;tz;w;&k0CWGc~
zAyl*Z+-NetAgu&2d~Ap%%R_ySk>Gvyt`!Yx-|RWVtIF%D(ZUnc9;gp(!Nj&QeWSA`
zs{pHGI3*jj5#+fq1NHqw?58;(w6D+en5`NoM&H?u<ddtb;H`rw5KW9va=aR#ANzp5
zKVUk)XYj_5OBG?|-c5&KQHV4@l2efyzyBU^DB_JGjBx%Z!oY9FzKS=dBTA(!s_Q|H
zDBNJ)I#SlV0gEsf+}TDNWOgm_m97)E96abk$OD!7#)%(o5tK^GLz;KOS<v)aihgZD
zsgLID&C~hY41;Izrnic#es*US@=Zj4(+1}w+S0ww61zr)fg_oT@1)W9|2uAit=5jN
zotbk_47v^v6}bv~nYiAG_1h%~=L_5$--H=<EPjd)p~wCaT03%JVewD^^Qr^0G8!_R
za#*W$7((>Zp~XP1cvEpYO!~}6AAw|gCK!FK3}Jf$qPhL>k{xwf^E0g6ix%TrLSle}
zc$j~9SyD3CmWLP$qS`)BY>SDC6&BsJ-iivZ_;8Dj3j<BrGg-J06)^p#-n*k`p+;Hn
zuOXKplU5YP9{4p!2j9<~!{`WMC~N}e4qIKWBQ(*#Uf~uQF!$iNR4`6UIH;A630-3V
z6Odyl!&XJZ*-}aO(W}czAi!}pV|y8qFdBOxCMy%RI8A7^l;h|q5(@#&sa3uZ`(dgq
z2$+3Qbf6Nj05tAFMda4xq8{bq`Q55z%I|(M&zK1|B`3zHQ=H^7y88;_2{AKJ?pi&e
zjra5Yp1B1z@x=IRFeU`^3v_S6jPaI9q=&FzF(_RV&dwt)A$lWIf9fDo`Jk0W?YoKi
zVb>}vS-}f8PROB7aeoywP;QSoXG=ZCV<)M`gH97<Vn&4>fYw784CX2_8|Eu>${ed`
z86#0^NXX%aq0}StL+Rh>92rr-41~Ip;tFA@^Q-55oUYH%6n`OJ0QP>;C;*#?iFA7g
zI8tDzpbY<nEf>u7XWGIGora=&<g|5v|BMXiK(Ot-;Mxzzg@mN2jqj?n5B@-8q&=lc
zSkhXgQgT48z8~;n-GtIN_aDDoDh88==NjQM-P0=p{#B8P(a|H=x=u+8qc8Qqd>(mT
zJ#Z4<%dP}QiAv3H)Q=Q-2KeDG)^zU2X-$<zTT$83dT_3P2o4WA-o8_%l}VT%Ww%UR
zmo(T6TN%t4^($X&SIJ%nzZb|7t(<aUe`mc7>m8~vd5COrG;pu*kz$Qm!hMuUw=%qY
zTdM^8>Aur#svARkiX#kf6-W|FtyJ9oKVpUQ8Mm6JRJ#8(jRLVsLzTLbl2QGDp(oU~
zR7!vnkyQLRk{g`DFu2BE!YD24$bsBrWFo}nffAuT%L$j;N-iK@>!-8vc}9%ktj>UR
zJ01M&M_wgul4~d5`P08dsk};THxgcMqrkS2(Men#X%+*vzVRbkLM+#R6~bm}2J>J`
zW-{P<8T~7fId|cep6Ns^uYW^AfH~m2ClD6948G|dKekXRA#RFnoy6bD^<F2`-`w6(
ze1rXqM4x`CTF7n`uVa`t!M5%EQ;V;_j>)a=Ssqa$0de*A*@myV9F+%~fn}RE;flfz
zi#orAun@c{!BQ=6JGA}&>dJWy!!2vUY?%jRRTU2-UakiPpCl9(@!tO_pg7j0@EYA2
zCH}C~$o5|-yc}*=N+lu~9#wU!qm+=2O!$5ABN^RU*_6ppB(K8Qz0@ci%vCGWXv7c2
ze?X$$-Q#Ss8LiYRFS9@Wm;Oc4e8)HMtb=b(rL?H<A^d$E#j0pvOrb$Gm_`|i(hPe~
zoTZaNpv_Ann_@pUy+lPPE9{@b0cjADL4REiKtGpeX-7;as|ofpy^eIhTlfGNak5US
z6s(o0PNH!_z87GmuKFLo{n+^d&NzsBOskPh2W^*4;KM=a387@>Olnlk6F_2psR;c#
z4Mv!q0V#CmRKwdhVJ+({E`>i(gGwR58+}{B?_b^Ae%GuVyQYAzsq<qzs4=do(}&I0
znH*y9iy}5g!%^y{mOXtW?oYsQwv6G3xJ*)>0>S_=ksfkqC?Wu|JB+`_oohyRQ%r$8
zBh6N~KTOi2dkHBi-777_LIhGtEoUSEop5VyzDP)l|HJ7Gt0NL;78pa%J(6N~9u8~r
z>p^=vtieK1Lyg3u95qoj;XqLgo=$_kALdua+H+~Vu2+PRlMYw*--7@zR^sRBeG<*x
z&>C{*<|Y>JX)=x|Z4x9totJysvhx`Cjai4b^{+^|mY-8yO8_td{X+R1<j4r(N5MGG
zPb=42pHHcObL<ds<(c7$kbg^RPk45L4&I+4J-&4cqMQ6CJtLltgc3XIBB~J5@3~?|
zsTGGWt2k+nPIH(4cgU2SY@>duqHSxBm^+3hY7?i&8WlemS-!02au2$_T`81D3hT)K
zx}6Sr6qPk&B=5}7eVjk3vJREKyFZxICT2qP*SoVBX5HN9FBy0X`?5k5eTE4wC`UIj
zLHAl)e%{M`G3<}tlc;xR;_<EL@VQ`-HS_!9uJUY8x|&n}z$Fr<Uoe%Fm3r7@mh)5H
zBl5;NdRyxaz+vYq**+cY<#f3B&s22KwPE9Bt;h6Ej0mW0_J!~3s-rr~^0E}xZ}-_9
zZyC?lS9G+)=-8vL7t^;x-m2-+$B)z!U1873>&EmVmb$i*A6u{0zXY59oyoabNqA`y
zYB&w7=q|5`CoOIegrD0x!fmvpe$rUPItQ>OC07fVzq|DIj7a3zK=c|XLe?Qpjg7tc
zXQ!MPoNLOI14yT+Ky_@heLNicxXA#lyS@^n$A9={oO^)_hdxP{?FYW685=(|rSXQ|
zyEWA{iD~J&)PS0T6mljS6&UeiWE7beQRDox38;aJ57ZC|a6L$l!?GR~3qxe?+)vzl
z9!XM3DKa&M=!sp>>`d@rvZIaF!iJw<@~(v3bbmbkfy?z)_Q2Q^Tl9T2hv|0?TH4=0
z!w=3(95K3cVhCm#-9Sp+r-^hc8Nf>l885wI2P>jSCg#-mC`e|I4Dm4s-;PA|D6MM>
zcslZ_TOI~5$8=+p#`Jn4%n7-==K5&z9h=q|6ENYGE-Vt?UijL~IctQWIW5S2|Ab+j
z-D>itcB66m+xac!=v%g#1DXd3a{v)>(fFk+y{j(3o03;`Ccz!{N2Z3i#t4?b?Bd0w
z$z{`Swz`<BGSl4rujk#yTG7x<LD7uFEiNw8Ddg7%sL$g^5BZsf&5*=%1ND&)BUjw*
zNFyO7xo<9*aaE3?QZ%u0bhu&vr26z5nY_6)G=S!K5f13X<oZv%IX=SHnu;w*?nWx?
zj!4(Nq1t0vr(Bs7lf1RS(wi8!YRQ4csr#>>3xxd{<VtYc=I1u)<m)~-r7(Wy5xDn`
zFM6jZJ1k{-*Si^)mp{-~s$EgOgsD4xY2qPxzwLFsocZ8k)PopqIEC1?&q+^UoBh<<
zQH-d7*KBX=c!f(++@^rfv@L-ixQQ0x#JNeXX8GuV90?Q}__db!S|~@`s}tCcYWl-%
z=erNWw-0_uTT!3yzpgYrE|JZOlOcf_g87fb<;MwPc@>Vdp4yHjG!f?pw5i8))vTHm
z-0KIs<fG@A_gbIjXMv(GK6A?K70YK75P;?{AU<GyvV6lue_#tw&-N>hHb7Uc)h>a!
zF6*wv0tUw~Kxlv%-EHSH{|*Oct_QY2|ECe%8Fzl!{`8g5c6BvA`TApeK5Tz>z3HHi
zpSL%70NPOH8i|Dya|cqK$=<Ec9G;R-@iTiRAXp>n1~I;p7sA^wi)lrGLU=F(;!S3b
z0=Y@V2uY&HC8+R&crkjZVvR(Kv}A|viH2mWd$Hl$w;?+{74#-3#R9Ocwjd8nRJ45b
zx<vA+m`nd%7GK_4>_}yFA5-&cBTaR%#lT^&nos4JW7{gv`Tp^pdJ#`Ry>f?x80HSB
z6v<z5HQ{;=y4r>p>tIWJsnB8_=eD3|lMUmw6~|_-4IfD*G=LgK*)wE8%vR-(!2_H8
z(KQIM)m*}ZzR)(h!q}b+IkoyZ+-DVx%~E6VL(TH@7`eZys($2NFUtuni!onL|H!8Q
zBduZDP`<4bMm>3DRwg2#hqqT#kOxvUs(qzOrrfg!3GX2(#4m`Dv7ltMCD8*I{maOV
zA7alj2k4=WP3XpW{ueM9(P5G9qB40Ah}>x>Pbg9jL)7Dh`th;<KX~vZhJ+-;C#S5p
zAMdr6fbgl!sM%nPaRPt($zz-+W^u-1wgCqa0VvzDW9``q?vM1^myM*kok}nR=)@V6
z{q;jR840q>{P>zcy8l=XegLl$vjSn%G+R*`;sS7yX@bf|jhK@NNkbHy3|Ah7D3lP{
zk%BvBj3LZfKTz_zCLH;&ck(=(_zO%VNJ!c|TY$B1>ob*SUuymsFGTSHkp>dj@uP)*
z_>0^;a-}{4GQwPeHs&}Sdi~h?fHy-kp;rJ~+9D1wgp<gDl4$sOG7&{HcAmq&+g$3e
z4>2o<%8mZ|&^)0hc3wV!7aLBXS|b&#?~ET{->iwn5tD{%MHN0Qh=m@=yjLr~txq@v
zWINnu?B-Y~#Do3oz*sY?UY+K4RFfZph^@R4U?pd`PkJ!ugP!7z$ShMZz_8dI+Q`xF
zR-&;WomKv?U8Cy(6Lif{{8yMj9S9Is<cLb!=p9KY^Sfdi8w!%7a-0ASJHh&I)xn2J
z)6#jGX%mxMg|JdEm?sIQAPl?!`#?=Bp8r4v;)cpG;~T~I3sMen#wfOGmvFBfJBNdD
zq>6^QvA0<C3=nGghk<@2j3!hd1#I)}Sf3haGL=ZBd4ZTw42ttI6bW%>PJ*b3%-oxP
zlAEMVTOlwo@vhFh!ZQ-=*9m(OC8RK>Vtq3L{Acr8oO;*WHf;dy!efU*rhww^knnC2
zI~&mgG}#i0<bz5z5)Tz53ket`X9ezR#PA-0lp}FO2aRtSQaHa<;czSpXsmIMJWecS
zanPkUBajcbvx}^3i-?HCox&qb{weC-XKc>^boi9;2n2K!douV`qN{pep<#k}UKnGw
z2G&4TkbbzdF(Bi1!u=%khr!yWFr@HE_s8lqKUJr*j^iO=p9xiEWOjJ{*}PDiserU{
zl{mnt#YP&0asLK9%vGx_fsk65YX#(q00ct0{kf}$BLyM@iYeeR?KN^+sW*sXacHn(
zwMM_kt1cw^#Im#5$q}M>#UOQu#wf?W|EI{|Ka09fO~+0JvBck@gkbf6!jd^*1OF**
z#GvV&648%dYS&fqYH8jfB&k8#i7YGCJs3?Rz98LvZXJOEGbWEfdw1+sQIVv7{C50~
zhbPOPvH_)N#tu>07G<zUGnzw8Kdcw69~mb!rI=L}pg|iLC9Rp^b8cQgo3?k_u&GCS
zbP?3M_r<fr(J`20>WXT%%7@0PPNe>#_V$NC)*dBRvaI1PW)lG$)<;xNj=QXyljDq`
w>c*4g0v$G7so?*;l>T!!{Z}$yIyB^va=vbseGmNmmjH~sw6avC1jzsY0CKAVy8r+H

literal 9821
zcmb7qWl$VI6D5HV+$Cs$5G0Vrf&_Q>#a)84xH|-Q2`s@~76|SH39#7W5}X8g*Twd@
z@2=|P$4OP!NX`6sucy1GtE;2cRAg~5DKL?ckZ|PXq<~0BD1evsFLacbQG%*Y^<{c(
zEv_t%gjAP^^=O9rvVY|Ul$AiL9;ezzLP91|Q__@1AP~>b&ySCfKp;>_Nl8{#R!vQf
zgM&j*P*6fbB0M~Nb91w?vGM8YDL6Rz&!0a_OG^z64Ngu@XJ=={#l^X~xvj0OMn*<(
zINZR%AUQdCa&q$T-+#NiyXWWUS65fl)6?_w^9Kh9U@%xqOY8Rbwyv%&Ffg#9q9Q&%
zJ|iQetgK8=PtU`{<Kf}q?(QxtE32fWBq}P()zx)-dpjZ`!r9q5E-ud0)U>?3{P_5I
zVq)U*^78cbw70jnsj11z%If<1CM_+^-rnBE#%5z<<LA$xc6N3xEiJ>t!-a)~-@kwV
z_U)Uwxp_@>jgODduV23$92{gl5MyIwm6erydwUlb7x(w~o}Qi-78W-*H&s<tM@L7$
zfB)|9?}x!)P$;y$z5V3m#NXdPFE4L(b+w?NAU!>OWMpJ^b~ZXXIyN>oGc$8%XQ!*H
zYjJULU|?WqXlQF|tD~bMDJiMDyE`#4ad~<9@bIv@x*7t36crU^XJ@;)xuv9}?C<Z7
zkB_gctb~MwgocLt`T4D{uXlEK*4EaJj*hOat@ZTu%+1Z^=jST~BW7l1Gzt+a$q4J8
z2&FiLmzP&SK){b5KN{x|P4kGH5k%V}V&@#ObAf1GKqMq2=$0U?st~y&2<3Rhk3q!z
zKH?dH$R0st3?Wof5P$X&zyd_;A_7>5*u6mL6eDzt5!>g8`2&ROYXedwBw8eSDRE8j
zrK23U0g*h#;NRl!&)S0@UMGdUPNh^rZwUz&LFo@wchtmxWqn40`fJid$Sd2LO3zwY
zX8xKYZ?Vn#bXC-)@;>RG2(G|*OkY<X4Rck?;qifcz+MHojMkhi!t8&@4$k>MrxqE<
zRi7c6*L|M`^SYi7POqRveqQh*(?E|_ER>o*v_gFMg=+AX+4_2a`Kzm}GATr(JI3t%
zd`D2d^uA%#DdDB(WMZ|BeNtpRJLWcR>k9Xg{r%-GJw1J1kmBvT@)#?*6#JmUVf{Ne
z8>bU0<+f>#zgzR;HY>1R&S-Cn8U}tq{cLP#Zt$ZeFUw}&jb1gDZ)fQDSWBNgokSgi
zoGA34Q_6>-##5K)pA8N^rwu$gXy)S)C?6hcx=R-?n+$*rOoXWGydSr~maqq@j-(G2
zCxkv_b4pHzD^BxeHoD(0xrHYhElsl6rn$V8Z|x1>rJSr`j4}jt6myevc*6fuSJM`j
zLj`ou*Q8#*h2Ziy;9n;I@@NC_b03SyK9CD|>PF>9+@#l9hIQ3Bz{LYk7hFkf55meO
zdK?5W-F@hArq&CQxMxUdrbET}OJ4m<bfReB3R9ExtBWtSlpkA5(!gDBkpldn5kpN=
zN>2$<XUSOuEptUTX4$QKQT7VINwk;2g%kEY04KoR0u$h%#R>4jl?pW~FhQQ>`!Slj
zveuGYvmqWDbHw2^n6b-xRADOi+XglptiYyo%yq<=mL0D(5T!isEdgo>IQn{A=_oaZ
z;z!As7|(T-=~^x7)w*8*uXl@wV4D30!3k~n8Bc0?YTsnZ2L`F=UC_s?3G9kpWr|&R
zE+?y04^<`pY$>Bu3KXbXGW}bbSYg<9N}pwA71jIF!9WEGGW!pV$^xbFBY2PJ57Ff2
zY5N7hJDqA#NT)$Ot#(F&0mlXJ_@f2$fu)6<3Ki+NoHJmgHV1?0Nj&}LxC`a4+EGSg
zj*e_eo3e2>|DKzn_29jt>1#iU2OH6puLV4fZD<b;20K#{nn2%d!?og42$L%LR6OwZ
zqIq(aJ^CHu>_^u_<TV0dx9W;r81_pBrOh#Ni?GC@N>}c43a}3kV8B~ZqD8sfTg5Em
zK2r16x!REST_~BKHiZp{tJV>vJz~6<&&u?e9PehKx%Ga1`5hEr{f+Cec-cB+ObqK+
z7{L8@t%&Jr%WoHPF{Tw*nT^F*>+wKqwbz=2Cs@N>gy%c(b#WT!=xEy-tD&$Jb#|+Q
zDuR^>(}pQJyZ#fhw~9tz994%0T(cNupmDLBWY9LCGP{c>!wI8SnKXxMrAemx!ek?S
zE>v)_o5^Yk_=c0>i#<|+mei&4*bH9@bem$5*}*pDFCM!0y+y`=RhRv!f!OWN?ufs=
zt=pQvlM(}5F`+uo@E+?k{K2>bh3!&lJ@eyIm6aKn_1p$B>tCo>lv(bk<STg6BFvRz
z^dh^PjQtCg2BnV!`~NDJ-91e!jO%>Oh@+L7sjIniTtH`OR)NXgYn<b4cHAAq4YRAD
zUO_v_(vk4DG)b(1o+tA*_Y#aEM)#+e9UakeIEn`s$?)(AUnFUE+~xwmMMtj6elT^n
zD78ih^pORG@o%++B&+tM8&q(4!e^`av~{s+p&bpdON^`TlzI-_T;eS}Nu4(k77}mr
zsPE$ciVN3JPp$$J<^GKPg)ui2jmmat?v10a9=qT=k|5|&3J4rKYy0RdPxLfcZl(Qa
z4ClLGk<Zf66UWhLsvuiCZ!)$Pg~#>;;Zhr^#<(A?yHBCZR67h5G!V=uH((eWRgU>U
zkupF0R*>2AN90NsaYHn1z!7;lRoO+pPHen-vTW{OQ8w1H!om}dsU3>GtonBZ3?ely
z+ril3MdrFUCEhi1xwQ^cZ}g?+Q!nL*jBiY652$qf+9{{>eS$}82C;rRT5VfsCj-LY
zOLqU(3({mS5SZf5Zx(;1WhnxPTfzjeRnU?p?bX`^WqDl91F?S*#ZOaAQM{8HidlZ4
zCwITOAU`AbYngqeLz=E_i#9fP3BzSlsCU@^%~(#~k1}$qw*13aOa(dioR+s3jRB08
zV-c6mx>{7-amUgY`CbJ;E3aztE#N!-N>QM!VSk%5UNaE4zu-wrK43j%uZY^NWy!Ni
zwXxOkr;h^jo==%Z|ENewe@|G8RzzHgOmcoedzTt5$ROCXm4xXhD}c0b{fhu(HNQ6s
zoTc_4Eh~(I+H39cnU$$QAEftVEos0Z#$RGK<Ry?sG8@||212q1`lb101gd0Is>U?f
zL#yLNWJ0$1Ssmx~nu&>|t0(>Co*d%T&{Q<YV{Rdz{olCZSu?q9;Yn%zzU|-?cmL{K
z^nG$XEp0k`L#o&=-1n0`qo=aN7c$rC-;E{HYa9ySJ#gMx!Z6^>8p0P}p9%qyQGfmk
z*oy0AK2HtDODRi4Y#niz4CBf1LOei=8!6VgP1W3+wzQaxX@D}9Y-Zz+moO?x@yaYc
z{tT_gk@UU=oI8IJ?vr5OhfO1Mtblg69omFReRe?8HnUJ&C0o;BJ*Yy@rDMEa8hjpD
zSczfsx`ca0Df&ZN;ovSTl;?Xr*ZgvjD1`VA@wmLr?uY^;qF`BQX+F(T@w@&~_pV{6
zZEWYUDakBpxVU93)g+%5-mU3;A;7X;LRF3aJt|Zi>sGA_FNtn3-A*mU&UK+qdaOC~
z;V0{A;ms?YBDE#gej!dwJaWB5a8>r`K}K|VoqPg|s<brp-}Bc4S%~7Nx)SsyP*FYf
zG8^FDsw0_`jSeY2_FSp(YaU4)t_wfcZD?cwy>8U!zX>2A$*|{}CGgyl2pfCT-OyYS
z0G=Ff`T@l0d!rHDJT$HK%)I9IqG+gfVgU9~jmHRShTuA9`cavZfn6Hlz&gk>&QQ?*
zO_dj_PdUt{HsQ9<u703STI7NGT~l?VC_{I)SW6>Afq)@VW#*;DVoKU~J>llpjg7I5
znDCl}3YPvkyisHpd`CAfx=8;lKC$q{<}Y=GZQ5O77tM`Tltxa_<93k2Y-+LQ(saBb
z`4`$e3*uU11O5y|-<nTQlMBe@vEn#~M6OV`oK~t1yOdAE!S^#Y?(3O492E|_W)~*U
zD1)Q^@nLrU)4|*BF2RllRP<<*3x8a^lU=kA$Ddl_c02s6!>zdlxm!h2cVGuh2-h-8
zwMEwq?5Qmzf7SgX-S0qH(oa%Wv=)6+F4D3QAY?n*@XPHh5%%IXLjJPQwhKN#+B}wC
z{W1SXX|HO4Ea3A3gP;_o<Xd1r<EYZI-CiJH^{~QGuBOQoOV#ibx~ujm2X)q{UgmaC
zvA$@`qGb9x<LK8yo%y2K$)qI-Nq|9XdWCZ()GiBGO29yBm6b|$l^D&cLtsZ67RA1+
z5iyILC2`WuxA9k{Gwmxr73_<Lb#_Ie(37}rZj`~BG(fuiq?Ox0ozVc#U{T6EnDeh8
z?bx(X0{{W`7KSo}!Gxx@<M=e3n{B76fD>ktxE0M+lbfDKVxP7<=;CIh{Kamc7$xuB
z-pwb(gZ0x^&(IZ%NZ=ny4;n~`;zX>JIffjXuc*UaRy>ChZ^q{$(smYKLXkwKk7`5p
z{wG<h?*W)}ENf_JOmTY8v>OS$Z{orFRn3LQQiwM_9ysR?or{jt4RiIcO9K0upWoE7
zv2WK-Dp~(f^#Z^qYl`w=E-rvV&w1W*P@9qjKaRyjNJ3_l28bvjSOm{Ge(USDn4N9Y
zEHdOR8iSw$Ac;s4q>O?M)0!yJXG6bI|Kvt&UemVdkl53sQ38HfET4`i9a%!kg0cN!
z_$V3~2l_Qp6KjR3L-FdNW|;s@d+a|PBFk8%L<g+5B%Wxtwf-!E3h$<q-F`OvHWm7`
zkK0y?b{z!<t`;QnO%HzZo2A(EfJS1o7_faWpu7MLB2nG<QPW3C`Y&9FbsF0S8F!gw
z?q87c<<>}yoHzL{OU@_r<jpjrWtvdCCV{PuxhsBJHYq%~u3*g64QDIgyV$;7PM=T`
zIs9QudXItUN`Fw-yIYtmL$&c<`@EdL1tf*wArh5@7gyl9>ZsZr9^IXG*>^vpsfJna
z{1USHAIbdxoY?=L)^LA?!L?6a<gD8Xra!vP@BUI^)z%vEj~e~v2%-baT$fIPWBJ|*
zcrIzvV>8sZb^LHMir}};)vhqFB6B%f@F|z%i=flYfdvd?>kRN7wJa;p3rBT{0<nZ*
zL*G8FSdaQ_$2V|$-^arRf{A{hoQW-?=}z6yB7UA6GB){7H`jAZ{X`mJd<=0W=n(`g
z^9=<IWxpj&>@<P?sdVjw%aWmbN1qBel(*1BEOA+b9;sb?Yrcdkc9xff;65<6;$>X=
zIl<q#b-u^1pS!?E!K!ttfL8TeITO*w&C3JgS3*bmGh0A{m*BSpif?v-oc@-TC6voZ
z_bYb%Jxs1;k-R{d+llzjqw`V5LQ>r@XLFLiG4j#I1G&=3)3%|VZJ$T5I(CXaX)9WW
zTmRIl0ficDEJv2WBz+m3edB@n&+Kny13>#qJm*I~_@Z?a$F2%n+On<O^55-;?XC-s
zc>BL}+F=BL{XTzL{E(_&u96j%x~~f-mL{kS=MRGZcoeLAdr&zHtV(82JfnV$DGxsv
zwrHa7!hfX!_$*LO=9j}L@(Qv|;YHIYcc4AzSpq##){YO@1V6O;{Xai8e@@uOAg-lH
z&++P`D5B{l13a$lDmn@S+f&0$J`9>fbO-Mb#Ufm8M)$2R?<!1hCuidQ&itQMpC#)8
z;ZA<P;=`F5EzHJ6N4ATj+@PYo0olAq4~B@mbYZuHj{}>mDk=K;=>J$qpYk9tH@c(r
z541&>MJu=Ck}6NF_O`v+dINXpd+zgxDrF{Ap9^IL-t_*Xo_Nh-gMC-QbUxjLDLiRz
zEONbSMUX|`go<*H*Rt7l=nl$%HNto$)nv>6V}-aVNf^>iiA<JB@?2&dJX=`awi}n;
zYsJ}yceZ4bgx_H4DmTF-fmF2QAUPc2faDY;Q&VzZa)zc(uj2~j)#6rBi=+oLx3D!`
zHN8gOZeUdtX(cJIf7F==Dr$&QADtfppu{^-lN7?9Oz_f7>C?<KAUwsUWYiDbqcR^i
zdUbm6AuTv9SMZ@#h7tJ8wVb9fvbRfrk}=Z@Tu!2rJx05F*RalmOZ=KZnE%K1sv;Fz
z7$X(yttI$X9blRA#_Kk!7(z;gNFs2tA<$qA(bmmI^^T%E|H0mZ35)-HQQP!5$aMEb
zuz)18QA#}3(Hxd}L&pMYD((k~Gu(*1zJ|O}XNbJ|yhsM(%S>}v_+4|$1GxH5*47n@
znh*LGGk|g6-0!MVy3#%iWThzMj_XAo9hLor`1_%}gkK2_h4pPew>L6Mk$T&QGGtD}
z$(Y-*RLAueR3C3N0r%Qzt>lbnqnu*G+G#gylSIB(Cz~X&w6xTt-S!uX8oiRALi)eT
z0^|`46nqi-aqWe8Wfmc`IIjE_XW{#O)Ea<Oq#K*pYu(6`%>U?(L+ykcnckjOj{dM4
zo-}%YLz+)C|BJyk_>cbH0I|`qL(|p6;j3OA?rbX?8+aUDj{G;BQOdCqPnzmUsepTh
zpkVW5>IRVhRO>eZVotL*kJ;&HcOoTnyM6aZLA#I1_AZ{D>Z)S<i3$2|gxo*hX_qv9
zJjIrWkg^)FaupG}L5u!F!wCX)wPav;fS3F2q^gD21Ys1-Ys1i=H2PwSz=ZyCXpcBz
zI;L$W_Mb9=m!z4;TbpmZty74i@ZYwWa$%T!<&bM(+~hP^dyS*Rjms_e9B7GpPfL*>
zA;@j4{}dR6{HC}CIZk$nGPQ`aco6waA;E%wL3x>>K8?fNZBg?-;OnGbz;nf1L~91m
zzNfEyL0@oDhTT%|HcQ8FVp2`pK>0fhLtBw)txg40K}XuE0!oso(4#OhzE(oIJ)-j8
z4J>5P@Pj|~()Ut*MuRQG0d-geXS@HC7zuuk2*vDqy)ev#wrR`Ep&QTkPRYysWAy0;
zG?rvoF+%?vQu?GSTIu}ED`CTM&hiUNH@F0Id3E(W-p<v&F7!Z#n*D(!w%+WrhI~8z
zzMF}9Ez)@LO=!KX^d{zkT7TH~A9a|KkIyYSFgC9L!l_bPE?nJf*2F~W*I{|MqoY~|
z2e4w$;37m<>3@f>25UE@xQcPLWU{=vB)A>j&wowh?%`oO!!d0~iX_P6?t$|h+4&h^
z_kMBXPI-FY00%=+f*1Q0_tC3GzQsPqA<uuqg{|vx%;n{@Y@si8G+5SUV8(5rKjN_R
zpjx55&)Hu<fGhF=E-tW|)1ehmSt*d~SOVtkN@RB=x*M{C=2L<xJv#IqqmpkJbzpu~
zbJ7!=idzkT#@<gg^|;9>1y$Vi2a6_0_#C|rZOe@Iz;K!oSeQeuTwas+xgDyfCML=-
zb#TgwoCvMPVa{TqFi=Z~;vaF)254=-8_iPf)So3s9mew&`lU_LPTPst(0vUW>>%q1
zDYl{1cW%;B`r-PT?JQjDe@PP+#7e9u)&P#uCuSY4B`Jg+;~uJ1c=}`7)PqtVjT39m
z23Gr53tjBfCdxj{SSH=%vSX8VYO_*=JU+^m83EK+$PBCv0fC`-3zJT-F|p|Ds`MrH
zC@Z1%Bwx}@zS-_s?gyQakvC=ctv-p1JUN$Jl1kGMx5TF&2iIwkn@(Y_`0@-hNl%x?
z4ZKUGH+SQxU0KqGE0R%iVM9o_gOIW|`P9oxIyO2<U7&T(uBi6G8w^b&LCvDQWhzz*
z-Dc;{SpMv@g)b2T1JUfQiOeD_djr|paKLM3)#3WsFm6ZVQl)D(_J>TDI*t|`!+)6)
z;w#*K17%*0A)53GCWE{_T&gdp!)-FKTc?I3-e!nLtPTE>m4vjlw@w^a>07(URBy9b
z4lS>~6e?mLtVI2it}RY!BRwoS*eV5aFq@8IGm?C}^XiS(qRKC$hv}(Z?Dby!YvG%#
z)TfhZ`Ib`so1Yq_P7dk&bT(6<=O=#;P66K##XW2UvWc<iSAS}C)LZ}rY>O8Yo|!g{
zW&A#H>Yv?kF)RJ&r{#@gjPfh0#lO5#&{Gy2mKQp%G%lcz=|4B?0qj}*pL?_ZfUK``
z#-4J!|HAuvmh{J`%l|qhG+@B_*FC9JsP6UX5(Fbbd}*+TC(r+wNgILnN`*}+ys8>q
zbmu-XlYRc*+wAhI{#_0KW^UR!!Z-U<T;>$QMawg3FCn+#e2a82Ibibm?y$ZCy&WP;
zm{+QI_zdob#s52a?OF45{+kf6d*kaP1Bm<*dOfS#@3k`+ap7c#u-g;8oT5+Ax~HNs
z5lN$LI`7*ZXP-V(#eXgS|0gfV_^*ApuQeG+zR`+6?}BQK!(y{MHZ?K7-G%AS+F$8&
zxw^=Ho=|$6zX=#zRK_yU<l5+0={w-c@^IzSPWV!CbDe+b;{LQ(l1adn2C2*#Q-&mq
zOHHWTg>*b=e%>g)xHq@@e7<y_HGs7PqpY5&4dQcay4r(Eesbnd+!t{^bWkgZ3^dD3
zw3E%|*2Z-(85no_g6xc0w=7l-Hi#m6L$SuaVavz3E>xJC!VaU4A_{QuiGVupTuZ*<
z?Wwh@uzV{*%V>&Hqic8mNs>||e}jO@VYNQPs6~hm@xg`j-S0fQaK8RS$}s&ubR$~G
z%ia?}7^zsaw+n}OHZ$%j5oLq%^3tnzZ?EBI2>4YsIMrLHMpN;l7yuIf#b@hzZ92}^
z<(#m7kLnro#1V)kzOV&s$q1I(Y4OK7y$ITM4tS?`h@Ya5-YY^*git+dd$g?w4k7;|
z=nBE_)69W@Srq_&<V~N}1uLk;EzX$A-~2zn(c|%%bzV_R>+ToVuY%>gM%^R<1#mQ-
z=XxcPI7t)LGgeA~|Fg7-;IiBOgzxw%eBhc8S^+-3Pb^V1G2g&@2(RZq-BU@^$XoVq
ze)a+_^f1{q*w4CH&^|<U=6m~>Y)vmyVX1;65_wH#?&j!4Moc(E{XgB0jJG?Ji7=VW
zO?w|q_;y8BJ1t)n>dO3VYXf<gb$?Ly>mKr#T?*6e546z{a%HvtkSSDu{^zgY{a=>?
zs=96TCb5j4*e9b+=uB=(*?slhngCh&1EZa7`(w}pg0iv%{WM5DvpF#NDFLWx0%yV`
zzj(LkUDW;M;V);w!h%Xn_r!Nl<yT^3+pZ6k<do*CF5Z=CA=W};z+dYc-QN&QIe;zE
z*`$3nVc!`8JV8!yMTG1dU#uSCoU1=)R~HI=3-B(AzGbs`B_6bni08OUt_gdpl_=k^
z+37Lo`)>sHNxnRZNUgFdGW2=f*#f2?&wnxgjXSrBn_sC<<JrGrA~P^u`r6X@uaDZ;
z>AIJJd>6vYdr6!xj^5%Cc1krHhr5<~j#1iT(NS#O9FOx8Mx5`P=D~)HT`j?=%gP1o
z21sZ0umY&QVhM%ZVJfaR%o5JEMYnniY$`Br+y3~?lI52ne!Z9C*m!~KZJCNnQLL}>
z*894h`7Y0IVbo!$F^c?r8eh;G*e7(0o1s=#sSx$P*o*3VqyjpqaWDM6v{NtW?Pb}P
ztR4}0C%}1){leItY)NB?H@<Fl;Jwi4PvD~U=-2O`7cq~ax<{{stcJR+eKg{k>=)z9
zwPK#jG8c2Ny)2sSm9A>-Rx+u2)tRNnT4Jk2KyeqZm}u~`2CvDHw6R69siU9~r)KlA
z%)hsQX5`~W>^;35qU(1bZJ-c4RaYG31-++wF-kIv60rW6X+4pXBwAMI)^S)GYH*}C
z55+n0{MRO*2q9#zv%#|VlOPx)<Ebgxjr0858JPIeNT&Nek&d7+DegIIu`(dO%2InU
ziNrb^5O(N{?+Cq1Zbt5!@q>hog}|~zXnK#@G3#hohSBsshaa|*;Qqs#{2Gj@En@|5
zDPbmJmipS9G1r$_-HpYm2(Uh<=m`MnRBHmGjJisz{L;iRWEcgViHywzvLnIz73NEz
zsO{e#Re9NFCrYup1nHmXva)D;ZK^Rm+AE|)4zVZn=G4oq=2C))tlw&7CRiN@(yiQ8
zWe)8fdu%?v52g$y`r|)$pAa&0n(_%Vo~M4|hxH$d49xA#6F3ew>3Cgd%XF5VkRHrF
zx1cj@FQ_8pST9KQojGd1C!Fj&A~88a4Xfr`b1#~?6=WOttoJsi!rfLGzsfn|a~)w<
zY>;ywm!Fk!U?g<&?!pBLSzeR|1M@DD=2H`yqsa1M$ip!b09(YIhMVjeZG$ezV@Fz<
znp{Q%De#9q&AIj~kg9l?NvxlX(PDju``u<MD<M)&Ja5xg4B2L>zIQhLl3wt)RAm5(
z{}<?5;JIh!NV;BAvC*S>tz`-RBEC)puz-}LDrPj>apC1}B;F9xNr+T!+5F|N(!~7o
zKOPa*B#gA`kf+k-RofV;Rk)}+fb~6FEzG)*-d&7h`uJ8zk47Qp*V06!T~N<k=C4K%
zT#tTNv$A2aBD1DP1^1Km(y`cwY`=Q{O-e{CjtoyhgHsoxnVd9|uKE1ey?fs2W(<F{
zj2O)GWa+UxHCXd-Tk2<Jhqh1ALR3gX@yO!c7TX`zL`%4Os$?(2)cnf9@rRYZJt+AH
z^QrPm6d*awCbUI{DWd5L(}Uii)ylA$Ic%*L&%9vay&$JU{P#iK5f$vi3FQXz>nVA1
zktc1mbz``GQFj!8>?Aq`UparlH9L^9Elthm&D5i#+!(-i(dF4U;F3Tn8J~mzX%yHk
zr;YlgX2Lr&>ITEl8G*eQ%Bw++%I;)z+=3EC4Q@W_V~GG?dko}4zSEc`Dc(1+NtO)e
zX7l{@@(}Ach4JLG0_)-~+)}uC#j6KMl}sp4x;LGlyIdAg%W=qC=_Jt=#WptkNsmAI
zl`8a}MWU3KA&mzg4AA&3_Li>XpD8gZT~diJ(e;nBVxO=!R|y`iIr8U9=N`t%C32E9
z&`YfR9$PH?mfj&JRk9srJ2ptl$0YNj9|*-qPAaD6q=s?5P{6LuqX|Q^^H?iL9UUO(
z=^--chGnq1#R<*?IA)HOCn`xC$oA^oo5qVVHm{u5m&iwnLrKrQd69)j!OTtP_&#eB
zwbdh4QjAhuDt0wc>b)vu_^PFl$*qzUe#G4ha|Np;MDt*%Wd>8EUKR}DiGwA2Ms1|D
zk^F?I?bk&Dqxd~6hbTac`NzT*)~R`XY(p7vgLFXiugr$`_tk93ywPk1d++V$G049m
zTYOOjO^w%ESA4(@`htY9>Vm&ro}HfoV7)@g4+V|j#F+Ao9-<d_c<iPP#>W5*)Gc{%
zZZA;!NynqET8AxTO;FjrlAW2O+G0z2Xbjw6j0Gx}yGY0fH2)_9qSH0E?$mfTf|6E~
zr@xdbIWu#SSs4}!f4W?_XK)y-aA&F0WDuKm03o_=y$6MXHw_@$-%HN~ON88xL)qAa
zgzuTmat4}_2RD&_X)lzV9W8y$0KpS@BR#^*@B{!AMpX3=;JG<^j}Ovi`<lBpZ*v!*
zeX#eyLU4uAA(y7_QNd)i(Wnvy$TpHKCU}u+CEk+HJ{r6Ed{(@~Hg-AU?Ye|qu{jFQ
z+h7;Pm&THn|Jn=CZ0af9Tp<x<Izu>ui*L}_u=Kg!>8=Q6vWWwagewr3LpPBe6uOj(
z``<L<4sl8ubb*4=X7zbi(tnzqJ2&5How>e^HZx>AAyu*$Y2M=)YmCXDo8w|pO1))t
zL|foGHp7~aO9UJPW*MrZ<1|>`rwO$vl?r@#QAiL0h&&12g&YpB0WE}0)LXJ?i~9aP
zA^9`*Chfb2_uNYlMf2~YkDTNk+Ij9W44!68K1aHqLl%m-@03Mr2_nKmDRaud4By{Z
zQ6X07<*hq-Y<FYM9%r;bF<j36?L_bD*)(4KrTFpst1ZXkd&j<LmqD{;e-tOrf!dH(
z?5D9qF%bF36X}KmD`xh$#|?$&&AAz(M@puLA7&6}+$a8F!sfA_+I})OI6>}6?W8it
z!%q&8HMCxNT}=cb;tnyPDYXZuap>+4(NI1d9q$qL{()PaqJ<o3iW^m$anf$gPDA=S
ztcEeX<HY}FFu9F8W<Pz@8^SyJsBRmipW}a%8htiy{uO!3YRwTg&yhF%NAqIEoGdEm
zsOWyi_L*>@-t@L|^;`*A@Xv4pxfM)f7))&i!}69d&!#|&sy5$@p2{xDE-ppl{dq`6
zF&d>P`pSYcldktfo7mJ}tuEYna=w#c02I|JNroSkscLNX>I6b^FQ<qX9KL%yPug>d
zN-(l4_R-8JLLpJOec*FkJE;>(kJnvYSeZdtRosOJx1MSD?`SN+4G4sVR1*V%R5pvp
z>$!3KzPE-4?TDg$7fcr>B4D~M6A5z3v79Il=%c|Eli-U8Ig;t=8UigkBVBwEY4}K;
zdena>NRPblND`T_Z1ZbWCrLEk)DA4oN-^4#=P2V3I<K6B@eppX2p|;mY~y=eXI1J{
zA4DVf<?UG%pA$J5j{?SADzJQ*J?p>}(>@q{nNZvoD;pFy!?63>1vyn1dX>F>wvZ9_
zwK_BKY5&F9f-veQFa9RF83O0p{;e&6b_G@46Dz!i{VNJjdx&^RPRE){N>F5d7sDka
zaJ16GATRNxCH?ZL$H&GqS7oca!-P0BJlo%e*0GzvIqZqpQ!zcfTDZA9Rjz~q<_;GA
zeq;Z9CrO05nQO#y1jo)`1g=ZcbI{!D0`Ztid_}XUyD{5VqzWhf7Jw!yLbh{=bMHJ%
z8ecxX#~Pl^?;Mfoig(zpx)E0>db#zOTZkl#Rz4K^$bZ=h_iTkNtss6{2Ie5B+-pMg
zVY{7Ec%N~{%0WN?eBu;NlQV`kKmHf<Kc{lEA+HJlmw^iMh+_6uxG}(j3-Zz*h9obo
LB2_J6`t82}#<yh&

