From bcc887fb115ce42325cee1cdaa009e96114a361b Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 24 Apr 2024 21:11:40 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../components/board_add_new_column_form.vue  |   2 +-
 .../boards/components/board_card_inner.vue    |   4 +-
 .../boards/components/board_column.vue        |   2 +-
 .../javascripts/ci/job_details/job_app.vue    |   2 +-
 .../graphql_shared/possible_types.json        |   1 +
 .../list/components/issue_card_time_info.vue  |   2 +-
 .../notes/components/discussion_filter.vue    |   2 +-
 .../profile/components/user_achievements.vue  |   2 +-
 .../label_filter/label_dropdown_items.vue     |   2 +-
 .../surveys/components/satisfaction_rate.vue  |   2 +-
 .../components/state_container.vue            |   2 +-
 .../states/unresolved_discussions.vue         |   2 +-
 .../components/registry/registry_search.vue   |  29 +++--
 .../notes/work_item_activity_sort_filter.vue  |   2 +-
 .../concerns/dependency_proxy/group_access.rb |  32 ++++++
 .../application_controller.rb                 |  48 ++++++--
 ...endency_proxy_for_containers_controller.rb |   7 --
 app/controllers/jwt_controller.rb             |   3 +-
 app/models/ci/running_build.rb                |   6 +-
 app/models/group.rb                           |   4 +
 .../policies/dependency_proxy/group.rb        |  23 ++++
 app/policies/group_policy.rb                  |   2 +
 .../policies/dependency_proxy/group_policy.rb |  67 +++++++++++
 ...dependency_proxy_authentication_service.rb |  10 ++
 .../dependency_proxy/auth_token_service.rb    |  33 ++++++
 app/views/groups/_home_panel.html.haml        |   2 +-
 .../merge_requests/_merge_request.html.haml   |   4 +-
 app/views/search/results/_issuable.html.haml  |   2 +-
 app/views/search/results/_note.html.haml      |   2 +-
 app/views/shared/projects/_project.html.haml  |   4 +-
 app/views/users/_profile_sidebar.html.haml    |   2 +-
 ..._dependency_proxy_pass_token_to_policy.yml |   9 ++
 ...amespace_id_column_to_ci_running_builds.rb |  15 +++
 ...nner_type_and_owner_namespace_id_and_id.rb |  16 +++
 db/schema_migrations/20240419124207           |   1 +
 db/schema_migrations/20240419134956           |   1 +
 db/structure.sql                              |   5 +-
 .../auth/ldap/google_secure_ldap.md           |   2 -
 doc/administration/auth/ldap/index.md         |   7 +-
 .../auth/ldap/ldap_synchronization.md         |   2 -
 doc/administration/auth/oidc.md               |   2 -
 doc/administration/auth/smartcard.md          |  25 ++--
 doc/administration/credentials_inventory.md   |  16 +--
 doc/administration/moderate_users.md          |   8 --
 doc/administration/raketasks/ldap.md          |   2 -
 .../settings/rate_limit_on_users_api.md       |   2 -
 doc/api/access_requests.md                    |   4 +-
 doc/api/appearance.md                         |   2 -
 doc/api/applications.md                       |   2 -
 doc/api/avatar.md                             |   2 -
 doc/api/graphql/reference/index.md            |  89 +++++++++++++++
 doc/api/group_access_tokens.md                |   7 --
 doc/api/members.md                            |  24 +---
 doc/api/plan_limits.md                        |   2 -
 doc/api/project_access_tokens.md              |  10 --
 doc/api/settings.md                           |  18 +--
 doc/api/users.md                              |  29 ++---
 doc/development/cascading_settings.md         |   2 -
 .../permissions/predefined_roles.md           |   3 +-
 doc/integration/ding_talk.md                  |   1 -
 doc/integration/kerberos.md                   |  50 +-------
 doc/integration/oauth_provider.md             |  18 +--
 doc/integration/omniauth.md                   |   4 -
 doc/integration/saml.md                       |   4 -
 doc/security/password_length_limits.md        |   2 -
 doc/security/rate_limits.md                   |  12 +-
 doc/security/reset_user_password.md           |   2 -
 doc/security/ssh_keys_restrictions.md         |   6 +-
 doc/security/two_factor_authentication.md     |   6 +-
 doc/security/user_file_uploads.md             |   1 -
 doc/security/webhooks.md                      |   2 -
 doc/subscriptions/subscription-add-ons.md     |   4 +-
 doc/topics/git/img/get_started_git_v16_11.png | Bin 16844 -> 16547 bytes
 doc/user/ai_features.md                       |   4 +-
 doc/user/custom_roles.md                      |  36 ++++++
 doc/user/group/saml_sso/group_sync.md         |   2 +-
 doc/user/group/saml_sso/index.md              |  14 +--
 .../group/settings/group_access_tokens.md     |  14 +--
 doc/user/packages/container_registry/index.md |  40 ++++++-
 doc/user/packages/go_proxy/index.md           |  13 +--
 doc/user/permissions.md                       |   8 +-
 .../account/two_factor_authentication.md      |  31 ++---
 doc/user/profile/index.md                     |  16 ---
 doc/user/profile/personal_access_tokens.md    |  11 +-
 .../project/settings/project_access_tokens.md |   9 --
 doc/user/ssh.md                               |  17 +--
 keeps/helpers/groups.rb                       |  21 ++++
 .../overdue_finalize_background_migration.rb  |  78 ++++++++-----
 keeps/remove_duplicated_indexes.rb            |  19 ++-
 lib/api/helpers.rb                            |   6 +-
 lib/gitlab/ci/project_config.rb               |  28 +++--
 lib/gitlab/ci/project_config/source.rb        |   4 +-
 .../dependency_proxy_auth_controller_spec.rb  |  48 +++++++-
 ...cy_proxy_for_containers_controller_spec.rb |  60 +++++++++-
 spec/features/groups/packages_spec.rb         |   7 ++
 spec/features/projects/packages_spec.rb       |   7 ++
 .../registry/registry_search_spec.js          |  11 +-
 spec/keeps/helpers/groups_spec.rb             |  70 ++++++++++++
 .../ci/project_config/repository_spec.rb      |   3 +-
 .../gitlab/ci/project_config/source_spec.rb   |   2 +-
 spec/models/ci/running_build_spec.rb          |  15 +++
 spec/policies/group_policy_spec.rb            |   1 +
 .../dependency_proxy/group_policy_spec.rb     |  99 ++++++++++++++++
 spec/requests/jwt_controller_spec.rb          |  10 +-
 ...dency_proxy_authentication_service_spec.rb |  70 ++++++++++--
 .../auth_token_service_spec.rb                | 108 ++++++++++++++++++
 spec/support/finder_collection_allowlist.yml  |   1 +
 .../helpers/dependency_proxy_helpers.rb       |   7 +-
 .../features/packages_shared_examples.rb      |  37 ++++++
 109 files changed, 1156 insertions(+), 497 deletions(-)
 create mode 100644 app/models/packages/policies/dependency_proxy/group.rb
 create mode 100644 app/policies/packages/policies/dependency_proxy/group_policy.rb
 create mode 100644 config/feature_flags/gitlab_com_derisk/packages_dependency_proxy_pass_token_to_policy.yml
 create mode 100644 db/migrate/20240419124207_add_runner_owner_namespace_id_column_to_ci_running_builds.rb
 create mode 100644 db/migrate/20240419134956_add_index_running_builds_on_runner_type_and_owner_namespace_id_and_id.rb
 create mode 100644 db/schema_migrations/20240419124207
 create mode 100644 db/schema_migrations/20240419134956
 create mode 100644 spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb

diff --git a/app/assets/javascripts/boards/components/board_add_new_column_form.vue b/app/assets/javascripts/boards/components/board_add_new_column_form.vue
index 3975a4258aa..aa6e506e847 100644
--- a/app/assets/javascripts/boards/components/board_add_new_column_form.vue
+++ b/app/assets/javascripts/boards/components/board_add_new_column_form.vue
@@ -41,7 +41,7 @@ export default {
 
 <template>
   <div
-    class="board-add-new-list board gl-display-inline-block gl-h-full gl-vertical-align-top gl-white-space-normal gl-flex-shrink-0 gl-rounded-base gl-px-3"
+    class="board-add-new-list board gl-display-inline-block gl-h-full gl-align-top gl-white-space-normal gl-flex-shrink-0 gl-rounded-base gl-px-3"
     data-testid="board-add-new-column"
   >
     <div
diff --git a/app/assets/javascripts/boards/components/board_card_inner.vue b/app/assets/javascripts/boards/components/board_card_inner.vue
index 42e12601ad1..d09629db94a 100644
--- a/app/assets/javascripts/boards/components/board_card_inner.vue
+++ b/app/assets/javascripts/boards/components/board_card_inner.vue
@@ -408,13 +408,13 @@ export default {
               v-if="item.milestone"
               data-testid="issue-milestone"
               :milestone="item.milestone"
-              class="gl-display-inline-flex gl-align-items-center gl-max-w-15 gl-font-sm gl-text-gray-500! gl-cursor-help! gl-vertical-align-bottom gl-mr-3"
+              class="gl-display-inline-flex gl-align-items-center gl-max-w-15 gl-font-sm gl-text-gray-500! gl-cursor-help! gl-align-bottom gl-mr-3"
             />
             <issue-iteration
               v-if="item.iteration"
               data-testid="issue-iteration"
               :iteration="item.iteration"
-              class="gl-vertical-align-bottom gl-white-space-nowrap"
+              class="gl-align-bottom gl-white-space-nowrap"
             />
             <issue-due-date
               v-if="item.dueDate"
diff --git a/app/assets/javascripts/boards/components/board_column.vue b/app/assets/javascripts/boards/components/board_column.vue
index 844a4e51a07..6baee7c11c3 100644
--- a/app/assets/javascripts/boards/components/board_column.vue
+++ b/app/assets/javascripts/boards/components/board_column.vue
@@ -69,7 +69,7 @@ export default {
       'board-type-assignee': list.listType === 'assignee',
     }"
     :data-list-id="list.id"
-    class="board gl-display-inline-block gl-h-full gl-px-3 gl-vertical-align-top gl-white-space-normal is-expandable"
+    class="board gl-display-inline-block gl-h-full gl-px-3 gl-align-top gl-white-space-normal is-expandable"
     data-testid="board-list"
   >
     <div
diff --git a/app/assets/javascripts/ci/job_details/job_app.vue b/app/assets/javascripts/ci/job_details/job_app.vue
index 7f04f5cf798..403fde4c86d 100644
--- a/app/assets/javascripts/ci/job_details/job_app.vue
+++ b/app/assets/javascripts/ci/job_details/job_app.vue
@@ -284,7 +284,7 @@ export default {
           :class="{ 'sticky-top gl-border-bottom-0': hasJobLog }"
           data-testid="archived-job"
         >
-          <gl-icon name="lock" class="gl-vertical-align-bottom" />
+          <gl-icon name="lock" class="gl-align-bottom" />
           {{ __('This job is archived. Only the complete pipeline can be retried.') }}
         </div>
         <!-- job log -->
diff --git a/app/assets/javascripts/graphql_shared/possible_types.json b/app/assets/javascripts/graphql_shared/possible_types.json
index 0db85fbd630..e222283a037 100644
--- a/app/assets/javascripts/graphql_shared/possible_types.json
+++ b/app/assets/javascripts/graphql_shared/possible_types.json
@@ -103,6 +103,7 @@
   ],
   "OrchestrationPolicy": [
     "ApprovalPolicy",
+    "PipelineExecutionPolicy",
     "ScanExecutionPolicy",
     "ScanResultPolicy"
   ],
diff --git a/app/assets/javascripts/issues/list/components/issue_card_time_info.vue b/app/assets/javascripts/issues/list/components/issue_card_time_info.vue
index a263017fed4..f6d79b470fd 100644
--- a/app/assets/javascripts/issues/list/components/issue_card_time_info.vue
+++ b/app/assets/javascripts/issues/list/components/issue_card_time_info.vue
@@ -86,7 +86,7 @@ export default {
   <span>
     <span
       v-if="milestone"
-      class="issuable-milestone gl-mr-3 gl-text-truncate gl-max-w-26 gl-display-inline-block gl-vertical-align-bottom"
+      class="issuable-milestone gl-mr-3 gl-text-truncate gl-max-w-26 gl-display-inline-block gl-align-bottom"
       data-testid="issuable-milestone"
     >
       <gl-link
diff --git a/app/assets/javascripts/notes/components/discussion_filter.vue b/app/assets/javascripts/notes/components/discussion_filter.vue
index 8e5e237e7a5..52ab58551c0 100644
--- a/app/assets/javascripts/notes/components/discussion_filter.vue
+++ b/app/assets/javascripts/notes/components/discussion_filter.vue
@@ -163,7 +163,7 @@ export default {
     v-if="displayFilters"
     id="discussion-preferences"
     data-testid="discussion-preferences"
-    class="gl-display-inline-block gl-vertical-align-bottom full-width-mobile"
+    class="gl-display-inline-block gl-align-bottom full-width-mobile"
   >
     <local-storage-sync
       :value="sortDirection"
diff --git a/app/assets/javascripts/profile/components/user_achievements.vue b/app/assets/javascripts/profile/components/user_achievements.vue
index c50663a5af5..6451c18c463 100644
--- a/app/assets/javascripts/profile/components/user_achievements.vue
+++ b/app/assets/javascripts/profile/components/user_achievements.vue
@@ -87,7 +87,7 @@ export default {
     <div
       v-for="userAchievement in userAchievements"
       :key="userAchievement.id"
-      class="gl-mr-2 gl-display-inline-block gl-vertical-align-top gl-text-center"
+      class="gl-mr-2 gl-display-inline-block gl-align-top gl-text-center"
       data-testid="user-achievement"
     >
       <gl-avatar
diff --git a/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue b/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
index 0b468a60cf0..f56ee27ccc5 100644
--- a/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
+++ b/app/assets/javascripts/search/sidebar/components/label_filter/label_dropdown_items.vue
@@ -31,7 +31,7 @@ export default {
       >
         <span
           data-testid="label-color-indicator"
-          class="gl-rounded-base gl-min-w-5 gl-h-5 gl-display-inline-block gl-vertical-align-bottom gl-mr-3"
+          class="gl-rounded-base gl-min-w-5 gl-h-5 gl-display-inline-block gl-align-bottom gl-mr-3"
           :style="{ 'background-color': label.color }"
         ></span>
         <span class="gl-reset-text-align gl-m-0 gl-p-0 label-title gl-word-break-all">{{
diff --git a/app/assets/javascripts/surveys/components/satisfaction_rate.vue b/app/assets/javascripts/surveys/components/satisfaction_rate.vue
index d83de56169b..e4b51b9c755 100644
--- a/app/assets/javascripts/surveys/components/satisfaction_rate.vue
+++ b/app/assets/javascripts/surveys/components/satisfaction_rate.vue
@@ -57,7 +57,7 @@ export default {
           :aria-label="grade.title"
           @click="$emit('rate', grade.value)"
         >
-          <gl-icon class="gl-vertical-align-top" :name="grade.icon" :size="24" />
+          <gl-icon class="gl-align-top" :name="grade.icon" :size="24" />
         </gl-button>
       </li>
     </ul>
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/state_container.vue b/app/assets/javascripts/vue_merge_request_widget/components/state_container.vue
index 2a18af90495..c8e22afc11e 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/state_container.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/state_container.vue
@@ -127,7 +127,7 @@ export default {
             :icon="collapsed ? 'chevron-lg-down' : 'chevron-lg-up'"
             category="tertiary"
             size="small"
-            class="gl-vertical-align-top"
+            class="gl-align-top"
             data-testid="widget-toggle"
             @click="() => $emit('toggle')"
           />
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/states/unresolved_discussions.vue b/app/assets/javascripts/vue_merge_request_widget/components/states/unresolved_discussions.vue
index accacc5df71..f617d31316f 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/states/unresolved_discussions.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/states/unresolved_discussions.vue
@@ -42,7 +42,7 @@ export default {
     <template #actions>
       <gl-button
         data-testid="jump-to-first"
-        class="gl-align-self-start gl-vertical-align-top"
+        class="gl-align-self-start gl-align-top"
         size="small"
         variant="confirm"
         category="primary"
diff --git a/app/assets/javascripts/vue_shared/components/registry/registry_search.vue b/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
index e42bf405784..3e1eb7b9f8b 100644
--- a/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
+++ b/app/assets/javascripts/vue_shared/components/registry/registry_search.vue
@@ -46,12 +46,6 @@ export default {
     isSortAscending() {
       return this.sorting.sort === ASCENDING_ORDER;
     },
-    baselineQueryStringFilters() {
-      return this.tokens.reduce((acc, curr) => {
-        acc[curr.type] = '';
-        return acc;
-      }, {});
-    },
     sortDirectionData() {
       return this.isSortAscending ? SORT_DIRECTION_UI.asc : SORT_DIRECTION_UI.desc;
     },
@@ -63,20 +57,25 @@ export default {
     generateQueryData({ sorting = {}, filter = [] } = {}) {
       // Ensure that we clean up the query when we remove a token from the search
       const result = {
-        ...this.baselineQueryStringFilters,
         ...sorting,
-        search: [],
+        search: null,
         after: null,
         before: null,
       };
 
-      filter.forEach((f) => {
-        if (f.type === FILTERED_SEARCH_TERM) {
-          result.search.push(f.value.data);
-        } else {
-          result[f.type] = f.value.data;
-        }
-      });
+      filter
+        .filter((f) => f.value.data)
+        .forEach((f) => {
+          if (f.type === FILTERED_SEARCH_TERM) {
+            if (result.search === null) {
+              result.search = [f.value.data];
+            } else {
+              result.search.push(f.value.data);
+            }
+          } else {
+            result[f.type] = f.value.data;
+          }
+        });
       return result;
     },
     onDirectionChange() {
diff --git a/app/assets/javascripts/work_items/components/notes/work_item_activity_sort_filter.vue b/app/assets/javascripts/work_items/components/notes/work_item_activity_sort_filter.vue
index 425679c1400..10fbad16bb5 100644
--- a/app/assets/javascripts/work_items/components/notes/work_item_activity_sort_filter.vue
+++ b/app/assets/javascripts/work_items/components/notes/work_item_activity_sort_filter.vue
@@ -85,7 +85,7 @@ export default {
 </script>
 
 <template>
-  <div class="gl-display-inline-block gl-vertical-align-bottom">
+  <div class="gl-display-inline-block gl-align-bottom">
     <local-storage-sync
       :value="sortFilterProp"
       :storage-key="storageKey"
diff --git a/app/controllers/concerns/dependency_proxy/group_access.rb b/app/controllers/concerns/dependency_proxy/group_access.rb
index e9fb2563e42..76d6535a21f 100644
--- a/app/controllers/concerns/dependency_proxy/group_access.rb
+++ b/app/controllers/concerns/dependency_proxy/group_access.rb
@@ -11,13 +11,45 @@ module DependencyProxy
 
     private
 
+    def auth_user_or_token
+      if defined?(personal_access_token) && personal_access_token && auth_user.is_a?(::User) &&
+          (
+            (auth_user.project_bot? && auth_user.resource_bot_resource.is_a?(::Group)) ||
+            auth_user.human? ||
+            auth_user.service_account?
+          )
+        personal_access_token
+      else
+        auth_user
+      end
+    end
+
     def verify_dependency_proxy_available!
       render_404 unless group&.dependency_proxy_feature_available?
     end
 
+    # TODO: Split the authorization logic into dedicated methods
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/452145
     def authorize_read_dependency_proxy!
+      if Feature.enabled?(:packages_dependency_proxy_pass_token_to_policy, group)
+        if auth_user_or_token.is_a?(User)
+          authorize_read_dependency_proxy_for_users!
+        else
+          authorize_read_dependency_proxy_for_tokens!
+        end
+      else
+        authorize_read_dependency_proxy_for_users!
+      end
+    end
+
+    def authorize_read_dependency_proxy_for_users!
       access_denied! unless can?(auth_user, :read_dependency_proxy, group)
     end
+
+    def authorize_read_dependency_proxy_for_tokens!
+      access_denied! unless can?(auth_user_or_token, :read_dependency_proxy,
+        group&.dependency_proxy_for_containers_policy_subject)
+    end
   end
 end
 
diff --git a/app/controllers/groups/dependency_proxy/application_controller.rb b/app/controllers/groups/dependency_proxy/application_controller.rb
index a5266d89ddb..11a7ef3189d 100644
--- a/app/controllers/groups/dependency_proxy/application_controller.rb
+++ b/app/controllers/groups/dependency_proxy/application_controller.rb
@@ -3,6 +3,8 @@
 module Groups
   module DependencyProxy
     class ApplicationController < ::ApplicationController
+      include Gitlab::Utils::StrongMemoize
+
       EMPTY_AUTH_RESULT = Gitlab::Auth::Result.new(nil, nil, nil, nil).freeze
 
       delegate :actor, to: :@authentication_result, allow_nil: true
@@ -19,15 +21,18 @@ module Groups
         authenticate_with_http_token do |token, _|
           @authentication_result = EMPTY_AUTH_RESULT
 
-          user_or_deploy_token = ::DependencyProxy::AuthTokenService.user_or_deploy_token_from_jwt(token)
-
-          case user_or_deploy_token
-          when User
-            @authentication_result = Gitlab::Auth::Result.new(user_or_deploy_token, nil, :user, [])
-            sign_in(user_or_deploy_token) unless user_or_deploy_token.project_bot? ||
-              user_or_deploy_token.service_account?
-          when DeployToken
-            @authentication_result = Gitlab::Auth::Result.new(user_or_deploy_token, nil, :deploy_token, [])
+          if Feature.enabled?(:packages_dependency_proxy_pass_token_to_policy, group)
+            user_or_token = ::DependencyProxy::AuthTokenService.user_or_token_from_jwt(token)
+            sign_in_and_setup_authentication_result(user_or_token)
+          else
+            user_or_token = ::DependencyProxy::AuthTokenService.user_or_deploy_token_from_jwt(token)
+            case user_or_token
+            when User
+              @authentication_result = Gitlab::Auth::Result.new(user_or_token, nil, :user, [])
+              sign_in(user_or_token) unless user_or_token.project_bot? || user_or_token.service_account?
+            when DeployToken
+              @authentication_result = Gitlab::Auth::Result.new(user_or_token, nil, :deploy_token, [])
+            end
           end
         end
 
@@ -36,11 +41,36 @@ module Groups
 
       private
 
+      attr_reader :personal_access_token
+
+      # TODO: We only need this here to get the group for the Feature flag evaluation.
+      # Move this back to app/controllers/groups/dependency_proxy_for_containers_controller.rb
+      # when we rollout the FF packages_dependency_proxy_pass_token_to_policy
+      def group
+        Group.find_by_full_path(params[:group_id], follow_redirects: true)
+      end
+      strong_memoize_attr :group
+
       def request_bearer_token!
         # unfortunately, we cannot use https://api.rubyonrails.org/classes/ActionController/HttpAuthentication/Token.html#method-i-authentication_request
         response.headers['WWW-Authenticate'] = ::DependencyProxy::Registry.authenticate_header
         render plain: '', status: :unauthorized
       end
+
+      # When we rollout packages_dependency_proxy_pass_token_to_policy,
+      # we can move the body of this method inline, inside authenticate_user_from_jwt_token!
+      def sign_in_and_setup_authentication_result(user_or_token)
+        case user_or_token
+        when User
+          @authentication_result = Gitlab::Auth::Result.new(user_or_token, nil, :user, [])
+          sign_in(user_or_token)
+        when PersonalAccessToken
+          @authentication_result = Gitlab::Auth::Result.new(user_or_token.user, nil, :personal_access_token, [])
+          @personal_access_token = user_or_token
+        when DeployToken
+          @authentication_result = Gitlab::Auth::Result.new(user_or_token, nil, :deploy_token, [])
+        end
+      end
     end
   end
 end
diff --git a/app/controllers/groups/dependency_proxy_for_containers_controller.rb b/app/controllers/groups/dependency_proxy_for_containers_controller.rb
index 1fc631f299b..4dc2802916b 100644
--- a/app/controllers/groups/dependency_proxy_for_containers_controller.rb
+++ b/app/controllers/groups/dependency_proxy_for_containers_controller.rb
@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 class Groups::DependencyProxyForContainersController < ::Groups::DependencyProxy::ApplicationController
-  include Gitlab::Utils::StrongMemoize
   include DependencyProxy::GroupAccess
   include SendFileUpload
   include ::PackagesHelper # for event tracking
@@ -124,12 +123,6 @@ class Groups::DependencyProxyForContainersController < ::Groups::DependencyProxy
     @manifest_file_name ||= Gitlab::PathTraversal.check_path_traversal!("#{image}:#{tag}.json")
   end
 
-  def group
-    strong_memoize(:group) do
-      Group.find_by_full_path(params[:group_id], follow_redirects: true)
-    end
-  end
-
   def image
     params[:image]
   end
diff --git a/app/controllers/jwt_controller.rb b/app/controllers/jwt_controller.rb
index e6e232cfbc3..de7fe52e3db 100644
--- a/app/controllers/jwt_controller.rb
+++ b/app/controllers/jwt_controller.rb
@@ -33,9 +33,10 @@ class JwtController < ApplicationController
     @authentication_result = Gitlab::Auth::Result.new(nil, nil, :none, Gitlab::Auth.read_only_authentication_abilities)
 
     authenticate_with_http_basic do |login, password|
-      @raw_token = password
       @authentication_result = Gitlab::Auth.find_for_git_client(login, password, project: nil, request: request)
 
+      @raw_token = password if @authentication_result.type == :personal_access_token
+
       if @authentication_result.failed?
         log_authentication_failed(login, @authentication_result)
         render_access_denied
diff --git a/app/models/ci/running_build.rb b/app/models/ci/running_build.rb
index 6d0d4e6c09a..548458c87e2 100644
--- a/app/models/ci/running_build.rb
+++ b/app/models/ci/running_build.rb
@@ -21,11 +21,15 @@ module Ci
         raise ArgumentError, 'build has not been picked by a runner'
       end
 
+      # Owner namespace of the runner that executed the build
+      runner_owner_namespace_id = build.runner.owner_runner_namespace.namespace_id if build.runner.group_type?
+
       entry = self.new(
         build: build,
         project: build.project,
         runner: build.runner,
-        runner_type: build.runner.runner_type
+        runner_type: build.runner.runner_type,
+        runner_owner_namespace_xid: runner_owner_namespace_id
       )
 
       entry.validate!
diff --git a/app/models/group.rb b/app/models/group.rb
index c1579dbb21e..12f1cd91b56 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -971,6 +971,10 @@ class Group < Namespace
     ::Packages::Policies::Group.new(self)
   end
 
+  def dependency_proxy_for_containers_policy_subject
+    ::Packages::Policies::DependencyProxy::Group.new(self)
+  end
+
   def update_two_factor_requirement_for_members
     hierarchy_members.find_each(&:update_two_factor_requirement)
   end
diff --git a/app/models/packages/policies/dependency_proxy/group.rb b/app/models/packages/policies/dependency_proxy/group.rb
new file mode 100644
index 00000000000..00986e6f474
--- /dev/null
+++ b/app/models/packages/policies/dependency_proxy/group.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# We use this class, in conjunction with the
+# Group#dependency_proxy_for_containers_policy_subject method,
+# to specify a custom policy class for DependencyProxy.
+# A similar pattern was used in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/90963
+module Packages
+  module Policies
+    module DependencyProxy
+      class Group
+        attr_reader :group
+
+        delegate :dependency_proxy_feature_available?, :full_path, :licensed_feature_available?,
+          :max_member_access_for_user, :member?, :owned_by?, :public?, :root_ancestor,
+          :root_ancestor_ip_restrictions, to: :group
+
+        def initialize(group)
+          @group = group
+        end
+      end
+    end
+  end
+end
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index 560625f6541..ec193a8cf2c 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -462,6 +462,8 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     resource_access_token_create_feature_available? && group.root_ancestor.namespace_settings.resource_access_token_creation_allowed?
   end
 