diff --git a/doc/development/documentation/styleguide/word_list.md b/doc/development/documentation/styleguide/word_list.md
index e4841f3cf82..5d7c94a6721 100644
--- a/doc/development/documentation/styleguide/word_list.md
+++ b/doc/development/documentation/styleguide/word_list.md
@@ -61,7 +61,7 @@ Instead of:
 ## access level
 
 Access levels are different than [roles](#roles) or [permissions](#permissions).
-When you create a user, you choose an access level: **Regular**, **Auditor**, or **Admin**.
+When you create a user, you choose an access level: **Regular**, **Auditor**, or **Administrator**.
 
 Capitalize these words when you refer to the UI. Otherwise use lowercase.
 
diff --git a/doc/development/pipelines/index.md b/doc/development/pipelines/index.md
index d3ba8ea1561..bfe4f2697b4 100644
--- a/doc/development/pipelines/index.md
+++ b/doc/development/pipelines/index.md
@@ -501,14 +501,12 @@ pipeline in `ruby2-sync` branch, which updates the `ruby2` branch with latest
 is triggering a pipeline in `ruby2` 5 minutes after it, which is considered
 the maintenance schedule to run test suites and update cache.
 
-Any changes in `ruby2` are only for running the pipeline. It should
-never be merged back to `master`. Any other Ruby 2.7 changes should go into
-`master` directly, which should be compatible with Ruby 3.
+The `ruby2` branch must not have any changes. The branch is only there to set
+`RUBY_VERSION` to `2.7` in the maintenance pipeline schedule.
 
-Previously, `ruby2-sync` was using a project token stored in `RUBY2_SYNC_TOKEN`
-(now backed up in `RUBY2_SYNC_TOKEN_NOT_USED`), however due to various
-permissions issues, we ended up using an access token from `gitlab-bot` so now
-`RUBY2_SYNC_TOKEN` is actually an access token from `gitlab-bot`.
+The `gitlab` job in the `ruby2-sync` branch uses a `gitlab-org/gitlab` project
+token with `write_repository` scope and `Maintainer` role with no expiration.
+The token is stored in the `RUBY2_SYNC_TOKEN` variable in `gitlab-org/gitlab`.
 
 #### Long-term plan
 
diff --git a/doc/security/img/unlock_user_v14_7.png b/doc/security/img/unlock_user_v14_7.png
deleted file mode 100644
index 51015d932cbb69c92000659f481807c2f3291d38..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 31666
zcmV);K!(4GP)<h;3K|Lk000e1NJLTq00Za%00FcJ0{{R3mahGC00090P)t-s|NsB`
z`ugzj@c#Y&{r&y<`S}0<0QdLz_4V}c@9*2&+wt-7*x1<C*4MbWxa8#I>FMeJ{{7?Q
z<NW;m;o;%)^Yhx;+Pu8H#>U3(?(W$h0O;uG-rnB-{{Q9W<-owe#l^+l-QB^#!O_vt
z+}zy0zP`)L%l7v6?d|P>NZ8jN0G^(n=H}+x9sq)Zf`d%hJ3Bj-m6frvvHte;-5&tp
z;NZ{C&ybLiMMXtONJwI0Vx^^}e0+RfUS8+t=V@taH8nNX*4FCl>Z+=$QBhII$jJZv
z{L|CZ&CSiHr>BO7hHh?df=bx_^YMRwf9>t;wzjs3iHVGijP}mTcXr22OiVyPKu%7;
zF)=ZDd3h`>EEg9SC@3f)At8iM*@8*f>+9>1l9E|jSuZayqN1W59UWw3WdHj4|M>Tr
znVDN#TaJ#7R8&-JYim|kR<yLVuCA_{n$u=xW;i%F-{0SSI@heMteBXXbaZrmJ=ji8
zPCh<95fKsm>ga$)*9r;>{rms;+18<d;hUSA@$CB~BqaUt?(3kM{O#-a)zSLn-__OC
z`{v|!c6Q=eNci;q!otGC!^5DUpz^u0-YEe3-`nrBu7OC`c`euLoR;gDkmPD!Z!6Vs
zaB$;aQ0%Cr_VE4d;`!y<_T_P8`u6_$+}Nmu<iy0p*vRwflZ{wdSbH|uv$M19rk{R7
z*Ym)-@2sXmLPDK%;Eh+^<#%k|H6Mvn+jcD1_R-DpySL?fa^qxJvzX?DMcU_yg5Xa+
z#jotIj^^codUJDg+%6fGXx^}}u<x*{xSQ&cWZd+{zv9;R!l~@NqUw4v*z?K9=YV$T
zhJ4w~^4&NnhfLh_#>3t~FmZ8l-bFa>=lba0_}<X<fk4`Fa&nMe-uBAH-!cK|>gD21
zHQ+-i)57uH+2op<(&vqc>X3)`-rW26{@_tX^25Nuui@Z1568LTxuxOL%j4M8;(j{W
z&A9L4aBAEs53Q2n;NRh9D%8!w;#yk4jg8L)BDw-1xl|7`!~g(za7jc#RCwC#!GQn(
z004lX{izqJ0ssI200000000000001(y*Wk!AOvCnC}jWt<|_`g&_b}VaHiZP2><{9
z0001Yqz$R*TUm$B2hXLFzcKw%`{@P``Pea=)+VAT3_ruUbEa)HDJI$x#qY+zNSFq+
zwn;jvRcsnalR``DN?R>hO_VBCYIa>p7rO7d;LhJ5_!nIDzxYu*Ni>2W2-SIDW^wL0
zb7yfM-eKgB9(^$Y=J36EM8w}m>~<WIIc?L8GZ~`?w)~-=V1z$Hz!}Vd2<gHl1c2k$
zP6)qA(hw2xUm)1I(aeGAhL8STq-)*PjUH3!nMs7-poh-8o&!KRm*n>mLpOr6QC(QB
zr@?9H76!y{TQ>~?h#d3@y)axWcy?z)&moDv6(art42heiGzJhb#8+pLwkRUp$e%|L
z={oafW^p9+4LS#Yc0=eU-|RzxO4e=<ad34%F(h1W7mim|i}R{An63|e?>?#(6ZW?s
z_A`c>K6a3>q1TW|<a)%vfDm79+_Mk_EJM6F3qbPVCOs0>a3a_X1`pQkZ?k~(O5XGY
zKU6jv`=VDL*<HJ|^WB!8cBjvEkS<Zv+Pu|&cSFbe4=lYg%YX(3%Yn=U2!feN*a()B
z1dMG<I6tI;gJ37FSP0<|fR&gq2*B}#9sL1_IQ&?j9>zCsAj0{2B}nIrgG^`B^`L$%
zkqrvB;MC4h?iSLy)g7-tjNDwsZ4O~DWiS0{ub+XrpzyH|!?DrI&b<Ue$lL57LMKz}
z`=S@-Y|Ods^`#*Lyjg0@xIk?#U2UY;-LFe1dTc3g(-rYGEdZCN@`HFf1cOVP3v<J|
zE>`{K)IEQG`xJ)Bz%MQD!i)DWFg$rxw>m^$cVKwUUnsiZjQUST{IR7|2p5WresBas
zqVT@;*mEM&BMvvh(bDVwg&Kw{jpe6LgYhqRxTPTf<lW0XZ+K@c#nr`YB*w?HXY>9@
zn68ZxX6iO1AI=9}+&;6m8uwmpIUJi0Y8%Z;1|jVALeqPQe!=(LtyT@*+^NTB7B9g4
z&9#wQ%q@AY*Q#|!dZN%}y1~`=`2hzYIjT8gd)jL1N^4cDKwFE=md;oV_!?}h-r}6z
zjA2(bj&z8AnPJsn^=m`lOI81-YF2Pnw*y@~&B>w`JYQcB5pk$7l$U4CT-6ft*C*k`
z+85E&58@E_r{MJUVNzokITKW47;pR}0tiR^Y2tngNqU>tz&xtNV7GLef&3}BwQ>YQ
zhv{<@$S*{H)aZkuVKQs?0dL%)yy*g?`*lNzkjj=Xcbb2^pjxVoUNj^}G{>|)OIxYp
z*F@je4};0F`Wfn423L28U00XqD=R5XTl7`?@?$OAeVzu6Q_$@j)_omwSknuzp%0nV
zW{SktR21o-**CwRq{1+ce-F>g0|o)(V90D`J9%J(Ib}0`2cZn9O~nmonj4t1S(*)-
zIc)2qb=AD_zUwyUjekR1|3X*&FP#G=NBh05sQ1GK@B57JGr0JiXTW<TeGMVfoC5T5
zH$-(o1tHq<p|ltP-t1lhT<tglNe!_r4;1LBz!%Y9<?V1jiUZ<#Rsq7T>ZLcA-lawX
z3|w)0jD+<IeI%PXFM7TwdS-F&jtzj8ice}+PimKtS#v<3(ydz&(9$!O#su4ZmJOnc
znBWt9-~@mj&XcmwalrlXrOm$0A9Q_wB^5xFD;VOc009t!1U#G;?xhDIAh5FQ7g<y9
z$(IKq-}vfiX(nUHe~o!;#H~Ui>1zbE<bESDn|g{!YYIYOC+EXZ?HW)v<VR@wq$_&6
z)DxXB_c2{fJYL&(Kup{<P0lsb&1P$@0_S=<*KArvC)l4ZL@rG9!86fq(cEc%y@>0z
zR=Sza=Ss+=!yvdib!(1LY*ZAS$63_wzveO;yo1Ml1O-}GbPwQ7@t}A7AsZ~c(4g}@
zTf(RdbWsuH97>!U0B#?%o3cCvxK<0UnU@7NSU&Y3SYzg<CI`BtzY!B_N6}YDAGZf-
zc0!OqrD=-p{UZ8+MRfJ6=mI0D$48q-iS{ihhUf%mZnGGR73+hT-`#W1X{Q=Q&-1<6
z$b}!#+LI6huI)_)KuFJ|7BDkDYV+PMMjTzyyY*T^vBc&Uj)b+5>ehz=L{dD01fO7!
z8z6YjME9rI7S3~NcrxG}cEFkE^6|sD?m)k(`+yy8(dFfb1Au?E5D;0T4+d7pL$UGI
zE8fY#HJ<_~Gbh`8>XN2Q`WQmw$vO;52e%NN4gk0F`@`Q6{kBDPg3@^F0%3S<9co8(
zW%j-U2#@;Jg+l=Zm&*{n`E7VE&L33S*dqX=4}x%v+yU@7rwrHP0DPmaj_9xtne{|2
z-1~>ybvHv0u#n){K|$q3){SKxIxlJ{=B=X7;Vw@Bp~{{Mi1NLSv9oB^?x=DDt}Tv}
zTH%({KHC-jppGqm2Lz5h;?hJA&<iVdDY~SO5%4VEgdn)q8o2W0P}j55hqp15G(|6%
zq8s{68v4XiL#F79UD0EU6$lWbPwGgF0R$~MRxXdNx)Co--Hhif6CD`xo!67#+&qYu
z-Idx{2%<VZ`t05GD}kw{ihE>j+lh>6H!T?Tk?BogNnKYiTrh4jPgiG``28R?I1XE$
zm-2-bPLuMfBl;=NL3_=g8Y!L?z)fCa9n`(n@PqX6s<Fim^Wi<_>u`1_`ios3g3MzJ
z4|p9{nD0-0;;dbYF6mzgY9i}`Ac#u72tD6Ei0^ItP&$qQcWS2SkLKZ@){Nn;o1$;|
zJED(nT?IivPioj)00_|c+o{7c;Cg<%co=+CzMv#7n4U=|PjeF?2-Kf%wWp&lKzZ7#
zwG+d@R6Y#C+?P6?PoC#aZkf4|2tj?t^T4(I(#!jvjeDeIIS6>SmP5d;Co5ctIw7EJ
zuhfbVojxMI#2dR$&CSl@#zry-gzs_*u#LCtfG7EalW_%fE4RVR)sXaD($@&PYFRjZ
zPLQ394Ve`IW2bf&WNtbu6GcG>Qq;4xunh=+fWe3gyZGr@cLJ2a4F{p~2-h85g_Vet
z0H_MVQtu(~4Qk}pB_}{o>?#Oqu`Xa&U~bP&!P#T}aHml{&C%W=+X3xzCkZ(H-mqCy
zx}Vri1UURLJ3xRM@`mNfILW^R{dI%i?LoaKvL-Eg>-N`uy3mhbBjDI;@v;|mF-i1o
zlzQ)~4{zR;NPYp)-(-Kg$FJ@f`-4Vg@T-hjBn-9-@5>--@|)%NI+47kMIz}RM9izm
z(JYbt2T0E)l7Af`q~{WeL?V$$Boc{4BKgc790&ja0002_zczxZs;a80s;a80s;a80
zstS8|Yy$uU1OV_u6o>)rzo=5H^vT^K2LODf##{qPX}u@EZI=!tRCWu1s{%;{00000
z000000Eb;WSZN*z;sE|{XM*8V%oo~^d?FZV-QdBi9t$2s@!~6Z@+~}gQ}E)!XYgHe
z_kBzqIvb*tipEuUevqU)JDp}rhP}iXV?KsRFfr3IlEFl*L!D5}Iz|_@uvTb?m?h@1
zmesM>y%p|Ev?nFO4_M1CA$hNHXT9Cu=l0oNdNtpGJ%n$tf7$#xYk$Xmn5F1i-ycUQ
z+Z$P@o3Lnh?<SLSGC#_4qE}Te&SeuW8xqn)&5?<DNXoh00osxc_fkMprKHx9Z%a($
zlGh6Q35jbVDJnF#l#g1`uR!iz%K9ZP3NJ!_iCRyNIi2^FTA31)qOKakn2@sKC`BKV
zadAZOMpL&lK$K`$l|$RpO+cypgT7pBZi93*F4hq(s;Uu;350O)n1Ij+0!~h$=y)UE
zJ&iGRTk$U6ghrSig3u2_=Ae?|Jmx2z+)m8PH(?PDr#&|MtbiJ9#=WJvEb8T(pa|2i
zYV?scdd$l=?`Avtk7SK*!dSi0iOCv0WTR69f<Oc>_}jI4p1&ixu|kSeHN7`FDH+<1
z9<<S!<$?xbFh6|;W+r@8E@x)O=dmUiJvTbN%E|7xK-TDi8l8b8P1j^Mhr2wx0OJMW
zU-kbq3HSznj@$a_X659&y1riC#!bEY3O9BAVD0|Q-nqp@afNaGKc2JSE-Ws>E-a4L
zOOa(GELo8IMV9+5qCg;Ab`ul<kxPvjF@hlt5pUS2rA^e-KA5Jlv8g5{scq6GEvbnw
zwIQ{AX=>_2+tl>Y=bkgOFk7&;wou!;f7zYyob$~$v$((c&N*{og+XUv)_GaDEN2}I
z)PO(ftHS<;ptHwTvc<)x5PL=$J@%#go}zCrBr<SVTaHr(I5csT5VfrNYjMrzobr06
zzsdROO!eMLOuc&R;U9C!aYI!<1%Fb!-Ve8`ugj<pPKHTeQP3GId-s&<8aP@7&iKyy
z+@xT~kq5<AJfkzt=8b<(KY%?8&~1L|?jAc%)Mx>c2Z)>o=uuw(K<QuWZMg$Po524b
z=aqL=&mG|5)~(Z(e**N|9`%Pm0R2-n^Ht!ss$L3%zQUkiZ#j|{R6{JVzA(a_#6!R5
zp{Ctp0?cce2IMk=&g9E5o?ddtmTHY9Bp5@o+;KykvnL&NwwuBJY0w$ordA*24p4V4
zHQIra-3Q`iAkM+;i1Kxpmx2p{%SvX9>KSLoK-@44(Dx4qT+kdL-xj=>7Tx&dOA7{<
z->I{&Yy-Yf?_H@3spl~Oi&-e?@paHYhP1f!&|5SsSl~>6?h&9L`$Ww=6()UULC<N9
zgrP%q<p(YEO{)?rq+I8NeLjxWl){isHXX=i1D#=Kk^@W{otp8K;z*>LrIoAch#=kI
zypR&X|1f7W`C>?*#(zAcGnj_j+Xt#kJF^<bj#3o3UOOMEWLSW{^x*irvn`>Z5BN!f
z&L2OFSsI8hjS_P;Q+*wk_(JerY1ID4Sm50NJt+PdHyw12k3H%MaD=sjp!c^d5Xq4>
zm_L+Z2GdJb6qHR%1&reiO>pFhG7=lBz?KVijtVLOm&PXD0Ar6krSw=+?pQVLokvu!
z(ucHXt<uzAu(VM&xZ#tuTZ7T4nE%+dlCT8oXG=G~(x7iR?xk#LCJzzSfK|CFcFI8O
zHWhrHZC~FNC|`pJSM?d@$QU`0Xp&7@<HYqUGhoTic5T-JMY&vAU`s(~uqGbpD>xS|
z>v&bQE6#Fm;=<dd(0@aTpZC=ybOKso^|^_R#0?=pADerW`SN1WW3cVi>z6Lx`YA@3
z;%Bny#-$Svr$RIOsivkcIB@cdH!t02+5slrb~N31_p4(Fg8rSVUI~xVR~Yo0oxv)O
zLxVj7FJYk=Pi<O8-?RoyudAX72J?CjT&Iku>$)3VWwvMuaAZ@44!TPkA>f6c@>@cj
z;ZRKliyGydV^v6&Vz4@lP@>#O#xKLz1c!~ZIf_FTuq7MD;^{rZSQgON`@IweX18N|
zNl7Yr9?{#d<6J8VrP-Rt%h#crC@;ZJ9ik!v9B}$bs%-<-HWTH5bFAwk`FmUfx*a7&
zBo!#*fYMH6You|a(QGh|tU8j)eH&nK=!JHh@t^dnNBwAW5$G{^?W#u=%Dl7<F){ey
z6;*2bJp=StRdwr|K+`8$%axa<+tg)M)c$hkV;%I#%sKVta7tg{jJ^{(8G`eC$vLn9
zdisJJ5E1FdY6-ex;!Me)3~qWF(DiLBeM!lTd>{zAZrD>d*n{AeMy}O3HJhQV--)2?
z+hdhrME91pNR*(PEWny*xps6amtjqcUg^#<Lr77$^tWVLWuqmBs=1=IZ+A%d2!S?&
zpqs!IMce$E$ejQ);w%y~-j@S(ON+0&IC5bte9%iSAd&nxH3VBa1n5<io7YO+)RjjC
z+V1)~jyIE+irgrp);bF~vW1KFF&Q0E<Ktdxr+`<i3Z<y^W}X(8gg3V5(l8zEINnYP
zKy)s(d)u1*K1vD#$Z=7X;Bo_WZ6f}GdQZ*F6mMTvGMw_LbL#y}&zyP-I_S8QdC&7Y
z(Bx4cWqzMIt4^N=c3e^Kc~sBV``<j$K;L#{TD^f65Y~!=Zshai?aBh^Ib0KCF!gzf
z(l=5cM;STR1^m8N>IeJNpfm6d(fXjE)M15`)#1kDL04?KM0vY7IAXsIP*<%Lu<ZY=
zBA5DtD~Q}iEf<o(ki2`CsLx4zfr+u|HVV|GMh=jFPYK`<?tCOSsgTC<Y+y(k+YGEr
z^HX=*79^0b)kij@=i0udatl@$`>Crw8tZ+>eZy3PNb#~G>Y&*CSphAZXi2K4aV?G^
zYbTgK$KYO`S$AGbx!u%ucw;OB<KPF|sRHIV$UDBb#C3#*0|N9!8V$50ZE@}Kx0ZJz
zx@(vkBBM98N_OMBd}CGM*h?J^0G5Dmd4qf{8xNf+q!x;YG87o5zNo0(qLc)CKlySi
zVj~O31AE-KPQ&>Q>$)7Gvm8uAI!2`5cNc*!E9Wv_ee2~P)Nj;>*l}5%eem9EZ{1ZN
ziLUq!33`)A)^BQPdp<gK`hzQ(>X*HEU3kCWbn2q|Xhs9Q@{+3lh_L<v(0MSQGwkxk
zf(Jq0z2H_rEq&>fJ0?KCKwB(_&r)Gc!c%|_rEH))N7kJ$I@-1#98qsHAFOyR=&;d{
z?ek_j4D1{b+bO1c6XKeW2a0kM^evT9OUi+K0XOFpl$Wxb@`R0k^7fRyK}C5*WrbAk
z#(LS0?I-{KvfV`0Ksv=EZjkz4%ptO-?(G@tuZa>X`9>SdSUgd~^)xEtt1=3ywxAkO
zlmcY6i_MFOrQkW#zNajGoLt}rmT5hk!R2S^sprcx>%M&twR*>iTIya@z$EAisL~TK
z-1z~&26_u^1jN$Y5sNbF{)_`~QERyw#qG2UFc0`B8+<Y76{w<7N|KSvTWLgq-cD%>
zU?~nz8Dfun$D#n3_xs3&!*sk}7F-oo%KTXTec8{BF+i7<Ck4kh0BpPLQ9s4YB746F
z;N*kp%u^EdYg5yY)Dw6CAE<K=P69YRJ(GDlMnn>W0N|oJCqptpzURa65PjuAH~Q@y
z1>;+Sphr<rid2CcXK26yWaUwcOczm-McY%1(IvsTgLTa*z=r+#b$i;(Fc%Kh<?q=5
zz8LhwQ0mD6I12Z|-arR9%sKQDta~WM#Dmc;v}FOQxkXm7Vo@p(sgbao3N5gnr8F}v
zg@WwOv>QB~8Z3ZKV9Q1*3fYtn@Lg?*VChr>`F_MLC)tZP0ZN1LK$3RCIZ~`)86+En
zX|IekLbZCFP=GRy4$5CvNl$ae@?>;|wTGK&d@SJWphhz!=$mj}q}mAB6*#F?1AW+Q
zfgM)Am$J}L9rf|q*(J8tuHh`$C~!6z>pT1dosR=OiG0lpxE&eP)dTyGj}o9L*iCdn
z9yhvNRoRJ&b?tOmc;+3iJr|{f&c%tOd}lG}cRVxGQ>d)OtLp48JHFUD^Gzi<$JD7)
zlejH#zN~sKiW<DDK6<6;1M%;{ochz`{TcODv694IKXyD+A6*WEzVe{6g?TuRva!wc
zpmzjF(`Ia>UEmxU3!v|k6;A`YZJ@3=zZQrpuRB<mZ^f#fx}G<hBbR_Kje5Fnft0ml
zKZHst2iBuEcP<(jr*$9FXU-UEs78XG4ZAQCp@{l(LD040ArS%T8t7j~X{*bYDsTb%
zCNMps<k$%~#j1)1dNh5_!Lg<#ZynM_a0L!(TyO@Hq}N5_%)#;+QM(+Vg9CAgG8*%#
ztA(6F(4B%xru~*W^o-uR#{`B|EyEPe+GzNAM|XF3hp)A}8qpozjy0$mH;zY)F{A5V
zL;kahesZI054R6>Q6f0U2+>~HXt-Sl8f*8`2&`{V7t!d!zC*?ptq&e~nihlpx|pCl
zDW}(d5?%OXA~9d>#k_8dd@V-nAAlp~M|H-NDK$H{wdq)<pk1sayZSolUx|?6xww@F
z9lTBEb7`PvA*07r!&<j{t$VGV^-(pr!0@kw?iwu~%q;_=hl=XTYfVUQE3YfcFI@or
za|3i#5S7<D-NJc%bg;O1FrRv0$=z=Nrc|e&9W3&BMM9Iba-63E3393idI=P4r1LuH
zITSA{9aL)<?U69|6Mfxx#$<pl+9eBF1@(3Ld1RBIpAUk5hH``lOlh<kITQsuV#m@H
zFockv*Jk^=S#rLtx2YyOeZG!bFs<wEr1n7#^hE!09rXPYbgKki`Bw1h^?FB#sVk5T
zrI9EJg%k)KVHlwAr9izM+R4NAA%*`2^p`{+->8U0-890nwxFEGNGJg;2>SP`=etFq
z%kKHr9g^A80`#fds``Gf-T*E@pLwLtdOnc{f-lwC>HGKZ|8n0mo%z+20DTHEax`Fo
zekGjIR~&Q>B|lf=d=cpB&}Hw}zY*Cq@z+3?-R0te0t*;iN6H%|-&wT-X9Z&jf?lSB
zUZI^9imJ&c^1HBk%v+x(m7;`z4*OoB{KAIvRtM5(HMm%9G3ZHjZXWb4I_O*j9hUR`
z?L=u-1N2A<x{Ij%Y(pK{LNmJT=QDse2+;KdM)Y`^9SotQm+z7JoG;I;dqk{bEjZ(l
zo$LLa^~j9=BKgYAV0N6Ru0^0b&_LrUmQJ_Z9T69&a3m4sZ18prndd|9Ox<7sM`^hP
z-6mG$U|e<*ieP^y6m%E)hBicqKx?gW$q=$`zMj_V>u%l|oQ#_k>GzfadW;aqd!E@}
zj>#Bz)S3H}54X;KB3n?oZ(pSZeeTPdS@p{p$Qk>)$4&}O?wE|3nx0Yb$d!&gnAJhQ
zrA}WBgZ@v9(cPsS42wa};kw|YjZo}xK7B?v6w#?~BCgb=EzPBIAy>B5E07yH931;w
zQ&VWaeH9hi6-D6yEO|lDwefR)R<e?OHjpKFsDRy$m#F4<L5~atT}ZKJ57GhH4bV9(
zJ+vt~S!~@In$aCp56-b_f0qNh9|yWLukR^iU|0^&IZ}uQO^_;}u7eur32>2jd=miH
zK<$e_&ys62Kx$2FDwor2bfk>v!u;-;KO?FEaHiYm&lZtJ1DgRTg=5`mP(nbzfGsrY
zUjw1ISce6r(XkwWtJ^zX0<M9+??csddmeNI^;+hf=PLm6;<n3`r^H#amjU$tc=eT^
zWVZhlH`IIT>%c?(>RI6A>C=@vK2klBesP!xPR8936$oqPLDy~kUPgyYPJF|BHe@oc
z<}Y09&Vnx<veXvao5#;dE3%xb;dZ{Q0G82#2&HH|5r8`*0dXOqyR<KIR7cBZoTCQ2
z@U5eQKLdI^wqzUvP$4K*M#u#OL67hi$xR;AGrA2-1KpkHF9Gl(wJAu~K_B}q=)&fk
z`SP7dcTvk&qgyeVY=KdlfIjQKcK>nzO_wR+0(k>VK(D4zx^7Ywo4+;J0)|E!9rel2
z6pUCyqq!w~Z9R20m!h-0y}M_fVy>ZFN-#k0lNsGQ*wKB~t=O~jz2xF;xh;Jrjx+7U
zfp~B|)HQkU374SHd@^-xYD&Cz^j=XP-TSGx_m<%KHjaIg>A5mhx$lOm-k;J=ugSy1
zT;?fEP0y*9w)IvvJ-DCw7ETE76O;SC`z3gKZQorPIxMXGm2r$SECu}yn^cAamNu$Q
zNH{_P0eS(&OY-w=4zQ;IoiVm}X{>vgS}#;r9T<{h>9}S}iOfo&S|FQR4kT{up)$mk
z=P!UBeLVN`)wX7T^C3BD)R?fTj=Bqg5e@XR;28aF0eU)ky4H1%4K&Ea6_4}OoD}Uk
zNZAmMg>UbK4!Wt0MiO10b@-h?5)Im71?YPv;zKW0mvzw@@DYlXp!>!Cv8BhZ<pCYA
zAEA~GU-6NnW8OeVG<fkaxqz2QTt|~PN?k2oL+j)@vV0Bnyqn|zYZUkw)ed&IQVqc5
zoP6t8T^!g#@5kr!4~!naNqyjOlDD<>;L(nobi@p$$g6`s(M<)AeRu!O!g{Zt_OC?^
z`ML*FM#Qn?tZ6<4yeqojF_55tGdCl3PrZmHb#`X@%FklbO^n5HOP!mYzWj;j8}$VA
zyVo%FV0QM(q{!LA<L=ez*{xsh!|6<s%4fb&J+t>T(04qTQ6E0n&o96~kkMEDwxVo&
ze%AerajiSn<csCez0}XqCrHAoBP9E^%XU9HFBm7O1}ius4@$Fe9T?7$)M1V|YBeU~
zoFtS}OoxCC?+A0x1?mH8DH?X91ZUlyh@@KZG;I<si;i$K2-B27QW=b4{eW0Pwu{2%
zJR&OIO}l{3BSaH8BaadSF`<qM;n6^=wVuJZi$Dk1a^Ahx`594n$9Ol9*9Guq?dDQ@
zA4%n<2gsj_YSAX)iy)#bz>-F~`Z$=tf56{Dhrt&jel7wA{9{xc0R|i<U3G3i@sU2q
z+AlvahjW}X?T-e`6Qrwc{s#CMe2}SrKZQy>+^Pn(Re*deQ@3AvO}NCo>CsC+?f~B1
zy7fch-X#3quk5`j{l%K^Ps(G3zS5<u@_uxVDbHNy>F_16D+_vaH55a3^N3&X_c2)F
zBc--PMS#Pa=&W94UcF8*Ut*DsQPmEx<pP}nu}LW@FU2e1GFio+tJrMT0&H+Ov!emn
zx2%VuXjf9CDK$#Etj%_2TP-DPglmZ`%iZHxdnQ8c;s&q{QF3q1@zD&a!UUodld84@
za?O(JPDIN}S*S`%jI)-=y^f1=rNUAok27$%oYm4Bslhn0Y$fkUXHc9Cdvb4<w-v0B
z#j?JfNO17C8{6tf9Gw#*d#!NfOcW?!u%t}v?gWSZTz}hOT3;f-z!~c!Z+m<wG}&qS
zEqQfi!AoLG`sxQi>$jO@)Pla<S>OyC({mEQfz2uPb!T&SS-=?JnrN&`>vNinP`y9T
zdYVv)pME%TQP;JH0A4$B_wv<`Z%<0jfm4@0y!`3K_bS2BbnV(LS#|5$iEH90&~)v?
z%O765Q>ppAb?L+Re|WF**0oEgwE21U?!NF%Eh`Fo#%RwQA^N&*;A<VxP)DX0mX?<-
zqchEU@zCA42jvNOU@mQ9U<;P9w;^U|n=T&eVK^8ujm1iW4hG1Hu<d5uH1;UjwB!RD
zjh0o)e2aUaz5B=_A9rlD#kjf8WVIkPI+(Fk^tPb0)%4r#T~gI+lG0GgV(;V*X~>s&
z+c((@NSc@2#JX*AThNkj(uVH&zN)?+PUtHOy6Jjdeou%FHl|9KB~O@PT>KM1nx!|g
zWdt2CLTk%;lXJ$oZorVNWs7%A_h9q2&{ou)4ATe*86a3`gqg3`O>nlbd8RK`7Ifn%
z7u;NM$>fV^Mfr}!jY0pYU3DETQ~|ampx(ap!4ttHUuX-~f$N1(qNnc9-j^rExh~^@
z5{sTF0nT+(U+RuaA3VWgWRtL7o>o7Z3@7xJ1YOGfTiL@;fqmAGdkzBl=O1{-=3Db=
zY)l)hFAm5SIX^kj<G0C-XFfgQA<#zY$$s;840^?!`&VJkR~U4L#o}Sm|FeI<p{;vp
z(1sP-bPTrLz4FoN<wa7C*MGk9V{aIAL*c*F^54-j0^Jdns;m&_`b9H4cJyMo)w^Rd
z%sIlK|0ng=K!4^BuYIx%8vjF)pGSp3f0F(WpmWYvYO}^D`#%!(Iac_usXj^n2hhU`
zE1c1vs4(bZ{cpsOn7x9aM{hJrCTHjK{7vUc8=mKnAJ(%KgX6pj3@af9c@!~<t`e~4
z^{dX|PKpSF9@eu{^2XIzDQ&lvf*I-E=Eid?dqs8lg3hp>ofy_R6RjM}FP6N;8Ho__
zGtMmY^O@9sW#?{k(*^=4j?eVH(HKmds4gW{BAEtUcfqzSD^aO(kC8+47Hq;Pdd(K8
z;wwRrc&tn`?<XX{z+f!?GRBsRuRmA0R_OAg?yjm)7pnUYG`sAytVT(ys`*fz%L}ug
zX4k=8&hET9RR5S=UMJ{#PIWHN@*0kt(sx_SLL!2Wm_taG5s4i@X-TO|<N#{NP+OoD
zqC^d(fzPBBXFzJDF0lehGhCMMq?PfFRp}Bhl6Z5!y2z!CUVk)qROu2akgQj~tdW-T
zYRN*SOPol{Z&jA?Zn03zMb%@Wf8-=aScm?l(ZL=8*y=s3R_PKWvaq}wDD)7@-&E)l
zBanr&3O$VSrf}MuE)fE0om1#xlvC@hLYMd`bcHTSfPT6MQ+~FNfO#5Pk*+yk53{jC
z590P?metPLHJbCl^qRq2kxnfZO*5H~`U*XS@pv+6mWzMOb<muDp2)&GFVd|#%kun>
z*62ap4u*MF*WP>Q3nLN{ZKH?WMlT#qc)<Fyf%WAC>|DW|wjC6QQy&h6|JU2w*qe;a
zO&ref!5~`z3{KA#3?4q=_zRB1<CCyI(q^WB-N%8)KLxNI2WPxJj?WB^-92|Yuy>z@
z^<LZPVU&I6Evd83NOVZ+ok9<zoI0=FYZ4=cuFxd`3SFT~0u;JJmjozug)RwD=n7pD
zpwJb%BtW4nbV<Np_U`YcsW6V?_~-OI=W~|FrgW?=3j1MOgGFou-4C_RG|~xXLSt?Y
zG&Ruj2N@bE>_WVXpuF!o2yglug8qg6o%U?gTs3M@wA%BgbjO|Nt2Zys!|*r_T|?Kk
zKz|Opkh0EiTK>0hW~ia-nzbY7^_U7Neyc`lpf<D7!6uqD4PDo))q(ySuDV@bzkzSE
zqAQnc?i}zx-jodu?qBX})@!<ku4~r54_(54W6p*Uu!hr{1{zOdpR^&q=HEkxA-^0O
z<7CaP+m30}EUI}10v+VIhOX279_X9oT?O5hWYPqL6zc!cEqb#2NL6!-UiDB^Cfv6V