+  # TODO: Remove this when we rollout the feature flag packages_dependency_proxy_pass_token_to_policy
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/441588
   def valid_dependency_proxy_deploy_token
     @user.is_a?(DeployToken) && @user&.valid_for_dependency_proxy? && @user&.has_access_to_group?(@subject)
   end
diff --git a/app/policies/packages/policies/dependency_proxy/group_policy.rb b/app/policies/packages/policies/dependency_proxy/group_policy.rb
new file mode 100644
index 00000000000..11e57a2d337
--- /dev/null
+++ b/app/policies/packages/policies/dependency_proxy/group_policy.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# The policies defined in GroupPolicy is used in GraphQL requests
+# With a GraphQL request, the user is always a human User
+#
+# With JWT requests, we can be dealing with any of the following:
+# - a PrAT for a human
+# - a PrAT for a service account
+# - a GrAT
+# - a Group DeployToken
+#
+# We use this custom policy class for JWT requests
+module Packages
+  module Policies
+    module DependencyProxy
+      class GroupPolicy < ::GroupPolicy
+        overrides(:read_dependency_proxy)
+
+        desc "Deploy token with read access to dependency proxy"
+        condition(:read_dependency_proxy_deploy_token) do
+          @user.is_a?(DeployToken) && @user&.valid_for_dependency_proxy? && @user&.has_access_to_group?(@subject.group)
+        end
+
+        desc "Personal access or group access token with read access to dependency proxy"
+        condition(:read_dependency_proxy_personal_access_token) do
+          user_is_personal_access_token? &&
+            (
+              user.user.human? ||
+              user.user.service_account? ||
+              (user.user.project_bot? && user.user.resource_bot_resource.is_a?(::Group))
+            ) &&
+            (access_level(for_any_session: true) >= GroupMember::GUEST)
+        end
+
+        condition(:dependency_proxy_disabled, scope: :subject) do
+          !@subject.dependency_proxy_feature_available?
+        end
+
+        rule { dependency_proxy_disabled }.prevent :read_dependency_proxy
+
+        rule do
+          read_dependency_proxy_personal_access_token | read_dependency_proxy_deploy_token
+        end.enable :read_dependency_proxy
+
+        rule do
+          ~read_dependency_proxy_personal_access_token & ~read_dependency_proxy_deploy_token
+        end.prevent :read_dependency_proxy
+
+        def access_level(for_any_session: false)
+          return GroupMember::NO_ACCESS if @user.nil?
+
+          @access_level ||= lookup_access_level!(for_any_session: for_any_session)
+        end
+
+        def lookup_access_level!(_)
+          @subject.max_member_access_for_user(@user.user)
+        end
+
+        def user_is_personal_access_token?
+          user.is_a?(PersonalAccessToken)
+        end
+      end
+    end
+  end
+end
+
+Packages::Policies::DependencyProxy::GroupPolicy.prepend_mod_with('Packages::Policies::DependencyProxy::GroupPolicy')
diff --git a/app/services/auth/dependency_proxy_authentication_service.rb b/app/services/auth/dependency_proxy_authentication_service.rb
index 84cbbc59cc2..d362cab9284 100644
--- a/app/services/auth/dependency_proxy_authentication_service.rb
+++ b/app/services/auth/dependency_proxy_authentication_service.rb
@@ -65,6 +65,8 @@ module Auth
       JSONWebToken::HMACToken.new(self.class.secret).tap do |token|
         token['user_id'] = current_user.id if current_user
         token['deploy_token'] = deploy_token.token if deploy_token
+        token['personal_access_token'] = raw_token if personal_access_token_user?
+        token['group_access_token'] = raw_token if group_access_token_user?
         token.expire_time = self.class.token_expire_at
       end
     end
@@ -76,5 +78,13 @@ module Auth
     def raw_token
       params[:raw_token]
     end
+
+    def group_access_token_user?
+      raw_token && current_user&.project_bot? && current_user.resource_bot_resource.is_a?(Group)
+    end
+
+    def personal_access_token_user?
+      raw_token && current_user && (current_user.human? || current_user.service_account?)
+    end
   end
 end
diff --git a/app/services/dependency_proxy/auth_token_service.rb b/app/services/dependency_proxy/auth_token_service.rb
index c6c9eb534bb..a207ff2f92a 100644
--- a/app/services/dependency_proxy/auth_token_service.rb
+++ b/app/services/dependency_proxy/auth_token_service.rb
@@ -12,6 +12,10 @@ module DependencyProxy
       JSONWebToken::HMACToken.decode(token, ::Auth::DependencyProxyAuthenticationService.secret).first
     end
 
+    # TODO: Rename to make it obvious how it's used in Gitlab::Auth::RequestAuthenticator
+    # which is to return an <object>.<id> that is used as a rack-attack discriminator
+    # that way it cannot be confused with `.user_or_token_from_jwt`
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/454518
     def self.user_or_deploy_token_from_jwt(raw_jwt)
       token_payload = self.new(raw_jwt).execute
 
@@ -23,5 +27,34 @@ module DependencyProxy
     rescue JWT::DecodeError, JWT::ExpiredSignature, JWT::ImmatureSignature
       nil
     end
+
+    def self.user_or_token_from_jwt(raw_jwt)
+      token_payload = self.new(raw_jwt).execute
+
+      if token_payload['personal_access_token']
+        get_personal_access_token(token_payload['personal_access_token'])
+      elsif token_payload['group_access_token']
+        # a group access token is a personal access token in disguise
+        get_personal_access_token(token_payload['group_access_token'])
+      elsif token_payload['deploy_token']
+        get_deploy_token(token_payload['deploy_token'])
+      elsif token_payload['user_id']
+        get_user(token_payload['user_id'])
+      end
+    rescue JWT::DecodeError, JWT::ExpiredSignature, JWT::ImmatureSignature
+      nil
+    end
+
+    def self.get_user(user_id)
+      User.find(user_id)
+    end
+
+    def self.get_personal_access_token(raw_token)
+      PersonalAccessTokensFinder.new(state: 'active').find_by_token(raw_token)
+    end
+
+    def self.get_deploy_token(raw_token)
+      DeployToken.active.find_by_token(raw_token)
+    end
   end
 end
diff --git a/app/views/groups/_home_panel.html.haml b/app/views/groups/_home_panel.html.haml
index 5984a21dd0c..cb34d500087 100644
--- a/app/views/groups/_home_panel.html.haml
+++ b/app/views/groups/_home_panel.html.haml
@@ -17,7 +17,7 @@
         - if current_user.admin?
           = render Pajamas::ButtonComponent.new(href: [:admin, @group], icon: 'admin', button_options: { title: _('View group in admin area'), data: { toggle: 'tooltip', placement: 'bottom', container: 'body' } })
         - if @notification_setting
-          .js-vue-notification-dropdown{ data: { disabled: emails_disabled.to_s, dropdown_items: notification_dropdown_items(@notification_setting).to_json, notification_level: @notification_setting.level, help_page_path: help_page_path('user/profile/notifications'), group_id: @group.id, container_class: 'gl-vertical-align-top' } }
+          .js-vue-notification-dropdown{ data: { disabled: emails_disabled.to_s, dropdown_items: notification_dropdown_items(@notification_setting).to_json, notification_level: @notification_setting.level, help_page_path: help_page_path('user/profile/notifications'), group_id: @group.id, container_class: 'gl-align-top' } }
         - if can_create_subgroups
           .gl-sm-w-auto.gl-w-full
             = render Pajamas::ButtonComponent.new(href: new_group_path(parent_id: @group.id, anchor: 'create-group-pane'), button_options: { data: { testid: 'new-subgroup-button' }, class: 'gl-sm-w-auto gl-w-full'}) do
diff --git a/app/views/projects/merge_requests/_merge_request.html.haml b/app/views/projects/merge_requests/_merge_request.html.haml
index 8fbdbf3e6dd..4dbcb5b7d34 100644
--- a/app/views/projects/merge_requests/_merge_request.html.haml
+++ b/app/views/projects/merge_requests/_merge_request.html.haml
@@ -26,13 +26,13 @@
           &middot;
           #{s_('IssueList|created %{timeAgoString} by %{user}').html_safe % { timeAgoString: time_ago_with_tooltip(merge_request.created_at, placement: 'bottom'), user: link_to_member(@project, merge_request.author, avatar: false, extra_class: 'gl-text-gray-500!') }}
         - if merge_request.milestone
-          %span.issuable-milestone.gl-display-none.gl-sm-display-inline-block.gl-text-truncate.gl-max-w-26.gl-vertical-align-bottom
+          %span.issuable-milestone.gl-display-none.gl-sm-display-inline-block.gl-text-truncate.gl-max-w-26.gl-align-bottom
             &nbsp;
             = link_to project_merge_requests_path(merge_request.project, milestone_title: merge_request.milestone.title), class: 'gl-text-gray-500!', data: { html: 'true', toggle: 'tooltip', title: milestone_tooltip_due_date(merge_request.milestone) } do
               = sprite_icon('milestone', size: 12, css_class: 'gl-vertical-align-text-bottom')
               = merge_request.milestone.title
         - if merge_request.target_project.default_branch != merge_request.target_branch
-          %span.project-ref-path.has-tooltip.d-inline-block.gl-text-truncate.gl-max-w-26.gl-vertical-align-bottom{ title: _('Target branch: %{target_branch}') % {target_branch: merge_request.target_branch} }
+          %span.project-ref-path.has-tooltip.d-inline-block.gl-text-truncate.gl-max-w-26.gl-align-bottom{ title: _('Target branch: %{target_branch}') % {target_branch: merge_request.target_branch} }
             &nbsp;
             = link_to project_ref_path(merge_request.project, merge_request.target_branch), class: 'ref-name gl-text-gray-500!' do
               = sprite_icon('branch', size: 12, css_class: 'fork-sprite')
diff --git a/app/views/search/results/_issuable.html.haml b/app/views/search/results/_issuable.html.haml
index 52da4ca254a..d5b9a49c297 100644
--- a/app/views/search/results/_issuable.html.haml
+++ b/app/views/search/results/_issuable.html.haml
@@ -10,7 +10,7 @@
       &middot;
       = sprintf(s_('created %{issuable_created} by %{author}'), { issuable_created: time_ago_with_tooltip(issuable.created_at, placement: 'bottom'), author: link_to_member(@project, issuable.author, avatar: false) }).html_safe
       - if (target_branch = issuable_visible_target_branch(issuable))
-        %span.project-ref-path.has-tooltip.d-inline-block.gl-text-truncate.gl-max-w-26.gl-vertical-align-bottom{ title: _('Target branch: %{target_branch}') % {target_branch: target_branch} }
+        %span.project-ref-path.has-tooltip.d-inline-block.gl-text-truncate.gl-max-w-26.gl-align-bottom{ title: _('Target branch: %{target_branch}') % {target_branch: target_branch} }
           &nbsp;
           = link_to project_ref_path(issuable.project, target_branch), class: 'ref-name gl-text-gray-500!' do
             = sprite_icon('branch', size: 12, css_class: 'fork-sprite')
diff --git a/app/views/search/results/_note.html.haml b/app/views/search/results/_note.html.haml
index c7c91e768df..128755ac3f2 100644
--- a/app/views/search/results/_note.html.haml
+++ b/app/views/search/results/_note.html.haml
@@ -4,7 +4,7 @@
 
 .search-result-row
   %h5.note-search-caption.gl-max-w-full
-    %span.gl-display-inline-block.gl-text-truncate.search-max-w-inherit.gl-vertical-align-bottom
+    %span.gl-display-inline-block.gl-text-truncate.search-max-w-inherit.gl-align-bottom
       = sprite_icon('comment', css_class: 'gl-vertical-align-text-bottom')
       = link_to_member(project, note.author, avatar: false)
       = _("commented on %{link_to_project}").html_safe % { link_to_project: link_to(project.full_name, project) }
diff --git a/app/views/shared/projects/_project.html.haml b/app/views/shared/projects/_project.html.haml
index 88fbe6a1989..f68f2314ba7 100644
--- a/app/views/shared/projects/_project.html.haml
+++ b/app/views/shared/projects/_project.html.haml
@@ -68,7 +68,7 @@
 
       = render_if_exists 'shared/projects/removed', project: project
 
-      .gl-display-flex.gl-mt-3{ class: "#{css_class} gl-sm-display-none!" }
+      .gl-display-flex.gl-align-items-center.gl-mt-3{ class: "#{css_class} gl-sm-display-none!" }
         .controls.gl-display-flex.gl-align-items-center
           - if show_pipeline_status_icon && last_pipeline.present?
             - pipeline_path = pipelines_project_commit_path(project.pipeline_status.project, project.pipeline_status.sha, ref: project.pipeline_status.ref)
@@ -84,6 +84,7 @@
           %span
             = _('Updated')
             = updated_tooltip
+        = render_if_exists 'shared/projects/actions', project: project
 
   .project-cell.project-controls{ class: "#{css_class} gl-display-none! gl-sm-display-table-cell!", data: { testid: 'project_controls'} }
     .controls.gl-display-flex.gl-align-items-center.gl-mb-2.gl-gap-4{ class: "#{css_controls_class} gl-pr-0! gl-justify-content-end!" }
@@ -109,6 +110,7 @@
         = link_to project_issues_path(project), class: "#{css_metadata_classes} issues", title: _('Issues'), data: { container: 'body', placement: 'top' } do
           = sprite_icon('issues', size: 14, css_class: 'gl-mr-2')
           = badge_count(project.open_issues_count)
+      = render_if_exists 'shared/projects/actions', project: project
     .updated-note.gl-font-sm.gl-white-space-nowrap.gl-justify-content-end
       %span
         = _('Updated')
diff --git a/app/views/users/_profile_sidebar.html.haml b/app/views/users/_profile_sidebar.html.haml
index 4ae1083572f..fa2a221dff4 100644
--- a/app/views/users/_profile_sidebar.html.haml
+++ b/app/views/users/_profile_sidebar.html.haml
@@ -1,6 +1,6 @@
 .user-profile-sidebar
   .profile-header.gl-pb-5.gl-pt-3.gl-overflow-y-auto.gl-sm-pr-4
-    .gl-vertical-align-top.gl-text-left.gl-max-w-80.gl-overflow-wrap-anywhere
+    .gl-align-top.gl-text-left.gl-max-w-80.gl-overflow-wrap-anywhere
       .user-info
         - if @user.confirmed?
           .gl-display-flex.gl-gap-4.gl-flex-direction-column
diff --git a/config/feature_flags/gitlab_com_derisk/packages_dependency_proxy_pass_token_to_policy.yml b/config/feature_flags/gitlab_com_derisk/packages_dependency_proxy_pass_token_to_policy.yml
new file mode 100644
index 00000000000..9131f3f01d7
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/packages_dependency_proxy_pass_token_to_policy.yml
@@ -0,0 +1,9 @@
+---
+name: packages_dependency_proxy_pass_token_to_policy
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/434291
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/141358
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/441588
+milestone: '17.0'
+group: group::container registry
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/db/migrate/20240419124207_add_runner_owner_namespace_id_column_to_ci_running_builds.rb b/db/migrate/20240419124207_add_runner_owner_namespace_id_column_to_ci_running_builds.rb
new file mode 100644
index 00000000000..a575b867420
--- /dev/null
+++ b/db/migrate/20240419124207_add_runner_owner_namespace_id_column_to_ci_running_builds.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddRunnerOwnerNamespaceIdColumnToCiRunningBuilds < Gitlab::Database::Migration[2.2]
+  milestone '17.0'
+
+  enable_lock_retries!
+
+  def up
+    add_column :ci_running_builds, :runner_owner_namespace_xid, :bigint, null: true
+  end
+
+  def down
+    remove_column :ci_running_builds, :runner_owner_namespace_xid, if_exists: true
+  end
+end
diff --git a/db/migrate/20240419134956_add_index_running_builds_on_runner_type_and_owner_namespace_id_and_id.rb b/db/migrate/20240419134956_add_index_running_builds_on_runner_type_and_owner_namespace_id_and_id.rb
new file mode 100644
index 00000000000..190cdd6dcf8
--- /dev/null
+++ b/db/migrate/20240419134956_add_index_running_builds_on_runner_type_and_owner_namespace_id_and_id.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class AddIndexRunningBuildsOnRunnerTypeAndOwnerNamespaceIdAndId < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.0'
+
+  INDEX_NAME = 'idx_ci_running_builds_on_runner_type_and_owner_xid_and_id'
+
+  def up
+    add_concurrent_index(:ci_running_builds, [:runner_type, :runner_owner_namespace_xid, :runner_id], name: INDEX_NAME)
+  end
+
+  def down
+    remove_concurrent_index_by_name :ci_running_builds, INDEX_NAME, if_exists: true
+  end
+end
diff --git a/db/schema_migrations/20240419124207 b/db/schema_migrations/20240419124207
new file mode 100644
index 00000000000..1c887dd1b87
--- /dev/null
+++ b/db/schema_migrations/20240419124207
@@ -0,0 +1 @@
+1ccb744e72b4d4ace0ad9c31f3f9cd8fedf0cb82d5d7570737dd646c24e24a65
\ No newline at end of file
diff --git a/db/schema_migrations/20240419134956 b/db/schema_migrations/20240419134956
new file mode 100644
index 00000000000..d2175a366f5
--- /dev/null
+++ b/db/schema_migrations/20240419134956
@@ -0,0 +1 @@
+23540efe713468eb8bae788431a65f6336dd04be08e77b5d5047b8b303f5e24a
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 904f9229def..1e84c396bb0 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -6856,7 +6856,8 @@ CREATE TABLE ci_running_builds (
     runner_id bigint NOT NULL,
     created_at timestamp with time zone DEFAULT now() NOT NULL,
     runner_type smallint NOT NULL,
-    partition_id bigint NOT NULL
+    partition_id bigint NOT NULL,
+    runner_owner_namespace_xid bigint
 );
 
 CREATE SEQUENCE ci_running_builds_id_seq
@@ -23997,6 +23998,8 @@ CREATE INDEX idx_ci_pipelines_on_user_id_and_id_and_cancelable_status_bigint ON
 
 CREATE INDEX idx_ci_pipelines_on_user_id_and_user_not_verified_bigint ON ci_pipelines USING btree (user_id, id_convert_to_bigint DESC) WHERE (failure_reason = 3);
 
+CREATE INDEX idx_ci_running_builds_on_runner_type_and_owner_xid_and_id ON ci_running_builds USING btree (runner_type, runner_owner_namespace_xid, runner_id);
+
 CREATE INDEX idx_compliance_security_policies_on_policy_configuration_id ON compliance_framework_security_policies USING btree (policy_configuration_id);
 
 CREATE UNIQUE INDEX idx_component_usages_on_component_used_by_project_and_used_date ON ONLY p_catalog_resource_component_usages USING btree (component_id, used_by_project_id, used_date);
diff --git a/doc/administration/auth/ldap/google_secure_ldap.md b/doc/administration/auth/ldap/google_secure_ldap.md
index d62652eee7c..bfa49038d6c 100644
--- a/doc/administration/auth/ldap/google_secure_ldap.md
+++ b/doc/administration/auth/ldap/google_secure_ldap.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/issues/46391) in GitLab 11.9.
-
 [Google Cloud Identity](https://cloud.google.com/identity/) provides a Secure
 LDAP service that can be configured with GitLab for authentication and group sync.
 
diff --git a/doc/administration/auth/ldap/index.md b/doc/administration/auth/ldap/index.md
index 024278b2184..050d63433ec 100644
--- a/doc/administration/auth/ldap/index.md
+++ b/doc/administration/auth/ldap/index.md
@@ -54,8 +54,7 @@ Users are considered inactive in LDAP when they:
 
 GitLab checks LDAP users' status:
 
-- When signing in using any authentication provider. [In GitLab 14.4 and earlier](https://gitlab.com/gitlab-org/gitlab/-/issues/343298), status was
-  checked only when signing in using LDAP directly.
+- When signing in using any authentication provider.
 - Once per hour for active web sessions or Git requests using tokens or SSH keys.
 - When performing Git over HTTP requests using LDAP username and password.
 - Once per day during [User Sync](ldap_synchronization.md#user-sync).
@@ -277,8 +276,6 @@ After configuring LDAP, to test the configuration, use the
 
 ### Basic configuration settings
 
-> - The `hosts` configuration setting was [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/139) in GitLab 14.7.
-
 The following basic settings are available:
 
 <!-- markdownlint-disable MD056 -->
@@ -1245,8 +1242,6 @@ You can find more details on the expected behavior of user updates in our [LDAP
 
 ## Google Secure LDAP
 
-> - Introduced in GitLab 11.9.
-
 [Google Cloud Identity](https://cloud.google.com/identity/) provides a Secure
 LDAP service that can be configured with GitLab for authentication and group sync.
 See [Google Secure LDAP](google_secure_ldap.md) for detailed configuration instructions.
diff --git a/doc/administration/auth/ldap/ldap_synchronization.md b/doc/administration/auth/ldap/ldap_synchronization.md
index d59abf01313..0d1aa8c0b9f 100644
--- a/doc/administration/auth/ldap/ldap_synchronization.md
+++ b/doc/administration/auth/ldap/ldap_synchronization.md
@@ -489,8 +489,6 @@ group, GitLab revokes their `admin` role when syncing.
 
 ### Global group memberships lock
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/4354) in GitLab 12.0.
-
 GitLab administrators can prevent group members from inviting new members to subgroups that have their membership synchronized with LDAP.
 
 Global group membership lock only applies to subgroups of the top-level group where LDAP synchronization is configured. No user can modify the
diff --git a/doc/administration/auth/oidc.md b/doc/administration/auth/oidc.md
index d574828cadd..b03d880aa77 100644
--- a/doc/administration/auth/oidc.md
+++ b/doc/administration/auth/oidc.md
@@ -463,8 +463,6 @@ gitlab_rails['omniauth_providers'] = [
 
 #### Configure Keycloak with a symmetric key algorithm
 
-> - Introduced in GitLab 14.2.
-
 WARNING:
 The following instructions are included for completeness, but only use symmetric key
 encryption if absolutely necessary.
diff --git a/doc/administration/auth/smartcard.md b/doc/administration/auth/smartcard.md
index f53c8e38840..ff69894a025 100644
--- a/doc/administration/auth/smartcard.md
+++ b/doc/administration/auth/smartcard.md
@@ -14,8 +14,6 @@ GitLab supports authentication using smart cards.
 
 ## Existing password authentication
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/33669) in GitLab 12.6.
-
 By default, existing users can continue to sign in with a username and password when smart card
 authentication is enabled.
 
@@ -31,10 +29,8 @@ GitLab supports two authentication methods:
 
 ### Authentication against a local database with X.509 certificates
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/726) in GitLab 11.6 as an experimental feature.
-
 WARNING:
-Smart card authentication against local databases may change or be removed completely in future releases.
+Smart card authentication against local databases is an experimental feature and may change or be removed completely in future releases.
 
 Smart cards with X.509 certificates can be used to authenticate with GitLab.
 
@@ -57,23 +53,19 @@ Certificate:
 
 ### Authentication against a local database with X.509 certificates and SAN extension
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/8605) in GitLab 12.3.
-
 Smart cards with X.509 certificates using SAN extensions can be used to authenticate
 with GitLab.
 
 NOTE:
-This is an experimental feature. Smart card authentication against local databases may
-change or be removed completely in future releases.
+Smart card authentication against local databases is an experimental feature and may change or be removed completely in future releases.
 
 To use a smart card with an X.509 certificate to authenticate against a local
-database with GitLab, in:
+database with GitLab:
 
-- GitLab 12.4 and later, at least one of the `subjectAltName` (SAN) extensions
-  need to define the user identity (`email`) within the GitLab instance (`URI`).
-  `URI`: needs to match `Gitlab.config.host.gitlab`.
-- From [GitLab 12.5](https://gitlab.com/gitlab-org/gitlab/-/issues/33907),
-  if your certificate contains only **one** SAN email entry, you don't need to
+- At least one of the `subjectAltName` (SAN) extensions
+  must define the user identity (`email`) within the GitLab instance (`URI`).
+- The `URI` must match `Gitlab.config.host.gitlab`.
+- If your certificate contains only **one** SAN email entry, you don't need to
   add or modify it to match the `email` with the `URI`.
 
 For example:
@@ -100,7 +92,8 @@ Certificate:
 
 ### Authentication against an LDAP server
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/7693) in GitLab 11.8 as an experimental feature. Smart card authentication against an LDAP server may change or be removed completely in the future.
+NOTE:
+Smart card authentication against an LDAP server is an experimental feature and may change or be removed completely in future releases.
 
 GitLab implements a standard way of certificate matching following
 [RFC4523](https://www.rfc-editor.org/rfc/rfc4523). It uses the
diff --git a/doc/administration/credentials_inventory.md b/doc/administration/credentials_inventory.md
index b0fd268c64e..3bc3b8e93e3 100644
--- a/doc/administration/credentials_inventory.md
+++ b/doc/administration/credentials_inventory.md
@@ -10,9 +10,6 @@ DETAILS:
 **Tier:** Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/20912) in GitLab 12.6.
-> - [Bot-created access tokens not displayed in personal access token list](https://gitlab.com/gitlab-org/gitlab/-/issues/351759) in GitLab 14.9.
-
 As a GitLab administrator, you are responsible for the overall security of your instance.
 To assist, GitLab provides an inventory of all the credentials that can be used to access
 your self-managed instance.
@@ -20,7 +17,7 @@ your self-managed instance.
 In the credentials inventory, you can view all:
 
 - Personal access tokens (PATs).
-- Project access tokens (introduced in GitLab 14.8).
+- Project access tokens
 - Group access tokens ([introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/102959) in GitLab 15.6).
 - SSH keys.
 - GPG keys.
@@ -30,14 +27,12 @@ You can also [revoke](#revoke-a-users-personal-access-token), [delete](#delete-a
 - Who they belong to.
 - Their access scope.
 - Their usage pattern.
-- [In GitLab 13.2 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/214809), when they:
+- When they:
   - Expire.
   - Were revoked.
 
 ## Revoke a user's personal access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214811) in GitLab 13.4.
-
 You can revoke a user's personal access token.
 
 1. On the left sidebar, at the bottom, select **Admin Area**.
@@ -58,8 +53,6 @@ When a PAT is revoked from the credentials inventory, the instance notifies the
 
 ## Revoke a user's project access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/243833) in GitLab 14.8.
-
 1. On the left sidebar, at the bottom, select **Admin Area**.
 1. Select **Credentials**.
 1. Select the **Project Access Tokens** tab.
@@ -71,8 +64,6 @@ The project access token is revoked and a background worker is queued to delete
 
 ## Delete a user's SSH key
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/225248) in GitLab 13.5.
-
 1. On the left sidebar, at the bottom, select **Admin Area**.
 1. Select **Credentials**.
 1. Select the **SSH Keys** tab.
@@ -84,9 +75,6 @@ The instance notifies the user.
 
 ## Review existing GPG keys
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/282429) in GitLab 13.10.
-> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/292961) in GitLab 13.12.
-
 You can view all existing GPG in your GitLab instance by going to the
 credentials inventory GPG Keys tab, as well as the following properties:
 
diff --git a/doc/administration/moderate_users.md b/doc/administration/moderate_users.md
index 34c9e5f3c0f..f1bdb414d71 100644
--- a/doc/administration/moderate_users.md
+++ b/doc/administration/moderate_users.md
@@ -142,8 +142,6 @@ When you deactivate a user, their projects, groups, and history remain.
 
 ### Deactivate a user
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/22257) in GitLab 12.4.
-
 Prerequisites:
 
 - The user has had no activity in the last 90 days.
@@ -162,8 +160,6 @@ To deactivate users with the GitLab API, see [deactivate user](../api/users.md#d
 
 ### Automatically deactivate dormant users
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/320875) in GitLab 14.0.
-> - Exclusion of GitLab generate bots [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/340346) in GitLab 14.5
 > - Customizable time period [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/336747) in GitLab 15.4
 > - The lower limit for inactive period set to 90 days [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/100793) in GitLab 15.5
 
@@ -222,8 +218,6 @@ A maximum of 240,000 users can be deleted per day.
 
 ### Activate a user
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/22257) in GitLab 12.4.
-
 A deactivated user can be activated from the Admin Area.
 
 To do this:
@@ -242,8 +236,6 @@ Users can also be activated using the [GitLab API](../api/users.md#activate-user
 
 ## Ban and unban users
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/327353) in GitLab 14.2 [with a flag](../administration/feature_flags.md) named `ban_user_feature_flag`. Disabled by default.
-> - Ban and unban users [generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/327353) in GitLab 14.8. Feature flag `ban_user_feature_flag` removed.
 > - Hiding merge requests of banned users [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/107836) in GitLab 15.8 [with a flag](../administration/feature_flags.md) named `hide_merge_requests_from_banned_users`. Disabled by default.
 > - Hiding comments of banned users [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/112973) in GitLab 15.11 [with a flag](../administration/feature_flags.md) named `hidden_notes`. Disabled by default.
 > - Hiding projects of banned users [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/121488) in GitLab 16.2 [with a flag](../administration/feature_flags.md) named `hide_projects_of_banned_users`. Disabled by default.
diff --git a/doc/administration/raketasks/ldap.md b/doc/administration/raketasks/ldap.md
index e3473b9b897..671d6edbe64 100644
--- a/doc/administration/raketasks/ldap.md
+++ b/doc/administration/raketasks/ldap.md
@@ -44,8 +44,6 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/14735) in GitLab 12.2.
-
 The following task runs a [group sync](../auth/ldap/ldap_synchronization.md#group-sync) immediately.
 This is valuable when you'd like to update all configured group memberships against LDAP without
 waiting for the next scheduled group sync to be run.
diff --git a/doc/administration/settings/rate_limit_on_users_api.md b/doc/administration/settings/rate_limit_on_users_api.md
index cad09a8e2ca..1277bf9306a 100644
--- a/doc/administration/settings/rate_limit_on_users_api.md
+++ b/doc/administration/settings/rate_limit_on_users_api.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78364) in GitLab 14.8.
-
 You can configure the per user rate limit for requests to [Users API](../../api/users.md).
 
 To change the rate limit:
diff --git a/doc/api/access_requests.md b/doc/api/access_requests.md
index 78bedbdca17..76754c0a31b 100644
--- a/doc/api/access_requests.md
+++ b/doc/api/access_requests.md
@@ -16,12 +16,12 @@ The access levels are defined in the `Gitlab::Access` module, and the
 following levels are recognized:
 
 - No access (`0`)
-- Minimal access (`5`) ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/220203) in GitLab 13.5.)
+- Minimal access (`5`)
 - Guest (`10`)
 - Reporter (`20`)
 - Developer (`30`)
 - Maintainer (`40`)
-- Owner (`50`). Valid for projects in [GitLab 14.9 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/21432).
+- Owner (`50`).
 
 ## List access requests for a group or project
 
diff --git a/doc/api/appearance.md b/doc/api/appearance.md
index e90658529da..2775c028467 100644
--- a/doc/api/appearance.md
+++ b/doc/api/appearance.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/16647) in GitLab 12.7.
-
 The appearance API allows you to maintain the appearance of GitLab as if
 you're using the GitLab UI at `/admin/appearance`. The API requires
 administrator privileges.
diff --git a/doc/api/applications.md b/doc/api/applications.md
index 1715131a717..c8474dfbc70 100644
--- a/doc/api/applications.md
+++ b/doc/api/applications.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/8160) in GitLab 10.5.
-
 The Applications API operates on instance-wide OAuth applications for:
 
 - [Using GitLab as an authentication provider](../integration/oauth_provider.md).
diff --git a/doc/api/avatar.md b/doc/api/avatar.md
index 3755cbbf7eb..ce0a31b6edd 100644
--- a/doc/api/avatar.md
+++ b/doc/api/avatar.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/19121) in GitLab 11.0.
-
 ## Get a single avatar URL
 
 Get a single [avatar](../user/profile/index.md#access-your-user-settings) URL for a user with the given email address.
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 56d6ae045be..8dbfba452c0 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -13612,6 +13612,29 @@ The edge type for [`Pipeline`](#pipeline).
 | <a id="pipelineedgecursor"></a>`cursor` | [`String!`](#string) | A cursor for use in pagination. |
 | <a id="pipelineedgenode"></a>`node` | [`Pipeline`](#pipeline) | The item at the end of the edge. |
 
+#### `PipelineExecutionPolicyConnection`
+
+The connection type for [`PipelineExecutionPolicy`](#pipelineexecutionpolicy).
+
+##### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="pipelineexecutionpolicyconnectionedges"></a>`edges` | [`[PipelineExecutionPolicyEdge]`](#pipelineexecutionpolicyedge) | A list of edges. |
+| <a id="pipelineexecutionpolicyconnectionnodes"></a>`nodes` | [`[PipelineExecutionPolicy]`](#pipelineexecutionpolicy) | A list of nodes. |
+| <a id="pipelineexecutionpolicyconnectionpageinfo"></a>`pageInfo` | [`PageInfo!`](#pageinfo) | Information to aid in pagination. |
+
+#### `PipelineExecutionPolicyEdge`
+
+The edge type for [`PipelineExecutionPolicy`](#pipelineexecutionpolicy).
+
+##### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="pipelineexecutionpolicyedgecursor"></a>`cursor` | [`String!`](#string) | A cursor for use in pagination. |
+| <a id="pipelineexecutionpolicyedgenode"></a>`node` | [`PipelineExecutionPolicy`](#pipelineexecutionpolicy) | The item at the end of the edge. |
+
 #### `PipelineScheduleConnection`
 
 The connection type for [`PipelineSchedule`](#pipelineschedule).
@@ -21745,6 +21768,22 @@ four standard [pagination arguments](#pagination-arguments):
 | <a id="grouppackagessort"></a>`sort` | [`PackageGroupSort`](#packagegroupsort) | Sort packages by this criteria. |
 | <a id="grouppackagesstatus"></a>`status` | [`PackageStatus`](#packagestatus) | Filter a package by status. |
 
+##### `Group.pipelineExecutionPolicies`
+
+Pipeline Execution Policies of the namespace.
+
+Returns [`PipelineExecutionPolicyConnection`](#pipelineexecutionpolicyconnection).
+
+This field returns a [connection](#connections). It accepts the
+four standard [pagination arguments](#pagination-arguments):
+`before: String`, `after: String`, `first: Int`, and `last: Int`.
+
+###### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="grouppipelineexecutionpoliciesrelationship"></a>`relationship` | [`SecurityPolicyRelationType`](#securitypolicyrelationtype) | Filter policies by the given policy relationship. |
+
 ##### `Group.projectComplianceStandardsAdherence`
 
 Compliance standards adherence for the projects in a group and its subgroups.
@@ -25098,6 +25137,22 @@ four standard [pagination arguments](#pagination-arguments):
 | <a id="namespacecomplianceframeworksids"></a>`ids` | [`[ComplianceManagementFrameworkID!]`](#compliancemanagementframeworkid) | List of Global IDs of compliance frameworks to return. |
 | <a id="namespacecomplianceframeworkssearch"></a>`search` | [`String`](#string) | Search framework with most similar names. |
 
+##### `Namespace.pipelineExecutionPolicies`
+
+Pipeline Execution Policies of the namespace.
+
+Returns [`PipelineExecutionPolicyConnection`](#pipelineexecutionpolicyconnection).
+
+This field returns a [connection](#connections). It accepts the
+four standard [pagination arguments](#pagination-arguments):
+`before: String`, `after: String`, `first: Int`, and `last: Int`.
+
+###### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="namespacepipelineexecutionpoliciesrelationship"></a>`relationship` | [`SecurityPolicyRelationType`](#securitypolicyrelationtype) | Filter policies by the given policy relationship. |
+
 ##### `Namespace.projects`
 
 Projects within this namespace.
@@ -26039,6 +26094,23 @@ Represents pipeline counts for the project.
 | <a id="pipelinecountspending"></a>`pending` | [`Int`](#int) | Number of pipelines with scope PENDING for the project. |
 | <a id="pipelinecountsrunning"></a>`running` | [`Int`](#int) | Number of pipelines with scope RUNNING for the project. |
 
+### `PipelineExecutionPolicy`
+
+Represents the pipeline execution policy.
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="pipelineexecutionpolicydescription"></a>`description` | [`String!`](#string) | Description of the policy. |
+| <a id="pipelineexecutionpolicyeditpath"></a>`editPath` | [`String!`](#string) | URL of policy edit page. |
+| <a id="pipelineexecutionpolicyenabled"></a>`enabled` | [`Boolean!`](#boolean) | Indicates whether this policy is enabled. |
+| <a id="pipelineexecutionpolicyname"></a>`name` | [`String!`](#string) | Name of the policy. |
+| <a id="pipelineexecutionpolicypolicyscope"></a>`policyScope` | [`PolicyScope`](#policyscope) | Scope of the policy. |
+| <a id="pipelineexecutionpolicysource"></a>`source` | [`SecurityPolicySource!`](#securitypolicysource) | Source of the policy. Its fields depend on the source type. |
+| <a id="pipelineexecutionpolicyupdatedat"></a>`updatedAt` | [`Time!`](#time) | Timestamp of when the policy YAML was last updated. |
+| <a id="pipelineexecutionpolicyyaml"></a>`yaml` | [`String!`](#string) | YAML definition of the policy. |
+
 ### `PipelineMessage`
 
 #### Fields
@@ -27508,6 +27580,22 @@ Returns [`PipelineCounts`](#pipelinecounts).
 | <a id="projectpipelinecountssha"></a>`sha` | [`String`](#string) | Filter pipelines by the SHA of the commit they are run for. |
 | <a id="projectpipelinecountssource"></a>`source` | [`String`](#string) | Filter pipelines by their source. |
 
+##### `Project.pipelineExecutionPolicies`
+
+Pipeline Execution Policies of the project.
+
+Returns [`PipelineExecutionPolicyConnection`](#pipelineexecutionpolicyconnection).
+
+This field returns a [connection](#connections). It accepts the
+four standard [pagination arguments](#pagination-arguments):
+`before: String`, `after: String`, `first: Int`, and `last: Int`.
+
+###### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="projectpipelineexecutionpoliciesrelationship"></a>`relationship` | [`SecurityPolicyRelationType`](#securitypolicyrelationtype) | Filter policies by the given policy relationship. |
+
 ##### `Project.pipelineSchedules`
 
 Pipeline schedules of the project. This field can only be resolved for one project per request.
@@ -36000,6 +36088,7 @@ four standard [pagination arguments](#pagination-arguments):
 Implementations:
 
 - [`ApprovalPolicy`](#approvalpolicy)
+- [`PipelineExecutionPolicy`](#pipelineexecutionpolicy)
 - [`ScanExecutionPolicy`](#scanexecutionpolicy)
 - [`ScanResultPolicy`](#scanresultpolicy)
 
diff --git a/doc/api/group_access_tokens.md b/doc/api/group_access_tokens.md
index 257bd420930..edcf791f07e 100644
--- a/doc/api/group_access_tokens.md
+++ b/doc/api/group_access_tokens.md
@@ -14,8 +14,6 @@ You can read more about [group access tokens](../user/group/settings/group_acces
 
 ## List group access tokens
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77236) in GitLab 14.7.
-
 Get a list of [group access tokens](../user/group/settings/group_access_tokens.md).
 
 ```plaintext
@@ -50,8 +48,6 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
 
 ## Get a group access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82714) in GitLab 14.10.
-
 Get a [group access token](../user/group/settings/group_access_tokens.md) by ID.
 
 ```plaintext
@@ -85,7 +81,6 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
 
 ## Create a group access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77236) in GitLab 14.7.
 > - The `expires_at` attribute default was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/120213) in GitLab 16.0.
 
 Create a [group access token](../user/group/settings/group_access_tokens.md). You must have the Owner role for the
@@ -188,8 +183,6 @@ for more information.
 
 ## Revoke a group access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77236) in GitLab 14.7.
-
 Revoke a [group access token](../user/group/settings/group_access_tokens.md).
 
 ```plaintext
diff --git a/doc/api/members.md b/doc/api/members.md
index 27bb50e1aa7..22f4d40e29d 100644
--- a/doc/api/members.md
+++ b/doc/api/members.md
@@ -10,24 +10,18 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> `created_by` field [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/28789) in GitLab 14.10.
-
 ## Roles
 
 The [role](../user/permissions.md) assigned to a user or group is defined
 in the `Gitlab::Access` module as `access_level`.
 
 - No access (`0`)
-- Minimal access (`5`) ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/220203) in GitLab 13.5.)
+- Minimal access (`5`)
 - Guest (`10`)
 - Reporter (`20`)
 - Developer (`30`)
 - Maintainer (`40`)
-- Owner (`50`). Valid for projects in [GitLab 14.9 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/21432).
-
-NOTE:
-In [GitLab 14.9](https://gitlab.com/gitlab-org/gitlab/-/issues/351211) and later, projects in personal namespaces have an `access_level` of `50`(Owner).
-In GitLab 14.8 and earlier, projects in personal namespaces have an `access_level` of `40` (Maintainer) due to [an issue](https://gitlab.com/gitlab-org/gitlab/-/issues/219299)
+- Owner (`50`)
 
 ## Limitations
 
@@ -124,7 +118,6 @@ Gets a list of group or project members viewable by the authenticated user, incl
 
 If a user is a member of this group or project and also of one or more ancestor groups,
 only its membership with the highest `access_level` is returned.
-([Improved](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/56677) in GitLab 13.11.)
 This represents the effective permission of the user.
 
 Members from an invited group are returned if either:
@@ -334,16 +327,13 @@ Example response:
 
 ## List all billable members of a group
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/217384) in GitLab 13.5.
-
 Gets a list of group members that count as billable. The list includes members in subgroups and projects.
 
 This API endpoint works on top-level groups only. It does not work on subgroups.
 
 This function takes [pagination](rest/index.md#pagination) parameters `page` and `per_page` to restrict the list of users.
 
-[In GitLab 13.7 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/262875), use the `search` parameter
-to search for billable group members by name and `sort` to sort the results.
+Use the `search` parameter to search for billable group members by name and `sort` to sort the results.
 
 ```plaintext
 GET /groups/:id/billable_members
@@ -423,8 +413,6 @@ Example response:
 
 ## List memberships for a billable member of a group
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/321560) in GitLab 13.11.
-
 Gets a list of memberships for a billable member of a group.
 
 Lists all projects and groups a user is a member of. Only projects and groups within the group hierarchy are included.
@@ -685,8 +673,6 @@ Example response:
 
 ### Set override flag for a member of a group
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/4875) in GitLab 13.0.
-
 By default, the access level of LDAP group members is set to the value specified
 by LDAP through Group Sync. You can allow access level overrides by calling this endpoint.
 
@@ -731,8 +717,6 @@ Example response:
 
 ### Remove override for a member of a group
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/4875) in GitLab 13.0.
-
 Sets the override flag to false and allows LDAP Group Sync to reset the access
 level to the LDAP-prescribed value.
 
@@ -842,8 +826,6 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitla
 
 ## List pending members of a group and its subgroups and projects
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/332596) in GitLab 14.6.
-
 For a group and its subgroups and projects, get a list of all members in an `awaiting` state and those who are invited but do not have a GitLab account.
 
 This request returns all matching group and project members from all groups and projects in the root group's hierarchy.
diff --git a/doc/api/plan_limits.md b/doc/api/plan_limits.md
index e239f494e0f..3a2bbfbaf04 100644
--- a/doc/api/plan_limits.md
+++ b/doc/api/plan_limits.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/54232) in GitLab 13.10.
-
 The plan limits API allows you to maintain the application limits for the existing subscription plans.
 
 The existing plans depend on the GitLab edition. In the Community Edition, only the plan `default`
diff --git a/doc/api/project_access_tokens.md b/doc/api/project_access_tokens.md
index 4dc4af2e1d5..48ec0d7c37d 100644
--- a/doc/api/project_access_tokens.md
+++ b/doc/api/project_access_tokens.md
@@ -14,8 +14,6 @@ You can read more about [project access tokens](../user/project/settings/project
 
 ## List project access tokens
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/238991) in GitLab 13.9.
-
 Get a list of [project access tokens](../user/project/settings/project_access_tokens.md).
 
 ```plaintext
@@ -50,8 +48,6 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
 
 ## Get a project access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82714) in GitLab 14.10.
-
 Get a [project access token](../user/project/settings/project_access_tokens.md) by ID.
 
 ```plaintext
@@ -86,8 +82,6 @@ curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/a
 
 ## Create a project access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/55408) in GitLab 13.10.
-> - The `token` attribute was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/55408) in GitLab 13.10.
 > - The `expires_at` attribute default was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/120213) in GitLab 16.0.
 
 Create a [project access token](../user/project/settings/project_access_tokens.md).
@@ -98,8 +92,6 @@ role that can be set is:
 - Owner (`50`), if you have the Owner role for the project.
 - Maintainer (`40`), if you have the Maintainer role on the project.
 
-In GitLab 14.8 and earlier, project access tokens have a maximum role of Maintainer.
-
 ```plaintext
 POST projects/:id/access_tokens
 ```
@@ -197,8 +189,6 @@ for more information.
 
 ## Revoke a project access token
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/238991) in GitLab 13.9.
-
 Revoke a [project access token](../user/project/settings/project_access_tokens.md).
 
 ```plaintext
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 69e717fa5d5..8e7a28a5f7a 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -386,7 +386,7 @@ listed in the descriptions of the relevant settings.
 | `deactivate_dormant_users_period`        | integer          | no                                   | Length of time (in days) after which a user is considered dormant. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/336747) in GitLab 15.3. |
 | `decompress_archive_file_timeout`        | integer          | no                                   | Default timeout for decompressing archived files, in seconds. Set to 0 to disable timeouts. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/129161) in GitLab 16.4. |
 | `default_artifacts_expire_in`            | string           | no                                   | Set the default expiration time for each job's artifacts. |
-| `default_branch_name`                    | string           | no                                   | [Instance-level custom initial branch name](../user/project/repository/branches/default.md#instance-level-custom-initial-branch-name). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/225258) in GitLab 13.2. |
+| `default_branch_name`                    | string           | no                                   | [Instance-level custom initial branch name](../user/project/repository/branches/default.md#instance-level-custom-initial-branch-name). |
 | `default_branch_protection`              | integer          | no                                   | Determine if developers can push to the default branch. Can take: `0` _(not protected, both users with the Developer role or Maintainer role can push new commits and force push)_, `1` _(partially protected, users with the Developer role or Maintainer role can push new commits, but cannot force push)_ or `2` _(fully protected, users with the Developer or Maintainer role cannot push new commits, but users with the Developer or Maintainer role can; no one can force push)_ as a parameter. Default is `2`. |
 | `default_ci_config_path`                 | string           | no                                   | Default CI/CD configuration file and path for new projects (`.gitlab-ci.yml` if not set). |
 | `default_group_visibility`               | string           | no                                   | What visibility level new groups receive. Can take `private`, `internal` and `public` as a parameter. Default is `private`. [Changed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131203) in GitLab 16.4: cannot be set to any levels in `restricted_visibility_levels`.|
@@ -405,7 +405,7 @@ listed in the descriptions of the relevant settings.
 | `diff_max_files`                         | integer          | no                                   | Maximum [files in a diff](../administration/diff_limits.md). |
 | `diff_max_lines`                         | integer          | no                                   | Maximum [lines in a diff](../administration/diff_limits.md). |
 | `disable_admin_oauth_scopes`             | boolean          | no                                   | Stops administrators from connecting their GitLab accounts to non-trusted OAuth 2.0 applications that have the `api`, `read_api`, `read_repository`, `write_repository`, `read_registry`, `write_registry`, or `sudo` scopes. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/375043) in GitLab 15.6. |
-| `disable_feed_token`                     | boolean          | no                                   | Disable display of RSS/Atom and calendar feed tokens. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/231493) in GitLab 13.7. |
+| `disable_feed_token`                     | boolean          | no                                   | Disable display of RSS/Atom and calendar feed tokens. |
 | `disable_personal_access_tokens`          | boolean          | no                                   | Disable personal access tokens. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/384201) in GitLab 15.7. Self-managed, Premium and Ultimate only. There is no method available to enable a personal access token that's been disabled through the API. This is a [known issue](https://gitlab.com/gitlab-org/gitlab/-/issues/399233). For more information about available workarounds, see [Workaround](https://gitlab.com/gitlab-org/gitlab/-/issues/399233#workaround).      |
 | `disabled_oauth_sign_in_sources`         | array of strings | no                                   | Disabled OAuth sign-in sources. |
 | `dns_rebinding_protection_enabled`       | boolean          | no                                   | Enforce DNS-rebinding attack protection. |
@@ -507,12 +507,12 @@ listed in the descriptions of the relevant settings.
 | `max_attachment_size`                    | integer          | no                                   | Limit attachment size in MB. |
 | `max_decompressed_archive_size`          | integer          | no                                   | Maximum decompressed file size for imported archives in MB. Set to `0` for unlimited. Default is `25600`.  |
 | `max_export_size`                        | integer          | no                                   | Maximum export size in MB. 0 for unlimited. Default = 0 (unlimited). |
-| `max_import_size`                        | integer          | no                                   | Maximum import size in MB. 0 for unlimited. Default = 0 (unlimited). [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/251106) from 50 MB to 0 in GitLab 13.8. |
+| `max_import_size`                        | integer          | no                                   | Maximum import size in MB. 0 for unlimited. Default = 0 (unlimited). |
 | `max_import_remote_file_size`            | integer          | no                                   | Maximum remote file size for imports from external object storages. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/384976) in GitLab 16.3. |
 | `max_login_attempts`                     | integer          | no                                   | Maximum number of sign-in attempts before locking out the user. |
 | `max_pages_size`                         | integer          | no                                   | Maximum size of pages repositories in MB. |
 | `max_personal_access_token_lifetime`     | integer          | no                                   | Maximum allowable lifetime for access tokens in days. When left blank, default value of 365 is applied. When set, value must be 365 or less. When changed, existing access tokens with an expiration date beyond the maximum allowable lifetime are revoked. Self-managed, Ultimate only.|
-| `max_ssh_key_lifetime`                   | integer          | no                                   | Maximum allowable lifetime for SSH keys in days. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/1007) in GitLab 14.6. Self-managed, Ultimate only.|
+| `max_ssh_key_lifetime`                   | integer          | no                                   | Maximum allowable lifetime for SSH keys in days. Self-managed, Ultimate only.|
 | `max_terraform_state_size_bytes`         | integer          | no                                   | Maximum size in bytes of the [Terraform state](../administration/terraform_state.md) files. Set this to 0 for unlimited file size. |
 | `metrics_method_call_threshold`          | integer          | no                                   | A method call is only tracked when it takes longer than the given amount of milliseconds. |
 | `max_number_of_repository_downloads`     | integer          | no                                   | Maximum number of unique repositories a user can download in the specified time period before they are banned. Default: 0, Maximum: 10,000 repositories. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87980) in GitLab 15.1. Self-managed, Ultimate only. |
@@ -575,7 +575,7 @@ listed in the descriptions of the relevant settings.
 | `remember_me_enabled`                    | boolean          | no                                   | Enable [**Remember me** setting](../administration/settings/account_and_limit_settings.md#turn-remember-me-on-or-off). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/369133) in GitLab 16.0. |
 | `repository_checks_enabled`              | boolean          | no                                   | GitLab periodically runs `git fsck` in all project and wiki repositories to look for silent disk corruption issues. |
 | `repository_size_limit`                  | integer          | no                                   | Size limit per repository (MB). Premium and Ultimate only. |
-| `repository_storages_weighted`           | hash of strings to integers | no                        | (GitLab 13.1 and later) Hash of names of taken from `gitlab.yml` to [weights](../administration/repository_storage_paths.md#configure-where-new-repositories-are-stored). New projects are created in one of these stores, chosen by a weighted random selection. |
+| `repository_storages_weighted`           | hash of strings to integers | no                        | Hash of names of taken from `gitlab.yml` to [weights](../administration/repository_storage_paths.md#configure-where-new-repositories-are-stored). New projects are created in one of these stores, chosen by a weighted random selection. |
 | `require_admin_approval_after_user_signup` | boolean        | no                                   | When enabled, any user that signs up for an account using the registration form is placed under a **Pending approval** state and has to be explicitly [approved](../administration/moderate_users.md) by an administrator. |
 | `require_two_factor_authentication`      | boolean          | no                                   | (**If enabled, requires:** `two_factor_grace_period`) Require all users to set up two-factor authentication. |
 | `restricted_visibility_levels`           | array of strings | no                                   | Selected levels cannot be used by non-Administrator users for groups, projects or snippets. Can take `private`, `internal` and `public` as a parameter. Default is `null` which means there is no restriction.[Changed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131203) in GitLab 16.4: cannot select levels that are set as `default_project_visibility` and `default_group_visibility`. |
@@ -671,10 +671,10 @@ You can configure inactive projects deletion or turn it off.
 
 | Attribute                                | Type             | Required                             | Description |
 |------------------------------------------|------------------|:------------------------------------:|-------------|
-| `delete_inactive_projects`               | boolean          | no                                   | Enable [inactive project deletion](../administration/inactive_project_deletion.md). Default is `false`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/84519) in GitLab 14.10. [Became operational without feature flag](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/96803) in GitLab 15.4. |
-| `inactive_projects_delete_after_months`  | integer          | no                                   | If `delete_inactive_projects` is `true`, the time (in months) to wait before deleting inactive projects. Default is `2`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/84519) in GitLab 14.10. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
-| `inactive_projects_min_size_mb`          | integer          | no                                   | If `delete_inactive_projects` is `true`, the minimum repository size for projects to be checked for inactivity. Default is `0`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/84519) in GitLab 14.10. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
-| `inactive_projects_send_warning_email_after_months` | integer | no                                 | If `delete_inactive_projects` is `true`, sets the time (in months) to wait before emailing maintainers that the project is scheduled be deleted because it is inactive. Default is `1`. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/84519) in GitLab 14.10. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
+| `delete_inactive_projects`               | boolean          | no                                   | Enable [inactive project deletion](../administration/inactive_project_deletion.md). Default is `false`. [Became operational without feature flag](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/96803) in GitLab 15.4. |
+| `inactive_projects_delete_after_months`  | integer          | no                                   | If `delete_inactive_projects` is `true`, the time (in months) to wait before deleting inactive projects. Default is `2`. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
+| `inactive_projects_min_size_mb`          | integer          | no                                   | If `delete_inactive_projects` is `true`, the minimum repository size for projects to be checked for inactivity. Default is `0`. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
+| `inactive_projects_send_warning_email_after_months` | integer | no                                 | If `delete_inactive_projects` is `true`, sets the time (in months) to wait before emailing maintainers that the project is scheduled be deleted because it is inactive. Default is `1`. [Became operational](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/85689) in GitLab 15.0. |
 
 ## Housekeeping fields
 
diff --git a/doc/api/users.md b/doc/api/users.md
index c7a47298c93..3aaeba877ef 100644
--- a/doc/api/users.md
+++ b/doc/api/users.md
@@ -105,8 +105,7 @@ GET /users?external=true
 GitLab supports bot users such as the [alert bot](../operations/incident_management/integrations.md)
 or the [support bot](../user/project/service_desk/configure.md#support-bot-user).
 You can exclude the following types of [internal users](../development/internal_users.md#internal-users)
-from the users' list with the `exclude_internal=true` parameter
-([introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/241144) in GitLab 13.4):
+from the users' list with the `exclude_internal=true` parameter:
 
 - Alert bot
 - Support bot
@@ -138,7 +137,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed, GitLab Dedicated
 
-> - The `namespace_id` field in the response was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82045) in GitLab 14.10.
 > - The `created_by` field in the response was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/93092) in GitLab 15.6.
 > - The `scim_identities` field in the response [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/324247) in GitLab 16.1.
 > - The `auditors` field in the response [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/418023) in GitLab 16.2.
@@ -550,11 +548,9 @@ over `password`. In addition, `reset_password` and
 `force_random_password` can be used together.
 
 NOTE:
-From [GitLab 12.1](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/29888/), `private_profile` defaults to `false`.
-From [GitLab 15.8](https://gitlab.com/gitlab-org/gitlab/-/issues/231301), `private_profile` defaults to the value determined by [this](../administration/settings/account_and_limit_settings.md#set-profiles-of-new-users-to-private-by-default) setting.
-
-NOTE:
-From [GitLab 13.2](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/35604), `bio` defaults to `""` instead of `null`.
+`private_profile` defaults to the value of the
+[Set profiles of new users to private by default](../administration/settings/account_and_limit_settings.md#set-profiles-of-new-users-to-private-by-default) setting.
+`bio` defaults to `""` instead of `null`.
 