zPZ3AYx&~HzAcYF*AAH+O#+Ug5!!wClh%d8cb)m#=J}Chw9QRe{;qV6%5@?1y#x!(Y
zvsMrK8bg6H^Z^c-kUxGYO&qQ~Y?$wD)TRa+Hbl*$6UUGWV1f5%zkgqKl<$Db0vs)9
zs@Lc=bX~Jn4|;^D3iN4Cn}G2mG8bu=>MNE%7+!x00r_gJ{iHA2QC-_{F&OlAmJiy7
zgC1*LLGN9=a`JNjZVyCXFgR)e*F2sJu-yl<0e3jk4T&MQ*8q&6()?2f&iJPDv0>ji
zT#5|2eBrY|mv48$8vsst#(CfEvBYcl5G2f={&0Vv35njwE7#TjrMIrXFI_{|HETZy
z-M&H9t_4^VRJ{VMI9HZQKO`XF%du3h2NFJ(N~ZH68|%!ZS<1c7QgaRh<R&hY(KyL$
zJFvvK3wD~Su+zz%RF3RHjLB!@N4WDW6@P(tE~;nF%M7Eyi2<sn1Hb{_-(#tXzb{=w
z*EMTD1Kq+VV+*hEksdfv=Ay&n%A%FX?d8)0S0NyAmQ41~#recW`(k!JJ(VqHOVHQ2
zUAPwwWedEqHIiZ%0vkL)FXK!Gr?X5uSl~k!)*0J>J4Je|V6qU3?w`kCwosgy7#bqS
z$L2EpfZ5$d{(W%Y<s`TSImMZ03j_0NfSYmNTY3<p7mX6r&~>d+edyU^SM&iU0eRcq
zgFY4y0P_RiNOQ25@gJW5^uS{SlT5Xtp9K%#pU-XEI3S0CeHO#OMecYIm}dmN-1}t1
zHO|3X2r}Wq4L$^f-+f1*pCbXl8C=Zz06dNOT)+aKcL8B8126`;g|1?L!hn-56nn5n
zegs|=IEIGP&~+_RJ?ICASM-<aiXLWW!q+LFDDPdl<8MzhW|hd@IC?1_koM^d>*QIa
z`NV?6BgWJfJ=+HO^TpdhSB#rg=tcTqV3YBV3iKs4|GWgGLVXi(5}W{(8OJ`|wou;W
zN4YFT1-g5OUKnU2eOTk-dBA?iu!KNEY3RCEsV?-IEBf^WOAWf!CO*STffBhTNK|rs
z%Ph6c3$9g04M_C!y@DR^1xE7)KhSZXACI8lhJ#7ouR_21kfoL<O(^K+%h2Z_1x)uU
zOQmvWE6`DaKE_ZRBsyjoQBxH3Pa3*T_Y2VT-H;N2cN{PQ(?6BmBO_Sn{McF~vhH?U
zrXnY*=f7n!5&ak@FPllG4H(#G><jcoKX5wE^&{wB1^wuX4r6pGIYWL_&__DU(4z{v
zkNL#b=G0EM0$o(04|Dzn99-X_TYZa8z#iAob-IS3dzc?aDL=UjdG4G8j4tOB@Uhqn
z!0ZgbN^q&NPQaOB;tX(!Y{ynvp81BETIe0eq2I27UY_4Kn16T;`;2!VLWlK|&s@L(
zQ)TF@Misih$O8bc$V-RN-)QJMU4zgCx;JvU^;!GM^9_!|HSj!r5`iaN5#8Ix@osr@
zBJ{~Hk3l!4IMOTHM^YTZ8gtW6yB{$X`g-fGpl22IotmxtHDloUjdM7+!W9c+JB2Zq
ztZdz3J!7H+cVfBuv%nnZ-Pc4J`iV^8{-|*$wioMGQ#5p)?iX)rndBl<8!T{30{vv>
z%{J);yku^5o_q`I_}2X*3)$z~NwFPgUUH|9=li{sjR-SO0Y8gs>mF0k_ZY!bHOavm
zV+#793uEN=n+$mg=;KU&ZwSkkt@|Vkxe;b(3hjW0Gfd6OciaMAv6v6#7wHBj8Pi*L
zovv}{l`aiti=2r^Ob9sck&T_u!#+UZ?c-D-mFxqo6$X#inVYc`!=7BO4Y>7kV`F}D
zY-YrUJHOfm^lXGif$n#UYd9BMoJ4PmemHP*`8pQ3;wsI5T$-O41t1Sr--k{i$t?xl
z+|O*}!=6IC4Z;{3$;4*m69xfz6RDZhgV&Jo@WCy>p60HGuG2LLT>$1~uXpGgAk={o
zxNOU+>F%p1B_Lp!&hgVb0)S~MZ8Fg1f;0`GK1e{SFGHyFg=sp~<H{M1X?!)`a9xuy
zOrtW^>No+YDdlIZ%6C-@I?rA=0a2L(p%yfnhOTRs>OqGP$36@3?fdN2Ccb_w&_K2G
z>yNEn&>Xj{Y3RCtpnA|%Ldq|aMD4@+S{nygJG7Q`{aH=;R)!k7u36K698yEqwLluW
zhOTRYG;|GJ*8*wi8oI6p($F<@T??e4Yv{TbNJH1qbuEyFuA%E%APrqZ*R?<z`e*je
zt);OmisS#|-udU4lP19vjbgEJGRA-sl0b~nsPTrEK-7TZ6}*Gv6%|KRm<RD`5bC`5
zc|iKo&oD4wVV?S3+I^zYT5ZzSwzkb5M^|>XYpuP`{LbFzVon+Kvi=7ugI)%`tp9<^
zpqD`}>wlm!=w;9!Jk0(db1tQL-mv0<{Zv@s?;f)1P<-5F&|j#Y6Lg`z{*;6eCC5^d
z0)L6bGxQa|J2!c6NJ3cO3g(UR+!CVXZVyfIhc|H<^wRWVLI3+C1hCjxuPpop63{;m
z$x=EFyL5=>+qu*q>V^Gf=xgJt;b|Y+B%WLPRp7UsO5at%e!pA!cy8qx{e|k;Ko@A9
zNcFsi_%l9qLl>nn5g46h`f{}z0?#jrIKS8+igv3f1CWouS*?rTS3kLTe8BZhx8?BF
z%p{jb-$Nj@zX}0m%xu{5mcbqEdG=?C(K?8{-M}90i6Kj)83GQn6;jtFV2|)K<R1#@
z>iP<z40;KAv7kFS$HdJG<xq+TrW6Ge;^C30gg|qO;o^KLeNT35<mS2GstA!n-iDIm
z)?wiZ_CnrocyJUfWj?cfKg*Vos7jCK6Dc^zza<L(RU>Tuqal?*Ap!~y&3C6~>=1c(
zvXt`KCdkp~0NWjq7$H*|>zo?|x;bO{K`VRgH=sw3wcBIneC&H;mie}lVpa^ycEjo{
z(VY%!)&TAg)+!O)T!Mt2IJcpqYdHiVcC&E^Jg965AthQEgt+ky>+3<0?^2MOt=V1%
z{l$U)mg(7n>RXCU0Mat0iTuxk`9Ou<_7uZfDWL*fXljP6Yhg<M`nmMt-it?0Ajk*(
zA3NmsE<Clzc^C-to}+>(;F&!Z$|&)8R^VG^s!XBxGb=H~_V*g>KA!5RXE<NI`q|4{
z&}TCm<V~Q50q)w0$29gQJ-7W^7g8D?a|iS>aog6swN-sL{D+k-0rU|L7u?HRM^6@6
zLv0!K7X`Y2(Z%p7zlDT=47P+@{1p%a%~#RUk)U0fAzxy&C1`_?{#CyOLZ3V1u*Eui
z7e7z53<)?^m(RLJTqVrumvlkN>|q;hwa)6`hd59XJnA2;gG9CewTkEVk3si0%D`T1
z$W#rQ({&Ua!!3NKv#CGmhCp-eYg^#6%VD+F)sDEj-SfAg*ZJLguz%bk0duI$`0D7D
zfHt%{@~TSpb_R7wglb2=AIekW{$}K=#)Ndlrn~&ZcHr=8q_zqrD9Uk231ebn3@(mX
z7;IcNpqpV>6JGbir+c6a7{RM*pwHjG+p7VMevkFmRSn<?_BYi?h~nF<Bk6%eoxk7J
zP(Pc}0K|QrzBm931?`UUSilC&8RMs50OoKTT3wS#U$7E2K?711{BywCv}TR3KiCIR
z9P~~GA>RjWj_=34umz5+s)t^A?1TN|$}FTHU=Id7gX4}e=r0L$i9yaevs?lM@PSHQ
zaiBR%rEDeOn50tJfNh4~*#IZ$gR#Ib?IigPMmV2dBMpcmp&aRU15!v6abF|qxb=l>
zf@hy3m%D+lISMJz$#2ofObbbV0H7}^YoPaL?$zIt<XkP_=K7|xzgN&&Ue2eoH^;+4
zW<QZCQ|Q+WlgE%zDyb#t7kUBr07<q05^ZbBjOzG~>3K4Q7<tBbO(-UTe&qo|*z6Kl
z9JK?Gnq68mx}~vupnqqBp5l@X@gzyEO1QYGi2KYI1k+YN5~YETu`ZJAJW!y2q*5&;
zPMA>UlGfbC(*;h#&NYniV3uq{mc77O4@u^1K(kfZQzv9;pub^@73Tb=vVJB;^QI8+
z-=qK!+cW%dSO)zifexH=-R@(1D<opPNPRv}GNs7`FLJR&nk_KiF#R?bp5-}gqYT>s
z#}B-MaS~xqY$-CgBMv*4-*xr-Y(@XG_!+j}ZGIztvC}kc*nVW<eeVYME8)$5!hVc{
zh^MEg$6q&f(FeGgYwe41O3QmW;!K;{HJ5Bg!_-_y(7n4b+W`A0M+45cWcUX3z{T2t
z-w|8k5cJgCX@8p+ojeY{j;)+Ip^eVF5nAU5XE4KEpmBcfsHS#?BMA9d_8o3G*i%#K
zUt>K)G3XA-gwvy0wkOF{px$oT^_;0#92;9Sde@E%pl`#T;t^1{%ueTE5659du600e
z&yCr3&R$jYZnFup1kmf1r-^_w!MUsr?|I;IxFU1_$7{1bckm4Z2n{mpcEjG@A@#t?
zWSiSAqGwLnXBh2mOYs9x%dmGW#z-|pNua0JB2C`aHAcSi#?A&7F*tXjiaf>lKrho)
z3N`S&S(yCZRi4pb66gY<A2<T%8b1PK?Q=Z_FiyI=d6okZ<+9PncO!uPa&4s*VP+NR
z5q=9}k{t$+W6}*X%P@*cqKPp`*czQR&Y=cWygRJ|)GTOPp<*~>RDr&yK%b`{K!6zo
zE$jvGK49Sj#DhA34GzIQpMDKsiC1v&i)ww#(Ob}Y8VAtC9P}Bw0C>6MfwkKZGE6UG
z+yf9wzA><=Xh;3^jDgnKV^a|j18_K8QOc%RAtMv9ZU}+*?c_ps&kKoerqk0(2P}Yo
zacP9P2Z5NP9iHiR4J{l54w-^;?$QM6)ImuJptoX}Gj;$uhBf?Xl_<z_;5(~uE)}4g
z2>|xU8x8u-jseIeI#J6g0KIG4KvZpZINR(cf__OKATCt|8Ma(S8m(XnSx8|6i(4Ej
zAEUoC(EVHpsGa<bgqw6hgRH1TEjbJgTBTvOaQYB7)$;lQ=;yG(#RDgd8D{MzT-Ex9
zE|`c@X$h75QDMErZ(y1j;s)aPK<B!(%D-eQVqEsM8h0tfaJ#)x`r+n`CQQ7d4}(0)
zdzmPJo`sZHT>GTie_U}x!w_3wO4KKlA%y8hj!k3Us_raX^^?;E^_E(3duM;N3-t1|
zzbaH(1rgev*ddd>iuCGlHrL7dSBkQMiP4`mk-7tYWk1DnKpg`$^?4iOUm}MHa25E>
zL4;12sOhs@mIV4YY=UNDkXf-f8F93FTb&0P8#1hbi2&b9RB;nB4|?U!RtQ2au?7hq
z^?BV56AZw|YhQx_rIJ8D<`_)mSPu=Ie2-e@BqWT}Wo_)|6uP|)&VwE^l)SDeUtW7@
zpr@Ejv~=#zO{?`P{g6Tc*yVIDq_U7>S07BYk;4x_AAy9A2Q|=Bs=YYqL2gI^!?o+$
zU=)>10YH`x2#Feo;k^&~1Oy}!^yUxB*Zb?N2m%!?Ns^pXpid~6YuSVreyhBEeYbRH
zivrKsp6)g??R}8=mi@}R?F&5!v)h)LV_pt}+d72mE>QI|=z!dvCnwLn5GYA~L!;aY
z!BVAjgYUfP<|r(M?vBw<7pxMaxnqHO1)=v$Rm#iLJ|K`JFA~E5N?N*)a8QjWJ~xBc
z2lKRa(TwejN=SUAKzHAPUZFsT1$yd?d5xnvU)e>7QbE@tF~L@t7U+Z45)HD8+Tm>q
zYqn5(Po1Vf{}Xp23t8SxJR|4=?x|TSrP+_K$t##bHT%dRn1BS9IO&F_K<`DCS(|_}
zod>=19_ZmxKz}{ETn#JdarUE<Gs+xgK+)>t<}X3dYKq(mx&h&FB_d2ITm-ZPw?DsX
zORyGhj;dev(}x&c%B;D!bWf;;%ImE<Ei<J+4{}6#H`Xuu5N4}($<DUg!NJ;(dR_WW
zNWG=xp3P%f>EF0!yQlc{sy7SutNIL`&~+&#Aafi?E5nfLW$PX2k(H$g-vjpji@o6B
z&#?#VfDwLO&$p0(9$3v#;ak#-zDqw$iC(4<kNnVN`3q{uEL1?XMjwD)n9;*rwfg$&
z0sLIq1AfvWN(8<70qCm`0@^@Y^A=JNW67eR3n2hl|DG5k$_s*L1YKgB^Lw=){Y}@r
zl%9ER0{A)_4K<Q`0D_55-AC2}Xd&a+<Qp4MOTM}Xx)b^gk4+SpcF86H0`?4tQIQ9I
zg#FflxQaM)5I~N#h|f*AAyK)L3_%kBygdv+Lc+7wp##X>fnG}=-gCpcsC~C|&)+Z>
zXBf?2e&~a>6M*%jry5~aVS{b?te_wBJtWLvuo>Q!j0Ry<)|g<d`0gvbZ78=$uos;J
zjZoNkau2PA>*#l&uUx~&Ef2I!4nxU=fSczo1|Wo{-0gCyM9}>lQT8~qQoo)z@-rlU
z33?9V7W9)m=uULfbrTz=RIFzhhx|h`dM$f&2z-5ZtTkU>+@`Sj+n{R&*x?+ngm`=c
z8m}so{%oKN*up%qDYKtv4urXOWH{EDHuQnDgKw*cBm52xoZkr;;}>ebzsmU|V`zC+
z&FCjLOZP~P@^VmX$l~FKIP2G>S^1WkW>hc*NW__RN;7`KHh7ZljS#)FbABAoa#NS~
zRpx{((KQ5Ae>(d*5BfsSqL71gYxkD!J~Yg(1*KWFb#F%Jk!BiUjzIrpE!~X{`ZQS?
zW(-=GUJP>GZ3^#9M>lpk6O!^99&6}sk9dICiBCYB^9rK){YD#xgy~<KuTs#BNyy%I
z2GCsqeg5tk{ga6ewKNH`$1R07vpoiwKThuq*n!~52OSt@O9`N_Pj=&QdLdwnuajyu
zwZW)v%HUSQL}tF?Zt0#eB<!bM8jSt3VZZ|YYfjckxftH@VsyU^kSV%L0eu+q@|^-b
zR{-5l_S?*gQSPCT!lnp44Z47RCX?CTKHj{NkciR=`Di#7$IGBU8|V^;WQ&kegOeOV
ze1(>-fFLc+_X4}Lbmj!!^Ni%m6q{h2a@E=(3r?sj={z+cilTl*uD9gU>iixmcnl>U
z&$8hKYw~Pi^6ltcJ3r!(TL<l%UFxzQzUM-sf1NqY17w1e8!4XfBiz>N7$4~auE?2D
zw$G&spub_q<_SMlqj`J910mtKU?w-o2|LX2J2%kJ*@?|rjsRMMQ=8xMT`z>$#mP<0
zNoMy_T-J+&zPQX}wDS{H5=NFQxz4OAD!Q4<gWk=|E$H0WtgBlPt4!w-7wlJgeM=re
zV(|xV_b+kotKu;$mJjMx;g||@=j_s2lMF;tWB}M_r8T23Nrcio`2hRHfCiD^RJaN`
zIsq5w!qF)v1a`TWI9lg~R($Ec${=LMTDp(20VY<}sdaXpb>&W&(NRdD4W5IJr$N`}
z*s<QxPOb`x4{U@~C4iLo?{1cO#U=>If8C#L0WT4Bfu@0zfGRaAvpXp}sz$ex%iBQ+
zfuT<W$*!3iNJxLrNpdUuwQBWu4YcR3z9fUF{%$e`iQ29GL!i2I{mo2KC?J5gOp<E@
zOV$i~l7J;&$3f)HI3Up+y`DYT9X}XGoJ+4e(m#CXPziiok6di^=lu&*M+auxedDKX
zsGocbDKY%c4++<s$aFNYAJuL_U-fTIC&M1VKCvBwP}AIZ?b8Eq4M=m8Zb0rWrw{hO
zk&w_^wx&-mzfwc2$qt-UqW3sCH@P%c%KfNyn_KVL-ZQLheRXG^k&bZyeW%ep=zU$c
zhZB0ogel<pE*XT@e?5J$e`PV$(9T9kf%@FQ+EmI}%31epMx{2s965+O_Y)cr+B}(U
zPt^bz?J^+Ic+x3=z;XL0*n4J7z>`~^>cxkFLjbO>gLK!f3E)*vWNo>#xoAj<*vb%O
zZbyg2`IHAHV)IT6a(sC5=OXt(in|o*GU1A+K|k0r^y=#2>9t0ng|8tWxf5BUiN2Ti
z0OJz%5<v&V!&in|$Bio7c0i~`5po;1efvU>d(mWx;S6Wo{-9Zg#>|^g+L#7qRxtq)
z3f)FED(*i;+qP)p*V6h5sav3TLM~cq-yfdG4oKM41vd$3ssn`O(__Pp?56cSBug!!
z7XQk)wPizZNLjyG11VIx2J)(5R?8=0j@eMURMO1_r_GlAP<Hb!OIyK|W0kiFR#!fq
zZ3&lATrkx*#Jv>6(|^6DKwr6*%Ic&)54s6Gm3>t}98J(5F2UX1g1fuBB?NbOUEE!R
zgb>^o_u#OwNYDh`pb0Js3j|+mvE%#yd%Tx>nR=M%vhJF$s;Q|C>iE6i#bJ#Vc8VR6
zg>La}L#T1*rD;MwlJ-=Y;QeDVo*RA!jO@Ppo2VS{=x@>D`_esn+H0=S@cGi9f&nEr
ztUl}{^k_PYrn?Q@b+WNzhVxYZ!)Q%hg-uPMeR3kfSjAEV5O>#-G!hALZ>=UrFrQma
z{6~)#05$n!jv@C=s^(qxS2@)^u9kDz6~EYLX!{|ZSNM2_MaXEKgL)7}LYP4P^-(vt
z<HEe^NsTP|?Ljj=9afmtuDGnm(IH^&yWhowtxUYvVaS&gcK*q^OgvX(Y}jEmny%ZD
zlc(!9B#X6u=Q5u&+hr`6pX4gE0Eny&80HU!q`ve$7nkzAuSfX@w#0bEq)@!pl?cS^
zy|CTCgYvx;v*n?t4UL3)q{K!@yqwZ}H(=4~n2#1Yr9w#WiG$xKQ4KW!u(kVrTc&f*
znjbP^(;phHB6F{{TF7!|O4;pw=9#jfYu%dCZdOOpq|5Z<7HXJyxjP4}ai8bioozc(
zTV9&t*<+sr!wlUoNIHVl<B2Y}Lc0&_lzC3bEv){;IYvi}(pN@F7sq96DIzGS-Kmv~
zU&M61KYUGDEx#xz%WXj_h4g!c!OqbGs)I-yJz~S6kKUn{Rmn7%0pt!pr^<4#-+lOL
za@*Q;lZhHaM1;UMZ5K9%OBE$!)#5L}Gl6+OXx0B;)~o8MTVD4JdgBQ8j4iy+_DMy4
zbY3tO3`4!bdhjS9sGbA$JG%R!yaeX_--oTXBXsA4#VOEd4-t_3rsHaQ8KReo0`?=e
z({Sl5<ib+6p0{dXuc@@B(aooR5u9-!>KB<O83vc#TIM>x)tQ{xuCk=upxPv2l&okl
zwEuK}I6Ef>{Uy#4raM3N%={Abr+G!kN7skoM+Ea)J50TF&W%cld9CcvMj}l8A@68?
zKD2KREp~V!k@r^pXQC><ddTD6%;o}HOdfmi_2X6F1Fe4GnTYz)z}Cjsen1><^$&$P
z=^AnvD#6?!81(zYeZFcOF6S9=-Xxsc5-^Rm!o(S5hNXb+M`HCUIe%V6A<=dCw;Kix
zSJXU#gfT)n6W}X?f-2M+F)n?67zu->JQfun{!?-5v%_!ZuLKHK0Z=2}xqmO{DsoUw
zT#KJO5HXsJC0$mUn!}fmcCM0=N*<2rJQ^=g&)>7I)?B)dp;R&=LmC_avT|NQSZSoA
z*Ob6RcoM^gMxzR#F{7Ciu%i^O_#zx?QSvMBlXbb8m~<Kxq;N~KlFV4g_h-c5tT6|Q
zX6)i2b^=%qk82*e2{;(@7V~m3oeIxQsYdq(7s%_K-45C+t?W(#Dy*=O&Wx=eE)A?H
z*->U8*F9@r6yDijdvDms8EtfyRA8~^Q=BcLw_DSO<K_;1b5(@?za;lmf@0@5-NdFJ
z3O_Bl<(VNP@5E4qmv>iMgHZT?yUKM+*ZQ=kgalHuyxFT<8VJ<1gSwwZ1<ZSB?~1Me
zCNogmo?tLAugFPaq}YIs5RUl>{JP+MBkcs@()BEA4P7cl#05#7Fei_!;w7<*&e36F
zemD?e1<D<qRCB#&Hg5@B7MGB0-V@`nQtxewq%4N71YH~1JWg$bpDMG)d=Or6{ASOn
z#YmHomETo#O|lH*3(MD~kV48bgBV&b3W6Gv1A)~AzwPNLOAA<+Z)HSXZX8|`wBfw}
z-oNA)3zl`B{O(-aAj!LGD!!k|*DR!#DWb67&Pw&Er%);c`1JUz{nV`0m{DE$v`H7_
zd;2n1Jlk_VIC$um-L3MjZXz`PlpMO1wgg`xxe$4W;DNazH^9onwyPFpxw7@^rZzgY
z_Ie$vP1s`r*gi3+D9~t1qy!ePcP*ex??;|o3BbCj%C7F)d!t1glIkwe;t(<g%uKS{
z&Za({0P!&T2ffX$SOUL_L?fUL)pjf&nDnC-YjkxK$3{%aknw0&;VR%n#`>5+Khk_a
zefmzj@b-9hT#*;*OQo25;&5#w_>Q9Tpd{$!GH&B-i`Ph(Myh^|(?#z5%sN?j!f8)S
z-J*OggD2jGkp&a{H+sWH-ngCmHT3?*M{bgXH0kzK)OePvFVqT^67drm-Lhp)`gXX;
z5foQ1cy!1Qcig!v&jUELjyauMFui=^ejzq}tPl5x;-YRimM07*lvA;~A<=57B2tq2
z(DDx>N`>AD#FHZ;sj`P91g#=_wfY6nZYdxpex#sALE;vh`~GIvZj|Jk6KM(cZVF;=
zZcl>P%#j`_#`9oN1n`ar?nw9T(yoXy%y?8RQ_2z`HaFKLhSKfbKeq6(J>p5;MuzR}
zz7ILb=M9Ed{zCU%-SE!uG3>9N>lts(0|o$ipv%>kGES&}PDqr_6?sg?Dh`5>^ho&#
zmLnP;+Muoempw)Gd7Zyz(*iaMx4W28Srg1+;gkq*-dpxj2W5(+8wf+HGD^p~|HBX}
z48>7vWv_SAcz<Ck?bqVEAnC6mb?6u^y;3e!>()Vdnb~~j<2Qmkz7`?`FJ~^H^f|<D
z<Y>hM!|sz(KTh)-o(BY!<h%Wj5GA$_VNk_6y}uM)@{00?sjM(Y5hTPZ3F$gHD>UbC
z>{ue_Gc2F$<j}iX4a7B+<c;Q!**kG8kQFe5wh{R^%Onp!?Fhw_Wob>&Ehjxw{^)j7
zhkneRx6@@?T?Zme?yf)Rsgi3FhHyeVzT$sP|7n@n(#Hu6(9u@3>f~@jY)2p?&%~NW
z<SEKt!XKwkZLt>zJtM4sZ?{L4h~`NHcplT^lA0lu86=#FOc@1v(kPSb1?tbA6qzP$
z_KH%QMc|7MA>+=c4PJYH$v;dB_Nk3ePPHl-vp$D8<XyF*rXgxuiwe?vy_N!_{Y8Kx
zbn(*$zmxGVC9j;15@eWF7@QehOlmG$dGAUgvHR~IBjc=gOtT{At_mUqhdCMxxdw~9
z2!;Fs)o3BfhW=~DT@bd;JeI^fjTRQYcY4oSq6;;;+AQM@5e7Z&KgNXPx!xGh<3%n2
zf??6@!PVLYK6{Io2K7HuMaL7m(qqkz$RZ*~nu1Mkch#ZB)rjZ!c=l}eoc)n2Z%`06
z3m*CdPr4AJ_0IYZl)Bvic^(|i{|`Don3vawJxT+@r~U+&KSv1<Yrqw<M)8&fUe?z>
z6t9}l`O&N3O1d1QV=q5R_HkJ&(U%iy<Z*fS#}c&k?kuo{9U7p;t@twQGy`3s^6Jje
zdfLipE?X1wN3~FvH`1T?phex7eFa4S3$kDEC8~_7;8DFt(=SNH?>N}n-pzXz)+g#X
zaDZJO-*0}dXG<8=@K>nGS%-NU6Dd}>D!oJ-NCGqvv5^7w`X9xyL$rCo;dn&z!Z}{=
zbLQ)C4Kcvwg2LlMBg5FPD)NIK^;8nV*jvv1gA-WQS0}$P^cqM`c^#uSK(U?1wfgVx
zMV2s%3Ac=SvU?Bw@Zq_$8EBS`+@ieNlJsc=)^FfV?>6S^R5aiEQ9^_^6CdQ7o@1!T
zqfJI6z%r9&?OrVhJKQ&>+^{Q^tyA_2or^PSiC8I9iXVtgu*CyQASI`DNOt1aIjq55
z@voO0s83$+{>+!hNmhlH-yyLkFB2x4hHJd-AIJJN<}0sb?|@%%nRG|VwWNBHqvBAZ
z(<r=h`<bMi1RhsAb>Bw|DaYE2t~<ain!|4}N|OJxc*I*zM^g<}vXhp<S-+!Q{ZqfD
z*fOXa+N)eoDY5i;#)qVo=<|<pkq^5a^YJ6nsR@(BLR2^3e62g_N1cr_%8G(()!CLZ
z(Vc3;O~-t-BVXO+Z=9hj(w4E48f@89N=7ZvEpb=?y|ukhl-~PR8S(|Ke^a!wd4>#e
zoNX;h!`5%MkOcF2L+y>~37$ghJfZf%7}EF-1<o@Rfbc10p#tsF>Nah1^gNA^%`Z2w
zA#PD@+Q^``6-n%{=566#)x8FWJ3<MT^u4BEWXKd{l^)D`1>z^6v-=}<t`%1og+=S|
z$Aul2ohG<%tz=>Z9{B<|@8&8wdHuTyS?v7!bT+^oUn0{~^MqPViWi=YD*XlrS+F>q
zu1>`Z^NE&R=}*m7i$YE2gf=e%e+7gw0nijTs5QNl6gQAw*M5kyE3PN=k!kD$wRfg=
z5mGhYUed@NA!wNG+{FjuJ&!`QHyY7G(negtwaG4u?irD9dg?`UFm|j&XbTdQxvS^T
zHgCkC`QskbcP?8SIDTk;z{SMw5r8Z*X-wd?pfNuFk@5?+h8HTBeKb}lr}QJnOT!8@
z#FId_@gG~SRHx-IwbbY$`JP=OVF+n=LEYbR#@Gz8laD;NwwRW7kg|P(X5^)TC>=OI
z|MVlBPtq}B5vIOGN;om4_krc2Y&@F^>^7HzZ`{zRhw|qcIb3lb@%LA`N2<JYc;_|-
zr~;Bs^bbus(IPDd%ZM4~hwpdSV0|lVjkfAhE=j{7TNp_OQc<t&iApMERH^{y#Uk9q
zR?B1ZGQ$w~&H=cXtv<_02(g;M9Gl!M(ah)NI*0yHG&5y7y<##xB+oQtmgjsjdBTaW
zk95;CxIYJ+GJpt5{DXc_o6-h`%x?%uuy>Mr&|yqlFpA{RaGXv{S$9FhrS)IxkvH(b
zch~b2db;+0Bo|GyAs50h+qk@s<pMDNB+8Kn$!~&d;`&8AI#QuW(Fb?Sqc5{w=1=d&
zV{~kF=^ljrT&Qb?K5h(Q^TQT3bt8g}ib_f%qCFfrpK0m-XuxR{t%iMN2uB7Bb}3ml
zR$Ja{NM!^{;ll~xO#cKQy!x!cN;PF$pE(kBaOjDL@O>VO)u3<`kub#KtnW?IJ7!1b
z8yYnWiflBQ=6SKIP_zJle9R|fFL5obk;YqY=xcGvNXOT&PA9)a-!#?*CH34E)VjeW
z6D<E_v^Xg$Eoecf<4VRnZ53{--w(8uC;GH_af1E75@c{dMQcFi?{|w`=PS|<`L(dL
zOF*}F2*$*WJrOkU?L)PnbXad>MQ;nt&YK@UElz=Ffu99_CKQg!3UUgm%v7K>%dfDW
z7flr5&eoxo1^WiC<0r&Kbl04!XO<hJL#wR_$L*}K!*~;4y^+m?2`MP{n^__4V$fC|
zM<Ond`85&){x@U|78nNWTREZVi@A9tyWa>R(Z8f5#)UWj!Do}({N704y}_QeHLe-7
zBgY7O=cHO%E*oVvgEPJV+ZLjxhKz5fX=x!pXa=Q75>V;XgwCg#Wz*Y`ea~HiW(;-q
z2x1^?E;Gfx3R?Z6{C!0dk@ok$L%8Y4$07N##&iLH6xNc+5awD{70!;SM5Ie~Hs-YL
z^ef=odnWFEai=3Sh;vX}85G9Xirj$_e+4Aymw7BfJnLYry%vkT9&+NOx$syPYP}ZF
z7B@`W9l=!GbPFq3MJL0D{?nnQala~TrN>47jB$HhWFCG|SqFB(GLx4d6ko!zDCuLv
zpR;64_xs4gr<BAQpX9c-iiJOc!6zU!D59lC?r^E2z@EIPm1aIr^Tf1EY5SdPhu}w}
z_s4&B>I$X9=xE}U@`7}fLrIUU4cxhu^Jj4IX-o8nbdd~JfX1Crfk_fVENxLWF(sdT
zS)5H-7^;ItL3P<y5l3RPezEFJO(?SXFYSEQY_z59)8}w2zIp2cydcb_J7*=!d{M3I
zvkadFab(eEtBo}vL`^D-M)2VCC$zwqiKJ4!5i*^E&^9%ymA5XK8M(g`{56JeWy~lo
z(EdDno>@+zaLg^Vr54os8x!2Go<%t8X(X5l{uLsPXv(Tws}TIgwDA;;rdV-A`Ska7
z%lznykcKqLWZM0<u+!#Ak0ZAUr_#1T8;*8{xruxe9Ql!m@1UTwfk(3***MgY6x)JU
z-Ej0#fA)+R^sibYv?}#SJkP^=BZgcs$Afu|QA2GA|EXkM2$a&HL#nsnM;L^|DMv-a