 ```plaintext
 POST /users
@@ -1066,11 +1062,11 @@ Get the counts (same as in the upper-right menu) of the authenticated user.
 
 | Attribute                         | Type   | Description                                                                  |
 | --------------------------------- | ------ | ---------------------------------------------------------------------------- |
-| `assigned_issues`                 | number | Number of issues that are open and assigned to the current user. [Added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66909) in GitLab 14.2. |
-| `assigned_merge_requests`         | number | Number of merge requests that are active and assigned to the current user. [Added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/50026) in GitLab 13.8. |
-| `merge_requests`                  | number | [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/50026) in GitLab 13.8. Equivalent to and replaced by `assigned_merge_requests`. |
-| `review_requested_merge_requests` | number | Number of merge requests that the current user has been requested to review. [Added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/50026) in GitLab 13.8. |
-| `todos`                           | number | Number of pending to-do items for current user. [Added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66909) in GitLab 14.2. |
+| `assigned_issues`                 | number | Number of issues that are open and assigned to the current user.             |
+| `assigned_merge_requests`         | number | Number of merge requests that are active and assigned to the current user.   |
+| `merge_requests`                  | number | [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/50026) in GitLab 13.8. Equivalent to and replaced by `assigned_merge_requests`.        |
+| `review_requested_merge_requests` | number | Number of merge requests that the current user has been requested to review. |
+| `todos`                           | number | Number of pending to-do items for current user.                              |
 
 ```plaintext
 GET /user_counts
@@ -1541,8 +1537,7 @@ Example response:
 
 ## Get a specific GPG key for a given user
 
-Get a specific GPG key for a given user. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/43693)
-in GitLab 13.5, this endpoint can be accessed without administrator authentication.
+Get a specific GPG key for a given user. This endpoint can be accessed without administrator authentication.
 
 ```plaintext
 GET /users/:id/gpg_keys/:key_id
@@ -2040,8 +2035,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/263107) in GitLab 13.7.
-
 Approves the specified user. Available only for administrators.
 
 ```plaintext
@@ -2245,8 +2238,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/17176) in GitLab 13.6.
-> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/267553) in GitLab 13.8.
 > - The `expires_at` attribute default was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/120213) in GitLab 16.0.
 
 Use this API to create a new personal access token. Token values are returned once so,
diff --git a/doc/development/cascading_settings.md b/doc/development/cascading_settings.md
index 5c4c1cfed91..44d541fecd3 100644
--- a/doc/development/cascading_settings.md
+++ b/doc/development/cascading_settings.md
@@ -6,8 +6,6 @@ info: Any user with at least the Maintainer role can merge updates to this conte
 
 # Cascading Settings
 
-> - Introduced in [GitLab 13.11](https://gitlab.com/gitlab-org/gitlab/-/issues/321724).
-
 The cascading settings framework allows groups to essentially inherit settings
 values from ancestors (parent group on up the group hierarchy) and from
 instance-level application settings. The framework also allows settings values
diff --git a/doc/development/permissions/predefined_roles.md b/doc/development/permissions/predefined_roles.md
index 577cf6192c4..2ccfc51e6de 100644
--- a/doc/development/permissions/predefined_roles.md
+++ b/doc/development/permissions/predefined_roles.md
@@ -93,8 +93,7 @@ Project membership (where the group membership is already taken into account)
 is stored in the `project_authorizations` table.
 
 NOTE:
-In [GitLab 14.9](https://gitlab.com/gitlab-org/gitlab/-/issues/351211) and later, projects in personal namespaces have a maximum role of Owner.
-Because of a [known issue](https://gitlab.com/gitlab-org/gitlab/-/issues/219299) in GitLab 14.8 and earlier, projects in personal namespaces have a maximum role of Maintainer.
+Projects in personal namespaces have a maximum role of Owner.
 
 #### Guest role
 
diff --git a/doc/integration/ding_talk.md b/doc/integration/ding_talk.md
index 76efec66a3f..10f287e1cca 100644
--- a/doc/integration/ding_talk.md
+++ b/doc/integration/ding_talk.md
@@ -10,7 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/341898) in GitLab 14.5.
 > - [Deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/390855) in GitLab 15.10.
 
 You can sign in to GitLab using your DingTalk account.
diff --git a/doc/integration/kerberos.md b/doc/integration/kerberos.md
index 68c505e86de..43e75a1fc6e 100644
--- a/doc/integration/kerberos.md
+++ b/doc/integration/kerberos.md
@@ -188,8 +188,6 @@ LDAP Distinguished Names look like `sAMAccountName=foo,dc=ad,dc=example,dc=com`.
 
 ### Custom allowed realms
 
-[Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/9962) in GitLab 13.5.
-
 You can configure custom allowed realms when the user's Kerberos realm doesn't
 match the domain from the user's LDAP DN. The configuration value must specify
 all domains that users may be expected to have. Any other domains are
@@ -311,53 +309,7 @@ Kerberos ticket-based authentication.
 In previous versions of GitLab users had to submit their
 Kerberos username and password to GitLab when signing in.
 
-We [deprecated](../update/deprecations.md#omniauth-kerberos-gem) password-based
-Kerberos sign-ins in GitLab 14.3 and [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/2908)
-it in GitLab 15.0. You must switch to ticket-based sign in.
-
-Depending on your existing GitLab configuration, **Sign in with:
-Kerberos** may already be visible on your GitLab sign-in page.
-If not, then add the settings [described above](#configuration).
-
-To disable password-based Kerberos sign-ins, remove the OmniAuth provider
-`kerberos` from your `gitlab.yml`/`gitlab.rb` file.
-
-::Tabs
-
-:::TabTitle Linux package (Omnibus)
-
-1. Edit `/etc/gitlab/gitlab.rb` and remove the `{ "name" => "kerberos" }` line
-   under `gitlab_rails['omniauth_providers']`:
-
-   ```ruby
-   gitlab_rails['omniauth_providers'] = [
-     { "name" => "kerberos" } # <-- remove this entry
-   ]
-   ```
-
-1. [Reconfigure GitLab](../administration/restart_gitlab.md#reconfigure-a-linux-package-installation) for the changes to take effect.
-
-:::TabTitle Self-compiled (source)
-
-1. Edit [`gitlab.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/gitlab.yml.example) and remove the `- { name: 'kerberos' }` line under OmniAuth
-   providers:
-
-   ```yaml
-   omniauth:
-     # Rest of configuration omitted
-     # ...
-     providers:
-       - { name: 'kerberos' }  # <-- remove this line
-   ```
-
-1. [Restart GitLab](../administration/restart_gitlab.md#self-compiled-installations) for the changes to take effect.
-
-::EndTabs
-
-NOTE:
-Removing the `kerberos` OmniAuth provider can also resolve a rare
-`Krb5Auth::Krb5::Exception (No credentials cache found)` error (`500` error in GitLab)
-when trying to clone via HTTPS.
+We [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/2908) password-based Kerberos sign-ins in GitLab 15.0.
 
 ## Support for Active Directory Kerberos environments
 
diff --git a/doc/integration/oauth_provider.md b/doc/integration/oauth_provider.md
index e3a6d611a00..cf0c7602788 100644
--- a/doc/integration/oauth_provider.md
+++ b/doc/integration/oauth_provider.md
@@ -45,16 +45,11 @@ To create a new application for your user:
 1. Select **Save application**. GitLab provides:
 
    - The OAuth 2 Client ID in the **Application ID** field.
-   - The OAuth 2 Client Secret, accessible:
-     - In the **Secret** field in GitLab 14.1 and earlier.
-     - By selecting **Copy** in the **Secret** field
-       [in GitLab 14.2 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/332844).
+   - The OAuth 2 Client Secret, accessible by selecting **Copy** in the **Secret** field.
    - The **Renew secret** function in [GitLab 15.9 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/338243). Use this function to generate and copy a new secret for this application. Renewing a secret prevents the existing application from functioning until the credentials are updated.
 
 ## Create a group-owned application
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/16227) in GitLab 13.11.
-
 To create a new application for a group:
 
 1. Go to the desired group.
@@ -65,10 +60,7 @@ To create a new application for a group:
 1. Select **Save application**. GitLab provides:
 
    - The OAuth 2 Client ID in the **Application ID** field.
-   - The OAuth 2 Client Secret, accessible:
-     - In the **Secret** field in GitLab 14.1 and earlier.
-     - By selecting **Copy** in the **Secret** field
-       [in GitLab 14.2 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/332844).
+   - The OAuth 2 Client Secret, accessible by selecting **Copy** in the **Secret** field.
    - The **Renew secret** function in [GitLab 15.9 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/338243). Use this function to generate and copy a new secret for this application. Renewing a secret prevents the existing application from functioning until the credentials are updated.
 
 ## Create an instance-wide application
@@ -120,13 +112,11 @@ At any time you can revoke any access by selecting **Revoke**.
 
 ## Access token expiration
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/21745) in GitLab 14.3, with the ability to opt out.
-> - Ability to opt-out of expiring access token [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/340848) in GitLab 15.0.
 > - Database validation on `expires_in` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/112765) in GitLab 15.10. If your GitLab instance has any remaining OAuth Access Tokens without `expires_in` set when you are upgrading to 15.10 or later, the database migration will raise an error. For workaround instructions, see the [GitLab 15.10.0 upgrade documentation](../update/versions/gitlab_15_changes.md#15100).
 
 WARNING:
-The ability to opt out of expiring access tokens was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/340848)
-in GitLab 14.3 and [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/340848) in 15.0. All
+The ability to opt out of expiring access tokens was
+[removed](https://gitlab.com/gitlab-org/gitlab/-/issues/340848) in GitLab 15.0. All
 existing integrations must be updated to support access token refresh.
 
 Access tokens expire after two hours. Integrations that use access tokens must
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index d8e220747da..70de69739dc 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -292,8 +292,6 @@ omniauth:
 
 ## Link existing users to OmniAuth users
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/36664) in GitLab 13.4.
-
 You can automatically link OmniAuth users with existing GitLab users if their email addresses match.
 
 The following example enables automatic linking
@@ -429,8 +427,6 @@ omniauth:
 
 ## Bypass two-factor authentication
 
-> - Introduced in GitLab 12.3.
-
 With certain OmniAuth providers, users can sign in without using two-factor authentication (2FA).
 
 Because of a [known issue](https://gitlab.com/gitlab-org/gitlab/-/issues/196131) users must
diff --git a/doc/integration/saml.md b/doc/integration/saml.md
index 283003d1914..60a9d44b5d0 100644
--- a/doc/integration/saml.md
+++ b/doc/integration/saml.md
@@ -397,8 +397,6 @@ Your IdP may need additional configuration. For more information, see
 
 ### Configure GitLab to use multiple SAML IdPs
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/14361) in GitLab 14.6.
-
 You can configure GitLab to use multiple SAML IdPs if:
 
 - Each provider has a unique name set that matches a name set in `args`. At least
@@ -1260,8 +1258,6 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** Self-managed, GitLab Dedicated
 
-> Introduced in GitLab 11.4.
-
 Your IdP passes group information to GitLab in the SAML response. To use this
 response, configure GitLab to identify:
 
diff --git a/doc/security/password_length_limits.md b/doc/security/password_length_limits.md
index b6bcf425385..2c80224c8bb 100644
--- a/doc/security/password_length_limits.md
+++ b/doc/security/password_length_limits.md
@@ -21,8 +21,6 @@ during new user sign-ups and when an existing user performs a password reset.
 
 ## Modify minimum password length
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/20661) in GitLab 12.6
-
 The user password length is set to a minimum of 8 characters by default.
 
 To change the minimum password length using GitLab UI:
diff --git a/doc/security/rate_limits.md b/doc/security/rate_limits.md
index 68314d0a73b..a68d610cf08 100644
--- a/doc/security/rate_limits.md
+++ b/doc/security/rate_limits.md
@@ -31,7 +31,7 @@ Most [brute-force attacks](https://en.wikipedia.org/wiki/Brute-force_attack) are
 similarly mitigated by a rate limit.
 
 NOTE:
-[In GitLab 14.8 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/344807), the rate limits for API requests do not affect requests made by the frontend, because these requests are always counted as web traffic.
+The rate limits for API requests do not affect requests made by the frontend, because these requests are always counted as web traffic.
 
 ## Configurable limits
 
@@ -82,8 +82,6 @@ For configuration information, see
 
 ### Repository archives
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/25750) in GitLab 12.9.
-
 A rate limit for [downloading repository archives](../api/repositories.md#get-file-archive) is
 available. The limit applies to the project and to the user initiating the download either through
 the UI or the API.
@@ -92,16 +90,12 @@ The **rate limit** is 5 requests per minute per user.
 
 ### Webhook Testing
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/commit/35bc85c3ca093fee58d60dacdc9ed1fd9a15adec) in GitLab 13.4.
-
 There is a rate limit for [testing webhooks](../user/project/integrations/webhooks.md#test-a-webhook), which prevents abuse of the webhook functionality.
 
 The **rate limit** is 5 requests per minute per user.
 
 ### Users sign up
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/339151) in GitLab 14.7.
-
 There is a rate limit per IP address on the `/users/sign_up` endpoint. This is to mitigate attempts to misuse the endpoint. For example, to mass
 discover usernames or email addresses in use.
 
@@ -109,8 +103,6 @@ The **rate limit** is 20 calls per minute per IP address.
 
 ### Update username
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/339152) in GitLab 14.7.
-
 There is a rate limit on how frequently a username can be changed. This is enforced to mitigate misuse of the feature. For example, to mass discover
 which usernames are in use.
 
@@ -118,8 +110,6 @@ The **rate limit** is 10 calls per minute per authenticated user.
 
 ### Username exists
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/29040) in GitLab 14.7.
-
 There is a rate limit for the internal endpoint `/users/:username/exists`, used upon sign up to check if a chosen username has already been taken.
 This is to mitigate the risk of misuses, such as mass discovery of usernames in use.
 
diff --git a/doc/security/reset_user_password.md b/doc/security/reset_user_password.md
index 648c13645b3..83abae502f1 100644
--- a/doc/security/reset_user_password.md
+++ b/doc/security/reset_user_password.md
@@ -33,8 +33,6 @@ A confirmation is displayed.
 
 ## Use a Rake task
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/52347) in GitLab 13.9.
-
 Use the following Rake task to reset a user's password.
 
 ::Tabs
diff --git a/doc/security/ssh_keys_restrictions.md b/doc/security/ssh_keys_restrictions.md
index 2cf847d9f76..4833a013bb6 100644
--- a/doc/security/ssh_keys_restrictions.md
+++ b/doc/security/ssh_keys_restrictions.md
@@ -44,12 +44,12 @@ Hovering over this icon tells you why the key is restricted.
 By default, the GitLab.com and self-managed settings for the
 [supported key types](../user/ssh.md#supported-ssh-key-types) are:
 
+- DSA SSH keys are forbidden. 
 - RSA SSH keys are allowed.
-- DSA SSH keys are forbidden ([since GitLab 11.0](https://about.gitlab.com/releases/2018/06/22/gitlab-11-0-released/#support-for-dsa-ssh-keys)).
 - ECDSA SSH keys are allowed.
 - ED25519 SSH keys are allowed.
-- ECDSA_SK SSH keys are allowed (GitLab 14.8 and later).
-- ED25519_SK SSH keys are allowed (GitLab 14.8 and later).
+- ECDSA_SK SSH keys are allowed.
+- ED25519_SK SSH keys are allowed.
 
 ## Block banned or compromised keys
 
diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md
index 0a357277f5b..95cb1c068d4 100644
--- a/doc/security/two_factor_authentication.md
+++ b/doc/security/two_factor_authentication.md
@@ -84,8 +84,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/24965) in GitLab 12.0, 2FA settings for a group are also applied to subgroups.
-
 Prerequisites:
 
 - You must have the Maintainer or Owner role for the group.
@@ -159,7 +157,7 @@ when they next sign in to GitLab.
 
 #### Administrators
 
-In GitLab 13.5 and later, use the [Rails console](../administration/operations/rails_console.md)
+It is possible to use the [Rails console](../administration/operations/rails_console.md)
 to disable 2FA for a single administrator:
 
 ```ruby
@@ -203,8 +201,6 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/270554) in GitLab 13.7.
-> - [Moved](https://gitlab.com/gitlab-org/gitlab/-/issues/299088) from GitLab Free to GitLab Premium in 13.9.
 > - It's deployed behind a feature flag, disabled by default.
 > - Push notification support [introduced](https://gitlab.com/gitlab-org/gitlab-shell/-/issues/506) in GitLab 15.3.
 
diff --git a/doc/security/user_file_uploads.md b/doc/security/user_file_uploads.md
index d9dda257f41..a21b69f67c5 100644
--- a/doc/security/user_file_uploads.md
+++ b/doc/security/user_file_uploads.md
@@ -19,7 +19,6 @@ GitLab generates direct URLs for these images with a random 32-character ID to p
 
 ## Access control for uploaded files
 
-> - Enforced authorization checks [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/80117) in GitLab 14.8 [with a flag](../administration/feature_flags.md) named `enforce_auth_checks_on_uploads`. Disabled by default.
 > - Enforced authorization checks became [generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/352291) in GitLab 15.3. Feature flag `enforce_auth_checks_on_uploads` removed.
 > - Project settings in the user interface [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88567) in GitLab 15.3.
 
diff --git a/doc/security/webhooks.md b/doc/security/webhooks.md
index 80efbd1b6d5..8c51b7144ea 100644
--- a/doc/security/webhooks.md
+++ b/doc/security/webhooks.md
@@ -111,8 +111,6 @@ rules.
 
 ## Allow outbound requests to certain IP addresses and domains
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/issues/44496) in GitLab 12.2.
-
 Prerequisites:
 
 - You must have administrator access to the instance.
diff --git a/doc/subscriptions/subscription-add-ons.md b/doc/subscriptions/subscription-add-ons.md
index 75763a9ff06..48eae0fd079 100644
--- a/doc/subscriptions/subscription-add-ons.md
+++ b/doc/subscriptions/subscription-add-ons.md
@@ -66,10 +66,10 @@ Prerequisites:
 
 #### Configure network and proxy settings
 
-For all self-managed AI features:
+For self-managed instances, to enable AI-powered features:
 
 - Your firewalls and HTTP/S proxy servers must allow outbound connections
-  to `cloud.gitlab.com` on port `443`.
+  to `cloud.gitlab.com` and `customers.gitlab.com` on port `443` both with `https://` and `wws://`.
 - Both `HTTP2` and the `'upgrade'` header must be allowed, because GitLab Duo
   uses both REST and WebSockets.
 - To use an HTTP/S proxy, both `gitLab_workhorse` and `gitLab_rails` must have the necessary
diff --git a/doc/topics/git/img/get_started_git_v16_11.png b/doc/topics/git/img/get_started_git_v16_11.png
index 67361f451d01797a4c0c235e84e0644c868c14fb..09667f913bc2f98db20e68abdd4345d2e0bc2101 100644
GIT binary patch
literal 16547
zcmb7r1ymeeuqGBD$PioyclW^H?gR+#?hqg|c<>+r2Djku1b2c327-G6!4nu<g9O{j
z|G&3y_wAmuXZ!TIUAOA1x?k0u+dbW<J4Q=W2^Wh33keAcS4CM~2MGxkh>&kEQ4#HD
z<^Wv80nI^1Lk0<{Ap!f|>KUSs{8mRv7O8HMY7c=%(o)w|Q1VdcW^?A^aN%QeMgVv?
zTzJ@>@$q%InH^bKy|~$2c-WjdISl?{*qsqFLO|?_*vj1O&Lo7iqy#ilQo;YgTsS%1
z5daPjXC8JJgocQK7SSSLJgja!tba8KM?`SGe}um-?0-WE{iptK<i8phUS=nR2@xF8
zMGX4a>mM5YY_2pkI)7pRbpL7p4f~fQH@gcf6W>2b7j9NZc6KW+HWxxdMg$D8lMv7m
z6VMXBpyg(D`ezhpgn$5(5Yqe`AE88G5aW^&(h?K>RdTVqAgb{{ha<+PCBdWqk3rd;
z+1Wi2@rm&1{sqX%$&nDyBHR@e6v#=b5VVz)l>SN3g&v!e6dzFvXX1axQdCsr<@gT{
zTwDmjmGqw=|GFb!!i;W+0wTHstoCI1^jutSh|~~X|71ani2s*Ay9+`PV*T3^BMOB`
z<OK}}hZDjJp+SHV5fB2RhKN>HRu<uc5dPf|bAb>LCIswnQUr*d2BAT85!+uAKHb0F
z|JEY9|8x5niOBI^;eXZ3%gd7z{EdLv5LRLWntz7)%jDnfUzdLwB4mX1Uk!p1qTq-w
z!i3N~Jw4f2CjR<)$j9a8<(_?Xc&@G-lAYN;&^Ld7|B#%}C@SbBFYP}wz1G@1Ha@n}
z)j4Hm6xZ+xmY366RL~;@@>yGj>uE<uMO4LqsH?3W3iK<QpWCb~9|#R9y}Z13b<DWA
z{?n1+IgI$-{{ZV~zDBxdAVQYDL7_#@w?GSK9Xv}wRgz#q+g`&yCVlLqY+h!PcOQDd
zGqRfqfBt(;^}w1UN6_naw5ba<=DYU2Say9#%{uz4MowIAT;4xwiqs-IX_6O))4NqJ
z6+~oT`9Tg#x1blvk=F#`cv-?&vH}**HK<!lpBXqY6iNww>c*Gl_+gge4;axU2U5*z
zZ))fJ_{|XB@nzBit?7f)<1`hCiUqvawfpQpD!+Lds_WFrB|>KSV))m$>WAMg$@>6y
z54F;0Q*mKtt}!0}xBjPgG7UvH^5Ky@aktGsQhZ+{A<-hK$jj*ZE+2keabdqBh6Qt>
z4sz>!fbaP^az&vYvAtXNHFp+ub9%=*S9KKLEK^8yLF56-+ib_r|3dn_U4T}V;s{Fj
zA;VN%aE*Yc17^A^mf3S1+VhxEN6y3d9b>YLZ?ex*Vmz*xpTnhg%6NT!>IHv8jE1W<
zVfMEttKbLN`r4?a)Z>0iDE7X^{b6hj-q+D6*|5S8<-kApP38Q&x78=Xk3+oyOTCZ3
zUIjmiwTMdw7SYnACgZ(FlS59r*}W+D!mZ_bx?$P7zetcubMpv#B-W0@Q~f7Qg!28S
zz^&jaUJyfW(4EDt>CM#JBC`MRex7u5_xd*Q=AyS`4knd4^*$j;o@hH<=e#h{l9i5N
zz1S}9i$y1QAmeu4msio&fm*7PL<BfY@>{t%D|RQTTVeEpnP}USgDgpz5mvIW2<USl
zA&42Q4$qwCE42AfMXF+yi+=Tjziab&zm~vd1i*T(<4=ZSu9-b3uEzdPmj*^@Y&~-d
z+rcSs<E)Grm1KrEm^c0QTHWRKD8cjEHDM36U`cmSX3Al$6ZxWGdBf=I7pd7<i$>tN
zI8}WRXIYH`)3BZ9)QBQRZLB;u$=t`c*~aJ~dhDQscU`<waZ&_=8u?<b;Hfg8zc@4v
za3`={J7M1h%JrM~4YZWuO{!!I?vrY1+$;K7JV+w)68s7LU9UwPtQBW&WB>3`da>q=
zZ@XOX6JK}mE2$t5*s1sTIsGaIcynuD-y#dh0_=2<Q_bk{XpdeMxAy!k1J)wxZJ`X#
z2>z-#s(@iPi}y3mVTKzU*sLK?UK*`2r8OMwv~ZPMI%p%2zhwLJZfnwkf6C>-I1BF4
zWTYOOWUtYBHn-W3cbQZWm?7K&_mJp1(iqlAp#p0O9B$RNH)jC_Y|6u1_^#v4(n0|j
zf>vZcPo>V0blfTG;0mLZ)gzP3-0T*`Gl&&Wx(Nj-&|Cj4hYkF#i;q9CZ$k|6?Uskb
zyC%&MFU~U&uw&G2nL}Oh!nhsa!lvqZh9oa%o!fWiHpv`w!61)bc)TP9@HNNl>m!%f
z34pw9d2ej0rS5B?x>*VdpzW|g4dWkhGn$NVgF;F{y*LR-USvLE?NVw^^)2Kb2GTNY
z{WAB#)_opaGf5t0-a#s^b3NWiO<nCFcxm47nxQLKbKes_jdMciM-o8#p3xQc=ddhB
z>4m^`$b!nQ*^48MCvPhAI0Yl}imtEhm?1|oR4DT6#SE$d=i*qj?bACjNeWx_l8Uf^
zJdCe71xc?Fz29@X(4O?j`ufVK3Df{N6FY)D+KE)|^bBR2ZN;6$))tW`@FeX}*lL~;
z_ILa1g1-s=S-A??tM@Ir_eG}TZT2|^SB9l@r&f?l0NIQEQuqMsVh)G=*?p=%DeZ_%
z?s5zXQ!@rtygn>FbI<a)(}pIB?*dhLak6(-MA`J2C+c*}Kssxd1oZ|aCKJ>^uo?w3
zSglHTu<mkSrJ5H6iu+XR)h-7^mn^26nfYKtH@!Aj<_q<YeKRIz&Qf^cd1*OnVmK+q
zNI)Xo=lrd5=vl8K|CMbf6o*ZJqgEM~va!%f=&*e3xpm_SFTe-Hp_B@_03|(>Px^_e
zKSh)ZeG91;M=wrdfw_g`KG?Wg2{n?Ui*P`rp~~L=^%<h?iT7Gn?)1T;-SSrr3f){X
zcZtlKI=JbyE!-fFXf95y%B0ysmEO-}I)tR33}$suqh<8iMX2u<uBbiJr$gD(`m(OD
z%(Y%P`@mhgA+<riysT!H_3$D{9NDv|$h}!@Vv{R;(L-q#x|xQ!$5bpv3v}hy5q$e{
zT}IDwy$Mlz(ERck_L2l>d79qDH*U)nrbLdbB`Z~@3^Xr29d@Ead$Bf{;M&(O_to0?
z{`-)PaMthHq95CRBRF%R3F}Iryc`(<_DPXwqwoGWAl<_pObi*3IB2vsfl!ZrJGz7C
z=h^7<(HGylc8az5cQ!oODApX;0>61Yd4mEU*;+H=zh83d%L^x_|C9%c(D(T_nFblb
z{O|$gfFyu9(xyE*TJoJ`%Y_w~Q+>`ygEWySFY`oeKpD__@v2Tt&ET}i4`~e<xYA(<
zu>PjiN==P3xL?}*S~13h)7SCLLFTE$q^Nj!mm|?4YP=4~uS71FGvL~%ijmM*azNHq
z&^tl)V8|P@N0bU5Sf@5z<+EN|OdTYn^NU@6sqpI(omI%>qJKHpthREi-!<~jqQav^
zlGN~WJoZ>}Z2ck)mlLkRL!+q|K)s+|{GB8~kQ<N&m|*j1r{D?`+%AN?N5j%=Wcn7o
zS23uO59Jz=(|M6REl9QSl2(3^E_ADm5mT&Gdz!DdquE}2>$P`NK#-NWYsTJ0+ItQ0
z-NG{WW?Y#HuOFHpA}HCzz_i3X&nr_^YMTVDLB~qvY8aj;ODSZxUMy)<(t)VHTR(GA
zLF{Pwl4@y^B}RcJygQ^+*vWA3nX6_cD#f|)&zkJ&k1JA8D`5OD<Ur}0oFr<k+VCS_
zfluMlzBzVE6Mk&V6t!xU%j<9fxzgXS#}$x-Ud}xw31h|>2aqo&LUFnWX20=TswBRs
zNCbqfB`TVvQg?6}23XGJIPlTTUmo7SoB%XyY8v~Xy`Kf34H+3n%)|G1>8W&SpwvLo
z%7^(+8DDml=!oRrmJP_dcfEoMt&PTq0g5$x$)ck@Eg$sV41U$!yew7KI6ky72z;KV
z%g&U@ySNzwCHv{)Y|9Du;A8O92`%*sm)m}+r7Nfa6474Qvi8JG?DILt!y7&v5U3Ub
zY1UkDTqNt*knm`D$3O+RzsDrA>pqkDHoy`<7h!;s78Vbh?O&4Hbb}JEq@N~!=aa}-
z%;78(LJst%uv<GwA-=MOEbtdFV2<+g%xp3}QzqXy1OSgB4J89il7)ledBmj)mlNHf
z?qg-ob~KVb>1QxI>IA^o$Cg*iRD3EX9cG{p@tOkx(ZOxX7-pIzIltquRKHCqfcS@A
zw+k!cDavA;TeU^c8oRv(Z_>6BTli33;5vVOXPQex@O$RW3}js4k}xc%1ms^U_Fj2c
z|IS9do12lAuqRR+qcYn#0RUL5Xccx>tUu0t<&)jK^V{{6w!EQP@M^>RTKY)rx?h<U
zHR&L>7WM|%Hl=xmkPTH{RrwA6**P*;Ua-14lz8#g4`U9dSx+nT7ULFFkglCA{@#YP
z){v!JCRDXt!A$Ojf&Ex<VR)860B7>vm!Iv1Q%9Y0I>P-zx@)Dd;z3`pj_9Uh45b8s
zQzb^4qt6uQX9lijXRW$sxrjG|LTea~yGn8xg-@`x9(19!Rb-?m3=|da7jo+I)cwS0
zzvvQ90eDHY*qfy@TEB*ePCp2f5o3{^A=?@lEm7#A*+ME3j7i9qYT~+D^jwx!^}3GT
zA$OV7_N@<#dr?77<?A4c>&Ou~KOEaP9uf|U+>x=O_a{$2dDlhV*%F78YSHW$->P<s
zXJ)!IXm5r-J$giD`KZq$Cn%l#xC;W~9E>m6tWtEDf|IgNSNj>p6VA>Uv{w6~H0>vB
zFN^trVXqW-Tb21-c;Pa4L5vprhC3O!eq!L$sW@}$+nd9w{B?KB#?3wWYFBZu+W_ik
z0TGKgagv|kU6uO|``%SIEs++;8Ed!*_VecwSKVc59;l3Zv?%Vh_hKGczC}4meEfJ@
zc%m^My1Qo)*l#;ozCi`-VX}FbUa%bIGR;_CzVCav0KcGI&j-YFx0mF5Z+O5h^?7=S
zGD-{Ildo8G4{_RksFR}V@FVZNdhzP}$w`kSiso!TO<uFq$@<cP;p43a%be8F=W`Vn
z#pPR;kbqo+jqFJh@7&)$lV&qqkHsxnT&VUdLRW+bArou1=AVCu+*<WWbqyW+ng!iN
zujY64cKwobw0c=Wz1qp<p~&0K)yW2|{{DGcqA>&ak4F2oP?N@34bz~*?$kDV)#lf^
z$e#5u_~tE#dJA<<@E=DRj!v%}WE2gPCWSh}dJTE*;6VMLhEilj;}VbFX9)wn-|zY;
z(bSQ++fJoi$&vTMqZsP%{;Wx@yfSSEboy4Lt{x?3i>aytSEv(LEb~2~f``K`PJP=y
zR&g0<9dAnKAk)2XW^pzI$yOSD;2y?VWA2tMHMW6xoJ;n3gFQYLQq&JwZy|85E4T8E
zt<Qivz&xQ#edK}VbmwTBkDlm5R#-=^QDtYFQ8>&(&0`{$@xBoHXkB*cmh#St<G5}4
zr{<?Ybr4#5??*!0rDdw?t9E$|I0gpLM`Y&VVWDX~Qsn%8vV3w4SDnmcwB~qWSJSv@
zi=S*QJv8PevhjysC>e01PB|8j4uJSV!FPVwgZllw?FqTZoc%=ON9(j_2@av6g`>|v
zH|dhO>Y6T&9plTp_q*piWpd?N_6iwumKBj0!vWZSPafRuib^R#1FKtdn!(F<bs(ze
zMOM^GbC)I|a=_=P{cD5*(gi2M13saE0=187wt8}UjmgMaa~D=?F8UKX(6`p>9%r6u
zLwrRu*ViVxf~!9XfGHH8NE3S6Rik<+z!pLopc?(^Kx-#~F8FupPSs-#JeKB}*(uU^
z=npGk{<bCBO6RBVAh2*57>x53^wDjRXM*YgPLuwM+l>j>A9xHQqRIE7k>EN&<%Ynk
z>WE))hEE2QxlMwkRkwY1yELOFIJ0%f?M0XRF<bX*N};pWPYs`&FW;{4wt-ab8mrib
zT(v#(N&aM<l<@3ajed_HC}-*GhBz+Uw$l049e^*rS=8BANhFv0wbG2sB$L_`)?l^J
zGUta>+3Fi^RcvmZ3&_m^=T3hWfZXiI54X2jPz6F9&3$S5Gm1U3AHo$@J7%3OavJg&
zGcsWH9OMI-BGJ8hPY9eA6b(2g3_}b5M=JXNJV0M^5;)z;V}!8gz<q1MWG`5ljFY8$
zpnb%7rt|#*cFVjTy5V09&p1IMcth1*VRx$CHR08upD_*}(6%a0b>|KY@!7VDoL)GT
zsgt5Zosla2n&2DkL=CqBKhdt!e2p-aAX@Jy$)4AN3&<7q^L~^tM@y7rqZ$ZBpXVrG
z7!aT7P9zfkFxavKnl4!FD089%b8v-cz*ZaG=yT7IJk1jfenlLFg_`;*L<9a?ayHug
zFG#y(Kv%xLHDkfIztXyPE`x}zi?%U}2GzK}(2NCIq%ruhtottk<@c{oEn1h5Y-z+g
zu6pdW3iWvmN>-Y7E28dDAVfbaUfooXWI$VPC@5OAUt27yA_6rK&77gm;D6BHN<fbP
z<cK1%(89d^JPFednQC)k`*qtLl`K(2!TAW)t3mCZl6c3#0q_?!obqPzIr=$Ib;I33
zvA)3lzV+X-up~B?Sm<)X;~|fHdZd_4R5lD_eDhsG+Uw6R>S_W~z%{R3?Etb0dDW1L
z#a#&#tQQc_E2EL1U*F1dk*c+^su?O-pDOs|usrCL$p)e;HWv7o-aG?QVLa~nkz(ys
zGCXTRDcP#4mR380J$*JIfqbQDOhf9bxE@N4VtX!|`jt^wh&9kq<MyJ5m5_QnVhf8=
zJ8VK%fgzh;MU|a$<8rT5*NZf|GTcaayc@!L8dX#8Ygnb2{Cfi$m{E*LSG}EzcDpcW
zC3LK!jVZ}dl@ql{66WNmk?AQ_rz?1F)()`vQYI(5pY@fQ_L+Y68X1rh|GY2CmT1En
zc%oQNgIT@d@MY1SEGzV_uNKK15!Rp)P(rOB?})i5f?Xe@hTX<kpNaibMjcj#ggs|Y
zKD4tyk8k|xxweDujcV%6Ib|v`*2vZ-9}U49#h|FyI$^CJeGA7s@T<Q`8B;?<Tv4g`
zk>rc)JRSYe2?wTmQwWYQhRULc;f;2+6+MAss>ab!eO;RNU&$t{%ZE^Fn>tl~1Vyc%
zU*(3IMRbwkvoqIU<iDf0%>|*VcP}UM+vr+pO%7B1L<4pUhV-fGD_K$qgb{}Y(Dv~c
z28-AcZH2<|3o(66WYfAHyoG%Vkt}ybqfe~sjDk|N{tQm{59UU(rbj{M%^Xcn@C*X5
zQp?&reUcXpDHBX$KcYf}Jdyb3L#tiMSaUv_t0sYArFmE(za`s6^<**i8X!{xVAkdL
z_XDTltmtUY_9Tr2Owf2LGT_nPizvXdMg0Nm`cE>W_XV!eSiZtjeoEeA{KCV7h5V9V
z-a{71R?qO7F5Ux7quNd@rj`;!h4?s6O|_h9d9ZKr@wY*THeJmUB5}V85`PW?=9fRr
z%7AqmUI2+%*#J!bek#eU+Wge|XYz(hHZ@2;wBXt{ojxJ&>e6W%<=&yFo7^ORh$x>C
zeL+rISIjR=;1iw<r-px(9;pWqXuFXO#A6t5hhJ3d6>!NmsEGVgHD`Psl~4P#4Z9iH
z_={Sk^n6Op@(}mTS$?pH0j#h{+HhhFJ0x7euf?QQ*7nzxTC)1W<Txe`q^p@jAf0_h
zwjWx6%Dfh|BZhPHl^lSo_q}*yNLmq%8bx;tdoHNL+6pAgpJWjqjAimfWnVB+5+N5w
zxg4E6@h1jEWCs9Nj^J93Uip18ig~5>b@=!N*SO)>=Sx{798PTO-T|Eb?ZL$ol8zJE
z_N-}t=z)h#@2{hCZ*y$`D|B;{{ez2wZ))aSFFKHpwiUf|3G3G}U@gX}%%&j>>%MH$
z&|Fg<(?3cS0%<Os34v@Zy5V|ND`-z<rrjyBJdKzXEDm4w35?n|Y@$iwI}M3eARSoV
zL4l4M#!$W>h7X2cIjiP*{C1<Qo;zx%Pe+KOBw4KPAiYlk-yd{6P2`;h-<|aK-tDf>
zJbmwI%WrPvM%uvsLXXkG`kXbR0u#%N#k_#tJX)U~uLwQ<xf>m_s~{iWN3z#Lna*>L
z>aOY^B~P~o@8vE!!)lFrYFjjG=k5a6*ES$K2TSA<Zr0^@3U4PRSv)3hb9)xo)I1#y
zfRYyPzUD!h_c)bRtyL@92cufey#~id;ye7_RiNz8NI-o;s_ms^P|gAbE~EW5b>h6+
zjM46&tyTh#o-tIbQUr-Frd(TYPWaa}ZmBGjo+m{+pdIPL+$yQii&AV|sK)p~_sAy=
zQ07B)R*D|Wwarx2FZG5jqYN6;>wOq{b(Q)&wC*v0^EkC!@T;BP#8)kTsv}LW)(E&{
z9M5J@UxDQZ2AOGQwB>IX)r%9+g45ODryR1DOzY}vsTp!}NE)aK@KbcEpC9L?t3Pg)
zAeW)h1{Mu!imY4GHS)jxt)YKO2-NXv^dvGU4iDrapFw{1JY+`a9C=1FFYgc;&-r6G
zJ{-$53OTMi5siqiCj<zr-fQ`E@J-{5<Xz$;(9;bS@qEtVRaDE^E)2iOro$!FrWGG}
z`}2>_SBH3e0k0lqYHFs}IkgWHjQ0DTJ703*Bwxmz>qc#dfp+}e)asO*QR9Y(@!$2Z
zRdl>|5T2Ichn9-h<*=23j9GE;)7x|YNP--gR8`)MW!)O)II1rnyKEc!@d1TI7X3|}
zLieT3Y}CG7V*7V735OzQofR<v<21x-#+I8{iqiU;h#=U-=BL)(%idKCa8HA(7(g--
zSwMO@pLMN1jHilW(?mX>>?df2VYQ`@>Qck$lx{-oM{Cw|J3}NCrb+uweu*>5l^AG;
z!rr&A)MvnrndZH|t7sTo!JGO`=kd_v*FbQIx6SQYT%klk?E7edz^MA=Gj`Cto|RY^
z2q5L|o>K4h8~D(0<qmmkb9c17b`U;(ll&MTM?<rizxB9WO}f{kcLn~@H)2gUv)Me#
z&a4S0o35j$8zbnrRsp>B<x;RH_}-?MUxF8z^pif1{50`p<^?}UTAX6&&h{ty?B0YX
zAsAj?&T+S#v?sFj*{^f0-=GtYZoszO&D^=RiA`L=|ISw({NgyWq42io0JwnlQ{A(0
z+GUuWL!~5DL;!b*g^xd=#HLOvWcV=EP(fCep0p0V_-9HLnDs1g|AlG;lROws206i0
zsXPeZ|Gb60PevLeF9hxw)SditFHO%uDtBp;fwZ%&E+lc32?}_*tf0Qi!%arF9&DJ3
zrgYRZysu9Jo~K>J2fk<|LP>Fys%Gems{4W(#&>NP6@g=^SQL&%!QiM>7-c}Fk5ml;
zJYAfB|HJ%wc{$+94=>-X=liN}$D{Qdmz3i`Z+_E~V6h+Sy^^-CFyP8mYT!!_iZ?<z
z@CyB1;m9NtZ!TAwcz)hR+5;R7dw^$_Xl)-4*8+vIBFSJC)2~wSeXcj@*f+Mkn|zam
za)X=Qpd2??cJgct4@6WlK{4a@-5>P|zdhCDobBfyQuIwLPfh<=-&+9B3ywewbg_|T
z9?vJ??eU5YT{3)rwedbR3?%OaOKCv_B=H>;X7BOGP@qlKHcz9kP1W8Ub`O+iA4H%c
zpC-F5KdAcz{h)uiy1vGX1_(1$1J(rviAAM}!l2|hrEywEDdCGt4K;(7Kd#A|scke+
zQAZ^K`;BuiM3E`|+A>slW!BE1cX0f)u<7zY=^)+JQ(VaX(UsQn+)az*x>6L*pxwGw
zRGhq<kJqR)2*pEASM9TE`3Raj{!2Cr^gJy_biJlFO~6IbAp@Pqkg<sw<9Pt5^CU8H
zx`Dn?s2PxFwz-zNJ0ST{9g;YH_Y3>WlF9dm?GX5lv|)Yqwu@Wc9x`L`+S>%@qS&F|
z(33{RiDane=Doq)NMphfYGJqpa2;-4Z?58{yC(~-Z>R7rvALK)cM`ihs21xAo@w~F
zR#thtTfT0jG->_jsp$Oh2PDmC?=fTl#yySEKvzl68_ErHaL|Lnu20rax?lCaYv~HA
z?+R+~d?W?7cl<t{<7Sct2dci2dNPOT6Qj@EbjbFaK-h1DLCIVBAf!l&Pc=|A^BA65
zpXt`nm4m&P!5f>|m$3;nr(7zc9&hkG?=;HhCJ%mJrnK3vq_~OuW<6dq=+f!`IiIAS
z3D(#+w=4Iv-+yWW+5ZXJzcDJt28TVGI<vJ7$c>Zacws%dfzm&rHe*8}R1X4mTdw$b
z(%w+l+o{)f!BvYAsvn?{-fMl@ERvL<FKiCy<xrkB)A-DHz{a#k(-0K7GE22@X)~J+
z#>e(x5Aw!O;)-M57$?aU=|BD3db9*8fTj8J=4-->s?Zin)v6DL*?We2`JbymA7^5h
z8+p-lZgrJBX)uHUBWJX#KX{2`01Q#b<bq2MpO#-_5@_;%tCzt<1@Cc*AcHhSWUgD$
zXH1`&Ub3HlM%52|_HEl*M#<?@%F}CDhRK{KK5aHg^~6Xd_i|@e;aY}ifse;boqRzz
zs=JWpJdLoMt<r!Hj;8j!FB5MobmWt+QdPM(j*>L~ya+0_SJg<*i`~Vv1-?p%;Xshl
z6v2Y$l<;bU7Rs;TLaRMmW%>*Kv0N-WwJb9Yj)~-@t?3UPZI_k&Ealts80C4Bbl8HG
z-Ry@OMY1MYj-kYyaM!uJrzC)%xu>Ujq-+`J<sN!lNNmE$NNT<kj6n(N^f~d;PyPHv
zUC~%(46<_JD_V89nI)r^`0^U{pu&Va75NmGBOF{?=v11XKJxJ+%-UKQA}I6TZ>t;1
zbQw+~kff*nQ7V2}vpJkr#IFdoDZh^k9b;Igp^qiI{Zd!u;tL`by!cE4tays5L18AM
zD-0~FzWwCZ{t~e8OB!bneO6cHnY9$`KF)J26z0r1*eftuf~IfrXpBC$B$^@LplU)+
z9K*zuvJ&}lYI`C^8OaxNsd?4AGiD4={2JU5&##4Gu&4I>aGgWKy;0l^ynSsW3~u8u
zcN}=lGV>`(b;FUN%QX5*rV=~-6uv}cmvEDQX!2);?y>B~1=SKi&VAZlET_o><ryTp
zk25nd%ZBw@%IzTzo4QKg(My_arHEG=h8-)d>p~abk_j2;!;pRquti!`MFXf|vOzZL
z6ElfTZMeG6u*ohd>)*R}<pPJsD4hFMNJ$AQ34zJud&`46GeK2@(oca^9!$z={!e3T
zJ-<s9YLJnFL^(yDE2#Wzj>bX>V^t<fyr9#HHaBFN&#WgVR49HPlT^aDwUlXWqpB<@
z#@7RnCw-9XS@8=V&og58Y+F43b6YrTq!P=@3A4%*t;rJl^yejF>5LhV%lv5e^%nsk
z-w%)vwV$f!jF0Md<3?6}_7g~VXluw5Y2L;D)VNuZ0spo*->}1L6d7LevBq3E=UzTz
zpI4tp`8bmKh;pD7he<~U<J9t5Z9#MgjW&$rGJvw+6>91mu<I$f^|!NbP;=fMgI%z!
zVT&r6Omi*6p$gvhatt80eldWEv`}i%w;wc4uQTq0-F)P@gXCRvx<ff)E&6R085g}(
znMda%Q9Ag23$Bh;$w)6MPW)L=;#3R7*7LoffV>jWwvM6wXVhq0SZ}2bmgPFC91Hux
zvyZ6adoO<{D-Oh5$eIZYDzn^|A)eo;Cn-)fi0R21MbCp{+p|kw&P|9!P`>VdXI51#
zO=^ky@D^FpH^Odw&Ub@Q(>z!n$kK^@p3S*1-?^&@6VIO$Iy4|ZxU$5Jdt<tYS&5w?
zpCsK-JIK16QJn<O6w6+u8C7hkx${ValUAWF23%3zvo0hxD?Q|a4A(k~%c$fvLL<#s
z#01?;<a17`nbJpmX^Ra$1OH%>a8g>k0iSDwZF2TU<dt~QGL}`%TzDVL0JFz6u_bSy
zj@b5qZ=0$xR%RqlZZcI1ji|RJb<LYBb>F&0N<hpiCcTvMo6I7V+$q<8I(1=;M{SGd
zq=|yR;z?|aF7YI3(~?cOGsL$7qoz!7lnb?HgT7DpD?Wz@DvcZ%xtUM+I3})r(b6SV
z-$g>A()jx>0GZ4id8{qMDZ4;49r8_m>`eA6*Y-)7-qhh)&Re+aK&5#Zlvt<-d~j)z
zs6U&|I7OOTjA{wxU<uUZjZDSn0CS~yJ^bk$spCyfluyMEQ!P54i%{OZ?quD+KMV6W
zjH`ZqX@8^kZqs_3DCo5kg@3lj>{42Ppw{wYgPgo_^WzD`6=tjT=D;@|X4xvTo^oZ*
z_YuD68O4;YH&I!t5x$_LXn=h+?T(H|Rn{Xr{WCxi*y}!Uvu)8MAMCe^6VqiYe7Y3X
z(ja^rn}N9vC;$Zo3ww}p)X_;|a^#&ivf#P_>zfxH{f5>Le4~E<(l^0iRhUV4Qfw`+
z%@A)|t+L_&;PRW#pF?g+fs6`wT-^?<o*$a$rT_y6nvA*f1J`MK*4o%_lpr^{?*0(p
zn{FNvB>m;MvH72r{0`y@hLOtK_PSHyrd*MJzm=Rk%vvhak1H+)lFf|xgM?9e3--kb
zpJXn8cwB_Rau_djpMDFDFFb|}R^8LgdEZaS-_wBdm{~FbmM-A@E`T5ND3}+h4x4*N
zuZ}U-|5yIs4rVoS-~_1V5UHNH-?-7x+ZfTYbpvKlesp=PXutts2LsFF968lhN&pzl
zD%>(4ans}q_r=N+G4GHMu*iZ3(&urS-yXgC3C+>E2BW}!6y8z;clx1>MGn*V|3HJv
zisha+be(Vz=Dzxp0Lt6=8xs_~@m6J^Nf~u4uAJOm{3OTnd*8p*&a5HessK`3P$u+A
z!v1_pCW=1zl_nTI8^TOt3o`!z^>X00X;r_y0}CDkRfcjFZ!U7+^LBO`cynhu;BR7=
zu>k|udmE*>DnlQ)c16!@Q@*IfnikH$7r&?67Lfig75Jwf_nRO=RV#*u*T3*q$U0|z
z@_p@#&wfexsb_r3>zZ<Zn6CMm2`DQz0e35jtvaxTNqu>(dE58lBv|C6yVaR*I^O?X
zW%Y#m@S77m&a$p&l3GfPvuZT1&d(78{(x{AMVv|nsnyzmc#)>pi$DXTHn}*GRrcOf
zSV-TmlSR-0(#{e-P-GDwX2<>v{mcBqUKwR0pFs!st~(gVc43rvAxVRnx@-`tavmH8
zL;ELabHr*Zwl7Ebg;cH0m+BDC;G(ENl{?i`blg0+#9JZ99YH3}_XXVkrL`h`E1a_-
zdrh)6j?Y;_dy==&IF4O_vyNxef|9g~8Fb8FCABal=0G~YCQVt_6oJJ?@K=k&oN^O3
zmolapAkuf$b7zN<+An&l!(c)Hk|+zq)VZSjoUsk4Q#UGRehym~2215XCm-Kma(H~M
z(^Y+cW^`U(1=h?#Rj*1rAxbEgW5SZ1FPb0Zvp^!=7ldQr(iGec%;hc6e@2ZT!Cm|C
zqKhjQG*Ye0jyvPo<zQ!8oAh$&3t3t`ZoHJbQp!?@_R5zCPOh)tcx0k*zl<~IT+}){
z;XoTGI1KtWt3KxvrfUKzMk<uR#=frwokX>4$jTb@2jy^hfvc4apj`$g#t(}@89`R8
z={y_S%|ko`t-IFpg4jVnI4D2xlDiyddnFWykM$6&q{u4`O3MYy3pS6ClDdOS5_RV%
zSbZM`4r)bkQ_=~k9yBp(YH0jD707&QRxqeb7^e5bXFAx_Gw(=7mEpQk*bkDIqd(YD
z?5=g2=d&yHX^(S5CArL4wg;EAJ`6-#y{&OgY=z)}h}4yQ_P@Q#u!3;KEFxEv<+SV3
zqHeqbOI=dz&An2QUzwINXJq=KjHSNm2|nDiRF?sB_B<0A62Qg1D{wogpLzIz+d&B=
zNYdfuKg)&sea<s01u4VEq*&f1LgS;I##??eN>p#MJ>dfm5(&2=mGygbEIq=SjXexQ
z8_g@@=vSwfwI$MvRr_I1-AJA$O3CqJo%&J4E~UQ|W}C2%?RFA53J5K^0I_Ov)at-#
zhZTiy2cx!^neV88w#w8<MT1f7Ml@0ZY8X+i3D56jg9+qbf-F~#^CqZUh;*aKP=ot@
zW47C^C_Wv8?N^MCe+1AhHZ5lo-Oi|jU1N$`MHU(`33QlzVN-HTAWmYBG-a43lj)Lb
z{<o@I-o0nC(fefKj0=1dU~ny9F9}<;D11<Q%f$p{-=dvjqZ&P%$}x~EqX}(*%^>4<
zW$q^)G1QfAq(krVuR?1vJpBr4ZN_<IYZC2a;fcAH6vKNuzwvg`S<;I^pZ!iJ4lwpZ
z&;cqjP$JNVnh6GOT){wrt=kEYdo2pKxj<k%cJQ4+P#}4Mxa}cuX3Ujrd^Zz%yeI?u
zL(EUq%IrDNKEKEpz8`9%E;A}dQAyH2n(%d%_<{kBIX3v>QQlu&@ah()O=WwWV$>j;
zS4ES?oGu)Ip@gaw^msjCBHR|CR%d@+917&S&*%xbQz>>rMSA3{?;KM}l>b#P^NW*(
zZUbM2&N#-@*Ks<tz>;3s+1h%Ic?WxO*f+Y8uYu308$J=RY4Q7>Zykr)*(AW1t@N1#
z!C)hIJ@jHF*YC=RS-#LbwCx8AmUV`ucs5PAF@!8SsK}=FXnNakdebzsJ|&MBCw=<W
zByeY7%zUhRpF^H7x2ndP|Jgfa%xCy1>PoQ(iERoMfZ~YKgnWN}C6d@Y_zQcT&C{`c
z9Ivt@|G2M|*TFYd8l2AyHsURJdT1+rMNd|@atn6WLw^Xl{fyCTnkK&>B<!lXOLXH@
z=Ai|#m|aTK<*U2SMAzl)IcftF#<I@Nnrio(rCeN)?yzkO&EOFvb7$eRewlB94%95&
zj)SIWy+>$sGyI@D_R(1v4(g>v?raHczMkZBs%n~A%<h?J#EJV%tJCx>l*u;_v|mrC
zuB3KwljeOp(eq80J>kke3sAOwGP?;0GM2=DOohfgAI&>Ucz6KCiCz=B{8lL|W`cat
z!HccK{n;DjC)E8%KFMO~H4G~Rt5`EFPW)IJ9CZ8+$r8rY)-g(6y6SOA&|k4n`QsTV
zYw!7pUhxJ5c;by5;hN;us2`2<aa5J{6>i?WB5;j-iPXi~D&#By!Dk<yA82@)b6wdR
zbc;<Dbnccm23gcr^a%?}x5M-o?|<GM(ax4V@H!+-cofWz<?H?db;4~w+$~4{E?i|*
zvINrO-JFDxD;4!p>*pc1#JR<E1CWVjn((oY7vtP<c|1i<&Q1s0a%bqb8Bg;C%J@YI
zRU#i~Vk`Hc;UaO3E@HQMDIwWE3#vc8Nr5cK*gzJHace2V0H}6P#oA5v5|;<e%56%V
zjM6g~7nRjC{B~08udGCpPq=(*Ir4cv!dHWoQLr$vj38m)<Kv+F1jwr@&|B`Rpm>Rc
zr11sJ?VRC233a613i-Oa^1TnJ`OBAk%U!4jt~XxIzO3yWWtJUUPXF0Q2-(q(MmwxU
zZCMQk2R0+VTBuuz2fnGGNt-2=9IolK+C{f@nwn>I;*ZnPzWpfFSN36)9cueM)*xd!
z*tn?c{{53J))8tacInI3dfJ%pu|tE;PO`WSaO$WIi&OK5+@GY8GAxO%Y2Cj|P1JM&
z)KoX=j_SlR@I2lmo0jMUKkGU%AmM>VDs4+Kwy0)e_pVu0bnKOB^B<I>mbXWST6lNN
zM?H51-;<`F+7rA@E>T;oksEXiUz=%z-Zd39-%qZDI>}gswhzJwiUuNI>SBl{nHmz?
zOW>V&65R_(L*OrGKX~i_HTL!1N!)_wX1YO~#RW3tL?ch4_RA=cUZg>h^#niV8iN4+
zrgl7!a=FPpnI4+Ts~T!B5wcgwJHRtyq3aq&UR5wo*p0GMS(ObIY6%Ae;jw!RP@Ze=
zy+*hrYZ>^w-o1)S3<Ga3<Y;RGw{x_N$9a*?4!Id_UcQ%BYJlXYE@!Rk7iv#BnY50h
z4*{!4l-MxEMg;JAej1#U@wbEXZ>%`$@cdm<fzpDE?hxM*kRE4R|9K{mMW4e51f>C|
zo)Em1n!{&`SIJO)c2-~y+#i%(N|RH?+sptha%R+D*zcJuA(74rh~%dK*(7W6?ivvH
z1SpIt{~~%bUYf8!W7upD1X5Qq^lGM*2U>mf%?60ryV6uZ1vN50?N4Wnh}ei-FcUnL
zFmNCrZt!aOWe5PdYKm!MV_4IX32wvO4`rf|??(II@x;5&3O4Hjx8Wsi+j<c7?y`=M
zqn3oPW+l7L(Y_^jIvA$*FV@LUAkp4Gw?w#%J^LG<hyRe@zohD}hHi+Er*#EJe{cE-
zA?gqey(+3=AjuI3;5Bn4-2CkTigd!2M*CH-;>_jpY2T3ZcRw==FR-?5@IAT>!Pp$>
zOl?}ScH}2pJ)m)Fk^Ya@mn7biz}Ftl_%HOx^2B@R&e%t;nQVlhVs*ceu=;UmF?s!w
z=+1Si!@{-sHA&<{P$gyl2n?8UDkr5^I~{lT&1H8f`7wNNeyw&(F>>{*g+^iWbMau7
z+rcn$#s2hF!Etb=`4*PZlmjRbtXrp=;qOJQ<C0Bw$OsyLKZ_y?<3n(>S%iL0FeG{U
z<uULqkx_2m*;+3rz=;8NEl&dEu+e(H)k!vZd?p5*EJ4M~aGpOKV|w%4#lO=bn7!`4
z=N+8Cf<UlHtyr^ZAcpczy4v{Vg)_y<?{j;K8M7jMGXc!1HiK@`Wz-b<c=(5|DoKi&
zQk9-1btM<LZ)1cz4^oxV8@!6^)zZ6wmQU^`n~TMI&AxI{&KbRYu?(FQ9FZFt5OH?T
z6pe+IIlbNCKCoa9v~x*Xz@Cm`d-qu>(m#K&1sxH$BxTzyU_r-YmiO=XEI}VNVU5#?
zxi8WY=jq}-@V7wREWHa)FKoo0TfrFUt}Y?MZzd2#A;i!$VsGnC0Zfm486#C8m-C>h
zVTeI7AV*ct51c5HV|fEk@l{oda2aW5usILvVjf>?RXmi-UKj@p#sV}dXEe6(hHET0
z4|!Zk)L|CY+pqK$2S52BE&aVQnkd_T)2=`H&n?nR7wf*6M9rPJ^nchX*`N^Fv~F<z
z<&zCXf7Vv$7KbqGS8N;mUH)!=c<_7&5zJ#nnCE3+OtU5{y{yT(2tX!a#2>8m)5^Eb
z+Jq%xK-pXo5;x;#H(T{R2n4Y}DWHn^@b}8q4Q8Ca`lwm03&Q>AL54yZB;`=B3k^f#
zeLF*~S*o5Hr7=l8PVx5|X0%7<5mC1HGCb9*NPrA=4L!F%xDx8=K4wBeZ$dWpYDiR9
zrb2K4k;9a#(kq@fBi+m(VdO*LMsw{?UKPj)=inST53IoNi|f~{mdrE$7pMXY{LTMy
z3X@4fS_wmWwbkpD9!3sxT2SLqKwW;23!I2NDD|MI_+HgG=k8e3?EWq#xUQh)?~UY}
zxrRNFVvD$g&Lt}>IU1j88+p=hG+qxHG%K}X+>mjKiYO>POu<!D;I^l&v-@^b>bhDq
z>+c)~fj}9f-zepCf14{&@l4{qfn<upghHb7OfD@~P78Od0H8Iu`(kvPNn1f@@AH=h
z5^E_=&9qg5$Ap+pw&B|)0;E~!X_2Wwc%1W(1;Y?4Q{+Lk>J?nGlm!Uvjaj%ZET`;m
z6?zq-v~nMA4=EH!!@lF3245Z5md0~oA)S7;^WyV)pSiNZL@E>$6Zu2EXgI<->c&!C
zCAL6V7FZhgf?Zj3hTafg;gpstPy+9<@N*r_+pE0g#n=8di({3YS7Vu3>N(?w2|bH>
zqiZ@`ZJ)FsXT7~d2LtELTQwLs9XCn9-HMXo^8$gb3GwYV8bKWfu(GwCtk{?1E{6HR
z4U96sCC1anyg8jsysW^97bEpVjzkMPq;D?GKr?fgGR>Q8e8Byguq<#Qv}^S1Q&WlS
zZg`)?6Uem8hWr-ogZ|}-jT#<T0{ZN?I9o<uD?8kb!mut=jN)a{%3l{pI6P+!WkNDf
z?Nf77;e6ESP>hQgz>$U#_JfZ;uWc1T$0kaAGZA9b4Y7fzD?(JuN>b9>z>p9PxNolm
zEK5i{+#81jG%jp_$vn;c0fe#s=5wlqx+~QfKKAY}XPHafDKYRjH9w5Kb|2u&c0k4+
ze5htN%#auu*q9^Wx_Igad$DwOSPeDmK-qvfgwbA}J`9{K8a5cS_VEEw<0f+t;2>vt
zWsE&vM$l!bqrONUcW4pAp_(_2<y%aSqm!r7!HDNFyoP#K7uE&gCvDMHYs6_^@pL>E
zbBD$|pt>5r(-C!9ncW;`T>cY}q|sH<4Q(+y{IEQ+-T;_Zr>_$Jkq?nyE>a@=Hh)+l
z{^_yQCdw!6y_LX+Z>55OqdZ5z&J0#!nzm5&LlNo#X#hk8kxC4pI6544MCbci1StxA
z{kNc>13S_ib&&eNF0UeR#yeXOV^CWu={PoqX!uOUcqw5R>cnmxf4XJ+QZLR<{S*p&
zyjR6k+Jhep<$B@j1{1Jk+Z#-Eu{ZpO7Y}_-^+a>f_OWR2<B`+`X#O#iKVhVP6x%(8
zIA`K#7CCLIHudJhWw!n|)x`U<BZ~#k!pl41bTP9eu?n1$aImR`QmzybrFvWIi|X<*
zKEp2Pk1i^%A3BOyF82>D`nrplLhP9^rHHwG?LN}Txr}qoklOJ-=+G*LmrKYKz02nm
zv<NzF(^d|8Quh2q?a<gHy&4)X5C)p9P)WnNh7x9m%-2p>f}GYqT9h-^qb<iTyXbcN
zH!`qXJ@i=_P~E5EWfa!5UwzjgLBdkd=l6ZoQ;;a`W?<2qH|i+wEC!fiRxXL_qboI5
zW<=Y<2oLHEsLIq^q=%X66A0C@?UJ~<Qto@ROl>e`fjuY(I3@;y7&^pE3~lDdZhtqG
zj~cagUNeOafb$zoT`$bfYwI4x%n@PSi{vofYgOI8A-*r5SW$-+_497wlv%~M0s9T>
zh<}F1a&N3lJpUmGF71n;F<$leVF0M))O&B*e-UsHXZyWw3cJdtcBK53pk2vxt1tJk
zUJKVYe)%`B5k{tX^f?+U=)S^Vvj2p0WIFQKE&Cjw1+0LdHl{TM-ly@v!HJ=E<S=(u
z#Rb?A)&pk<v1)W3a+n0`Db3&|PM|Qxnvdzi`mo15&`S^Nyk7lqsvP13BJ~7UUEFCk
zF<yVC6TrS370-_ZH9I+l-Ql)=sPA#w6G#TkdS-)Y+w`|>iaKy>oQ+5)Xl`?#k(hFE
zevEq6cQ8>KM4sMhJx%#dY~gD$Re6}tU24yCcm#8+kJ~V2Z`HO)`&OR0SHL?$VorMt
z?wCa!!1$Oqwb?I^g04^%<*~YRT{2X=gf9%$o>P<h9w^<v+BMQJkE|G|Jb~{TGZ4$J
zT@Uz@&EdwU(Ov3h6mpXVc%Ba#@lwKKD%%!sqzGd+fPu%`4ipju;%O{JM9`<IQ%sfi
zrZI0x6{B23f@UTds<G^4*b#Z0t-wR<RdQMea3PM>P;g;l-ciIG&~Sf&cz)&}?+KfT
z@|`bCny1e+?Z6}c!xrsTG^)h~U|W3A0fty|H}Alvd!TzkjyKg)cPST9F*N%gND*fd
z2RD7eR<kV^e)qJY#6E@na<b*gX>Hhk84~h{XB!N2+LzC2U&~mi&YbB}zv-=DkZhVZ
z!l+}|!heO98-C#Njmf67dNqN0qC~=>uOZEt7TxAE{@*Dt*v_+WoB2~$Xrll@n-&G?
zfCCdfkBXoj+Hs%QKm{+MhM1nfLKJH-W={UMBD`k$*0_}DIlm7z$}kP^kGXNj$c&|F
z<Z^SQ6Xf8LMcfzsWUJ@`B7PX;b5@=vZ;@8MT2V5sq1MArzMg#IkV^W^%^HjUh<rd3
zia1$i!%vk??DRGC&OxBZE?(gJCsnkJPZs2VXCn-{zNK#Z;E_YJd8hZl%(C})v0kyG
z{ym0+69EYB2-tshBr^g&zFn+fK%n~f+VgL}#&2>XFw{AK*gzT|Mu^$pl|!8aeL5h6
z3;v((?j2-uh`8b+K$5#2am8MuDFo(h8Z0k#eUV=a`s@1<aG$S<q=)(6NB&=EoN<5{
zV}}}@kVd*c&qlqmN0@y1LF$HFN)SF@gWlOFJd(dES<quhnwQzk8DH8tin^X`<??R)
zuwgz$pO(O|b>Qd3tj}(ULGm&IzIMBylJ@e~OUSiy86WV500mCn9=FMsGsI=u^Rg)0
zVs?LV=>RtOZIJbzX@DPru^Mp`>%sTdXD~^1>d<Ebys_H{apTsBh-#OYgs075Ep3Xw
zMZAwzuz)mD%>NPW<~O-*1)`t+GPEQDnEqR1wmo02n#Pi_y&GE^4uJW5k}gxEv8fWk
zy1fbxXGQ>GegO;M9uxhoyG2kP)Era`$mxjcX%eDbj1ZBq(BtD+M8+qNW#M+e^3Yol
z4$t>av8K{Wn*r0=XQ~A1eB2BuQ(p_M8>>kB`^<AN>DG!VjT8SZ)$uu+*8BgO)c-8)
zef_1OBKPWAgBs$uzP*I+dr{odeR9>fm55j|zL%gyr8fOSdUEx{S92d{U2XMSK0r}J
z@yb6tKWi$8jONAJS=(X@QN%2*F^yu({Od9fTB|IIq6PSuS;;L(m`%%4R9A5c%y}-e
z?R=wjMK&Bl*{1iUJXh0`Dw&S_lm*RXS9e3W{YcXDLzPZ-Se6^>NmMwXakL`P;d7-1
zu-gRfWYFL4Rd|lOYsxPyUxPHTo}5mg#yS{-A|X<M@;Xp5p<)Yz32Yk6id-R@tz4d7
z{N*llXVN$&b{H*IXFVo4SQ|X^ZvF6qw`Ya1^Kgr59rim|TKHR^)Kpi#cuLHh$Sg`z
zU3*?58JN%X8LLloPgWAyaf~x~edfmRMZEcz0o{_+$y!o?MoH{dYa*&4_hygbG%|2q
z28N|w9&B-s5BL257B7PiZtp3&d+0cRP5KHM262}HM9phuF~DCC7aI4HVixClqCsp?
zBeR&+?vrl>l$+0AUa0LHNK@moRDTBUkuiSaFoK6beGk47nODeV2k&_gX<^-R9CKAN
zbWoZ-idkDg4W{H5HtO!vhe0FmROAQ>4U0*WZMB+8$GSe3I;R!x-dFuN`NI-(EgKOE
z5^^dMA=W>~S~e)n{F1%7E&h;$rIl(R_t)qfVIctc|6_*+FT|wsW%&r7CX7$>K|ndb
zV@`P&fe409b5>$(e4(nM!eD7w^PW~3vfF=)72N^-lGBN)PyfNPGB)v1&XwQ82#<MU
zV>(7r-z@T%e!CM_b*yDRK{k%*Vz`Qc2zcPOmRoKW?`4pgS;Wyh>y*$je_ki_D9u#t
zuk^Ovr%`Pse&lxKSa$zq$wYkmjW5{ta_ykwV-e1fP>MD>_d$O#IVVWl<u(e7!1iEG
z32omGLM*paxL(!pwa-q%S1??GMODK<{j=iZZUV~$4co|uu-f=vZqyT&GtY^z-pdw#
cHb05~<SExWOP7fFm>Nk%K~ug?)-vpW00AE)@&Et;