zcF%0p&3y3U^A8-}W8U;p4#9@&ws*5<k3^2-Pv&h6BKPl`2ZD`_8;D_NmGE*isX^Bs
z8_9d4+s0E5G@Ou;=e9?YqX<}i%<~8xx?|J*SsA+5`X&WnRah45>0r+Z1ed<^c&|9`
zl~o#hO7^EWbF4Gz?cm|?Y{fU5g>`9wFxQJ5F>DIMsjbx<C4AsGR>Vsu?M2v$pPE+$
z?h!)ceLGKbMVAy4LBZeCK}N*tK6v2m)y8G!NwzN@w#UV5+TI|n18KdUc38oB?n`XG
zWYV8+DJu=Hl{+&pCe{&@XNbXNo8w~Uy1?~=nDjd5R=vk2rR^?6$NCL<^_Pzqg<wl=
z^QdG+!LeE>!D!l09dx4DY{+GD$l?pV+LJtg&qHA<y7K3>a}5jmZvP_`IG>kpk03Zc
z`QO*Kie#-%kMrxC3!S|#Za#sG5p%rd-B^PyoU)FCL_w$<%XMT>ckDowa|E9?{e)9v
zRdb7xB}dx*_er6;=R)611K!`7*db=HorqR)Lc4S}<nU&8HGF%U{6v(j>=?(9^3sE7
zJ$Jv;Q;o6N==xGGjBJ+AR^B4Co3DDx8O@&*7bHCINC3>Q`G<}8-1of|um^_?wa-`2
z#Hz1tMM>6MOLTeY`pFAN4gvtLPMxGM&Xcc_Y-gG7LoC0gf+&CaLt*KFGubeCXnY3i
zmJMD8DoxQ<`bJIo>Rge?|BUFw4)@_TPIw-T*_?`zU$#h?UCT|N#c;~J-D{yaTnN3y
zXw8ELC2HPPkEA2Ns`G4-4~AY-tjhQ|&4<hrrGjC70BvKdsKDpmj=wAUpp}T4GXwhk
zMfR&~^ct?D%Bw<M$>EoDVxG+hk4We!FN7dFUxbkY>rJF|3X8m|=h`dAGb-8w?GQ`r
z?-7IM@8>;Ae#f8gdlqqTc)62Xjo!vs6@$>#JlP5CY^Yr%LESOPo6yx?pZe~1Byh)Q
zi5*WDCMiVtAJmQJJ&IpP;?HW2cET8ULEb8%d^QR-ChKerkNbcmF55RgBNKK~X+dyo
zx?8?E+RfW5_EFl0jo-kswO4<1gI($PW`5T5EOZd#@~@?6phR#bxvlEN;E$SUxih(l
zrzG?lP@P*@&*^3Aj{7<j_3)`jcgRRujAz3lA3#ul=c4njLZ`08R8XhaM8J)u6u`Fw
zm|S+&((}V7OVilVN|kUY`)|E?K;`etiDt{Vid%n7A9|z3=9n#W+}7oDe{;#n5$30g
zn1982{2Fy;pWkji+V&lv%l;BBov$wEi;6r9b+K(XHTh@YUX$a(O&Wuas!WVN5*r_b
zPJnkJcV0#xlR{eg#X|b6<#H@K0ek#6TpD*adAu0Op4fl8bZ?MD3GB^C)*&r3n(oER
zUzQ5Gws^l!JzRlrMcTG3KYdYRgBt*LOH+A>o}wx{nLs>&WW*M0n!rFUz=y1c4i*VE
zIAV2(8Cf_nU{f2QuK&RlBFPL=)pt-oP@@96DekQ$$yiHCFn4l*c=>vp`iiJ&HlH(<
z&QN|2RLEEX0#6F?T$)l(aZr%T_1@yYp<i13QQ(joMM5YrLZJV9)rgrPOY~uR))0ME
zN2zfmq40x=tjZ8>-O?I?p;LRs+hlEnR3Ows)<z8_ISqr*SbC->L4Q<?acHz;Zu8>n
z*T@c#vAvy>e(hH4HwpYcn4g@!@J|qw=_XF?=>x%)a7W4vu160%3F@*UJepU<KbLe1
zdlqC4L7%792}+bIX+7$^?cxDVAuCyxb@&`d5Q4B59D-vEVYBO?MCN=&oQzZ@IzIBa
zHGJt5buybG%@l<>C=Fq_mLc=3IxIRade<Bht;7bwBrK-?-%GM3;l`jFR;!6QGn{?_
z3s{=<#L?=a29qDZ2Tp}1MnMrm)nJI#qDlvHnNX#z)Y&L{Nb&$#v7l}HBOW9l^QrXt
z1r`Hkk^@AAcL4GDX2~qXzed`!wYso&C4e|3a_w2D4L=AsP7;D0TyhbK!w*(5T3w_h
zK}-@2w4mLsHg1Xj0n56yoT=jx$VHEA;{tb>Bz6Jx(h?N>ug>hY>|X|N?uwz|AerWz
zRfMtHEDy0?1E<@cogP;7Xy>e9q7AGfOtHP5y<a@PaYTwz+nmWdsrD$Dlt>N?H(I1c
zb(X~VUN-KoKQa#Sc=NjpDy^&B@eZD~TwRTS4m@_CHrlJm;oVBr{Piy^;7AdT)U(Rz
zUHtuhRri@8$3Ra#GK4UeO(ML1S&*(p{kLy0i|DOzVS!HMH24WS(?o6T6F*bdtTe`e
zh%e_K2W=!Esv6*1IneLL*P*k=SdA)~V)4<WQ&thel(i3gN4x#xZga8Z8gJnBIsx9*
z&?9Gu&d=Z+wNbsRN8~8_DEtkzKVOT2vo$K){Axj^%}^_!GH6;W+<n42P3epRa{c|}
zd3{gFwIsxHLF#IU21Of^-Fgs=ArNG$L8THh0CSM$L52{sr998+slhA>ENC{lM+_MF
zxrOl1WWgb>$+RP=G*?5L+sL5;{Mp5(sr7O~V?IE^y#8Q(l-~q&v5w~8iq1#XuB%6X
zjBF^F9u#1YRsB9yP_y@u=wD*VT+SvIWCoRHBeAA^LA^gq^vyU~Y3hK|0(DLD>`u`G
zG1)K0Q#%j^H>2{h#{HjA^yrn&C-JH6tOt}h62grgpx}14OlJs>qg#Wx;-KtIH7OSa
zr?m|If*ovKc1XYkz5`R&1o~?Glt8;T$j<gKZ@;?*W?Z?t7jID$W$pUhj1QZ3LR~dK
zB9e9*r~5xAuJtGYCCve7A%I1|jsG*n5%s8f1kaZ)LqG+n%x}`3FW5?Budnw|Z90$F
z@XL3YqnIvi#PinXJxuyk(+F13$Ai;oeTt-1XIKU$6VikDJBpmaDXLwUrRY5nqbt>z
zLG8-u;kRO<6QNHh$@otv?!QSb`h8z+b`iV4y(F4IXqKAo#S&%yCNX--b1c{oFQxts
z@*VoE@9L<WTvfBB8wV3_qgk7ft8KE{mp%@05pkVVi6u|N-$KpFEbXarawzxP?6LiT
z4sAYqR3jz9D^v{Dzp=zPY!D%=DOk&ZA1_xQmza)?=k!yZ)7<@O?+PS;E9{^sRP5oK
z(J(;nwDoLnh4d?Vp}@{YJTKm;=KE5s6B<%d5^C}edUqJJb>8hbuJP3v8BukLf~)`=
zBbO^?K;h%wc@9AZ$*1QXx(L32U*vdE<$K86(U9!KDPUh4^m%8HEGc8p2THp_$y-0`
zCF3Tw$R2X#cyxd9_qPz7M>;zt9m@5<i#An#n|_=u^KzY=EIPCIT7#gRY8=IeX>vmw
z93m!%kW9ZomL>i$3BA~7qO;x#^%uE!m&(_ifHPs{^ObOwV(=CBYm$bMV_;v0G2~y}
zH0+b0(OscU-`UR)ngGa1i*a7UBTb@(P$$NE{`MGx$P=q`b2Wjv)(SNxZU#%8V?!$r
zhbsEs@y#OKVR8M8D^xsh;ez`Yyre;Td*9o=lzWEDM6L3U>dsjgpvDn5HH|BPONgE!
zf2kH?H{B#~hc?=7Qb9K;CarkC&RB!>E57o#61^Y<h3iN<>(w@&*liO5iW17(1TGL~
z>ht-SfF`D}1#$6!GT8^!g{e0zkirc4i;s?WT4|7Xxf$%zhD;%wX}{ZvM&zr>%=H1K
z-}ikwuHqd|v6vohuuZVl7R~880&q6>v<+?V#VL^g$q0~S&Z)g^WX40h+&g}g^sOER
zOYpm<L2zUw@e@msYvX@(W$e$Zxr#Z^w4L-|Tpv0#h?pGw7qWu%VKjv)JCoI7$#znU
zOAWOLCs1)@PnlEt1;OUG@G^pZ8VMab%so=bqZFI7gWi15C3%Vr(c=!kP-#57J^NSL
zOp2klub)wds0m3rd>!;qf(gzr(7$ArbnUwcJohdsBG^NQ$CM8k`0hf!yy+AM9&(M^
zNDG=S)Je=Cr<C|(-*wzQ1~JRZlt#zw<wGF#H@~NXB#~3}f)BKKdw|dgzG9Sin--aE
zkx+uvYo9&Gxe_qnE&=g|nR(jFJL0Es>zZ%@WOB4UO&hx8A<I2do*+Wy3FiYVL0CS9
zf(#{l>ggpAIrMoYKwF5_Ij8j>u^MpUOLe7mvoKBzvem$$fY{K=$$TAGCo8OI_moL@
zA#|KX8E>qThA*=*ZU}?;iG~pW?rUzY!cIcU9Dq2SjzUQ=1V0~X0W;#)r`$e;oebby
zdnDj)sI1o>LF>s0*xtxH`N#(Bvl>;t)=#pR@QnVT4h8gZsczK^{+WpK53`pKRwoUa
zy~NJo8@?0*tD3)q4fEOG$GAZIoJJWVwN|{4cW;4xekw0nY2|`_@z4i*7&&G*|GXt2
z;Ji}qF;BPuOaow5nOLi+c=Jq~e0u2DZYipv;KY@hG1WA&$9g`A$#rxbxc{ZIn&b?q
z2nY?TodO|Re3iM}ex;@h>(&P>2An$MotxwT#j~{8?`0WAjKhwdP=d&k9YA$IokdyP
z{GCWuL|4grOZqK0yGk>xAJZq%$XziIO@{gEDM9NElg!Whhf7Q4ZuU*>{mL{F`o1T+
zq}k~nZrt^%&&^XG`zQ|7OiVToV?0ajt`;}%?%rPz8einU#oG-1cCD1bsEH7R8B9Es
z-TxiwP8nYyx1Wz>sPM<fKlWTk*#}X@+A2i*u{C^rFqc=GLg7oqZaYaS7Q?ZNV|`{*
z$Dd}BFCT(^ZdXiMHfvgzrL6DR=$Iv#6<6xugwgxqDH&n&2-Zsot&pz;(nObR7ylkB
zpdsw-yZP(*=X6jE#Xe+cOv!2cBHt3h^F5OD{ptai3Tp^Dm;gU*8O}W(miEV+E0zoo
zA;`IM_u^nVC=pqaE@?yM-B@XH9n>_9sx8Df^H#4Bn^G|I;&Qw%gw$f@wYz_(w}Puc
z7vDFeuN`eEg{T8vj?C`c9Ic~<-89!fwHu8uZLRurR&P$MlB?&Gokk)%oh!k-l$zI@
zOsv}k3C~?S|HRRLp1ZRv)o{p$gUl-$215oSpLF{e!|6ffc9jJdm7LBG9f>}t%L_BK
zw0wVtEtR}_fjAIX(Nkg`=69{~KP?D1A`Bws)Q}!<MMm?8eV^svD=1}i%6Owq0vrW1
zf_CQ}MnrPC&CWeU<n76{l5ZfR)I#~VyXArpyg%9jPUgA*Ym@Qj&p%n79Y^0B8@F+R
z<yzE>Db~OuqqtljLHB*ZXfhIC$sj9LNGz2Klhw901`b}*lt^iBC9r;1H~p&OL@<23
z#Obc*pxFDHR^*|c1q2&2e_*k$<8FfeVc3Bte9%sYF=PVh*+#Gt;PocSgYNvdOe+tj
zfQa#vkPkwReoT&6Q?tI38QV0<8R^`-C~wzG>ZU*viaLkV+rGdpPV&R)o=xQp6o~=P
zy+*VsSSd<6QGgweat(aJ(e=&r?q@5`c#fzMSNZQg6vZ!j8!;4&48@!Ra%~^<IO3%w
zki~{DHROMxl#xXIAd0JxfGIbJbAuA+SW`8A{H+x~7Q>o5vl%ME>o0~vIJBS$)v+q(
zEp*gx&vLv~NWt#`hV_*Zg}BLe>&vho#or9itANM6n0+&U-ODG-bf<STh=}ObgMmU%
z-Z*UBi~N}tI;xOtGfJFHCinT~RSsfAA)h+!!w<)cj`I;s({2K6lN4Yh2smQF!Eu~=
zE3}&2UpnCT@YQea^wg8pN!cDz+B+VIuu%Dx6!kFpY^IwIfr8B*LZd7y<eihr;69Xa
zqoAFX2boborqAuEOcw_Y5L6&g^{Qm*jIRPKfi(?OFnIBiJ$C-uP-eZ>uxV8$vg!3L
z`+N)34)W{#*o5WNU#YE-8|?Fd5>d0=d4THN8uucM2l6p*o?xMw+~P_5o^2siffU>a
zRo5G)Q4{IT=j5Yss`%*^ule24?-I?1dkC$ZP;SlF*08YGV;Ka*Kkp=aqC&RE3a;`n
zMNr#r?#OQ?T0t=V6Jq_aWLPLey0OsGXt7v?C`EUAM^L!3==X6psX8#aWTMtUMF^}2
zgF>|m=BqxZOa6KJl)G1yr5s2JVjBt3Q3y6B4*#H<YPQ4<g6py`emZ3iv8^!OZlvm%
zuQu>w42I)3*UFk~t^ftae78c=TxVnJI{WSW@*pf9-3l+<F-ZzMOXm(RTAbnR+boa|
zdGl3|>Ft0I*B<wYtN)QPPg_f}R3Y_Q`{bxkI9mQ-*sSkfqS=~k>8I0QVm}3?l2k@l
zGwE|E_QrhIQ=m~t<lM^$wSxJm(24vL(3q;IbLw((bq69xR#+$x7Aiaa`n*LUxU_r>
zbZLw*D){{0G`8!Rrz!6QETtdsJUJ~bu-r$cZr+D@klg*nsIpz%=1hq&n9Sl)Y5R(!
zJkgOs<fGJr{w5V%3(YaFK$L|1dg#nfM)TKB3d%+7&@h2XCZCD`JBLt!NAV6U0YJgR
zDNO@0)Roc2s$WW8(zKd(`AeZGuac5VD9*JsjLF>bY>*$YMOMTTwLw2YSDKlfi3q1j
zzQv;;2pZXmKo^>X*@4hxS)ak}m<JYrq8aEKc2*{XP$M6?W2ewv3eXPFz#!17?+mlB
z=`09m2)3}qa3|<uCRfnN$+d@^y_G;Ni9C@tGaFjqDDYh06jnW`I}D0S+Yin?q&&KJ
zaDmEj_=Pga{T|M96ry<_^6yvbn|oBVKzoQ}_mE|exBLv|vi<oVeS3f9*n(!T6V?I3
zr^TYqi-P$mih<AXtt8(t^u_z*C>LFtPdxX)NIjoUzmPV^@QgP-h^x-fAYiZ)HVd1g
z!b3i`E4%=`l#L#nIr(XU^;g(MJPp;rwZioKbsolio)8|7=+4D_`le=+ntGK5ZS-Ti
z$g5AvXX#uZ=8!SE$=MBUhSeb}w^Y|=18TG=>;?+s+V$W+`*06fflS5j1MBCYoNIg6
zieFtP!gY+-qjLuVj>qzYT~K=*a8CTF<}y*RESufgwOLstq+2oYb`9pXXnV6litvuy
z=_Le5yIZY9GH;VBeXR~!zj{*R6U{S~w7BxePDAt=j({hCI|-E3<b6`d@JVtZs?=qE
z*9axTxpP@z7!BxKMo3yz-<lKY-NJ(WqA*$$?s*bkj;XHzqFzJ+@&{DSll+99(5}si
zEpk6hjO2r9wyn3f(~qzAm&9IQ8!ViXtqU85Vg}`AL(AiZRX>+=2wGqhdmL~>*!eN(
zMVe}kSX7M#jh3hl1ZRA)6ZPiKWjl32;_Y~A<ipI>GyPr?R|s!e;p~iLpm#I;MsnmV
z9{POXwQJLy^m*yFh;XZRi$sceW#yvZ&fO@#U$hzB9^!D?2YvOwKVHn21ode0RnYMw
zEF%`}KfFrmOQ(EG#gO{^Ql$w9h*}vW**FPXZ=&ff-ZtUyu0MXG^|+BtJBVK7jFY1r
zxEqly<As^}hvwB%O(c|^<oM+-S_I)q4WfbKzU|EjECW<LrR;#+Nox}T+i5B^X<|Ou
z+sPhcL1w1nq=1fmd8Tx`hOIMNGrZwb-vwW8G7t5nxy<Sw7xx)dLT`y4k=mAxv)Pc6
zqWz@&QV15jciDT5zj9~Ge*WahuLcC406ui<tI7n0G%ZqBOY{904qPaF!n@m!B~Z!f
zW;9J+>S<GaOMuZ@Ya^VR{6R^9@QV=rPo>OHD)WR2KSeflo;IgfSIMDYNV_9sS$1X$
zy-3*}FTuBtn|m_J5w*~_b3S8UU}M;=^2^a;aP7WeT^v><UlkKu#OsePwp-PGDaj=x
z!^yZTb25)!m!nJ>5qGEAx_po`bY7|J9mx!-%h3@$Sxc1lEi$mHL1g-um;f+uB*Jcl
z+qeTsi<TA$#QoP5@@1CehUl}Om>eXUHymoUf4#CL>$}hL1#*T(HyE}*d9h*@S+*MV
z_bITnA|oIoKW9)m?~a)zB>k_rKVwb9rip$+{d<UR>jCuTtpP0Tnd&bdjji_W!^qX#
zWulncRp3@ypJ0$-9MOUHKw})|0h%_X_4$X+O6w`|WM$hsqYdqLi4>U-uF^rAmxo6e
zNN*(3voj<XuWh*Jff+smx2B%hz=Mn>cCF{?enWQ}M|+zaxovGb9uF)$)(Q*oRh3F`
zZ03nylP$Y5xIW`=Ff(^&SlxL0Ic-*DV~391e~=EScxW;GEoa{M$I_~?d`-TUiD!{K
z1ZQr8N62FOX8n(VwkW3zl{6x?+|=lPr)OUwH-9!3QL)bu(C_?r`_zV54YhXQ@q+G-
zLJe4*tT@Edv8LK7s>F<I5rz#ZoGmH4u$_umUs(-wmkGhu0*psH!GII>Ad8BeMZl3b
zE6mdZ5Dqr_eXO!DHXY{q-BdL_<rJi%eE?XRdwitl3m8&zqV9n{W=Y0=iM|?AoLVWh
zU5`KGCY7%6Bhn6#$n-pG1Qtr<kX?g(AGY%|<g`*f&-(Q+fwdV!bdDA<>O5##EGbRk
zql8@zyTxL+>FkHk6u?v?whfBok;C(osSRVNx}L|8?lp>yr}6y{X%l%rc)e(mRsQ33
zI3=BUs|b*5qj50*p$rqej!(1wXx}|%Oy^m6vtXQ9V)U&GDwu7AnD*ttDexEQw3iP;
zfzAsrZ;5dI_Sv%$DG?L=h@%J?0r-WB5oHxvLe!+mx|L<aKj<D<Sr$<@hGc^g3jfpQ
zIWSe%%YxHQ$S{(Gw};ECQi-hYa7946#(%eJ!44Yy_imj<&Xk9%k80x|JG}WnGCUH*
zFH*mnUiwLBP5I($lxvD!OwUT4@*}Q~H72(gIH^54N=Le_sdBx(v_<Y&SOW!dEnyWC
zBIqYVRes*X7KSA(5=p;G4wij@Su?H2o^<_J*oBZbtpDUros~Zftm$*%-Oz$oLm#rF
z!%x0lYB9~a4D*Bf{&n{JhwV}hAVD4I<Tx}CM$5{9_HQ!EO%$RmLl*w!$k(Y`xwKd0
ziij#@4Tn{NiB~BReW3mE@;k3nbNZ7l4^cKJoR<B0bkz5K1wRG2-{;?{;?QJ#^6VrY
zBxB(I`1N=xyb~f;r<SO^KEnN#liUFB>%;}Yjew3KTQATEA^h}J0l^FspTkh|&HFKS
zb>_^P!=!s(mHe=>LV4mvZVZ|WH$qC=um;xP%dK9&MSPZy8w?VT-aEg!CDO%@lOijY
z3{%o-A-{z{*=|U;+oZ`<Wn+FcIE`<9#aq=z<6zzSX&gUB4E9TH;%+C?f@vw)kg56_
zJl5bp@4jFv9O2ot$bp#VloNpysnLRDnG_yvc$O$B&T@FN;y3K!juCZ71*trg%Ito{
zd)q(dx|MJH4{JtR5bf~tph?zMVg}f;T#ki`6kqm#10tpI{HLFHj30}6+;;LvjwBQ0
zCUJxoAriK(C8@Z0(gDO`BUcny18;Btq~Gq$_Q;?TAj`PQ`p;}Qv+E|~o*?Hf9NI4z
zx-)y~=0Oe6+-&Ox2P4^kAFKD;iue~+kxV{frqZ@Js$e__W&3HUJU%ZO_c6xXWLW%i
z=(qEN8wO)&RN{nGT5bz4F_1VbSwC*B%%VefCIzbxik(}luDH?%I;~t)c{)oQ<F4!i
zh+m5lmOjw=*%{UVQ|W)^zJA~(kO;l^=gosw<M{jg`CZg<S>RDhoChIr-zDS3!K&Xx
zd{2m^Gz$y3B7fNz#9KlZqlGySW6xsaJ9knb_9yL#{6u9B!d2Rn`gRj6c4bYQz${Cx
zy<}YDTKrXxlHT97MAR!aQN)GDz<V@gI=i~%ql1o`MasdI9N@Wk#edGC!^YB*-<z<x
z=!mPOmi(C3Iq`>}HVDebIuHji?6y`Bt?m{2GUMJ_+SJ3Q1^W!8(plO$Z_Ea{+8NK5
z+k)98KCIi23$UQhJRYoPRdo}A%P6g;>4_2%ej&!_7dQLIFoZb92h$3N)4np-|I^?m
zUmwO^!6nDK^lr6Q;Os5aQ2u}}dW5()MEqZM?htx~C-{TT`w*6b(=KBUoo+wxXWt5j
zkR>PXA>^W=#?v-H1vKGMFwhu1{B_1$AZ|f&i^0>8F&LZ8`=+sYVio{eDIB+}R(!d)
z0U2ozVES+FLCyDH1ckA?w(+bD=mRuK%0V_BVH_wi2<c`semf+t?u|7P%TBN|RBR}D
z>7{L$f4k^n4)z?9!`mY4P$MmfOXZC00UhpkFmx$9f@;a9UY^RbLbMu}?N4Yc+J`IN
zAX}fp&hF(m3-3Jqxqd<R7LjS_<qEfs8!ec!nr*(0yS6GApU?R(!lTez24{|S1A?#d
zw)Qe6+=DYAh$(cDa4wJT_dlrktKKg_{0N9Z4eP+v2-kB1tREgi+vs!2D(KJ0GZPxo
zt*^G!0p-9jkRj|uLLvFtq846|1!2I?`Mmb?Bm`sm>28ma0?nD;K1;1ShdNEuqf9~C
z#Xlx6%bmIMnSQ%fC}|Ptu5wKjqZd^Q{5ep)UK2kU(OTKnB8N!H%clk3*DULxOAyY-
zU^V$uO*o2;kv%oea;ZL3OnvfQ0||V8?jc8}vw%y5C3v-hIgC&H6K06KY?Ml~S#+YQ
zi$?1Fkl5X1Jpw+Hz5173N{@UcVh8<CvE)UcKNBca$4TMSXm9m@i7-uA_*Hv2bpli)
z3W;Y2HJFK7RGNT~1pUgMJ4gOu!e#g%?E(^{K!1<z!(2D%YqxiT7zO}0^EXCDx1VZr
z0^wCIH6-qp<9{*J)uid6rF|xKst`s0D;;CD5!@z2SJYY-f|iLcr3ATSw(!l&r5*$G
zqibjB{gO8#@p00oP3C*i@QB{w_a|)CP$ZN;RW7>W#z)A)Ji>`moT+U%Ug>E;om~V1
zIO#6Cfv$Stu`pCcTwUOYSeJNMXRy2ePvqr~Z%M$3LQx~EO=iOLpA8YaD-@&QK6S{}
zd5hZjNc>W=(;99Cf<151<-~#@<##hPZk|&C8V5T+f^nS{x+|5=I_A=Teo~`4C(4my
z4^9mppwoiU03{Ffr!DIcMX7}~3rZldKgH-flKNtLYBGXc&WzNNS|U$z^HVHarp2j!
z@=q^OhCsj1kmo192?euf4j9VujvpTlt1uci=DqLdbML?%KP0Qbk~c%LrlAW&Qy)zp
zGy6$x>;~nQ%h*TnuOs&k!b)Wb>7^ndwiwt!9BRLb_ODYRD~?FVKdGpI65s=wla#kO
zHa)mIX*xi)M5*A8F4LLBG#%}iYx9~auHv7{je9N%yqZn`bGmfFmBc>dF+}up*q-}+
z?UOa|AW4P|y*%U2iHww#Q3L;5ts!!L_lD`$`#KSR7mTN#0WqmQKFP+k*Oi)50#L|Z
zq-+0xEEmP>NXC~mst+@iILAdx-~Q*Wi*nMHMSji!$fAGlimq4SPVrnHKRQ6<Q#xX?
z=pfc(#639rgeDcnB#ew*4pr5MiJb~5v+Z#tCPoYlJEiDU1X}=(cX7}$issYA2T23#
z%9M!^&k2LWy140RTPTQW`hx4#y#{iHOJpz^k+y!al)MMx6&#P0|DB3G`05QkIao!S
zdl*sL`US9h0-BOD2xK_`-!6clHh$TFDkY<cO5rx&3K>-ZcM<(hTUCT32UNTBm81m?
z(|A}_f(miIbq2Mv>My-7<QEF1yGx}N*`J|LnyN0*&$9H~^A^!mR5BAsXo)`)-T@o7
z%RjzhU<tuilIr;DH{+6`)27t&%zvZ=DVL{Ifw;9UOSJ7Hm$PXwv(Tb2@G2c_Ll<PX
zde==HgDd){wL=e`Z<nS%{$YnSq+RcbEv_#a^Rp{l*r^7I#M?yXLDyn^kmj!NnVDjK
zYq%<Ucz9f28-l@`n#<QSU2+;QP+WJ(avU{60u;d4{4oW0+w4$V&F4H5Crw@<L`77N
zji_>JnKXsdV-1MT;BF7wIZ4|*s|aBNzdH+1+1eIVmaR|asZ_Qy(g#eCVJ=NWJL}S#
zkAQAgT!$3WS|I|;=z6i8;Yt_#%5=r!$yHVxP4G<zUd|S=a9U>tI{)&UYN!*h{_S9Y
z(C-g6t#~|iAukt%>A}yEe2@ho@|d7P2;!qNqAiYCEfl&aL0>=dL!LJ!J)&$iY0jyL
zqM{#u%yWe+QwG_5IAO`yg98U7x2N!n6B&Sk>7qw%N^~lPS?K_}a9jrzZ&-l1d*uhz
zp=~h{QIW+C=qO$$H>h8OmwfauvX$RP%Gg(iki=iAMs8|U+{=@jT99zWM&iF!hf)N^
z?*NbI%l6rQ)2A{I+~*+*y2+OJh&67fo*ibOLRL|_&;)I*CyP8NJLEyMUV5oKp3(&c
z2lM+AXMxC~)d56#1z0&;vviw9QUK`-(}8B0t_gYM!46%|Ya`p|D2}rKF3AD6{u+Qa
z77;Dp2~?tnRQV8tdAUJG>4}XcxW35BY%UORN*nOr^?k)D_30Wp5M6bMfWbm$#!Rt#
zxL^|BBE7?80oX!Wae77DB%?6z>7H%e)WuS97{O~Vtg=Bh2@aWA;F`hW(*i)4sAP=U
z__eRczKaGkOC*g=czWu9oSZc#XeH7|3W2GNNg)**n__zsfd_y2Z(xsjLrS{I&G@KU
zljc!3wl$dQN{1D0(F4c0<q^J;K(!eTJS+iy&uGdo`&l0jL88~V)Ab#{>(}X<452K(
zZsuP?5vZ>|5%zMk)XQfB4>`qKyFT=SQ%wAoQ}iKE0Q$ki%#Ul#jPb+vDVb1zOmsy0
z&za48GccqsNqbAWG&6LJMf_mP^UTl?I*Yms`3&OTCM6OV3k2h=?`j4*^8qnVIdAvM
zvM3upzwA2~3lSnXXHwQe8+;M^->5SmPlA|AmC&~}GoJeWU9Is~vic<S9NBfRA?1H|
zeVy#`L(hGemfKY|u5PJLU#21r0SHd$RlS_f1Noq~fHO-~d?hGFiz>rW;e+W!sKF3;
zf#%j7!F42z`Lso6(3J99l<`-)Hx4EyZdHkIkc>mKv+Q%xQ7uyCe*>C0fBlAtNLk`|
zT$pgcn|krRgUXlhVgerxInoT7M;P#--}kb7z$|pQe&k2$xC^0gUU#vrJK~S$!ht5k
zl1^@BePkIX^7FECRv8|fXw;iwKQp@LQIR$S2)))6L-D^etOvkHDCOQ#XEfq81PhRN
z<5-0~o^Q;&XXBj1263K)15&{l+dsylhgrKHe3$-iOr(<?oOQ3g<iC7{W(sz%9r8{6
zZ8+00{ZS<6IMX<UK=MxP<598vq292~=jkScBw<OeD~rI1^i&V8e1gL_H3juPr_a9{
zU1ur2LZ?%Ixruu#SDn2)UVTsfkX<w3Sb&DE+ff8w7veJ!23>F1O=!^WN8@~ZVtDn{
zf?_+g%tI)Rm+eJBs%mxl=_1Ghg<#gBF)o&AJw&GXv^p=OXMvPo-PW^~L}`7~Vo_wM
z731p+d46j@MVa?e9A_+%nfKDK^Z{|a9OBPQMxtlWpw8aj;2<}@<CQ*9yvS?7VXV8#
zQE62209(x0Emp>V6d7YrWZs0^cuRkad}MuFp3r5CN@i5IupV<cd4jj^F7~|WBB9Zr
zey-rskVIdw{TG`#$LC9DED#VNjCe2GzhwUxF7Zk*ZCL}!u(e<c3CWgxd=M-O){x;L
zC0_eHC@L}$IMe3;<0h`99gqx73-&F+0fw~0oARs#iA{S!RA$L|#Tzro8uFcq1&{9;
z{d50|+Vk_aDJwiWb++L2h0J&XEceQVfcqlY`ak%B1NmiYcdHCj)PlwQk)?+>@V2K#
z(7g@$!~F$<mD^7Sh7KoMv7@D5h(?dJP_uK`0?9b;dEsulk&l+oGGup6;SVO-^k}<c
zC0c|6gm0^C%qr(;Q#MlP=%L>yuDHXrC*E2rJrdzDT|Mw{{lo3+#{15~OEmK=7An_W
z5CNTj?Ff`1P&Tpm{a{5F6ZQtGvVbE!dep9FHMgl}RQTt!_&qstS)rCJObFNEav<-e
zEU}Q+u*&-;%2VWIzT(!TlB@ujo+3u~eytZ7^c|oWctKwr59bF4$Vz{?g2GDnL5nj?
z5>%TsB%nJc(6j$mzi`r3R~a&B=Ch)#nr^<nm7V8o1u~$}C6TrOP)dla8SwcNUrXpg
zl&8?iyaoPIXUL+_h9Dl|d{Z?o$d5p}#%(%q9+#~&h)YcHzr*L$m35Sw6|7_a59I_q
A-2eap