literal 16844
zcmZX*1za1;7Y2%xpuw$3aCesi!QI`xNK5hJ6oR)99E!Ua3KS{s!6_6d6o=x)i_6Qs
z_r3qK$^Oos^UZg@nVp$Uc9Tu4wx$v;79|!E5)!V8vb-)55-J$s-vLk&_C2_@9<f7n
zlGTt!Li&=3{a}NRh>^W?l^{r;CtvI%*ht#y`U*;K)s2mfb#!zP*4Mbt#KgqN$fzvx
zxhnMeo#`L~M1;~3@(3J}j_?tVqoX4ihbY29)K<kjo0^&;oVw6wL@mPke-;GC%*+gd
z*jhOvEF%1`{Ezd$@IQx;knz7NMEE~G!XY7`Ls(M$f2_H=`TuGW;eQCik`d98644<#
z^S^E&Xe31cq#(+FDI_4;qQcVu{QrT(1mOQt{)hip^<Sg3RR5;}0z`<XrZyrRL?I=j
zMOYF-S~9|a2#8!nAtj<g*#AO=MHEs3FbN4QBC)Wrl#GDxztJEi1S7hNVE&g&N=S!5
z0?dXH-9Qlj#px*ssS)W7q0dF}&;MnS{6nL2aBv_cq(yKLg@g!<KoAbXl9B%7{O2RY
z|6?LTgvh_JNq&A6A{XHo6_g<eh)Mic>L0-X^C3itD2Q69-AqwoSzcZqA`yY)hu-Gr
zm-(9wAp|Qcs}W>GLExd*lL!RC{4Ycx0cJx8A0dvgQFgQc)E1N>a738ku@-0nM~pyz
zP9*~QuM`xN{pSQ*jD%W^CAh8ynhgb-!x38m!dk#H{Eq|720uD3_?r%dT8{dg4Hg!b
zA&?Nu(HO`1V9Swzky3;Rq8m~6vj}~}hFHUe1!V|91ny_t_ivX<i;7C$nfCwFC6m7Y
z_=qF*GwDMp;2hKbMy%{RZ(U72q<oaHP;418oJcD=j0a?)TXa-=5`26b5Lx9~oUzg#
zfEktW<D^_0zqpi+&+l$ro~x%t*sEdj4cb!*y(~@7M=%x3O9qbg<zRvHyU_vA?R0Mx
zTkQ+;)DD+`dNsuZ%!s2L0!%jp;~7d}_bWg8A7;djrJQ73O-6WyYAzSAkM&jJRhXJc
z2t|moMHP5;R%QEIm@JCrv2s;yG}-o==jQ*AJJ>=UAH+Pj#*74{^{(;0&Qq{#ngZD}
zf^7qy+$)Ycsw?iLqmCvtSyN7l-o$sA=hMU9@_a3-tH`7~61oq#Oy3JviCT(ia@Po}
zkJ}CXZ1*^3EYOtde&vdUM2DmzFRTA<>FCohExlXP;m{S0`}+3w_o}a2)3QC&3_oWV
z(M|Kapi^>^YO_iy@yo<}cMuor{ch6vrBa|BttpXS<y0igw<Y-jfBRL;rxEA}p52@e
zp`-r%9Ae#_YHAzmMZnVbl-a-2osCIHJg&7<-yYZ@&T3{$GwIDukGFsNt4kAATAm-S
zIMFSVE_i6n&n|zv>R`#+w|w|<I@s7UC4Fu^wYIuAe|ocW7|JM3wttO3sy9KT+;w?i
zdTya}w|QMkc7}fw3+JY&+=v&MqV+q|W{YoMlZ+X8_i&CX{r7IMoviXVQ2*|iwEuy{
z$(H^p83E^(rpxW-;ze=LN1~IA=1+^!ezflvV3c_>d&8l{#M-@f^3&NZmA~VyXf8xN
zo}a`$ga3XC#jV@`)@%;zYxg?Ie@oXLBg6l8qj$FHu>H+D`rk^ZC5;9;NsuDrp#?&o
ztv5ezrabAeuJplG8CR<$4(laD_{*|%o|p7b!AV$@Gwd_$x<(31M9w6L7v!IC23lf(
zcmX$z6sF1Np&3$WQ(Z9hSZ{ezFSGFPW{nQ%P7v07!{=ve{H0A?(HD4RjWwG>BETph
z=IvRe>TA6d;g4oR**txQTI!!Bv)v&2hO^Di`Y(s+w>E}}1WRYkevo#m4sn28qSd(U
z9vdq3&dS2;_q?e%s!i+6h9Y=6z|Y%ne(|2^ivhz=`QO-%Nq!&+Wln=F9$vi`_-0OO
zN4F6Zl*gj~txc?ZR=Q;ecjkd$(<5LaNuqd+eM<?wcE(ww%V%gGi`SP%JWJE{Y0b$n
z1n{LMig`iUu(%*fSeW_IYsj9^wu46G7DG6bt^ti)3g4vgN=wm_>T>OJI*0%w;r-?N
zP_ylZ0{X^xZkJcv^Odg}C(~}ypUUY6g!c_xEw1+Jo&2(X*mOs+AVx#2oxBW?-=7<#
z#i?alY&^Xogl`2!t8-sq89iQ?L$AfJaTDQbiT%!!3kx&*`YQ-W3%b6~T~TDKU|t82
zCDVe!QSh)Gtbl>2l%JvA8razlDZgVE!+a$;04D*AFO--DZv>S1X{>B;he4wtnpIke
z;F73l23fJ6$fqTo3zc&P?cEQwO;XGjjMDP9Zs$KQJUp(u2>3<(yjot17eQZuU4M=t
z`8!{qkX*)HMS@DKe1|nibRfq7wD5>Xv?>C9=15T16d#8ibR|>@1wNpF^s4r$c#UGh
zUA2iNbMR(Jvvx_;a><%9bf?#Pd1{ouTLD!{>iQ}g^!nj8>9xZlvk0v?(j-$PXlZlJ
zA4)Q>xU@tjN~7%_^U|=Vw?y5<F<>E;33^8ubW5T6j0_$e9fB&#57zwp=n~yuD$wBg
zeV9NOx7-ZryuRR*J&69IcD%vFIp5plC*i!$m%o|YVS?TI^fXrFGW3JN%`ca=SsT9N
zf}1S*pNl%H1a<P>y88TLLW!2|93NE1QH932TP*8*@>JMEda;(F$y}`Nn<nP?Nx`cm
zXlmUpHIc-|TS=wabJn&2tDLh-TGf&6+*c%aTGAvJMB>=)+-}vdsB%Lt4uMm61ioAk
z$kL-<qKC3>Jhcew%#2vZVYZUWrEN1OfG(Ib@FV~>Yn(}*P<{4qi^ua>)je1VF^!`(
zsvk)7d6s1=^m6n<oDvCiFmqlGiL?-&3)DEH&cB0j7c?lng)%{_#Du^Qi*2&G=<4fe
z5DF@!o<l~a|L0<pDBkYbuD@(EC~D*3fxO3RSI2-u#v+j9vxDFF4Bap}2jHkit{Sbx
zZbxjtTwB`(XOUq5#n&x<j}i(~T(o3itM_9CIXx&eq&;W{&_E!QeEYXH0ugIBx6ien
zokzsm9x5!-z-hjZ^1;S3G{NN8&7Pvl{YJG?1Aq|kQtuP?SMdVP=!A+Shv<q_A3&a@
z8O{%ya?JLVZ=w1-sDisix29n!Os`H!W!6M>*Ns<5m|{RC?_M*sX2a%b<B|%W=A9WS
zheCZAM#I`$WK1JcVIPUmv>ga~_I2#TutYnCWA^5RvtKW6^X|LVa0zHm;X$U+$p@j@
zoquot;?kpE&Y=<?V}kkD=&=D<+36EFe#?s(n-y{aB*{@lZ~WDy#X}TUaf5$|vBHnj
z4P!_TunAMLeV;Yf4COymE9Q`J@3M=S3ic5(hS?P@EwOxjx0$S(hMox;S)gOBgPwdB
zd!@<>21|XJ{h*luTV@M;qQLs?qp!n|wYa-cu*a@H4A_5F#V8w7Ce0$8uWQr%*@NYk
zpcyAbIQ;S8?TVTQR5Ep3I=ss6t&I%QMJ8<KVd>y|y#Jnj=n!2{^iUiI#y!iBSvfyk
z3w@^%2>e_*-zLSH2UDbLjEkbuEbb1IeFD94lF_;K5bY=AN9rWJG??m3`qE88^>)Ym
z*ynhz`U|PnJ6~6!Y#**+f@Bs7>XcDFu;&IEB}ya;-p7>Fi<cmXbM7%K9V-M5N>!rP
zjoF^22j!sYoRtn?WkQH}Bl2V#WwaM^VwQinE--6wxZMis9Kb$uWmjLd!Kkgedwu+C
zzP4gaCflz_F;b_1)d4Qyr~siKMI2HYMC$P4*&6_u_3%m?J19PmKW!94TR#jfma&K&
zoCq3fHClWS%kC}L{|Ql#q3Vf%GBteMw*aSze~az`-Qh(+U%$m7(gk)xY{u|oo}BO4
z4Hwote7~VlN7xkB|DCo30+$vinPzKdt8iKJx(&YYct*aJ==Mip<^@k^M;-U~;(TEF
ze&&}BBDgFpCMPxjRgK#^b`q?2y}!66Ww%|wFtm=>t^sJy<7tyBv6wc(6mqko9>yZn
z1YiTQGi=Bto|FL2D9t#yA5*`aoIu&Y!r!I#7k0(zp)bM+9!l5<+Em(nI5epbG4n%%
zvp7iSg}QSk^hfJlhmWO^a8*ln!%9TS?4ST}@iDh57Ptfk`N6<iP0jFSgrh(L0vMST
z7yL|-38Q#Osp_oejrv^I$Tc8dnWyK)ga5fk%ux&yFp`p$yT`c=L<@&J?6_q1`K`@5
z9Yja-f-U48XA)Q#&Ay=p?t||J4TiooRQcFyx^J?&neL((RvS<=$a`REk~-Kx0>GGo
z1$?Mz02Mo^_m^K=KoFI+AfJ;-Q`C2Uvp@h*cXST;%ygVk7tn7{rKXHLx`+wcThx&7
zn;AiFP=MbU@7Q=CUwT3bzj9d=4G}fmIhxOvzs+*tXvbjCzn=4o9no+xoCxvZ^b+`_
zEb@1JkwKyX`F!K$9q{>gX~diakgXScrgR%L19-jJYgTLGPmP_rp?Zwd<de`N2^>9-
z<ANyj!m*;s2<xMN(pTfpyrFDi#&+)^T#@76$UP$Fo=EF+e;QkDll<zl;_=`YSvo(H
zh7?&uf5DG(rWlhU)9j`Iz~mKH?7&s@q@&B@7ozV44;5*m)kY}dlDk<)HOXb!^sAH7
zd>bi?XRhXMa3Ood7N7NI&Yrw^7cfZ@H!$WXvmBptk^O~78FC#sbsIc+o4XeLzzhB)
zZuW`a9Ug8qE^8$jV~PpXB`e|sEhuY2;5l==ds*i^sAl{6AV}9SrMEcZGtYRtf`Avy
z#L8p%@vaY`qA*B07`cJZb=!|muNX7AAVixfhtgIvcsnf)B}%1=<d$ZYkb?Z|ogk5n
z9@jGTw4|UzYdAZ{uQfpTbRG$SZp*=9&*N$TMjVJA4Dhi+hV}rrWv}wa9Ad*W8Yv$n
z$jpf8FGDzE+;;A9?WqyV)}F5O#v9-v@%Vn0-fjIT#GK;g&kY@IlC3|1FjdkDoPjN$
zz-v4(y-)}n!%Gx)$8RVj7Lok#uzFmyF@QRP#0uBMW7T%LoQy?#GQJYuD9vc>TzkBf
zB}U=HhYm!eh)Y(LpyHbA18>x*KMoaE%qa`z8SR!%UjyWzGUaV?pdx2FHf$You;?kJ
zp-Y{edlF;-;K6k~ZdDXOc1-5G+MWS(Rn*V$4}k9FpjvROj#A5nLy_*y@5GKNv!DZa
z9>t6kBbGFOMuzl_O_>-M7Z-@w*7V2!h$nV8nG<{nP$TEpD%}wZ{U94W51?~Yl<8A$
zeQ{)L-`JV5#;N|cdE@%Er!;5KCiVv-6P3h~UUn}<9?$NC<l*|#H$t&Y26P)kv9867
zMamW0-<q%0>lyoFxhzM8?l@!CVh`rR6yp4{sSP3+B<7T(RjbgOg<PQU0Gc_Scl0FH
zKT+kyuc5AUDtIG&TiVdt9}dYh^^(Xjlf8$H9E`(U>FbJ%am<UBplhZt17`Y+zp7(#
zz^nVcSjXPVrE9YW1d?1RHJqo9XZ(BvYWkwb8fkySl+!^T5XUY@A1bP@xm>+_SqQz8
z(yLgCL)$$<spzRt=wa7_`+6^D5&Mt@7ix|MPoPU1?M}LxcTh{DU*I(t2xIj`39#Mp
z!b|U0q1s!tcJBBZIh?#SXWKEod5yKp(eOI{b9PI)m{(7sPo{@u5~40tF6eY<7~jew
zRyHh5Dnl<y<3D9?3@KLwXl~U9TkVXv<ENUnzX|tA^axq75kf(kXQB#D;h-1#<L_eI
zg7YFh+{Xsi3G1M&yWNY;%}~i+t1+x;!nj+9a+|s8i_fMl8J*=Gek%m}qCU~~f&K;?
zZ{49C9zKH;;k?lLEgPdODhwYKLPBrCTs5WSK<@P<*wRO2hgPzfA)_5)lqR%y?aZXL
zQL+(VUHb#DUV3zxlhR1PGyJlh=jPEGp0R>oQ!_5%*il0VJ)-Q9BuMN`lvS3A^DEBN
zf{>DuviHB9bN?Go2PJ1uv-GR|RsBLRhXnG%OS4NUo^)+Fb!zL9;No3bZ60u~Z-;&g
zTGPtmmmT<hwg?mj8%dX1*a)m0>tO+F_V3uYYP4s_utH?S8mmwv-$HL5<}G%v>&|O!
zt$W)*-z0(xLOP0Ur$vVA;^J~Iyli&-#L)H$$n%$Smh4g<RwK>Yje+H_l^E>}cAM`o
zcB%UaHa}Ibyyiw<V}C*NxzkUWdxG<<I=q&4&CW8~+AsM0cdpYj8^h`#cf{~PZcgR}
zuo+K`<F%}THstD;`U1<Wcmv+ARY7e?1(qtj>y-YchBwmHT)s2BssO4@qL0o5y}~q*
z1r|R3lkqB4n<N#qMEeiijArl;RDo3$P6#ph2e0~n<#@=GI7{bj4L;pIuCakndyRgG
ztO=7ycWjPzN$0?%gS`)#@O=;4<;=o)(AT=&$%US-5o1<>WClV=ATgp9N|T*;hyE{*
zXzLiZi={(*hLO%TyVt1a2_@OWLZ5eWAA61Tg6`*B^#OFY-B@7x7wYg^t8<%Ot6Yg3
znAt-sOGm4ZvD#_rI#0{048RJ~chzVWi9~-@4T2zAaCXjwS><;<9{h!NY;%kU`6H-x
z>mZ2bd7WK17P9=2(b>8BC4k~r=zaWb%bE^^73|Ig?k<OFBfM0QDu4+}2my*YK#G`>
z%TQINg94iP(-+Cuz|u?*LS?B1{l)iRW$d?m@9EONAUUs;4Coa?B_AvqQbq=n=u7Hv
z`%Lu@7U@f9!6oj$SgI!8l{|J%X+uI(q05X4*G+q)PwvX_frRsDwdpv=v--G~k$bk#
z@s%&ueRX4V9?Q|mu9}K5zwefmvzNVx0Bk7}iX&o5_~|Y`9+cs$4O~YNJ%%sFO4YX*
zWRyEfU~aZd_gGUtsZYxQXLjwBiFWkssTbh5?7JC!wdh}{Q14W^@J{g-UIK;pD%?qz
zlmeoO%5@SH;Np_9{Xc|~8BKhp&PWFP<1ysPdC1$m8QlDYdfczt^F0)DHz_()YzMH|
z?E20$-5F%K8Afdyh8;(K1+S<R&Mzj7GrAPS#%kIhzsLqriSak0Cy#yqD;XolM5aB|
z{sPRPm>P<{H1>s1ezdQ&>UTvqNPX`0j?Gc0TtDmMHq@;!8m*l%wc*<JP1RYU#l0B8
zIhu!0AyJafTgbc~tdm3{kDA0iNyKy7;33pq7GFtOR^$Vn?(xVavAU1>H9>{TsdqAt
zf8z9~?RQXlvXvlp`eu`0*>7K{s%S|3s9wWZSq6dG&DtS>uC7T-jI{Lm6RcZLUq`Zh
zy|}$UBQGnA`gm_(H=I~DR#K&fb4lB|waQj1%pFkeovQ%87fAr|^9}zN)r#7O=DChD
zLd|9Uc!UoP4l6)Iy2{AcU4ctw=jxKL1YM{uH*1P^SYETDK<RYv$A$>bWup3}O4T{j
z*-lfbhM5ZuaoLa+;$|uZZPlz%7;N0DK72IVu;OOw>D4*?r4sW(i@wGp0hkr+&Z&jd
zR@V21h=$2N*6!oYUiDJuVzN(|1WwA>#2t>W`o4g0?PVo!s@GrVr%}7?n0<AzmZEZE
zP7;%2{Yb^mr#k}YHSiDO8#KiEl7i-PKbij)8uQ&^M!}`6q#S?c;~SA7YIo{n{g0P+
zq_5s+_k1(a<9~sfFYt*L*b5^~L{8mKNwgGVsfc^S0w<D9N+O_V<bAAccq>rV>qsoe
zHshj$TmQQ`1(f`eyRNuew~~)9L7(|eN@FIBuN_b|J&hWyQNyR5Yg)s_)s0yejkTxH
zfLDTINQ(?PzxN2zNeu_KQAK<>e3#Fp=*@$CCq33@rwhDX)Uk*~(G~ymXnsl(5v4>&
z!F2Fl12=WiO__(}1FZXzqXFtY&(u@#&_z&mcr5Z#e~Yy3?DCtGK}s@#PocPmU5fxN
zJ_Re+-A~3{+i4zbr1_=yv3w-(d^zT;lS}etvANtu76$p6DY`+zENRtJ>ODRfB(e$w
zPMqj|KQ-D9B*>bL&@uGtLTQ-3^YAj!pdP}wNv<}^OB?Zd_X^J+XO#Y!nsCNs{ABra
z{1|vp>z6GAs_zl%sbRrY=ZaxQQ8{`WdNs*ZQd^7Nb4YGWry)3J%^Mp_d2vd>#}@^n
zB0~MHoD!yZrg8e7p8SiDc0FBRCl=XfB5dSbeRQYySY#gC@b^R#wST`yxBMI~NSP$N
zU3eK=7kK+C@b%L3i5;#dT<m^(p!2%LGH|f-jddX0NAzVhjHbrJ?!%VomlxGP6VlP;
z;j~}3{}2SLb|Py?u76Ma$xhIK0ZZ)SP3}sx4+9|^%4FE7V7I)5^s4*{uBf9Z+)bFc
z5S9n)u?J}5EM;kyk)QY`uDM<93BGdYIse)7#)79ZeMCSBo?ZJ<E8@%T-HM^D8RL?K
z7_rpKyF4+7Vs0nsQ~4xM1w5RM3pW6Wn@}m*5@t@WK>as$YV^H7pkQ(8_*D{K#`?ED
z_OP0fX>>65!rz7^=KbGBN6~R?EH6_pO{!FII;aMP+1&`W1R$e(Viw4bKXDb<AjcbU
z3h<owm%NE0SI~@D>hM(r>5`m?GNbCu_sGRTmqh4dz0wiKvZbxj&2z}AltWJWt=6X^
zxv{C|&)5)`h&BibK@o~^j}EE^ZGB=e23Tmv(0E7*CK4c*K+M#v;Q0#n1DVI)w54EX
zsby5;D-R0V6wrjFB%6Q3fx^@d;uNojefIUm=_WMs@q4->Jz9fv&0%J+k;Z%B&R<pX
z0y7`~P?kxMvh=Qwdau@w6Eq|(KM8`BMk1^TN2C>s{$vzMr)UW%DTihhV^CFG_*ihv
zyn+JSRP40#7OE2!zn3e1l5x#}EfnkeMo%r7kmSzSxAjk0f;Kz3!Q7QV&ttRTZ%>fD
zK`bGEwn)k-$a?`+v_i|k6axM-$M>-un5sE?l3?@|ou?#+8P2x~(JBjnt>R%i9}MPe
zKfafkUi|UJ)I9beZctX`rKb;~XXf_3_Mz~#FEmU}JWeyu%A6d<Ke>()%t1xL1*{E(
z;F;6#5Jjh+G=~<UAPWd5JEr&&c#6g&(!R~p+q=bvCti-2;5pby8ztE!U<#TI<Y3r^
zs!Qa2QE_4h>?i%jIEaPek(^B5WybpE5p6ndt(f92{V3jP!qXf9fG321?^aF>PL2~b
z1h!tJf9Sv8LKSzTeRFiw^;jQ#>Xv8`m>;C>%Xnt1=iTx6GD&g?{sOGgdcaybNlW>I
zcv+f-k#^y?)LwSMSvjCke}0_USv;3OR~J(|QR=iG)l(?yWjx4gpusqvyTT6x{Z7`R
zSdZ3{@4_r45o5l}2{mnetg40bCMcYpF+MeH%v8!bwoDk8cG%zQ{?C^klfc!#9h@x`
zr7JI4x#ElRb0o0t9x+&t`{z~#!Ly@CZRC}l6~BcQl)HpeaY^I~spTBVpfR~WzmIls
zPFB69BUvi?${xAESfWV>(r@?;+7NZBMm}!{Xq7-3Bii1N6cf4snfaBEBnr?vIZCs~
zg6%?x6JfNny!{4_1fC^5LZX*nXM3;uq7$Mlt?<J3bkxlW+Nz_3rzFu`c)Kq7(+O+8
zmTe1q)V1XA`HdkU)bn(E?)~1#Nc+~xfb-_MeY8c8=NsYVL_fdesa5*~5Fja31<E?1
z@jJ;2vOIruMR&Jj-}^V3AJ5iQL+qn;3Qc?ya)XO2?(Gb+rvL`CqjWr|f@~oAryI|g
z!MTr|E0jj%s4!-;j+$7A;p76v?~EzI&+o9?T5J<IsI;U{9eJE=TduI`I?F6Sy>zq?
zGf!{S>z}-Tt{qw2Z7TKc5aIO+`12Rm9g{P4U_ok=wD|5({!ki>76sP_f&C1Y60!z6
z)S#^P2@f^V>3EIvfr>H6ALT+6;Z-XH@6deHq#1=ELqM_BCF0jCR>z%-%gbU+jJ^s*
zXu0A6gWNQEZgIj1iHX-SF!cZv<}~CueM?YN_()>yM8MnXb8A_LnaJrEhHO37Kh}yu
z$PHEbQb)N)P$LLGO@W)dReD^NiVH{ws`_|LeToturS)?!#hsR<=XMT3MZN3GWQ_9Q
z)AvOJn3Qn-{h_gQrUD|EO6Fd)IKRX1a11z6Mw^O}LFvR?UGo`buZ3r)5=KRC=aQhd
zQI0=^P=%Q)FxqUyh$jZ7A)W?`&C4xugVPWs(+Tpc!OQKxRnSB^I2fgWE4Iio$G^3j
z6E)w8PmS-)cPlp0q!?1u2+bT-z%3&!J({Di<WnbVxHx7Sx!5A3no4|9ge#s4VJ}#{
z4sn2N<JHda1)6x_8Rx{&ro!qBea=4;>K5MRO8c@3Xu=yGA0Im(x1&Xr$^(_k+o^aE
z$vcxH8&5jtWTeqCS1EP*A+_IX!h>X2(#C!Loxl%_+hYXhX7?g$aHj<L@Vs1R2XSX`
zQcw%mQgDX)3ugH`HZ%fi>KJ+VmK((>+I;4gm(y*v3q_ssp3m(S=A0b|U-ca#L?UUe
zChzSCH;tYcx1C;}WO*O*tR<0|paip{>&E_;CI^ehxkV-mKp4^46p~b@_Zzrrxwm-?
zx}1Gdns3Cuc^B8HgXoFhE=mJ$TkVZ9f@~l%nHTs#wx>xzB}9lj6^*anJB5H=U-iob
zwkLzFGIIA^QR-L(mbBun>T{4`87X!613+=0!0s#B&ON9KPw_TSz|I>fs6x1S1=}MH
z*GZ9ICT5AK`c?%#>_F@#pry<ay`);v6T;d9Om}C2l-+An?EndkNwoKL8a=JLF_uig
z(fYVg35F!?ZSW6CG_1p<Tvr+q-;ev?dm?Je`MnYpHQ&e8c_E(|FlI+3KOA~_xwl(;
z%>9x!)ZzW5)9}W@2erR}*BN%?sdcfO{KH!_rYVx-NqOlL73TD|+yz8OAL!Ba`0{t#
z^$Fl?v{ART4PrRQ(Wb-61M|DjT03-bbTLN8Qt9kS)dbw;eB8#MXw)@)7|Z5xA5CY&
z>h^*h4_Hu!)jWvav!Q($nmd$N_AnSXOjd!E*hEN~zDomTmpiqkv)E6Hqa40FG2$G1
zWT+Blk)Q8tIGwF+9s+9xi_LQ<zH_tQmacj-V;WGyDlp-kZ{dSrv=7=k6cBrlNlmit
zwXb9crx5Gc8NYCLti5M`@3ozZ4(0s=%qQ}6OvsK)uU{K>(cL7Cnc7a0s=V`q){sZ+
zF*<A|6fx!NPs8-5d#l7rd<WKXwI$MCHTbm@Rl#Fr!OI>+-mFUREi}!~AU0GD`3-^x
z1i!r31i&_~N63cZ9P9i6l&?NTrQ(fG>?c%^<$k1K9O$j86|W=Q6yetjzitRu+;fe*
zF=ZRyfQy0gXZ%`326(Tfk5<&w%@!$;)}NO;EpKprU)#7@(S%s{q^~uo_gIfua|p-v
z0xn`WGtjVsiSJb8DS!^h$_yI9vXF3GDBQvz&XL|B`}eDotbJQj3!m@4Mm_@B&GEOz
zd0rZl&<!0{p<Zz(BFN_0l-O?jZcgA-f26o)E~Ds*OF(5idr8WV0k(v#IQbaUuQFYm
zO95XO#cW6}dzpwk#08U1BCBfs1AB1-y%n_l<%#J*V4f=Kxeq5j@{xOcgf$5kBDq+c
zokbu6wv4u^_J>XmHiN!MifYISkTq3PcJ}vG7=@C3P-}-(pM3^#h6MBYsDd{I-yyCI
zfn(yg_GO||`u49h`|j4@j>HGwo&B5j)>dNrc1AFToXeJ%Hr8M^b#&9#!!QJ^{i_GO
zsJU(#`xmmfzosdXZt&0I7Wa3)uhgZs-<W{Pwco@Zh8$ObI^*>JMqAz;a@C@|dO>#-
zUQ&;RN|~(W_(|y?Srom7OFaH?TflO9-8(xJpLqWh3_00@iQOKT@rv>2u0`3B+e!zH
zZHk1~XvmFUI2qY=a<>C|H?zh>y{6>Y-5_3?NxT3W@lf%DL!}hW(cTF!<lrS2#roYX
zY@b)oV~{o^Y@%c?c>7E%Q|!6v@Z(j+2m~#>(T=H05hTl|Om1)Z1XC}da5DgNvCmq+
zaN8%XFH(>_);=^QD(Zg$tpEuKvh=TW`X!f52KYtFSR!tod@dInagN7t=X)54{Spj&
zDTJo*Oquki?xd;?E*S9|?M0^#@To$^k&vj3|9KW*2il`Y-miY1A#88_RiH~gQr@?(
z<my<_>a#-114*P?Jhrc5Qxj9;w*i$|`Ix*^(7?3v!emU{M6tj2deeqOuOK86c2!$%
zWU+vuh?6q4LuIU-b7d#ge|Wi&_ff_^TC-?wxj#4(QrImEhWJjjl(-Q!(FAJ18KX2t
zwwz2f8JYMlkA5qItMyq7?9_gL0%3lNLuO~R#Y$-}X_Voa^A?G09hflW41Bz2%pc+U
zmA30WF>Sje%t5+d-X=MM`&*DqGQ^OdE`iff*F3JrG-=86LP}fAQpPd2(ZBQ$5NGh}
zIB96^&mY>8_RYqc{_yw9MTD~v!0E$HA+U=LmUa2G2jUB(pDw{5l#zP0yNd~>5`2E^
z*V`WOOkO%IwK+8vC8pO=59<#y94<IYn1?A!Y1u?G*~uP`^xPtZ`fu-H84-etElR8*
zBTNZYSa-8gZtc3Lw+xwUqh`vxb$1&hLfIdvJPS*e7ceFM%&D#1ibQ3w4A)#W+}do4
zqE*0LJNP8ko1-3?*YP8#7~TYH0MzlKlrTBos={HyDONWM$|`BNDI3=C(9@x{UvS8#
z=8w-`W&0wQo`iYFZCz{Tus@@7UURr>!X5U%UUY3FKW~a#G9Nds{Sk?J4t8M&c;0kl
zW%-c!ln8}TVhvqdr_PjTj9oUDP|!XTu8Re8=z+mO%|MJw48dmoc0r|X!ty&`l8MXx
za@XafR@>N^!0zW}yh@KNbHNg=&JAnGn{9`cQpf?p083y9;8$8IuuVS3D*<Q&$%I`*
zE?dU(B7Wi`>Vy8jcY;;06Y0ptx3totJS+#ay<)$0>SR_ehzGgQJOZ6Iy4p+RpDv&9
z|B7lp-gkFC?*xH;#KrH=PV#dyi2f$7=bTsQ(S<&26tTVm$CycIJr>hV!m<DQh5B3N
zUpk3e!K+#DLq5v|ATApH#dMwllLWfuGOLe||MIPrJg8)I4CoI+pUY_W>(+YEAqV-B
za3Cpq{HAcRwg8wDi*zup$Xcwos1;l1M>Xmb15sbmjcDiHonFl5nS;)c{n*}L`62d@
zV^!kkhc@p0a@wvg*0|6hvkX?6p!>RbwGvCM+_jh1{}4_NE+eF?0=wfjt6O}kvaBr3
z>03_uvw*h)#W#Yhj%%ZWn9R_BMho=+-OXt*Z_lvS<g_M^k}YpmVoS1*=L9>rzYV7u
zuF^ETru(zb$?~M*)lp4^7+%2`7&(@AOF3})rO*4ag5qyN+m(z)B$APrQb^7~)t~4Z
z@6M;k2t&@g0V<^fTqwJx0f_d*II^mon#cXW9k8IOP=Snez`1Fby4}&+x#z|&7(LzF
zf#pO6M_G#}NS0j&g}-?B$BHE-E!YL+DkWZqvz=gqJA#JT!H{o0@k6fI6vWp!lec`s
zh^cle1z@~?Q}iL>4hT$4x>{$g$Nduy>m@ek%~2;aOl1wu9MEw!8xl!hO(*x*j~QYn
zOYAm)FUhP6MrUS8lG-X`(fpw#u(kRbv-6n;npc&r#6I9^!t%<Yqb&N3Tuy!Ko()r5
za)>c1okv<#yS8u2(`uX>`ce%(t{^9H&q0#s(A%32jLW`ll5H&a;<PD4jiOLN{9$pK
zdH>JYwOh%w1SH2H<pchvE_X=>7@YF7;pjKrg<ICg0I1p|&0$gHl#ls2X8KUCapEHI
z_^j)OTx`z0Km=w9G#MHcy?yHioUrCRu{47xOJfFIg1nM}28Zk1#vY`6GeChSWwEh-
zoOJ9gB=Vz|U@n>ud}(N`Rd@4|A7AM!hPy@tR_yn&5n>R{z#uvMSe0Ojy}kPO3*`6L
zwlfrG-BBS{&lRKCUhiNkZ)7^&-rRmazy+GbZU;Vy(KGTR)Ab``S6%^Yf<O(-NUV>J
z3~^4~N$yPRU!8zL<<K6fH$S2~MDZxbEX`uX2+=IWquNN#L`v$X;%*bL3>g)~dikfz
z`Gs&ZP_3VG3EXr%dER5;$;|_cM>Jo~R(%Hg+iCNIKe9oy;WEl*5T!;2+2idMOI@uk
zQ9MfA%CBEY45Ym|-NM>>Qm`6B1Ryk}Ma4995EM+L>{nk4u1i4NRZ-=}f;6;q^u@zb
zGIi1+s>*Qp)g~Qq36bNJxf%Q&`{*wX(wQ-r#0jP^E2^It!uh7775iErV0lq|Bw-)2
zw{nyvbTQUGp!}BSrC7BqVjk!l0^@RQi}^Ze)T!{e-qIy2W@Y517k`y)VbdP6#C<e-
z#(43{%xvYdq>ze$P%DK}0lNK_GK6I`A4Dh@JrfT8D=Ot##V${H71?oKK~w>w$=S}H
zW=t8m3)iu{4aYJOy1aS4Kt^aZQ5XT(Hxwg#tq*sdwo|t<&deJA9n3yJgcNAV?R&Y`
z`0>;>%e@#<Rtd^mHjIH063x^@eyB){#(*e3MF&=Zut{e2v;R=`t#WyaM9$&zGLbNz
zi7=uuqcM@3@1fgzBWVIg6g+gLHkHzdUjp8fve0XOje%UgQ5T9W=iL{)E)Gw@+NT|G
z+x;8agNE@#UYUo|x`bIiYDzX?EZ|S*&-V8GrUovgb!@m8{_fkGWEms^Z5d=RJQ}P|
zpe&;?ryu#FF3Pxepk(;wJ9G$hD?-?Lrt8N*NpPhXOYTD1YyJ_*2|d~!hhu3zEs+$7
z&|cN!RV9a`pTF=+n`Sx@Pcfl?gFS8?bxtP#4ayQ3uqm^RfEoEe75@B2Z7n%T!P4gv
z9)tK2(9{fIviJg-KzGn7r;~dij&fG=s?Wakb(1@$u<h$j+vRxx_*W5S^F$LZ_XIJz
z=n}{Xn>lGVmb4)Tn9SoJqURhO7?2@ZSK?K>%}OR1@vg=vt9vL`+;jJlM#vnZjOkBC
z2MNGocxh!3!(^US@H)*B-YQOlX%@snBhh7Dxl-DRbos2hmVOO?!udW4ZE6KI+QeXO
zlxfp^#(uwHJgx?fF-s^{lR%2+FWaST(0lIN5{T>=f1j}XYKYVmrF*2k{T(*>t)!c{
z+zYK$LN{BdYjzJ0HPP1&s}_Z16kKz-cTqN<N!wpFFN{N*DqxLUOA^%;+z!8I<b2Dq
zn_?48kD#Q)=Skni_>XhSYZVTQFZDk?b%<ud(h1JHbdKAvk#?p1T$(k1+fE#xPUQcw
zXcMXa&JR{s4$jP39i$8DhEReqiDqUX+`>ZAgpmrRx=h02Ss>=^Y@)tgXV-6BAzWbp
z7qK_fAwtl%Tdz;V4!8usTx=y02G3hjvTVSIVcw_wc$)0_C@io<HX12bIQlnej?U@L
z?q4M8MC?vYPe%_UA!_k@toe4q;LEqDJq&NHHLqsg#dmVt3r5tZ7h-C(C{_>gaN2L=
zFO0S4qkO>or-6az>*_yd*W^=coyt5#-A)zeA4wa+rKpUdtm0fhPgI?*t*=;L49TuD
z`<3Ic!`HvXH-FQ*{9bn57Br}nu2{%^Yse&hyW{!6PV-SQp@bnfgQ$p>j%D_BNE-uI
zb|K}&efX*g3h%{|%n+`NB~(e0Vyx*-MD?xsoqq+}-!AZBmaR2&2?<nmx4^DKa5gX6
zp6T=VRbmKxZmE&bCzg}hKUyire<(QdUkS-hjCKuGUGhi2-;gI3XZ92Hx3mjSX3k&O
z>onL?!Exl~9^hWajsEHbHWSaT314h7k;;y;T*Lx%I=<CuJBtOebV1btG~Gyg0l>|}
zH-9;IAmnuTu(l7NHxSRk0B{(=kG)yGTjco<D;SuQVJU{UG#+n$$i!I=?)vzSfERn;
zz^G5HNz#MuxSc;+;vm)u6jtk_Y;G0$lGKQ&Opo2qPgJrrSAF6Gw9R$@Z2#BQZ}c2h
zPjXAE<$gM2KH#4(kxyU3yyOjISsVfaa1vRrOHA4Yy=}nlcx>ho-$0(K6m0!RqB4P`
zN1lu`iIX^4k515Si{M5|0k_XwHJgRHqVLGOX1^#iCg*m40DUZpmY*l;;V;ki{M`nu
zi3Li%Ys?`k_wnPCkAxAa9=xAC`fWo~Ti=DQAG4r6%k}ZMGhclePbO@hfUq$f0~^Fr
z=XL#tjQmloH8$}<UXHDxra_c*_LG@HjEQQPhmEp{!(5~~>IYibqWO1=ptP@oJ77pr
zK{;d|Y10RM-RG@gH@05<4MsAKY@|_=*dsDihEH3?)PPGqxNJMG^@iP25x|whV`CPU
z7rQMR#yAhRR7!&gaE)HCV=KfskIIsoL>88c$_CR9T%*0Zq~0rcU{_Z@1SGwWVWq}C
zOS0>eb-{@^26`|4Wr6G*Lc&?lJ5K<W$s?)0qU^0f9$^1AoRAkaX;VOdf?ue+REL!?
zfAjBkDd+}_m<}df_;OlDAiNohP;xIG54`Y|yD@-2Bm|8{9pjYLUstWkx}`Z|<(q_Z
zq`b|uymC<;=K99ZBklV&2y=M_4A+#qdj#5450cg-tA?Tyr<^slbC;mfrd-e46aRus
zva&%GzoVd#@FQurDUD&yW&Esc8Ad5%OYPW&Rv6fSm&PfFoU?VjR5vuKwj+@vB+NV)
z!|N4)@4+MXg;O=gY-tRTm0rY4&A|@&#-Wpq?>dXYwH&Af*SOOw=)PBYdZt&`WQ921
zUD+rSX2A@}HV5!Nf9O?rDHvNFCV5+50ARDRU&m$kIcp7J_=VjcB~=@yRjtGV!EnF0
z|9y;oEGO<vQfJ8MRPbq$(bMH_p@YJ00V&<ta8cFO-+8c(zey*7NJE}ii)V)zb?AY)
z6&uO*RdF}}@q0CgK(3T1UhZ)EfvuiH_8Roko01c1F#k#=wvNC3vJ#ZBenthF84BzF
zB4iCQwE!$;kM@)Qpi$lPMEN<AZooEht}4M{@2;COP_u%2hlSCENlqh0V9Vy@!T3%V
zoIxAW;3qEi_e;qIi$kCWH6+O~&{;T+sO8r*Dh=3r>!aYw;m&KpU-!C;6z^GY+TpT)
z^YqjjJD1GDqY+HL`ZS<3F8GA{cFV2n?8cxuhdWoDWvxBox$STq%%t%N^Tq|D&Vh~H
zX)XuNq4?9z0a><jQHH83V*}q~XaQTR(&EkU1I(FF{=GZV_z;1(3V$gJueSO`G{{qf
zNkZhw6xs1u%qAalyTygzm@9zm*1B92%cqRotpvd8a0BA=+75bkKzumxR-1U@fHZg)
zgUHjM=;rIb-X_Nr=W)lAGVyh&3s#bZ^okSYvnp}-bNeEq>R9g0!_`H!RTAyV+AGx;
z*P-_RR6YmK9kHE}c$u8;TCE*$^zAUmZ_4Qi{t1BNGD9ac(s^zMpvXiBnCQF>@^s;<
zN17Y@I1a66{agZLX5xN&_#=e4Pic*Vd`f+I>9r9Fw9yfSD7PO3b?@MjEW8Czbcc;1
z*pzf7&^;-?w}1(CKz6n|fSPh&#TfUL-_ER%R$x>t`key25!BP5y<Gkp?HXyoo_`8j
z-*!ulMUiFjX=#a?!KNu<apM!ru>$5>iEUZ1szUXVrl+xsc2fdB3nVPkEddTt_Y78(
zhZ`dwnfMhh;8Y#zD-)v|$INCk`l^aYTa+h^^Ml>qg!n-Sjep<!ecgV6qN?@x{RW$f
z?iIM&L6e551vCv5{-8u(iG?`aooi-!YC~}uC(TG4mD#LPJFu(7oH25Nk|vVdrc?v<
z;;T&9y0v}TZbV|b_`?7TXVoQQN;czxXR}j++rCHT5Ph5Czz5?Pp`ASzVO^zrTN>tj
zvFn*v#n5pFJ<QKv4x(vZb6v)2-I#a3VumVwmjSEIFyFdlv=M<r`d=Gu8v`VJ#qQo$
z*ozjha8mf*VgN^|@~GZZX?f)+=HtjZzciVCC&Te-sTuq%eRX`oGQs%~^`_W;^*Vg5
z8wGj01tlB=;zi@oCZrgTsl-as#rYzh%xwGc9jcN|&LghzsY&GZOi5>@Z~v-rE_3z~
zEiYMMW8jzPKFcYqdaZ`tj%I;oi9fGOOVW4ES*6js`GSI`ye6>|d4J``BX9Q=fPMnP
zuj8y!{hV^VD2*2}cqx0Qlik}l{Jh&>1qDpt)XjJR8(gi`v2;{_ePt`k#*{si>zwK4
zO-SO}AV#~E5Dj6W5=0knHEn{UWmhCt^}4-`lux4L?JHNBL)vxQTbYITa0_4KMyLAH
z%I5smH)m^|@zifOYM$uC9u&!fvv}nsk}CPZjT2#cQ0+J#y~<GU%+<Z9myM7o0q_`H
z8nZRrZ1yL4)WHVL2kZGxDpYg~+I9YcQw%Z`>yJmS4}12Q)K9nbfwvQz_Cq(Ie5dco
zX%8=&hL_#a4S3QNJ~`;bg<zlIXtZ|2K&zb5bpn3n9@uneC^CJVq9>ZciTJeE<Q=Wd
z*x#kOvlf4xcnDUhoe!r~|IPjT>z7AMPiz`x4;evtg`D&pIJM{mGAT95Jurp+!k4iU
z4jC##>dOp{6qr1|hq!e3!AYZ-R5qm)ZE8)ZU$>zk|5Ow{@mgHP@=tkLW(O#}Nr&R_
z42YEexn+k#=9#@F`Nn<u_B!wLK<J;<k{gOFXA^luZ?}eY9^vJN?y{U#M2D^ChRPfz
zd0<4-PLLs2Ih1>{j_*0JI@4&)DV^isA(hTuQj|bk`M<Bv<YNLWa`Sp>Doa9~1GSW6
zd5UXgt3KW+YW|jTYcKpj6E-1S<@(7FVvXC+2-Uq*hNFE;U!vfua7p~>Hi$#B9CTu-
zM+-&DwC&i9F!GNE#v<1==t5{YThrJ{+&St5<!tb=f+#+cys&+H_ouiF`{Zsc{(Ot;
z<tmS|{gfSIp%jTg;%=j`I4Ahuk?<wr>NTD~-D=!EdV!7FS5lZ`vAATe2<}-rORZg^
zPJZ{X8%jF0a6Txe*j9TIfXkyi&aXU67_W|aWFV}A3eZ!>4x}`r^`SO5AlZX^q_O#a
zq{@3B8;iGZS3KaNxF!y-hnbrR&&j5ndV-Tu@cN5>17?AjfK-|9r6Qna5@+HMGO&=?
zDiYTI+V_PHEAboV?Mu$;RxU{YB=m=gEN2d3LsPMbmi~YS*IF&?EtU8Ik|c#*uX>3R
zr0ZwgKe@YP=ebKriud48FF~6t7FN@3nIPffL_tm9V&9B~A*QQRek*U&NTQ4qvgil-
zVx>I>@a59O4wU>%?B3KBKa|d1j9aqB157$C`1*mgORa?nX>a?pokezCvoK$3A08@k
zm}6@9-{}=1aPMu({?g5KIVrFR`=7aygXcDl@tG}5oQgyJ0S8j7tZAy(Pv7e^*C8%Z
z#8wgL$}F~VK}e2@y(OCL^#CE9$CA}LH#;P^{cyk67PCZPs;~LmWoI0ok(Xb-3x&Lm
zz-<3V))JskO7Mk!6e5n<dYH6EcV1EYMv=4?<`kpTmLCvISYC!={Xt}_)WntXI3OIn
zN3%I?i-gruU#n+cg6GT^`Bz-#vja)o<QLS!`taO4T>q10I;bH!OW5<!(Xt>Ex-1wL
z?w>h1aVEUDlL|xUi~UIIR)Q8Chd8Y*v1}CD2HGcGZVV%|&M9s_N6g@oj%;tS{B;RG
znPhB1i>|F<=TkF94I{6rNM+|;p}>&f&=WKr!6YMS$i0re5dSVHMj)rOQW_s%__pT7
z)agfDkp!j$K1>FW_RiKQy?u4e^s<8U25%{8<oU~q;RBxwVw&36tIJvSG(`KWSZzJ0
z4x?gJpC3k!b~qun<i5>Ylcc_xu$IOeZhIXtHd|nHh9#xqG=Ag*YfKUbnXQCw@A7+g
z3Zrm7_Hz?M&>_eR22wqn10YZN>6noQ(8&|2B%q-%d<8skmjH}@dr_{m4qbC&Go-Mz
z|FMpL3uZDB48WFBv+JG%SMhVtvm<68ND4C96y;r}8vN=@M;gaT&2u4)v4`@m6(lYF
z`yeD1Tg)=~CkPcNysJmKt-8W7k;d;x2x04z1t*LIm1gF5&|_yglXaFy3esXQ#P>wT
z@D#sP$=HS@XJxu<cli;K1m06z8@%}2`RUtm2pobqk<fK7Yx^e;FMwy2vq(w)jhq8(
zihrEJ!eqj<a7fRZJWggC$P0;Y6}?~YY6AHatFS)qz^&Ln@0sx>dwLno-Osxj7eM5A
zk{(l0F|mwpJxl$A-X0zSaJaDts@tiMi1y%3;C?wxBhReqEt-;^_LC#u7Z$)OGNRku
z$wgYZFRh->FT^5)f?BmSaU`Vj5WkE||6)LVs_>VJwu2&0L-Qr<^~se1rF7s<3qCq<
zYB&@z%(9Sw5yX(eKnNw)!C}42O0r}81q9rh%69id>#<Hc8KmmLruVRvkvrxp{S*n+
z#!~gjBfiWiAV!EF0$B(vIzl!zTsLU(tbYn2W<E;X{dCbCY%+c~+^vF;`oL!STrJ&w
z@BXjw2e!NCD1StI$^gXq&j>|`5F!Q<9f)}Q4M+4OzyPt3uw#MYFkO_RvdPQKN)iMa
zLp274;i~yqtixDxc6JR5(S1H^NYlC+&nV;=+HV+UJG~s><5_-?XGbbSp<Da;{Eaw1
zH5H;eI0c}3hgO*Jg@gPqbSS}MLK=m}`ed)?WfrO|S>|vB#{3!ciIE0k8Vi8?%R%Fj
zH3_YqR~Ulce8GY*$B(g@%Wb4_QH~+F@v=jXl3M@rZ2C#IAvhb~4<3A8F(U0~KcO8O
zjWzenG0Q_a6UysR-m3pgQ&9mM+Vg_7x@momc)`Ob(Cr_GE9_*OQ3k7ZpMWa=97C87
z01i<V{t3?^)zt{IIT8Vz3Xdf-BZiIK7+ic?DZkkSLg!`<Aw!uu<&_=&_o!=<%{^qI
zWzXu2?f6(5)JS8E4nTVE9EW8`KHo43Sp5;gwEO3{Q(<{{|Nmhwy?Ftq={+C0&lN#T
zGdT_zdqnzMTHRrY3*)bUvY?>a!vKISUun37K0KQ~Zw01EstZ#;a)F};IFl~xB40j{
zN;G6Ldj0H=^k$SoOySx$7}>!M9_JtXosDL3zGrz<267#%1p#n6JUN@zj+73Htf<&P
z(_-PmVBU+a{#ciL;qS}<=szX*z<;eiuW!g%J0tWX({!IQt$@(Rrn=~TlLo<kgf?R*
zy5u{+<x)H*_;Q}cwpSlVP4f?%B{3tW)<O5i7sPW{lgIPSMukToM(!a$!4j}&_Z=I@
zbf#q(Pv=Q}R9MlYpUDW<P#)Qk_n$$$K!rtKpT@+?J+9KOH!hQp4qu)8=K!nOe}3`S
zOk;ix%_EJt)3^Dx*T;=boNEimaW~$wP$Q;cnU#pf(R%r}*``T=z+h`%g!9W-CZy7T
z7dNeP)tnziPUgF8)WDCw*DG96;}w1@_wUVrkY~r7|1sDMj0a!F9`}H>y~Dt2#d+Xa
z!Ja9)jn`dcs$%UmHz>hg5^lBQ2X)vF$Gg=Q>2}KCCRckK0PE5k40p6G%9vxs`;*oa
zt5n%vfC!_Yi{xAJn(u0)#TrB7XwsEhjonf8Pa96M<S22?B8<GLagwoTQEg?fCONtm
z&G3D$xmF1VJ;g6sTTGNa=Hu6=gRh-=PV5J7l_=hW3tk1vJ%w5WSgip#$mlo-APmfl
zMvSlpNa#4dHUAG2Nf)QSn!h&bgkZm+SMXRPQ#ij@Ks1`I{KaVe;R>9!NrTW}{Ve-l
zH4KIL|5ia@h!h!*IZ;4N#5C3F*TQ%^zzeuO(1ewje!?_W!-M#5vLDynAYZ0K7CRUl
zU9rR@J|#{xuHWk<AcQrc(34(|$-b~BM$lE~>#n?PPMTm{VcMiT-}s`z|Ha4lwKqcJ
zbPVY9^|(7(+rrf3afzTOy^ISUD5-*S5|byT^HdFA@jUBw)qKst_`5Vki~9^d+G0<s
nA#BjLmItB9{<ooR<MU+2tkB@-V<Y}`j-;ZXDgPN_9sYj+sI&rl