diff --git a/doc/security/unlock_user.md b/doc/security/unlock_user.md
index 9a1f60f2462..279f466e106 100644
--- a/doc/security/unlock_user.md
+++ b/doc/security/unlock_user.md
@@ -17,9 +17,7 @@ Users are locked after ten failed sign-in attempts. These users remain locked:
 1. On the top bar, select **Main menu > Admin**.
 1. On the left sidebar, select **Overview > Users**.
 1. Use the search bar to find the locked user.
-1. From the **User administration** dropdown list select **Unlock**.
-
-![Unlock a user from the Admin Area](img/unlock_user_v14_7.png)
+1. From the **User administration** dropdown list, select **Unlock**.
 
 ## Unlock a user from the command line
 
diff --git a/doc/subscriptions/gitlab_dedicated/index.md b/doc/subscriptions/gitlab_dedicated/index.md
index 2d9e3cb5ca8..9d779675c2d 100644
--- a/doc/subscriptions/gitlab_dedicated/index.md
+++ b/doc/subscriptions/gitlab_dedicated/index.md
@@ -1,6 +1,6 @@
 ---
-stage: Systems
-group: Distribution
+stage: SaaS Platforms
+group: GitLab Dedicated
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
 
diff --git a/lib/api/concerns/packages/debian_package_endpoints.rb b/lib/api/concerns/packages/debian_package_endpoints.rb
index 181759a7f38..db31f2e35f1 100644
--- a/lib/api/concerns/packages/debian_package_endpoints.rb
+++ b/lib/api/concerns/packages/debian_package_endpoints.rb
@@ -44,6 +44,8 @@ module API
             end
 
             def present_index_file!(file_type)
+              not_found!("Format #{params[:format]} is not supported") unless params[:format].nil?
+
               relation = "::Packages::Debian::#{project_or_group.class.name}ComponentFile".constantize
 
               relation = relation
diff --git a/lib/gitlab/ci/config.rb b/lib/gitlab/ci/config.rb
index 142f0b8dfd8..585e671ce42 100644
--- a/lib/gitlab/ci/config.rb
+++ b/lib/gitlab/ci/config.rb
@@ -117,7 +117,8 @@ module Gitlab
       def expand_config(config)
         build_config(config)
 
-      rescue Gitlab::Config::Loader::Yaml::DataTooLargeError => e
+      rescue Gitlab::Config::Loader::Yaml::DataTooLargeError,
+        Gitlab::Config::Loader::MultiDocYaml::DataTooLargeError => e
         track_and_raise_for_dev_exception(e)
         raise Config::ConfigError, e.message
 
diff --git a/lib/gitlab/ci/config/yaml.rb b/lib/gitlab/ci/config/yaml.rb
index de833619c8d..94ef0afe7f9 100644
--- a/lib/gitlab/ci/config/yaml.rb
+++ b/lib/gitlab/ci/config/yaml.rb
@@ -5,12 +5,21 @@ module Gitlab
     class Config
       module Yaml
         AVAILABLE_TAGS = [Config::Yaml::Tags::Reference].freeze
+        MAX_DOCUMENTS = 2
 
         class << self
           def load!(content)
             ensure_custom_tags
 
-            Gitlab::Config::Loader::Yaml.new(content, additional_permitted_classes: AVAILABLE_TAGS).load!
+            if ::Feature.enabled?(:ci_multi_doc_yaml)
+              Gitlab::Config::Loader::MultiDocYaml.new(
+                content,
+                max_documents: MAX_DOCUMENTS,
+                additional_permitted_classes: AVAILABLE_TAGS
+              ).load!.first
+            else
+              Gitlab::Config::Loader::Yaml.new(content, additional_permitted_classes: AVAILABLE_TAGS).load!
+            end
           end
 
           private
diff --git a/lib/gitlab/config/loader/multi_doc_yaml.rb b/lib/gitlab/config/loader/multi_doc_yaml.rb
new file mode 100644
index 00000000000..346adc79896
--- /dev/null
+++ b/lib/gitlab/config/loader/multi_doc_yaml.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Config
+    module Loader
+      class MultiDocYaml
+        TooManyDocumentsError = Class.new(Loader::FormatError)
+        DataTooLargeError = Class.new(Loader::FormatError)
+        NotHashError = Class.new(Loader::FormatError)
+
+        MULTI_DOC_DIVIDER = /^---$/.freeze
+
+        def initialize(config, max_documents:, additional_permitted_classes: [])
+          @max_documents = max_documents
+          @safe_config = load_config(config, additional_permitted_classes)
+        end
+
+        def load!
+          raise TooManyDocumentsError, 'The parsed YAML has too many documents' if too_many_documents?
+          raise DataTooLargeError, 'The parsed YAML is too big' if too_big?
+          raise NotHashError, 'Invalid configuration format' unless all_hashes?
+
+          safe_config.map(&:deep_symbolize_keys)
+        end
+
+        private
+
+        attr_reader :safe_config, :max_documents
+
+        def load_config(config, additional_permitted_classes)
+          config.split(MULTI_DOC_DIVIDER).filter_map do |document|
+            YAML.safe_load(document,
+              permitted_classes: [Symbol, *additional_permitted_classes],
+              permitted_symbols: [],
+              aliases: true
+            )
+          end
+        rescue Psych::Exception => e
+          raise Loader::FormatError, e.message
+        end
+
+        def all_hashes?
+          safe_config.all?(Hash)
+        end
+
+        def too_many_documents?
+          safe_config.count > max_documents
+        end
+
+        def too_big?
+          !deep_sizes.all?(&:valid?)
+        end
+
+        def deep_sizes
+          safe_config.map do |config|
+            Gitlab::Utils::DeepSize.new(config,
+              max_size: Gitlab::CurrentSettings.current_application_settings.max_yaml_size_bytes,
+              max_depth: Gitlab::CurrentSettings.current_application_settings.max_yaml_depth)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/database/connection_timer.rb b/lib/gitlab/database/connection_timer.rb
index f9b893ffd0f..4eb214e74f4 100644
--- a/lib/gitlab/database/connection_timer.rb
+++ b/lib/gitlab/database/connection_timer.rb
@@ -27,7 +27,7 @@ module Gitlab
         end
 
         def current_clock_value
-          Concurrent.monotonic_time
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
         end
       end
 
diff --git a/lib/gitlab/encoding_helper.rb b/lib/gitlab/encoding_helper.rb
index b1fd35184ac..99240f2ad48 100644
--- a/lib/gitlab/encoding_helper.rb
+++ b/lib/gitlab/encoding_helper.rb
@@ -16,6 +16,7 @@ module Gitlab
     ENCODING_CONFIDENCE_THRESHOLD = 50
 
     UNICODE_REPLACEMENT_CHARACTER = "�"
+    BOM_UTF8 = "\xEF\xBB\xBF"
 
     def encode!(message)
       message = force_encode_utf8(message)
@@ -147,6 +148,10 @@ module Gitlab
       filename.force_encoding("UTF-8")
     end
 
+    def strip_bom(message)
+      message.delete_prefix(BOM_UTF8)
+    end
+
     private
 
     def force_encode_utf8(message)
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index b439fbeb21b..dbf11468589 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -36293,6 +36293,9 @@ msgstr ""
 msgid "Run CI/CD pipelines with Jenkins."
 msgstr ""
 
+msgid "Run again"
+msgstr ""
+
 msgid "Run housekeeping"
 msgstr ""
 
@@ -36460,6 +36463,9 @@ msgstr ""
 msgid "Runners|Create an instance runner"
 msgstr ""
 
+msgid "Runners|Create an instance runner to generate a command that registers the runner with all its configurations. %{linkStart}Prefer to use a registration token to create a runner?%{linkEnd}"
+msgstr ""
+
 msgid "Runners|Created %{timeAgo}"
 msgstr ""
 
@@ -36943,6 +36949,9 @@ msgstr ""
 msgid "Runners|shared"
 msgstr ""
 
+msgid "Runner|New"
+msgstr ""
+
 msgid "Runner|Owner"
 msgstr ""
 
@@ -45995,6 +46004,9 @@ msgstr ""
 msgid "UserProfile|Activity"
 msgstr ""
 
+msgid "UserProfile|An error occurred loading the profile. Please refresh the page to try again."
+msgstr ""
+
 msgid "UserProfile|Blocked user"
 msgstr ""
 
diff --git a/spec/features/calendar_spec.rb b/spec/features/calendar_spec.rb
index 069c74dcd2a..b09e1f16b7b 100644
--- a/spec/features/calendar_spec.rb
+++ b/spec/features/calendar_spec.rb
@@ -71,6 +71,7 @@ RSpec.describe 'Contributions Calendar', :js, feature_category: :user_profile do
   end
 
   before do
+    stub_feature_flags(profile_tabs_vue: false)
     sign_in user
   end
 
diff --git a/spec/features/dashboard/datetime_on_tooltips_spec.rb b/spec/features/dashboard/datetime_on_tooltips_spec.rb
index a12772543e6..880f9ec2b72 100644
--- a/spec/features/dashboard/datetime_on_tooltips_spec.rb
+++ b/spec/features/dashboard/datetime_on_tooltips_spec.rb
@@ -12,6 +12,10 @@ RSpec.describe 'Tooltips on .timeago dates', :js, feature_category: :user_profil
     project.add_maintainer(user)
   end
 
+  before do
+    stub_feature_flags(profile_tabs_vue: false)
+  end
+
   context 'on the activity tab' do
     before do
       Event.create!(project: project, author_id: user.id, action: :joined,
diff --git a/spec/features/profiles/user_visits_profile_spec.rb b/spec/features/profiles/user_visits_profile_spec.rb
index 8ea7ad206c5..ad265fbae9e 100644
--- a/spec/features/profiles/user_visits_profile_spec.rb
+++ b/spec/features/profiles/user_visits_profile_spec.rb
@@ -6,6 +6,7 @@ RSpec.describe 'User visits their profile', feature_category: :user_profile do
   let_it_be_with_refind(:user) { create(:user) }
 
   before do
+    stub_feature_flags(profile_tabs_vue: false)
     sign_in(user)
   end
 
diff --git a/spec/features/users/overview_spec.rb b/spec/features/users/overview_spec.rb
index 6c6c5ca2b27..ff903358931 100644
--- a/spec/features/users/overview_spec.rb
+++ b/spec/features/users/overview_spec.rb
@@ -18,6 +18,7 @@ RSpec.describe 'Overview tab on a user profile', :js, feature_category: :user_pr
   end
 
   before do
+    stub_feature_flags(profile_tabs_vue: false)
     sign_in user
   end
 
diff --git a/spec/features/users/show_spec.rb b/spec/features/users/show_spec.rb
index 17c33398c0e..4b2e7c432b7 100644
--- a/spec/features/users/show_spec.rb
+++ b/spec/features/users/show_spec.rb
@@ -16,10 +16,31 @@ RSpec.describe 'User page', feature_category: :user_profile do
   end
 
   context 'with public profile' do
-    it 'shows all the tabs' do
+    context 'with `profile_tabs_vue` feature flag disabled' do
+      before do
+        stub_feature_flags(profile_tabs_vue: false)
+      end
+
+      it 'shows all the tabs' do
+        subject
+
+        page.within '.nav-links' do
+          expect(page).to have_link('Overview')
+          expect(page).to have_link('Activity')
+          expect(page).to have_link('Groups')
+          expect(page).to have_link('Contributed projects')
+          expect(page).to have_link('Personal projects')
+          expect(page).to have_link('Snippets')
+          expect(page).to have_link('Followers')
+          expect(page).to have_link('Following')
+        end
+      end
+    end
+
+    it 'shows all the tabs', :js do
       subject
 
-      page.within '.nav-links' do
+      page.within '[role="tablist"]' do
         expect(page).to have_link('Overview')
         expect(page).to have_link('Activity')
         expect(page).to have_link('Groups')
@@ -189,11 +210,33 @@ RSpec.describe 'User page', feature_category: :user_profile do
       expect(page).to have_content("This user has a private profile")
     end
 
-    it 'shows own tabs' do
+    context 'with `profile_tabs_vue` feature flag disabled' do
+      before do
+        stub_feature_flags(profile_tabs_vue: false)
+      end
+
+      it 'shows own tabs' do
+        sign_in(user)
+        subject
+
+        page.within '.nav-links' do
+          expect(page).to have_link('Overview')
+          expect(page).to have_link('Activity')
+          expect(page).to have_link('Groups')
+          expect(page).to have_link('Contributed projects')
+          expect(page).to have_link('Personal projects')
+          expect(page).to have_link('Snippets')
+          expect(page).to have_link('Followers')
+          expect(page).to have_link('Following')
+        end
+      end
+    end
+
+    it 'shows own tabs', :js do
       sign_in(user)
       subject
 
-      page.within '.nav-links' do
+      page.within '[role="tablist"]' do
         expect(page).to have_link('Overview')
         expect(page).to have_link('Activity')
         expect(page).to have_link('Groups')
@@ -358,6 +401,10 @@ RSpec.describe 'User page', feature_category: :user_profile do
   end
 
   context 'most recent activity' do
+    before do
+      stub_feature_flags(profile_tabs_vue: false)
+    end
+
     it 'shows the most recent activity' do
       subject
 
@@ -388,6 +435,10 @@ RSpec.describe 'User page', feature_category: :user_profile do
   context 'with a bot user' do
     let_it_be(:user) { create(:user, user_type: :security_bot) }
 
+    before do
+      stub_feature_flags(profile_tabs_vue: false)
+    end
+
     describe 'feature flag enabled' do
       before do
         stub_feature_flags(security_auto_fix: true)
diff --git a/spec/features/users/snippets_spec.rb b/spec/features/users/snippets_spec.rb
index 20fc2981418..0d6bb0823b6 100644
--- a/spec/features/users/snippets_spec.rb
+++ b/spec/features/users/snippets_spec.rb
@@ -6,6 +6,10 @@ RSpec.describe 'Snippets tab on a user profile', :js, feature_category: :snippet
   context 'when the user has snippets' do
     let(:user) { create(:user) }
 
+    before do
+      stub_feature_flags(profile_tabs_vue: false)
+    end
+
     context 'pagination' do
       let!(:snippets) { create_list(:snippet, 2, :public, author: user) }
 
diff --git a/spec/features/users/user_browses_projects_on_user_page_spec.rb b/spec/features/users/user_browses_projects_on_user_page_spec.rb
index 841b324fba4..b31e2a054fe 100644
--- a/spec/features/users/user_browses_projects_on_user_page_spec.rb
+++ b/spec/features/users/user_browses_projects_on_user_page_spec.rb
@@ -28,6 +28,10 @@ RSpec.describe 'Users > User browses projects on user page', :js, feature_catego
     end
   end
 
+  before do
+    stub_feature_flags(profile_tabs_vue: false)
+  end
+
   it 'hides loading spinner after load', :js do
     visit user_path(user)
     click_nav_link('Personal projects')
diff --git a/spec/fixtures/build_artifacts/dotenv_utf16_le.txt b/spec/fixtures/build_artifacts/dotenv_utf16_le.txt
new file mode 100644
index 0000000000000000000000000000000000000000..6ff398f70c5b2ee55d6c0ae8664eca5293ef1292
GIT binary patch
literal 62
zcmezW&zB*RA)djN!H*#fNQW^vG6XT$GL$eBF_bc-GVn5RF@ykRgMp+GP&|zxks*hn
H7%Bq*pw$Z*

literal 0
HcmV?d00001

diff --git a/spec/frontend/ci/runner/admin_new_runner_app/admin_new_runner_app_spec.js b/spec/frontend/ci/runner/admin_new_runner_app/admin_new_runner_app_spec.js
new file mode 100644
index 00000000000..a8486809cdc
--- /dev/null
+++ b/spec/frontend/ci/runner/admin_new_runner_app/admin_new_runner_app_spec.js
@@ -0,0 +1,53 @@
+import Vue from 'vue';
+import VueApollo from 'vue-apollo';
+import { GlSprintf } from '@gitlab/ui';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
+
+import AdminNewRunnerApp from '~/ci/runner/admin_new_runner/admin_new_runner_app.vue';
+import RunnerInstructionsModal from '~/vue_shared/components/runner_instructions/runner_instructions_modal.vue';
+
+const mockLegacyRegistrationToken = 'LEGACY_REGISTRATION_TOKEN';
+
+Vue.use(VueApollo);
+
+describe('AdminNewRunnerApp', () => {
+  let wrapper;
+
+  const findLegacyInstructionsLink = () => wrapper.findByTestId('legacy-instructions-link');
+  const findRunnerInstructionsModal = () => wrapper.findComponent(RunnerInstructionsModal);
+
+  const createComponent = ({ props = {}, mountFn = shallowMountExtended, ...options } = {}) => {
+    wrapper = mountFn(AdminNewRunnerApp, {
+      propsData: {
+        legacyRegistrationToken: mockLegacyRegistrationToken,
+        ...props,
+      },
+      directives: {
+        GlModal: createMockDirective(),
+      },
+      stubs: {
+        GlSprintf,
+      },
+      ...options,
+    });
+  };
+
+  beforeEach(() => {
+    createComponent();
+  });
+
+  describe('Shows legacy modal', () => {
+    it('passes legacy registration to modal', () => {
+      expect(findRunnerInstructionsModal().props('registrationToken')).toEqual(
+        mockLegacyRegistrationToken,
+      );
+    });
+
+    it('opens a modal with the legacy instructions', () => {
+      const modalId = getBinding(findLegacyInstructionsLink().element, 'gl-modal').value;
+
+      expect(findRunnerInstructionsModal().props('modalId')).toBe(modalId);
+    });
+  });
+});
diff --git a/spec/frontend/fixtures/jobs.rb b/spec/frontend/fixtures/jobs.rb
index ac58b99875b..6d452bf1bff 100644
--- a/spec/frontend/fixtures/jobs.rb
+++ b/spec/frontend/fixtures/jobs.rb
@@ -39,6 +39,7 @@ RSpec.describe 'Jobs (JavaScript fixtures)' do
 
     let!(:build) { create(:ci_build, :success, name: 'build', pipeline: pipeline) }
     let!(:cancelable) { create(:ci_build, :cancelable, name: 'cancelable', pipeline: pipeline) }
+    let!(:failed) { create(:ci_build, :failed, name: 'failed', pipeline: pipeline) }
     let!(:created_by_tag) { create(:ci_build, :success, name: 'created_by_tag', tag: true, pipeline: pipeline) }
     let!(:pending) { create(:ci_build, :pending, name: 'pending', pipeline: pipeline) }
     let!(:playable) { create(:ci_build, :playable, name: 'playable', pipeline: pipeline) }
diff --git a/spec/frontend/jobs/components/table/cells/actions_cell_spec.js b/spec/frontend/jobs/components/table/cells/actions_cell_spec.js
index 7cc008f332d..55fe534aa3b 100644
--- a/spec/frontend/jobs/components/table/cells/actions_cell_spec.js
+++ b/spec/frontend/jobs/components/table/cells/actions_cell_spec.js
@@ -37,6 +37,7 @@ describe('Job actions cell', () => {
   const cancelableJob = findMockJob('cancelable');
   const playableJob = findMockJob('playable');
   const retryableJob = findMockJob('retryable');
+  const failedJob = findMockJob('failed');
   const scheduledJob = findMockJob('scheduled');
   const jobWithArtifact = findMockJob('with_artifact');
   const cannotPlayJob = findMockJob('playable', mockJobsNodesAsGuest);
@@ -79,10 +80,6 @@ describe('Job actions cell', () => {
     });
   };
 
-  afterEach(() => {
-    wrapper.destroy();
-  });
-
   it('displays the artifacts download button with correct link', () => {
     createComponent(jobWithArtifact);
 
@@ -191,6 +188,20 @@ describe('Job actions cell', () => {
     expect(button().props('disabled')).toBe(true);
   });
 
+  describe('Retry button title', () => {
+    it('displays retry title when job has failed and is retryable', () => {
+      createComponent(failedJob);
+
+      expect(findRetryButton().attributes('title')).toBe('Retry');
+    });
+
+    it('displays run again title when job has passed and is retryable', () => {
+      createComponent(retryableJob);
+
+      expect(findRetryButton().attributes('title')).toBe('Run again');
+    });
+  });
+
   describe('Scheduled Jobs', () => {
     const today = () => new Date('2021-08-31');
 
diff --git a/spec/frontend/packages_and_registries/package_registry/components/details/version_row_spec.js b/spec/frontend/packages_and_registries/package_registry/components/details/version_row_spec.js
index faeca76d746..31e4c68a3f4 100644
--- a/spec/frontend/packages_and_registries/package_registry/components/details/version_row_spec.js
+++ b/spec/frontend/packages_and_registries/package_registry/components/details/version_row_spec.js
@@ -19,6 +19,7 @@ describe('VersionRow', () => {
   const findPackageTags = () => wrapper.findComponent(PackageTags);
   const findPublishMethod = () => wrapper.findComponent(PublishMethod);
   const findTimeAgoTooltip = () => wrapper.findComponent(TimeAgoTooltip);
+  const findPackageName = () => wrapper.findComponent(GlTruncate);
 
   function createComponent(packageEntity = packageVersion) {
     wrapper = shallowMountExtended(VersionRow, {
@@ -74,16 +75,28 @@ describe('VersionRow', () => {
   });
 
   describe('disabled status', () => {
-    it('disables the list item', () => {
-      createComponent({ ...packageVersion, status: 'something' });
+    beforeEach(() => {
+      createComponent({
+        ...packageVersion,
+        status: 'something',
+        _links: {
+          webPath: null,
+        },
+      });
+    });
 
+    it('disables the list item', () => {
       expect(findListItem().props('disabled')).toBe(true);
     });
 
-    it('disables the link', () => {
-      createComponent({ ...packageVersion, status: 'something' });
+    it('lists the package name', () => {
+      expect(findPackageName().props()).toMatchObject({
+        text: '@gitlab-org/package-15',
+      });
+    });
 
-      expect(findLink().attributes('disabled')).toBe('true');
+    it('does not have a link to navigate to the details page', () => {
+      expect(findLink().exists()).toBe(false);
     });
   });
 });
diff --git a/spec/frontend/packages_and_registries/package_registry/components/list/package_list_row_spec.js b/spec/frontend/packages_and_registries/package_registry/components/list/package_list_row_spec.js
index 780f324eaa7..f3d02e4e6ae 100644
--- a/spec/frontend/packages_and_registries/package_registry/components/list/package_list_row_spec.js
+++ b/spec/frontend/packages_and_registries/package_registry/components/list/package_list_row_spec.js
@@ -84,22 +84,13 @@ describe('packages_list_row', () => {
     mountComponent();
 
     expect(findPackageLink().props()).toMatchObject({
-      event: 'click',
       to: { name: 'details', params: { id: getIdFromGraphQLId(packageWithoutTags.id) } },
     });
   });
 
-  it('does not have a link to navigate to the details page', () => {
-    mountComponent({
-      packageEntity: {
-        ...packageWithoutTags,
-        _links: {
-          webPath: null,
-        },
-      },
-    });
+  it('lists the package name', () => {
+    mountComponent();
 
-    expect(findPackageLink().exists()).toBe(false);
     expect(findPackageName().props()).toMatchObject({
       text: '@gitlab-org/package-15',
     });
@@ -156,11 +147,25 @@ describe('packages_list_row', () => {
 
   describe(`when the package is in ${PACKAGE_ERROR_STATUS} status`, () => {
     beforeEach(() => {
-      mountComponent({ packageEntity: { ...packageWithoutTags, status: PACKAGE_ERROR_STATUS } });
+      mountComponent({
+        packageEntity: {
+          ...packageWithoutTags,
+          status: PACKAGE_ERROR_STATUS,
+          _links: {
+            webPath: null,
+          },
+        },
+      });
     });
 
-    it('details link is disabled', () => {
-      expect(findPackageLink().props('event')).toBe('');
+    it('lists the package name', () => {
+      expect(findPackageName().props()).toMatchObject({
+        text: '@gitlab-org/package-15',
+      });
+    });
+
+    it('does not have a link to navigate to the details page', () => {
+      expect(findPackageLink().exists()).toBe(false);
     });
 
     it('has a warning icon', () => {
diff --git a/spec/frontend/packages_and_registries/package_registry/mock_data.js b/spec/frontend/packages_and_registries/package_registry/mock_data.js
index 8c532f31499..ae8cd54a00a 100644
--- a/spec/frontend/packages_and_registries/package_registry/mock_data.js
+++ b/spec/frontend/packages_and_registries/package_registry/mock_data.js
@@ -97,6 +97,12 @@ export const packageProject = () => ({
   __typename: 'Project',
 });
 
+export const linksData = {
+  _links: {
+    webPath: '/gitlab-org/package-15',
+  },
+};
+
 export const packageVersions = () => [
   {
     createdAt: '2021-08-10T09:33:54Z',
@@ -105,6 +111,7 @@ export const packageVersions = () => [
     status: 'DEFAULT',
     tags: { nodes: packageTags() },
     version: '1.0.1',
+    ...linksData,
     __typename: 'Package',
   },
   {
@@ -114,17 +121,11 @@ export const packageVersions = () => [
     status: 'DEFAULT',
     tags: { nodes: packageTags() },
     version: '1.0.2',
+    ...linksData,
     __typename: 'Package',
   },
 ];
 
-export const linksData = {
-  _links: {
-    webPath: '/gitlab-org/package-15',
-    __typeName: 'PackageLinks',
-  },
-};
-
 export const packageData = (extend) => ({
   __typename: 'Package',
   id: 'gid://gitlab/Packages::Package/111',
diff --git a/spec/frontend/packages_and_registries/package_registry/pages/details_spec.js b/spec/frontend/packages_and_registries/package_registry/pages/details_spec.js
index c6a770fad76..6ea78de1bfb 100644
--- a/spec/frontend/packages_and_registries/package_registry/pages/details_spec.js
+++ b/spec/frontend/packages_and_registries/package_registry/pages/details_spec.js
@@ -595,7 +595,8 @@ describe('PackagesApp', () => {
 
     it('binds the correct props', async () => {
       const versionNodes = packageVersions();
-      createComponent({ packageEntity: { versions: { nodes: versionNodes } } });
+      createComponent();
+
       await waitForPromises();
 
       expect(findVersionsList().props()).toMatchObject({
diff --git a/spec/frontend/pipelines/graph/job_item_spec.js b/spec/frontend/pipelines/graph/job_item_spec.js
index 7b3ee276b91..3224c87ab6b 100644
--- a/spec/frontend/pipelines/graph/job_item_spec.js
+++ b/spec/frontend/pipelines/graph/job_item_spec.js
@@ -12,6 +12,7 @@ import {
   mockJob,
   mockJobWithoutDetails,
   mockJobWithUnauthorizedAction,
+  mockFailedJob,
   triggerJob,
   triggerJobWithRetryAction,
 } from './mock_data';
@@ -64,7 +65,6 @@ describe('pipeline graph job item', () => {
 
   afterEach(() => {
     mockAxios.restore();
-    wrapper.destroy();
   });
 
   describe('name with link', () => {
@@ -131,6 +131,18 @@ describe('pipeline graph job item', () => {
       expect(actionComponent.props('actionIcon')).toBe('stop');
       expect(actionComponent.attributes('disabled')).toBe('disabled');
     });
+
+    it('action icon tooltip text when job has passed but can be ran again', () => {
+      createWrapper({ props: { job: mockJob } });
+
+      expect(findActionComponent().props('tooltipText')).toBe('Run again');
+    });
+
+    it('action icon tooltip text when job has failed and can be retried', () => {
+      createWrapper({ props: { job: mockFailedJob } });
+
+      expect(findActionComponent().props('tooltipText')).toBe('Retry');
+    });
   });
 
   describe('job style', () => {
diff --git a/spec/frontend/pipelines/graph/mock_data.js b/spec/frontend/pipelines/graph/mock_data.js
index fc6dfe9ec03..f949ca9564d 100644
--- a/spec/frontend/pipelines/graph/mock_data.js
+++ b/spec/frontend/pipelines/graph/mock_data.js
@@ -1055,3 +1055,25 @@ export const triggerJobWithRetryAction = {
     },
   },
 };
+
+export const mockFailedJob = {
+  id: 3999,
+  name: 'failed job',
+  kind: BUILD_KIND,
+  status: {
+    id: 'failed-3999-3999',
+    icon: 'status_failed',
+    tooltip: 'failed - (stuck or timeout failure)',
+    hasDetails: true,
+    detailsPath: '/root/ci-project/-/jobs/3999',
+    group: 'failed',
+    label: 'failed',
+    action: {
+      id: 'Ci::BuildPresenter-failed-3999',
+      buttonTitle: 'Retry this job',
+      icon: 'retry',
+      path: '/root/ci-project/-/jobs/3999/retry',
+      title: 'Retry',
+    },
+  },
+};
diff --git a/spec/frontend/profile/components/activity_tab_spec.js b/spec/frontend/profile/components/activity_tab_spec.js
new file mode 100644
index 00000000000..9363aad70fd
--- /dev/null
+++ b/spec/frontend/profile/components/activity_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import ActivityTab from '~/profile/components/activity_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('ActivityTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(ActivityTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Activity'));
+  });
+});
diff --git a/spec/frontend/profile/components/contributed_projects_tab_spec.js b/spec/frontend/profile/components/contributed_projects_tab_spec.js
new file mode 100644
index 00000000000..1ee55dc033d
--- /dev/null
+++ b/spec/frontend/profile/components/contributed_projects_tab_spec.js
@@ -0,0 +1,21 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import ContributedProjectsTab from '~/profile/components/contributed_projects_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('ContributedProjectsTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(ContributedProjectsTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(
+      s__('UserProfile|Contributed projects'),
+    );
+  });
+});
diff --git a/spec/frontend/profile/components/followers_tab_spec.js b/spec/frontend/profile/components/followers_tab_spec.js
new file mode 100644
index 00000000000..4af428c4e0c
--- /dev/null
+++ b/spec/frontend/profile/components/followers_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import FollowersTab from '~/profile/components/followers_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('FollowersTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(FollowersTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Followers'));
+  });
+});
diff --git a/spec/frontend/profile/components/following_tab_spec.js b/spec/frontend/profile/components/following_tab_spec.js
new file mode 100644
index 00000000000..75123274ccb
--- /dev/null
+++ b/spec/frontend/profile/components/following_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import FollowingTab from '~/profile/components/following_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('FollowingTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(FollowingTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Following'));
+  });
+});
diff --git a/spec/frontend/profile/components/groups_tab_spec.js b/spec/frontend/profile/components/groups_tab_spec.js
new file mode 100644
index 00000000000..ec480924bdb
--- /dev/null
+++ b/spec/frontend/profile/components/groups_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import GroupsTab from '~/profile/components/groups_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('GroupsTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(GroupsTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Groups'));
+  });
+});
diff --git a/spec/frontend/profile/components/overview_tab_spec.js b/spec/frontend/profile/components/overview_tab_spec.js
new file mode 100644
index 00000000000..eb27515bca3
--- /dev/null
+++ b/spec/frontend/profile/components/overview_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import OverviewTab from '~/profile/components/overview_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('OverviewTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(OverviewTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Overview'));
+  });
+});
diff --git a/spec/frontend/profile/components/personal_projects_tab_spec.js b/spec/frontend/profile/components/personal_projects_tab_spec.js
new file mode 100644
index 00000000000..a701856c544
--- /dev/null
+++ b/spec/frontend/profile/components/personal_projects_tab_spec.js
@@ -0,0 +1,21 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import PersonalProjectsTab from '~/profile/components/personal_projects_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('PersonalProjectsTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(PersonalProjectsTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(
+      s__('UserProfile|Personal projects'),
+    );
+  });
+});
diff --git a/spec/frontend/profile/components/profile_tabs_spec.js b/spec/frontend/profile/components/profile_tabs_spec.js
new file mode 100644
index 00000000000..11ab372f1dd
--- /dev/null
+++ b/spec/frontend/profile/components/profile_tabs_spec.js
@@ -0,0 +1,36 @@
+import ProfileTabs from '~/profile/components/profile_tabs.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+import OverviewTab from '~/profile/components/overview_tab.vue';
+import ActivityTab from '~/profile/components/activity_tab.vue';
+import GroupsTab from '~/profile/components/groups_tab.vue';
+import ContributedProjectsTab from '~/profile/components/contributed_projects_tab.vue';
+import PersonalProjectsTab from '~/profile/components/personal_projects_tab.vue';
+import StarredProjectsTab from '~/profile/components/starred_projects_tab.vue';
+import SnippetsTab from '~/profile/components/snippets_tab.vue';
+import FollowersTab from '~/profile/components/followers_tab.vue';
+import FollowingTab from '~/profile/components/following_tab.vue';
+
+describe('ProfileTabs', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(ProfileTabs);
+  };
+
+  it.each([
+    OverviewTab,
+    ActivityTab,
+    GroupsTab,
+    ContributedProjectsTab,
+    PersonalProjectsTab,
+    StarredProjectsTab,
+    SnippetsTab,
+    FollowersTab,
+    FollowingTab,
+  ])('renders $i18n.title tab', (tab) => {
+    createComponent();
+
+    expect(wrapper.findComponent(tab).exists()).toBe(true);
+  });
+});
diff --git a/spec/frontend/profile/components/snippets_tab_spec.js b/spec/frontend/profile/components/snippets_tab_spec.js
new file mode 100644
index 00000000000..1306757314c
--- /dev/null
+++ b/spec/frontend/profile/components/snippets_tab_spec.js
@@ -0,0 +1,19 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import SnippetsTab from '~/profile/components/snippets_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('SnippetsTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(SnippetsTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(s__('UserProfile|Snippets'));
+  });
+});
diff --git a/spec/frontend/profile/components/starred_projects_tab_spec.js b/spec/frontend/profile/components/starred_projects_tab_spec.js
new file mode 100644
index 00000000000..b9f2839172f
--- /dev/null
+++ b/spec/frontend/profile/components/starred_projects_tab_spec.js
@@ -0,0 +1,21 @@
+import { GlTab } from '@gitlab/ui';
+
+import { s__ } from '~/locale';
+import StarredProjectsTab from '~/profile/components/starred_projects_tab.vue';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+
+describe('StarredProjectsTab', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    wrapper = shallowMountExtended(StarredProjectsTab);
+  };
+
+  it('renders `GlTab` and sets `title` prop', () => {
+    createComponent();
+
+    expect(wrapper.findComponent(GlTab).attributes('title')).toBe(
+      s__('UserProfile|Starred projects'),
+    );
+  });
+});
diff --git a/spec/graphql/mutations/ci/job_token_scope/add_project_spec.rb b/spec/graphql/mutations/ci/job_token_scope/add_project_spec.rb
index 727db7e2361..07c2755a3f7 100644
--- a/spec/graphql/mutations/ci/job_token_scope/add_project_spec.rb
+++ b/spec/graphql/mutations/ci/job_token_scope/add_project_spec.rb
@@ -45,7 +45,7 @@ RSpec.describe Mutations::Ci::JobTokenScope::AddProject do
         it 'adds target project to the job token scope' do
           expect do
             expect(subject).to include(ci_job_token_scope: be_present, errors: be_empty)
-          end.to change { Ci::JobToken::ProjectScopeLink.count }.by(1)
+          end.to change { Ci::JobToken::ProjectScopeLink.outbound.count }.by(1)
         end
 
         context 'when the service returns an error' do
diff --git a/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb b/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
index 59ece15b745..92f4d3dd8e8 100644
--- a/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
@@ -23,18 +23,18 @@ RSpec.describe Resolvers::Ci::JobTokenScopeResolver do
       it 'returns the same project in the allow list of projects for the Ci Job Token when scope is not enabled' do
         allow(project).to receive(:ci_outbound_job_token_scope_enabled?).and_return(false)
 
-        expect(resolve_scope.all_projects).to contain_exactly(project)
+        expect(resolve_scope.outbound_projects).to contain_exactly(project)
       end
 
       it 'returns the same project in the allow list of projects for the Ci Job Token' do
-        expect(resolve_scope.all_projects).to contain_exactly(project)
+        expect(resolve_scope.outbound_projects).to contain_exactly(project)
       end
 
       context 'when another projects gets added to the allow list' do
         let!(:link) { create(:ci_job_token_project_scope_link, source_project: project) }
 
         it 'returns both projects' do
-          expect(resolve_scope.all_projects).to contain_exactly(project, link.target_project)
+          expect(resolve_scope.outbound_projects).to contain_exactly(project, link.target_project)
         end
       end
 
@@ -44,7 +44,7 @@ RSpec.describe Resolvers::Ci::JobTokenScopeResolver do
         end
 
         it 'resolves projects' do
-          expect(resolve_scope.all_projects).to contain_exactly(project)
+          expect(resolve_scope.outbound_projects).to contain_exactly(project)
         end
       end
     end
diff --git a/spec/lib/gitlab/ci/config/yaml_spec.rb b/spec/lib/gitlab/ci/config/yaml_spec.rb
new file mode 100644
index 00000000000..4b34553f55e
--- /dev/null
+++ b/spec/lib/gitlab/ci/config/yaml_spec.rb
@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Ci::Config::Yaml, feature_category: :pipeline_authoring do
+  describe '.load!' do
+    it 'loads a single-doc YAML file' do
+      yaml = <<~YAML
+      image: 'image:1.0'
+      texts:
+        nested_key: 'value1'
+        more_text:
+          more_nested_key: 'value2'
+      YAML
+
+      config = described_class.load!(yaml)
+
+      expect(config).to eq({
+        image: 'image:1.0',
+        texts: {
+          nested_key: 'value1',
+          more_text: {
+            more_nested_key: 'value2'
+          }
+        }
+      })
+    end
+
+    it 'loads the first document from a multi-doc YAML file' do
+      yaml = <<~YAML
+      spec:
+        inputs:
+          test_input:
+      ---
+      image: 'image:1.0'
+      texts:
+        nested_key: 'value1'
+        more_text:
+          more_nested_key: 'value2'
+      YAML
+
+      config = described_class.load!(yaml)
+
+      expect(config).to eq({
+        spec: {
+          inputs: {
+            test_input: nil
+          }
+        }
+      })
+    end
+
+    context 'when ci_multi_doc_yaml is disabled' do
+      before do
+        stub_feature_flags(ci_multi_doc_yaml: false)
+      end
+
+      it 'loads a single-doc YAML file' do
+        yaml = <<~YAML
+        image: 'image:1.0'
+        texts:
+          nested_key: 'value1'
+          more_text:
+            more_nested_key: 'value2'
+        YAML
+
+        config = described_class.load!(yaml)
+
+        expect(config).to eq({
+          image: 'image:1.0',
+          texts: {
+            nested_key: 'value1',
+            more_text: {
+              more_nested_key: 'value2'
+            }
+          }
+        })
+      end
+
+      it 'loads the first document from a multi-doc YAML file' do
+        yaml = <<~YAML
+        spec:
+          inputs:
+            test_input:
+        ---
+        image: 'image:1.0'
+        texts:
+          nested_key: 'value1'
+          more_text:
+            more_nested_key: 'value2'
+        YAML
+
+        config = described_class.load!(yaml)
+
+        expect(config).to eq({
+          spec: {
+            inputs: {
+              test_input: nil
+            }
+          }
+        })
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/config/loader/multi_doc_yaml_spec.rb b/spec/lib/gitlab/config/loader/multi_doc_yaml_spec.rb
new file mode 100644
index 00000000000..bae98f9bc35
--- /dev/null
+++ b/spec/lib/gitlab/config/loader/multi_doc_yaml_spec.rb
@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Config::Loader::MultiDocYaml, feature_category: :pipeline_authoring do
+  let(:loader) { described_class.new(yml, max_documents: 2) }
+
+  describe '#load!' do
+    let(:yml) do
+      <<~YAML
+      spec:
+        inputs:
+          test_input:
+      ---
+      test_job:
+        script: echo "$[[ inputs.test_input ]]"
+      YAML
+    end
+
+    it 'returns the loaded YAML with all keys as symbols' do
+      expect(loader.load!).to eq([
+        { spec: { inputs: { test_input: nil } } },
+        { test_job: { script: 'echo "$[[ inputs.test_input ]]"' } }
+      ])
+    end
+
+    context 'when the YAML file is empty' do
+      let(:yml) { '' }
+
+      it 'returns an empty array' do
+        expect(loader.load!).to be_empty
+      end
+    end
+
+    context 'when the parsed YAML is too big' do
+      let(:yml) do
+        <<~YAML
+        a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
+        b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
+        c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
+        d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
+        e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
+        f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
+        g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
+        h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
+        i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
+        ---
+        a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
+        b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
+        c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
+        d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
+        e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
+        f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
+        g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
+        h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
+        i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
+        YAML
+      end
+
+      it 'raises a DataTooLargeError' do
+        expect { loader.load! }.to raise_error(described_class::DataTooLargeError, 'The parsed YAML is too big')
+      end
+    end
+
+    context 'when a document is not a hash' do
+      let(:yml) do
+        <<~YAML
+        not_a_hash
+        ---
+        test_job:
+          script: echo "$[[ inputs.test_input ]]"
+        YAML
+      end
+
+      it 'raises a NotHashError' do
+        expect { loader.load! }.to raise_error(described_class::NotHashError, 'Invalid configuration format')
+      end
+    end
+
+    context 'when there are too many documents' do
+      let(:yml) do
+        <<~YAML
+        a: b
+        ---
+        c: d
+        ---
+        e: f
+        YAML
+      end
+
+      it 'raises a TooManyDocumentsError' do
+        expect { loader.load! }.to raise_error(
+          described_class::TooManyDocumentsError,
+          'The parsed YAML has too many documents'
+        )
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/config/loader/yaml_spec.rb b/spec/lib/gitlab/config/loader/yaml_spec.rb
index c7f84cd583c..346424d1681 100644
--- a/spec/lib/gitlab/config/loader/yaml_spec.rb
+++ b/spec/lib/gitlab/config/loader/yaml_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Gitlab::Config::Loader::Yaml do
+RSpec.describe Gitlab::Config::Loader::Yaml, feature_category: :pipeline_authoring do
   let(:loader) { described_class.new(yml) }
 
   let(:yml) do
diff --git a/spec/lib/gitlab/encoding_helper_spec.rb b/spec/lib/gitlab/encoding_helper_spec.rb
index c62e3071fc1..bc72d1a67d6 100644
--- a/spec/lib/gitlab/encoding_helper_spec.rb
+++ b/spec/lib/gitlab/encoding_helper_spec.rb
@@ -283,4 +283,12 @@ RSpec.describe Gitlab::EncodingHelper do
       expect(described_class.unquote_path('"\a\b\e\f\n\r\t\v\""')).to eq("\a\b\e\f\n\r\t\v\"")
     end
   end
+
+  describe '#strip_bom' do
+    it do
+      expect(described_class.strip_bom('no changes')).to eq('no changes')
+      expect(described_class.strip_bom("\xEF\xBB\xBFhello world")).to eq('hello world')
+      expect(described_class.strip_bom("BOM at the end\xEF\xBB\xBF")).to eq("BOM at the end\xEF\xBB\xBF")
+    end
+  end
 end
diff --git a/spec/models/ci/job_token/allowlist_spec.rb b/spec/models/ci/job_token/allowlist_spec.rb
index 45083d64393..c69dcba765a 100644
--- a/spec/models/ci/job_token/allowlist_spec.rb
+++ b/spec/models/ci/job_token/allowlist_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Ci::JobToken::Allowlist, feature_category: :continuous_integration do
+  include Ci::JobTokenScopeHelpers
   using RSpec::Parameterized::TableSyntax
 
   let_it_be(:source_project) { create(:project) }
@@ -24,11 +25,11 @@ RSpec.describe Ci::JobToken::Allowlist, feature_category: :continuous_integratio
     end
 
     context 'when projects are added to the scope' do
-      include_context 'with scoped projects'
+      include_context 'with a project in each allowlist'
 
       where(:direction, :additional_project) do
-        :outbound | ref(:outbound_scoped_project)
-        :inbound  | ref(:inbound_scoped_project)
+        :outbound | ref(:outbound_allowlist_project)
+        :inbound  | ref(:inbound_allowlist_project)
       end
 
       with_them do
@@ -57,16 +58,16 @@ RSpec.describe Ci::JobToken::Allowlist, feature_category: :continuous_integratio
       end
     end
 
-    context 'with scoped projects' do
-      include_context 'with scoped projects'
+    context 'with a project in each allowlist' do
+      include_context 'with a project in each allowlist'
 
       where(:includes_project, :direction, :result) do
         ref(:source_project)          | :outbound | false
         ref(:source_project)          | :inbound  | false
-        ref(:inbound_scoped_project)  | :outbound | false
-        ref(:inbound_scoped_project)  | :inbound  | true
-        ref(:outbound_scoped_project) | :outbound | true
-        ref(:outbound_scoped_project) | :inbound  | false
+        ref(:inbound_allowlist_project)  | :outbound | false
+        ref(:inbound_allowlist_project)  | :inbound  | true
+        ref(:outbound_allowlist_project) | :outbound | true
+        ref(:outbound_allowlist_project) | :inbound  | false
         ref(:unscoped_project1)       | :outbound | false
         ref(:unscoped_project1)       | :inbound  | false
         ref(:unscoped_project2)       | :outbound | false
diff --git a/spec/models/ci/job_token/project_scope_link_spec.rb b/spec/models/ci/job_token/project_scope_link_spec.rb
index 91491733c44..30ae8bc6d88 100644
--- a/spec/models/ci/job_token/project_scope_link_spec.rb
+++ b/spec/models/ci/job_token/project_scope_link_spec.rb
@@ -18,11 +18,12 @@ RSpec.describe Ci::JobToken::ProjectScopeLink, feature_category: :continuous_int
   describe 'unique index' do
     let!(:link) { create(:ci_job_token_project_scope_link) }
 
-    it 'raises an error' do
+    it 'raises an error, when not unique' do
       expect do
         create(:ci_job_token_project_scope_link,
           source_project: link.source_project,
-          target_project: link.target_project)
+          target_project: link.target_project,
+          direction: link.direction)
       end.to raise_error(ActiveRecord::RecordNotUnique)
     end
   end
diff --git a/spec/models/ci/job_token/scope_spec.rb b/spec/models/ci/job_token/scope_spec.rb
index 37c56973506..da632622f1b 100644
--- a/spec/models/ci/job_token/scope_spec.rb
+++ b/spec/models/ci/job_token/scope_spec.rb
@@ -2,78 +2,144 @@
 
 require 'spec_helper'
 
-RSpec.describe Ci::JobToken::Scope, feature_category: :continuous_integration do
-  let_it_be(:source_project) { create(:project, ci_outbound_job_token_scope_enabled: true) }
+RSpec.describe Ci::JobToken::Scope, feature_category: :continuous_integration, factory_default: :keep do
+  include Ci::JobTokenScopeHelpers
+  using RSpec::Parameterized::TableSyntax
 
-  let(:scope) { described_class.new(source_project) }
+  let_it_be(:project) { create_default(:project) }
+  let_it_be(:user) { create_default(:user) }
+  let_it_be(:namespace) { create_default(:namespace) }
 
-  describe '#all_projects' do
-    subject(:all_projects) { scope.all_projects }
+  let_it_be(:source_project) do
+    create(:project,
+      ci_outbound_job_token_scope_enabled: true,
+      ci_inbound_job_token_scope_enabled: true
+    )
+  end
+
+  let(:current_project) { source_project }
+
+  let(:scope) { described_class.new(current_project) }
+
+  describe '#outbound_projects' do
+    subject { scope.outbound_projects }
 
     context 'when no projects are added to the scope' do
       it 'returns the project defining the scope' do
-        expect(all_projects).to contain_exactly(source_project)
+        expect(subject).to contain_exactly(current_project)
       end
     end
 
     context 'when projects are added to the scope' do
-      include_context 'with scoped projects'
+      include_context 'with accessible and inaccessible projects'
 
       it 'returns all projects that can be accessed from a given scope' do
-        expect(subject).to contain_exactly(source_project, outbound_scoped_project)
+        expect(subject).to contain_exactly(current_project, outbound_allowlist_project, fully_accessible_project)
       end
     end
   end
 
-  describe '#allows?' do
-    subject { scope.allows?(includes_project) }
+  describe '#inbound_projects' do
+    subject { scope.inbound_projects }
 
-    context 'without scoped projects' do
-      context 'when self referential' do
-        let(:includes_project) { source_project }
-
-        it { is_expected.to be_truthy }
+    context 'when no projects are added to the scope' do
+      it 'returns the project defining the scope' do
+        expect(subject).to contain_exactly(current_project)
       end
     end
 
-    context 'with scoped projects' do
-      include_context 'with scoped projects'
+    context 'when projects are added to the scope' do
+      include_context 'with accessible and inaccessible projects'
 
-      context 'when project is in outbound scope' do
-        let(:includes_project) { outbound_scoped_project }
-
-        it { is_expected.to be_truthy }
+      it 'returns all projects that can be accessed from a given scope' do
+        expect(subject).to contain_exactly(current_project, inbound_allowlist_project)
       end
+    end
+  end
 
-      context 'when project is in inbound scope' do
-        let(:includes_project) { inbound_scoped_project }
+  RSpec.shared_examples 'enforces outbound scope only' do
+    include_context 'with accessible and inaccessible projects'
 
-        it { is_expected.to be_falsey }
-      end
+    where(:accessed_project, :result) do
+      ref(:current_project)            | true
+      ref(:inbound_allowlist_project)  | false
+      ref(:unscoped_project1)          | false
+      ref(:unscoped_project2)          | false
+      ref(:outbound_allowlist_project) | true
+      ref(:inbound_accessible_project) | false
+      ref(:fully_accessible_project)   | true
+    end
 
-      context 'when project is linked to a different project' do
-        let(:includes_project) { unscoped_project1 }
+    with_them do
+      it { is_expected.to eq(result) }
+    end
+  end
 
-        it { is_expected.to be_falsey }
-      end
+  describe 'accessible?' do
+    subject { scope.accessible?(accessed_project) }
 
-      context 'when project is unlinked to a project' do
-        let(:includes_project) { unscoped_project2 }
+    context 'with inbound and outbound scopes enabled' do
+      context 'when inbound and outbound access setup' do
+        include_context 'with accessible and inaccessible projects'
 
-        it { is_expected.to be_falsey }
-      end
-
-      context 'when project scope setting is disabled' do
-        let(:includes_project) { unscoped_project1 }
-
-        before do
-          source_project.ci_outbound_job_token_scope_enabled = false
+        where(:accessed_project, :result) do
+          ref(:current_project)            | true
+          ref(:inbound_allowlist_project)  | false
+          ref(:unscoped_project1)          | false
+          ref(:unscoped_project2)          | false
+          ref(:outbound_allowlist_project) | false
+          ref(:inbound_accessible_project) | false
+          ref(:fully_accessible_project)   | true
         end
 
-        it 'considers any project to be part of the scope' do
-          expect(subject).to be_truthy
+        with_them do
+          it 'allows self and projects allowed from both directions' do
+            is_expected.to eq(result)
+          end
         end
       end
     end
+
+    context 'with inbound scope enabled and outbound scope disabled' do
+      before do
+        source_project.ci_inbound_job_token_scope_enabled = true
+        source_project.ci_outbound_job_token_scope_enabled = false
+        source_project.save!
+      end
+
+      include_context 'with accessible and inaccessible projects'
+
+      where(:accessed_project, :result) do
+        ref(:current_project)            | true
+        ref(:inbound_allowlist_project)  | false
+        ref(:unscoped_project1)          | false
+        ref(:unscoped_project2)          | false
+        ref(:outbound_allowlist_project) | false
+        ref(:inbound_accessible_project) | true
+        ref(:fully_accessible_project)   | true
+      end
+
+      with_them do
+        it { is_expected.to eq(result) }
+      end
+    end
+
+    context 'with inbound scope disabled and outbound scope enabled' do
+      before do
+        source_project.ci_inbound_job_token_scope_enabled = false
+        source_project.ci_outbound_job_token_scope_enabled = true
+        source_project.save!
+      end
+
+      include_examples 'enforces outbound scope only'
+    end
+
+    context 'when inbound scope flag disabled' do
+      before do
+        stub_feature_flags(ci_inbound_job_token_scope: false)
+      end
+
+      include_examples 'enforces outbound scope only'
+    end
   end
 end
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index a98f091b9fc..434f7a43665 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -2478,7 +2478,10 @@ RSpec.describe ProjectPolicy, feature_category: :authentication_and_authorizatio
       before do
         current_user.set_ci_job_token_scope!(job)
         current_user.external = external_user
-        scope_project.update!(ci_outbound_job_token_scope_enabled: token_scope_enabled)
+        scope_project.update!(
+          ci_outbound_job_token_scope_enabled: token_scope_enabled,
+          ci_inbound_job_token_scope_enabled: token_scope_enabled
+        )
       end
 
       it "enforces the expected permissions" do
diff --git a/spec/requests/api/ci/job_artifacts_spec.rb b/spec/requests/api/ci/job_artifacts_spec.rb
index a4a38179d11..ee390773f29 100644
--- a/spec/requests/api/ci/job_artifacts_spec.rb
+++ b/spec/requests/api/ci/job_artifacts_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe API::Ci::JobArtifacts, feature_category: :build_artifacts do
   include HttpBasicAuthHelpers
   include DependencyProxyHelpers
+  include Ci::JobTokenScopeHelpers
 
   include HttpIOHelpers
 
@@ -312,7 +313,7 @@ RSpec.describe API::Ci::JobArtifacts, feature_category: :build_artifacts do
     context 'normal authentication' do
       context 'job with artifacts' do
         context 'when artifacts are stored locally' do
-          let(:job) { create(:ci_build, :artifacts, pipeline: pipeline) }
+          let(:job) { create(:ci_build, :artifacts, pipeline: pipeline, project: project) }
 
           subject { get api("/projects/#{project.id}/jobs/#{job.id}/artifacts", api_user) }
 
@@ -329,11 +330,12 @@ RSpec.describe API::Ci::JobArtifacts, feature_category: :build_artifacts do
               stub_licensed_features(cross_project_pipelines: true)
             end
 
-            it_behaves_like 'downloads artifact'
-
             context 'when job token scope is enabled' do
               before do
-                other_job.project.ci_cd_settings.update!(job_token_scope_enabled: true)
+                other_job.project.ci_cd_settings.update!(
+                  job_token_scope_enabled: true,
+                  inbound_job_token_scope_enabled: true
+                )
               end
 
               it 'does not allow downloading artifacts' do
@@ -343,7 +345,9 @@ RSpec.describe API::Ci::JobArtifacts, feature_category: :build_artifacts do
               end
 
               context 'when project is added to the job token scope' do
-                let!(:link) { create(:ci_job_token_project_scope_link, source_project: other_job.project, target_project: job.project) }
+                before do
+                  make_project_fully_accessible(other_job.project, job.project)
+                end
 
                 it_behaves_like 'downloads artifact'
               end
diff --git a/spec/requests/api/debian_group_packages_spec.rb b/spec/requests/api/debian_group_packages_spec.rb
index f4d5ef3fe90..0c80b7d830f 100644
--- a/spec/requests/api/debian_group_packages_spec.rb
+++ b/spec/requests/api/debian_group_packages_spec.rb
@@ -36,6 +36,12 @@ RSpec.describe API::DebianGroupPackages, feature_category: :package_registry do
       it_behaves_like 'Debian packages read endpoint', 'GET', :success, /Description: This is an incomplete Packages file/
     end
 
+    describe 'GET groups/:id/-/packages/debian/dists/*distribution/:component/binary-:architecture/Packages.gz' do
+      let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/#{component.name}/binary-#{architecture.name}/Packages.gz" }
+
+      it_behaves_like 'Debian packages read endpoint', 'GET', :not_found, /Format gz is not supported/
+    end
+
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/:component/binary-:architecture/by-hash/SHA256/:file_sha256' do
       let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/#{component.name}/binary-#{architecture.name}/by-hash/SHA256/#{component_file_older_sha256.file_sha256}" }
 
@@ -60,6 +66,12 @@ RSpec.describe API::DebianGroupPackages, feature_category: :package_registry do
       it_behaves_like 'Debian packages read endpoint', 'GET', :success, /Description: This is an incomplete D-I Packages file/
     end
 
+    describe 'GET groups/:id/-/packages/debian/dists/*distribution/:component/debian-installer/binary-:architecture/Packages.gz' do
+      let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/#{component.name}/debian-installer/binary-#{architecture.name}/Packages.gz" }
+
+      it_behaves_like 'Debian packages read endpoint', 'GET', :not_found, /Format gz is not supported/
+    end
+
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/:component/debian-installer/binary-:architecture/by-hash/SHA256/:file_sha256' do
       let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/#{component.name}/debian-installer/binary-#{architecture.name}/by-hash/SHA256/#{component_file_di_older_sha256.file_sha256}" }
 
diff --git a/spec/requests/api/debian_project_packages_spec.rb b/spec/requests/api/debian_project_packages_spec.rb
index 5258d26be17..be1ca907ffb 100644
--- a/spec/requests/api/debian_project_packages_spec.rb
+++ b/spec/requests/api/debian_project_packages_spec.rb
@@ -50,6 +50,12 @@ RSpec.describe API::DebianProjectPackages, feature_category: :package_registry d
       it_behaves_like 'accept GET request on private project with access to package registry for everyone'
     end
 
+    describe 'GET projects/:id/packages/debian/dists/*distribution/:component/binary-:architecture/Packages.gz' do
+      let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/#{component.name}/binary-#{architecture.name}/Packages.gz" }
+
+      it_behaves_like 'Debian packages read endpoint', 'GET', :not_found, /Format gz is not supported/
+    end
+
     describe 'GET projects/:id/packages/debian/dists/*distribution/:component/binary-:architecture/by-hash/SHA256/:file_sha256' do
       let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/#{component.name}/binary-#{architecture.name}/by-hash/SHA256/#{component_file_older_sha256.file_sha256}" }
 
@@ -78,6 +84,12 @@ RSpec.describe API::DebianProjectPackages, feature_category: :package_registry d
       it_behaves_like 'accept GET request on private project with access to package registry for everyone'
     end
 
+    describe 'GET projects/:id/packages/debian/dists/*distribution/:component/debian-installer/binary-:architecture/Packages.gz' do
+      let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/#{component.name}/debian-installer/binary-#{architecture.name}/Packages.gz" }
+
+      it_behaves_like 'Debian packages read endpoint', 'GET', :not_found, /Format gz is not supported/
+    end
+
     describe 'GET projects/:id/packages/debian/dists/*distribution/:component/debian-installer/binary-:architecture/by-hash/SHA256/:file_sha256' do
       let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/#{component.name}/debian-installer/binary-#{architecture.name}/by-hash/SHA256/#{component_file_di_older_sha256.file_sha256}" }
 
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
index 490716ddbe2..55e728b2141 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
@@ -60,7 +60,7 @@ RSpec.describe 'CiJobTokenScopeAddProject', feature_category: :continuous_integr
         post_graphql_mutation(mutation, current_user: current_user)
         expect(response).to have_gitlab_http_status(:success)
         expect(mutation_response.dig('ciJobTokenScope', 'projects', 'nodes')).not_to be_empty
-      end.to change { Ci::JobToken::Scope.new(project).allows?(target_project) }.from(false).to(true)
+      end.to change { Ci::JobToken::ProjectScopeLink.outbound.count }.by(1)
     end
 
     context 'when invalid target project is provided' do
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
index 607c6bd85c2..61d5c56ae8a 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
@@ -5,7 +5,13 @@ require 'spec_helper'
 RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_integration do
   include GraphqlHelpers
 
-  let_it_be(:project) { create(:project, ci_outbound_job_token_scope_enabled: true).tap(&:save!) }
+  let_it_be(:project) do
+    create(:project,
+      ci_outbound_job_token_scope_enabled: true,
+      ci_inbound_job_token_scope_enabled: true
+    )
+  end
+
   let_it_be(:target_project) { create(:project) }
 
   let_it_be(:link) do
@@ -66,7 +72,7 @@ RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_int
         post_graphql_mutation(mutation, current_user: current_user)
         expect(response).to have_gitlab_http_status(:success)
         expect(mutation_response.dig('ciJobTokenScope', 'projects', 'nodes')).not_to be_empty
-      end.to change { Ci::JobToken::Scope.new(project).allows?(target_project) }.from(true).to(false)
+      end.to change { Ci::JobToken::ProjectScopeLink.outbound.count }.by(-1)
     end
 
     context 'when invalid target project is provided' do
diff --git a/spec/requests/api/project_packages_spec.rb b/spec/requests/api/project_packages_spec.rb
index d3adef85f8d..c003ae9cd48 100644
--- a/spec/requests/api/project_packages_spec.rb
+++ b/spec/requests/api/project_packages_spec.rb
@@ -88,7 +88,7 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
         end
 
         context 'with JOB-TOKEN auth' do
-          let(:job) { create(:ci_build, :running, user: user) }
+          let(:job) { create(:ci_build, :running, user: user, project: project) }
 
           subject { get api(url, job_token: job.token) }
 
@@ -130,7 +130,7 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
         end
 
         context 'with JOB-TOKEN auth' do
-          let(:job) { create(:ci_build, :running, user: user) }
+          let(:job) { create(:ci_build, :running, user: user, project: project) }
 
           subject { get api(url, job_token: job.token) }
 
@@ -229,8 +229,8 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
             get api(package_url, user)
           end
 
-          pipeline = create(:ci_pipeline, user: user)
-          create(:ci_build, user: user, pipeline: pipeline)
+          pipeline = create(:ci_pipeline, user: user, project: project)
+          create(:ci_build, user: user, pipeline: pipeline, project: project)
           create(:package_build_info, package: package1, pipeline: pipeline)
 
           expect do
@@ -262,7 +262,7 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
         it_behaves_like 'no destroy url'
 
         context 'with JOB-TOKEN auth' do
-          let(:job) { create(:ci_build, :running, user: user) }
+          let(:job) { create(:ci_build, :running, user: user, project: project) }
 
           subject { get api(package_url, job_token: job.token) }
 
@@ -324,7 +324,7 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
         end
 
         context 'with JOB-TOKEN auth' do
-          let(:job) { create(:ci_build, :running, user: user) }
+          let(:job) { create(:ci_build, :running, user: user, project: project) }
 
           subject { get api(package_url, job_token: job.token) }
 
@@ -430,7 +430,7 @@ RSpec.describe API::ProjectPackages, feature_category: :package_registry do
         end
 
         context 'with JOB-TOKEN auth' do
-          let(:job) { create(:ci_build, :running, user: user) }
+          let(:job) { create(:ci_build, :running, user: user, project: project) }
 
           it 'returns 403 for a user without enough permissions' do
             project.add_developer(user)
diff --git a/spec/requests/api/release/links_spec.rb b/spec/requests/api/release/links_spec.rb
index 4a7821fcb0a..462cc1e3b5d 100644
--- a/spec/requests/api/release/links_spec.rb
+++ b/spec/requests/api/release/links_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe API::Release::Links, feature_category: :release_orchestration do
+  include Ci::JobTokenScopeHelpers
+
   let(:project) { create(:project, :repository, :private) }
   let(:maintainer) { create(:user) }
   let(:developer) { create(:user) }
@@ -51,7 +53,7 @@ RSpec.describe API::Release::Links, feature_category: :release_orchestration do
       end
 
       context 'when using JOB-TOKEN auth' do
-        let(:job) { create(:ci_build, :running, user: maintainer) }
+        let(:job) { create(:ci_build, :running, user: maintainer, project: project) }
 
         it 'returns releases links' do
           get api("/projects/#{project.id}/releases/v0.1/assets/links", job_token: job.token)
@@ -127,7 +129,7 @@ RSpec.describe API::Release::Links, feature_category: :release_orchestration do
     end
 
     context 'when using JOB-TOKEN auth' do
-      let(:job) { create(:ci_build, :running, user: maintainer) }
+      let(:job) { create(:ci_build, :running, user: maintainer, project: project) }
 
       it 'returns releases link' do
         get api("/projects/#{project.id}/releases/v0.1/assets/links/#{release_link.id}", job_token: job.token)
@@ -241,7 +243,7 @@ RSpec.describe API::Release::Links, feature_category: :release_orchestration do
     end
 
     context 'when using JOB-TOKEN auth' do
-      let(:job) { create(:ci_build, :running, user: maintainer) }
+      let(:job) { create(:ci_build, :running, user: maintainer, project: project) }
 
       it 'creates a new release link' do
         expect do
@@ -385,7 +387,7 @@ RSpec.describe API::Release::Links, feature_category: :release_orchestration do
     end
 
     context 'when using JOB-TOKEN auth' do
-      let(:job) { create(:ci_build, :running, user: maintainer) }
+      let(:job) { create(:ci_build, :running, user: maintainer, project: project) }
 
       it 'updates the release link' do
         put api("/projects/#{project.id}/releases/v0.1/assets/links/#{release_link.id}"), params: params.merge(job_token: job.token)
@@ -496,7 +498,7 @@ RSpec.describe API::Release::Links, feature_category: :release_orchestration do
     end
 
     context 'when using JOB-TOKEN auth' do
-      let(:job) { create(:ci_build, :running, user: maintainer) }
+      let(:job) { create(:ci_build, :running, user: maintainer, project: project) }
 
       it 'deletes the release link' do
         expect do
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index 66337b94c75..02b99eba8ce 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -7,6 +7,7 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
   include TermsHelper
   include GitHttpHelpers
   include WorkhorseHelpers
+  include Ci::JobTokenScopeHelpers
 
   shared_examples 'pulls require Basic HTTP Authentication' do
     context "when no credentials are provided" do
@@ -869,14 +870,15 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
         context "when a gitlab ci token is provided" do
           let(:project) { create(:project, :repository) }
-          let(:build) { create(:ci_build, :running) }
-          let(:other_project) { create(:project, :repository) }
-
-          before do
-            build.update!(project: project) # can't associate it on factory create
+          let(:build) { create(:ci_build, :running, project: project, user: user) }
+          let(:other_project) do
+            create(:project, :repository).tap do |o|
+              make_project_fully_accessible(project, o)
+            end
           end
 
           context 'when build created by system is authenticated' do
+            let(:user) { nil }
             let(:path) { "#{project.full_path}.git" }
             let(:env) { { user: 'gitlab-ci-token', password: build.token } }
 
@@ -899,12 +901,7 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
           context 'and build created by' do
             before do
-              build.update!(user: user)
               project.add_reporter(user)
-              create(:ci_job_token_project_scope_link,
-                     source_project: project,
-                     target_project: other_project,
-                     added_by: user)
             end
 
             shared_examples 'can download code only' do
@@ -1474,19 +1471,16 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
         context "when a gitlab ci token is provided" do
           let(:project) { create(:project, :repository) }
-          let(:build) { create(:ci_build, :running) }
-          let(:other_project) { create(:project, :repository) }
-
-          before do
-            build.update!(project: project) # can't associate it on factory create
-            create(:ci_job_token_project_scope_link,
-                    source_project: project,
-                    target_project: other_project,
-                    added_by: user)
+          let(:build) { create(:ci_build, :running, project: project, user: user) }
+          let(:other_project) do
+            create(:project, :repository).tap do |o|
+              make_project_fully_accessible(project, o)
+            end
           end
 
           # legacy behavior that is blocked/deprecated
           context 'when build created by system is authenticated' do
+            let(:user) { nil }
             let(:path) { "#{project.full_path}.git" }
             let(:env) { { user: 'gitlab-ci-token', password: build.token } }
 
@@ -1505,7 +1499,6 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
           context 'and build created by' do
             before do
-              build.update!(user: user)
               project.add_reporter(user)
             end
 
@@ -1862,13 +1855,9 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
     end
 
     context 'from CI' do
-      let(:build) { create(:ci_build, :running) }
+      let(:build) { create(:ci_build, :running, user: user, project: project) }
       let(:env) { { user: 'gitlab-ci-token', password: build.token } }
 
-      before do
-        build.update!(user: user, project: project)
-      end
-
       it_behaves_like 'pulls are allowed'
     end
   end
diff --git a/spec/services/ci/parse_dotenv_artifact_service_spec.rb b/spec/services/ci/parse_dotenv_artifact_service_spec.rb
index 7b3af33ac72..f720375f05c 100644
--- a/spec/services/ci/parse_dotenv_artifact_service_spec.rb
+++ b/spec/services/ci/parse_dotenv_artifact_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Ci::ParseDotenvArtifactService do
+RSpec.describe Ci::ParseDotenvArtifactService, feature_category: :build_artifacts do
   let_it_be(:project) { create(:project) }
   let_it_be(:pipeline) { create(:ci_pipeline, project: project) }
 
@@ -223,6 +223,18 @@ RSpec.describe Ci::ParseDotenvArtifactService do
           end
         end
 
+        context 'when blob is encoded in UTF-16 LE' do
+          let(:blob) { File.read(Rails.root.join('spec/fixtures/build_artifacts/dotenv_utf16_le.txt')) }
+
+          it 'parses the dotenv data' do
+            subject
+
+            expect(build.job_variables.as_json(only: [:key, :value])).to contain_exactly(
+              hash_including('key' => 'MY_ENV_VAR', 'value' => 'true'),
+              hash_including('key' => 'TEST2', 'value' => 'false'))
+          end
+        end
+
         context 'when more than limitated variables are specified in dotenv' do
           let(:blob) do
             StringIO.new.tap do |s|
diff --git a/spec/support/helpers/ci/job_token_scope_helpers.rb b/spec/support/helpers/ci/job_token_scope_helpers.rb
new file mode 100644
index 00000000000..09084bc8715
--- /dev/null
+++ b/spec/support/helpers/ci/job_token_scope_helpers.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Ci
+  module JobTokenScopeHelpers
+    def create_project_in_allowlist(root_project, direction:)
+      create(:project).tap do |scoped_project|
+        create(
+          :ci_job_token_project_scope_link,
+          source_project: root_project,
+          target_project: scoped_project,
+          direction: direction
+        )
+      end
+    end
+
+    def create_inbound_accessible_project(project)
+      create(:project).tap do |accessible_project|
+        add_inbound_accessible_linkage(project, accessible_project)
+      end
+    end
+
+    def create_inbound_and_outbound_accessible_project(project)
+      create(:project).tap do |accessible_project|
+        make_project_fully_accessible(project, accessible_project)
+      end
+    end
+
+    def make_project_fully_accessible(project, accessible_project)
+      add_outbound_accessible_linkage(project, accessible_project)
+      add_inbound_accessible_linkage(project, accessible_project)
+    end
+
+    def add_outbound_accessible_linkage(project, accessible_project)
+      create(
+        :ci_job_token_project_scope_link,
+        source_project: project,
+        target_project: accessible_project,
+        direction: :outbound
+      )
+    end
+
+    def add_inbound_accessible_linkage(project, accessible_project)
+      create(
+        :ci_job_token_project_scope_link,
+        source_project: accessible_project,
+        target_project: project,
+        direction: :inbound
+      )
+    end
+  end
+end
diff --git a/spec/support/shared_contexts/models/ci/job_token_scope.rb b/spec/support/shared_contexts/models/ci/job_token_scope.rb
index 51f671b139d..d0fee23b57c 100644
--- a/spec/support/shared_contexts/models/ci/job_token_scope.rb
+++ b/spec/support/shared_contexts/models/ci/job_token_scope.rb
@@ -1,21 +1,27 @@
 # frozen_string_literal: true
 
-RSpec.shared_context 'with scoped projects' do
-  let_it_be(:inbound_scoped_project) { create_scoped_project(source_project, direction: :inbound) }
-  let_it_be(:outbound_scoped_project) { create_scoped_project(source_project, direction: :outbound) }
+RSpec.shared_context 'with a project in each allowlist' do
+  let_it_be(:outbound_allowlist_project) { create_project_in_allowlist(source_project, direction: :outbound) }
+
+  include_context 'with inaccessible projects'
+end
+
+RSpec.shared_context 'with accessible and inaccessible projects' do
+  let_it_be(:outbound_allowlist_project) { create_project_in_allowlist(source_project, direction: :outbound) }
+  let_it_be(:inbound_accessible_project) { create_inbound_accessible_project(source_project) }
+  let_it_be(:fully_accessible_project) { create_inbound_and_outbound_accessible_project(source_project) }
+
+  include_context 'with inaccessible projects'
+end
+
+RSpec.shared_context 'with inaccessible projects' do
+  let_it_be(:inbound_allowlist_project) { create_project_in_allowlist(source_project, direction: :inbound) }
+  include_context 'with unscoped projects'
+end
+
+RSpec.shared_context 'with unscoped projects' do
   let_it_be(:unscoped_project1) { create(:project) }
   let_it_be(:unscoped_project2) { create(:project) }
 
   let_it_be(:link_out_of_scope) { create(:ci_job_token_project_scope_link, target_project: unscoped_project1) }
-
-  def create_scoped_project(source_project, direction:)
-    create(:project).tap do |scoped_project|
-      create(
-        :ci_job_token_project_scope_link,
-        source_project: source_project,
-        target_project: scoped_project,
-        direction: direction
-      )
-    end
-  end
 end
diff --git a/spec/support/shared_contexts/requests/api/conan_packages_shared_context.rb b/spec/support/shared_contexts/requests/api/conan_packages_shared_context.rb
index 7c37e5189f1..f6e10543c84 100644
--- a/spec/support/shared_contexts/requests/api/conan_packages_shared_context.rb
+++ b/spec/support/shared_contexts/requests/api/conan_packages_shared_context.rb
@@ -11,7 +11,7 @@ RSpec.shared_context 'conan api setup' do
   let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
 
   let(:project) { package.project }
-  let(:job) { create(:ci_build, :running, user: user) }
+  let(:job) { create(:ci_build, :running, user: user, project: project) }
   let(:job_token) { job.token }
   let(:auth_token) { personal_access_token.token }
   let(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
diff --git a/spec/support/shared_examples/services/packages_shared_examples.rb b/spec/support/shared_examples/services/packages_shared_examples.rb
index e0dd08ec50e..f63693dbf26 100644
--- a/spec/support/shared_examples/services/packages_shared_examples.rb
+++ b/spec/support/shared_examples/services/packages_shared_examples.rb
@@ -2,7 +2,7 @@
 
 RSpec.shared_examples 'assigns build to package' do
   context 'with build info' do
-    let(:job) { create(:ci_build, user: user) }
+    let(:job) { create(:ci_build, user: user, project: project) }
     let(:params) { super().merge(build: job) }
 
     it 'assigns the pipeline to the package' do
diff --git a/tooling/lib/tooling/parallel_rspec_runner.rb b/tooling/lib/tooling/parallel_rspec_runner.rb
index b1ddc91e831..79af1124579 100644
--- a/tooling/lib/tooling/parallel_rspec_runner.rb
+++ b/tooling/lib/tooling/parallel_rspec_runner.rb
@@ -2,6 +2,52 @@
 
 require 'knapsack'
 
+module KnapsackRefinements
+  # Refine https://github.com/KnapsackPro/knapsack/blob/v1.21.1/lib/knapsack/distributors/base_distributor.rb
+  # to take in account the additional filtering we do for predictive jobs.
+  refine ::Knapsack::Distributors::BaseDistributor do
+    attr_reader :filter_tests
+
+    def initialize(args = {})
+      super
+
+      @filter_tests = args[:filter_tests]
+    end
+
+    def all_tests
+      @all_tests ||= begin
+        pattern_tests = Dir.glob(test_file_pattern).uniq
+
+        if filter_tests.empty?
+          Knapsack.logger.info 'Running all node tests without filter'
+          pattern_tests
+        else
+          pattern_tests & filter_tests
+        end
+      end.sort
+    end
+  end
+
+  # Refine https://github.com/KnapsackPro/knapsack/blob/v1.21.1/lib/knapsack/allocator_builder.rb
+  # to take in account the additional filtering we do for predictive jobs.
+  refine ::Knapsack::AllocatorBuilder do
+    attr_accessor :filter_tests
+
+    def allocator
+      Knapsack::Allocator.new({
+        report: Knapsack.report.open,
+        test_file_pattern: test_file_pattern,
+        ci_node_total: Knapsack::Config::Env.ci_node_total,
+        ci_node_index: Knapsack::Config::Env.ci_node_index,
+        # Additional argument
+        filter_tests: filter_tests
+      })
+    end
+  end
+end
+
+using KnapsackRefinements
+
 # A custom parallel rspec runner based on Knapsack runner
 # which takes in additional option for a file containing
 # list of test files.
@@ -13,7 +59,7 @@ require 'knapsack'
 # would be executed in the CI node.
 #
 # Reference:
-# https://github.com/ArturT/knapsack/blob/v1.20.0/lib/knapsack/runners/rspec_runner.rb
+# https://github.com/ArturT/knapsack/blob/v1.21.1/lib/knapsack/runners/rspec_runner.rb
 module Tooling
   class ParallelRSpecRunner
     def self.run(rspec_args: nil, filter_tests_file: nil)
@@ -27,18 +73,15 @@ module Tooling
     end
 
     def run
-      Knapsack.logger.info
-      Knapsack.logger.info 'Knapsack node specs:'
-      Knapsack.logger.info node_tests
       Knapsack.logger.info
       Knapsack.logger.info 'Filter specs:'
       Knapsack.logger.info filter_tests
       Knapsack.logger.info
       Knapsack.logger.info 'Running specs:'
-      Knapsack.logger.info tests_to_run
+      Knapsack.logger.info node_tests
       Knapsack.logger.info
 
-      if tests_to_run.empty?
+      if node_tests.empty?
         Knapsack.logger.info 'No tests to run on this node, exiting.'
         return
       end
@@ -57,19 +100,10 @@ module Tooling
         cmd.push(*rspec_args)
         cmd.push('--default-path', allocator.test_dir)
         cmd.push('--')
-        cmd.push(*tests_to_run)
+        cmd.push(*node_tests)
       end
     end
 
-    def tests_to_run
-      if filter_tests.empty?
-        Knapsack.logger.info 'Running all node tests without filter'
-        return node_tests
-      end
-
-      @tests_to_run ||= node_tests & filter_tests
-    end
-
     def node_tests
       allocator.node_tests
     end
@@ -86,7 +120,9 @@ module Tooling
     end
 
     def knapsack_allocator
-      Knapsack::AllocatorBuilder.new(Knapsack::Adapters::RSpecAdapter).allocator
+      Knapsack::AllocatorBuilder.new(Knapsack::Adapters::RSpecAdapter).tap do |builder|
+        builder.filter_tests = filter_tests
+      end.allocator
     end
   end
 end
diff --git a/workhorse/internal/badgateway/roundtripper.go b/workhorse/internal/badgateway/roundtripper.go
index cc982b092a7..ce4e9e6a177 100644
--- a/workhorse/internal/badgateway/roundtripper.go
+++ b/workhorse/internal/badgateway/roundtripper.go
@@ -2,6 +2,7 @@ package badgateway
 
 import (
 	"bytes"
+	"context"
 	_ "embed"
 	"encoding/base64"
 	"fmt"
@@ -47,9 +48,14 @@ func (t *roundTripper) RoundTrip(r *http.Request) (*http.Response, error) {
 	fields := log.Fields{"duration_ms": int64(time.Since(start).Seconds() * 1000)}
 	log.WithRequest(r).WithFields(fields).WithError(&sentryError{fmt.Errorf("badgateway: failed to receive response: %v", err)}).Error()
 
+	code := http.StatusBadGateway
+	if r.Context().Err() == context.Canceled {
+		code = 499 // Code used by NGINX when client disconnects
+	}
+
 	injectedResponse := &http.Response{
-		StatusCode: http.StatusBadGateway,
-		Status:     http.StatusText(http.StatusBadGateway),
+		StatusCode: code,
+		Status:     http.StatusText(code),
 
 		Request:    r,
 		ProtoMajor: r.ProtoMajor,
diff --git a/workhorse/internal/badgateway/roundtripper_test.go b/workhorse/internal/badgateway/roundtripper_test.go
index b59cb8d2c5b..ed2de452f80 100644
--- a/workhorse/internal/badgateway/roundtripper_test.go
+++ b/workhorse/internal/badgateway/roundtripper_test.go
@@ -1,9 +1,11 @@
 package badgateway
 
 import (
+	"context"
 	"errors"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -54,3 +56,36 @@ func TestErrorPage502(t *testing.T) {
 		})
 	}
 }
+
+func TestClientDisconnect499(t *testing.T) {
+	serverSync := make(chan struct{})
+	ts := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		serverSync <- struct{}{}
+		<-serverSync
+	}))
+	defer func() {
+		close(serverSync)
+		ts.Close()
+	}()
+
+	clientResponse := make(chan *http.Response)
+	clientContext, clientCancel := context.WithCancel(context.Background())
+
+	go func() {
+		req, err := http.NewRequestWithContext(clientContext, "GET", ts.URL, nil)
+		require.NoError(t, err, "build request")
+
+		rt := NewRoundTripper(false, http.DefaultTransport)
+		response, err := rt.RoundTrip(req)
+		require.NoError(t, err, "perform roundtrip")
+		require.NoError(t, response.Body.Close())
+
+		clientResponse <- response
+	}()
+
+	<-serverSync
+
+	clientCancel()
+	response := <-clientResponse
+	require.Equal(t, 499, response.StatusCode, "response status")
+}