diff --git a/doc/user/ai_features.md b/doc/user/ai_features.md
index 5ecda325d2b..cda90bfa6a8 100644
--- a/doc/user/ai_features.md
+++ b/doc/user/ai_features.md
@@ -63,10 +63,10 @@ To enable Beta and Experimental AI-powered features, use the [Experiment and Bet
 
 To enable Beta and Experimental AI-powered features for GitLab versions where GitLab Duo Chat is not yet generally available, see the [GitLab Duo Chat documentation](gitlab_duo_chat.md#for-self-managed).
 
-### Enable outbound connections to enable GitLab Duo features on Self-managed instances
+### Enable outbound connections to enable GitLab Duo features on self-managed instances
 
 - Your firewalls and HTTP/S proxy servers must allow outbound connections
-  to `cloud.gitlab.com` on port `443`.
+  to `cloud.gitlab.com` and `customers.gitlab.com` on port `443` both with `https://` and `wws://`.
 - Both `HTTP2` and the `'upgrade'` header must be allowed, because GitLab Duo
   uses both REST and WebSockets.
 - To use an HTTP/S proxy, both `gitLab_workhorse` and `gitLab_rails` must have the necessary
diff --git a/doc/user/custom_roles.md b/doc/user/custom_roles.md
index 928b6d6f120..20829a67e08 100644
--- a/doc/user/custom_roles.md
+++ b/doc/user/custom_roles.md
@@ -234,6 +234,23 @@ curl --request PUT --header "Content-Type: application/json" --header "Authoriza
 curl --request PUT --header "Content-Type: application/json" --header "Authorization: Bearer <your_access_token>" --data '{"member_role_id": null, "access_level": 10}' "https://gitlab.example.com/api/v4/groups/<group_id>/members/<user_id>"
 ```
 
+## Inheritance
+
+If a user belongs to a group, they are a _direct member_ of the group
+and an [inherited member](project/members/index.md#inherited-membership)
+of any subgroups or projects. If a user is assigned a custom role
+by the top-level group, the permissions of the role are also inherited by subgroups
+and projects.
+
+For example, assume the following structure exists:
+
+- Group A
+  - Subgroup B
+    - Project 1
+
+If a custom role with Developer + `Manage CI/CD variables` permission is assigned to Group A,
+the user also has `Manage CI/CD variables` permission for Subgroup B and Project 1.
+
 ## Billing and seat usage
 
 When you enable a custom role for a user with the Guest role, that user has
@@ -246,9 +263,28 @@ This does not apply when the user's custom role only has the `read_code` permiss
 enabled. Guest users with that specific permission only are not considered billable users
 and do not use a seat.
 
+## Supported objects
+
+You can assign custom roles and permissions to the following:
+
+| Object       | Version       | Issue                                                  |
+| ----         | ----          | ----                                                   |
+| Users        | 15.9          | Released                                               |
+| Groups       | Not supported | [Issue 443369](https://gitlab.com/gitlab-org/gitlab/-/issues/443369) |
+| Tokens       | Not supported | [Issue 434354](https://gitlab.com/gitlab-org/gitlab/-/issues/434354) |
+
+## Supported group links
+
+You can sync users to custom roles with following authentication providers:
+
+- See [Configure SAML Group Links](group/saml_sso/group_sync.md#configure-saml-group-links).
+- LDAP Group Links are not supported, but [issue 435229](https://gitlab.com/gitlab-org/gitlab/-/issues/435229)
+  proposes to change this.
+
 ## Known issues
 
 - If a user with a custom role is shared with a group or project, their custom
   role is not transferred over with them. The user has the regular Guest role in
   the new group or project.
 - You cannot use an [Auditor user](../administration/auditor_users.md) as a template for a custom role.
+- There can be only 10 custom roles on your instance or namespace. See [issue 450929](https://gitlab.com/gitlab-org/gitlab/-/issues/450929) for more details.
diff --git a/doc/user/group/saml_sso/group_sync.md b/doc/user/group/saml_sso/group_sync.md
index 411871bf35e..fc5595dccaa 100644
--- a/doc/user/group/saml_sso/group_sync.md
+++ b/doc/user/group/saml_sso/group_sync.md
@@ -49,7 +49,7 @@ item in group **Settings > SAML Group Links**.
 To link the SAML groups:
 
 1. In **SAML Group Name**, enter the value of the relevant `saml:AttributeValue`. The value entered here must exactly match the value sent in the SAML response. For some IdPs, this may be a group ID or object ID (Azure AD) instead of a friendly group name.
-1. Choose the role in **Access Level**.
+1. Choose a [default role](../../permissions.md) or [custom role](../../custom_roles.md) in **Access Level**. 
 1. Select **Save**.
 1. Repeat to add additional group links if required.
 
diff --git a/doc/user/group/saml_sso/index.md b/doc/user/group/saml_sso/index.md
index 4b812e25c52..c3e45b0aa72 100644
--- a/doc/user/group/saml_sso/index.md
+++ b/doc/user/group/saml_sso/index.md
@@ -10,8 +10,6 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** GitLab.com
 
-> - Introduced in GitLab 11.0.
-
 Users can sign in to GitLab through their SAML identity provider.
 
 [SCIM](scim_setup.md) synchronizes users with the group on GitLab.com.
@@ -258,9 +256,8 @@ After you set up your identity provider to work with GitLab, you must configure
    select the role to assign to new users.
    The default role is **Guest**. That role becomes the starting role of all users
    added to the group:
-   - In [GitLab 13.3](https://gitlab.com/gitlab-org/gitlab/-/issues/214523) and
-     later, group Owners can set a default membership role other than **Guest**.
    - In GitLab 16.7 and later, group Owners can set a [custom role](../../custom_roles.md)
+   - In GitLab 16.6 and earlier, group Owners can set a default membership role other than **Guest**.
      as the default membership role.
 1. Select the **Enable SAML authentication for this group** checkbox.
 1. Optional. Select:
@@ -276,8 +273,6 @@ If you are having issues configuring GitLab, see the [troubleshooting documentat
 
 ## User access and management
 
-> - SAML user provisioning [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/268142) in GitLab 13.7.
-
 After group SSO is configured and enabled, users can access the GitLab.com group through the identity provider's dashboard.
 If [SCIM](scim_setup.md) is configured, see [user access](scim_setup.md#user-access) on the SCIM page.
 
@@ -366,7 +361,6 @@ providers, see [set up your identity provider](#set-up-your-identity-provider).
 
 ### Configure enterprise user settings from SAML response
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/263661) in GitLab 13.7.
 > - [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/412898) to configure only enterprise user settings in GitLab 16.7.
 
 GitLab allows setting certain user attributes based on values from the SAML response.
@@ -459,12 +453,6 @@ For example, to unlink the `MyOrg` account:
 
 ## SSO enforcement
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/5291) in GitLab 11.8.
-> - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/9255) in GitLab 11.11 with ongoing enforcement in the GitLab UI.
-> - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/292811) in GitLab 13.8, with an updated timeout experience.
-> - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/211962) in GitLab 13.8 with allowing group owners to not go through SSO.
-> - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/9152) in GitLab 13.11 with enforcing open SSO session to use Git if this setting is switched on.
-> - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/339888) in GitLab 14.7 to not enforce SSO checks for Git activity originating from CI/CD jobs.
 > - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/215155) in GitLab 15.5 [with a flag](../../../administration/feature_flags.md) named `transparent_sso_enforcement` to include transparent enforcement even when SSO enforcement is not enabled. Disabled on GitLab.com.
 > - [Improved](https://gitlab.com/gitlab-org/gitlab/-/issues/375788) in GitLab 15.8 by enabling transparent SSO by default on GitLab.com.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/389562) in GitLab 15.10. Feature flag `transparent_sso_enforcement` removed.
diff --git a/doc/user/group/settings/group_access_tokens.md b/doc/user/group/settings/group_access_tokens.md
index c5ba5a9c251..d5a0c0c638c 100644
--- a/doc/user/group/settings/group_access_tokens.md
+++ b/doc/user/group/settings/group_access_tokens.md
@@ -17,7 +17,7 @@ With group access tokens, you can use a single token to:
 You can use a group access token to authenticate:
 
 - With the [GitLab API](../../../api/rest/index.md#personalprojectgroup-access-tokens).
-- In [GitLab 14.2](https://gitlab.com/gitlab-org/gitlab/-/issues/330718) and later, authenticate with Git over HTTPS.
+- Authenticate with Git over HTTPS.
   Use:
 
   - Any non-blank value as a username.
@@ -46,7 +46,6 @@ configured for personal access tokens.
 
 ## Create a group access token using UI
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214045) in GitLab 14.7.
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/348660) in GitLab 15.3, default expiration of 30 days and default role of Guest is populated in the UI.
 > - Ability to create non-expiring group access tokens [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/392855) in GitLab 16.0.
 
@@ -74,8 +73,7 @@ A group access token is displayed. Save the group access token somewhere safe. A
 
 ## Create a group access token using Rails console
 
-GitLab 14.6 and earlier doesn't support creating group access tokens using the UI
-or API. However, administrators can use a workaround:
+If you are an administrator, you can create group access tokens in the Rails console:
 
 1. Run the following commands in a [Rails console](../../../administration/operations/rails_console.md):
 
@@ -116,8 +114,6 @@ or API. However, administrators can use a workaround:
 
 ## Revoke a group access token using the UI
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214045) in GitLab 14.7.
-
 To revoke a group access token:
 
 1. On the left sidebar, select **Search or go to** and find your group.
@@ -126,10 +122,8 @@ To revoke a group access token:
 
 ## Revoke a group access token using Rails console
 
-GitLab 14.6 and earlier doesn't support revoking group access tokens using the UI
-or API. However, administrators can use a workaround.
-
-To revoke a group access token, run the following command in a [Rails console](../../../administration/operations/rails_console.md):
+If you are a GitLab administrator, you can revoke a group access token.
+Run this command in a [Rails console](../../../administration/operations/rails_console.md):
 
 ```ruby
 bot = User.find_by(username: 'group_109_bot') # the owner of the token you want to revoke
diff --git a/doc/user/packages/container_registry/index.md b/doc/user/packages/container_registry/index.md
index d65d7e7b564..603b9aed37a 100644
--- a/doc/user/packages/container_registry/index.md
+++ b/doc/user/packages/container_registry/index.md
@@ -10,7 +10,9 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-You can use the integrated container registry to store container images for each GitLab project
+> - Searching by image repository name was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/31322) in GitLab 13.0.
+
+You can use the integrated container registry to store container images for each GitLab project.
 
 To enable the container registry for your GitLab instance, see the [administrator documentation](../../../administration/packages/container_registry.md).
 
@@ -169,3 +171,39 @@ and [Open Container Initiative (OCI)](https://github.com/opencontainers/image-sp
 image formats. Additionally, the container registry [conforms to the OCI distribution specification](https://conformance.opencontainers.org/#gitlab-container-registry).
 
 OCI support means that you can host OCI-based image formats in the registry, such as [Helm 3+ chart packages](https://helm.sh/docs/topics/registries/). There is no distinction between image formats in the GitLab [API](../../../api/container_registry.md) and the UI. [Issue 38047](https://gitlab.com/gitlab-org/gitlab/-/issues/38047) addresses this distinction, starting with Helm.
+
+## Container image signatures
+
+> - Container image signature display [introduced](https://gitlab.com/groups/gitlab-org/-/epics/7856) in GitLab 17.0.
+
+In the GitLab container registry, you can use the [OCI 1.1 manifest `subject` field](https://github.com/opencontainers/image-spec/blob/v1.1.0/manifest.md)
+to associate container images with [Cosign signatures](../../../ci/yaml/signing_examples.md).
+You can then view signature information alongside its associated container image without having to
+search for that signature's tag.
+
+When [viewing a container image's tags](#view-the-tags-of-a-specific-container-image-in-the-container-registry), you see an icon displayed
+next to each tag that has an associated signature. To see the details of the signature, select the icon.
+
+Prerequisites:
+
+- To sign container images, Cosign v2.0 or later.
+- For self-managed GitLab instances, you need a
+  [GitLab container registry configured with a metadata database](../../../administration/packages/container_registry_metadata_database.md)
+  to display signatures.
+
+### Sign container images with OCI referrer data
+
+To add referrer data to signatures using Cosign, you must:
+
+- Set the `COSIGN_EXPERIMENTAL` environment variable to `1`.
+- Add `--registry-referrers-mode oci-1-1` to the signature command.
+
+For example:
+
+```shell
+COSIGN_EXPERIMENTAL=1 cosign sign --registry-referrers-mode oci-1-1 <container image>
+```
+
+NOTE:
+While the GitLab container registry supports the OCI 1.1 manifest `subject` field, it does not fully
+implement the [OCI 1.1 Referrers API](https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#listing-referrers).
diff --git a/doc/user/packages/go_proxy/index.md b/doc/user/packages/go_proxy/index.md
index a162eebe30c..2268c971d7f 100644
--- a/doc/user/packages/go_proxy/index.md
+++ b/doc/user/packages/go_proxy/index.md
@@ -11,14 +11,13 @@ DETAILS:
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 **Status:** Experiment
 
-> - It's deployed behind a feature flag, disabled by default.
-> - It's disabled for GitLab.com.
-> - To use it in GitLab self-managed instances, ask a GitLab administrator to [enable it](#enable-the-go-proxy).
+> - Introduced [with a flag](../../../administration/feature_flags.md) named `go_proxy`. Disabled by default.
 
-WARNING:
-The Go package registry for GitLab is under development and isn't ready for production use due to
-limited functionality. This [epic](https://gitlab.com/groups/gitlab-org/-/epics/3043) details the remaining
-work and timelines to make it production ready.
+FLAG:
+The availability of this feature is controlled by a feature flag.
+For more information, see the history.
+This feature is available for testing, but not ready for production use.
+See [epic 3043](https://gitlab.com/groups/gitlab-org/-/epics/3043).
 
 With the Go proxy for GitLab, every project in GitLab can be fetched with the
 [Go proxy protocol](https://proxy.golang.org/).
diff --git a/doc/user/permissions.md b/doc/user/permissions.md
index ae040de747d..f8dc5fb377a 100644
--- a/doc/user/permissions.md
+++ b/doc/user/permissions.md
@@ -40,19 +40,16 @@ for the GitLab instance.
 
 ## Project members permissions
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/219299) in GitLab 14.8, personal namespace owners appear with Owner role in new projects in their namespace. Introduced [with a flag](../administration/feature_flags.md) named `personal_project_owner_with_owner_access`. Disabled by default.
-> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/351919) in GitLab 14.9. Feature flag `personal_project_owner_with_owner_access` [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/219299).
-
 A user's role determines what permissions they have on a project. The Owner role provides all permissions but is
 available only:
 
-- For group and project Owners. In GitLab 14.8 and earlier, the role is inherited for a group's projects.
+- For group and project Owners.
 - For Administrators.
 
 Personal [namespace](namespace/index.md) owners:
 
 - Are displayed as having the Maintainer role on projects in the namespace, but have the same permissions as a user with the Owner role.
-- In GitLab 14.9 and later, for new projects in the namespace, are displayed as having the Owner role.
+- For new projects in the namespace, are displayed as having the Owner role.
 
 For more information about how to manage project members, see
 [members of a project](project/members/index.md).
@@ -382,7 +379,6 @@ DETAILS:
 **Tier:** Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40942) in GitLab 13.4.
 > - Support for inviting users with Minimal Access role [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/106438) in GitLab 15.9.
 
 Users with the Minimal Access role do not:
diff --git a/doc/user/profile/account/two_factor_authentication.md b/doc/user/profile/account/two_factor_authentication.md
index 4cc6480e254..7f3be2aa159 100644
--- a/doc/user/profile/account/two_factor_authentication.md
+++ b/doc/user/profile/account/two_factor_authentication.md
@@ -52,15 +52,12 @@ git-credential-oauth is an open-source project supported by the community.
 
 ## Enable two-factor authentication
 
-> - Account email confirmation requirement [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/35102) in GitLab 14.3. [Deployed behind the `ensure_verified_primary_email_for_2fa` flag](../../../administration/feature_flags.md), enabled by default.
-> - Account email confirmation requirement generally available and [feature flag `ensure_verified_primary_email_for_2fa` removed](https://gitlab.com/gitlab-org/gitlab/-/issues/340151) in GitLab 14.4.
-
 You can enable 2FA using a:
 
 - One-time password authenticator. After you enable 2FA, back up your [recovery codes](#recovery-codes).
 - WebAuthn device.
 
-In GitLab 14.3 and later, your account email must be confirmed to enable 2FA.
+Your account email must be confirmed to enable 2FA.
 
 ### Enable one-time password
 
@@ -98,12 +95,9 @@ in a safe place.
 
 ### Enable one-time password using FortiAuthenticator
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/212312) in GitLab 13.5 [with a flag](../../../administration/feature_flags.md) named `forti_authenticator`. Disabled by default.
-
-FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per user, an administrator can
-[enable the feature flag](../../../administration/feature_flags.md) named `forti_authenticator`. On GitLab.com and GitLab Dedicated, this
-feature is not available.
+[enable the feature flag](../../../administration/feature_flags.md) named `forti_authenticator`. 
+On GitLab.com and GitLab Dedicated, this feature is not available.
 
 You can use FortiAuthenticator as a one-time password (OTP) provider in GitLab. Users must:
 
@@ -113,7 +107,7 @@ You can use FortiAuthenticator as a one-time password (OTP) provider in GitLab.
 You need a username and access token for FortiAuthenticator. The `access_token` shown below is the FortAuthenticator
 access key. To get the token, see the REST API Solution Guide at
 [Fortinet Document Library](https://docs.fortinet.com/document/fortiauthenticator/6.2.0/rest-api-solution-guide/158294/the-fortiauthenticator-api).
-GitLab 13.5 has been tested with FortAuthenticator version 6.2.0.
+Tested with FortAuthenticator version 6.2.0.
 
 Configure FortiAuthenticator in GitLab. On your GitLab server:
 
@@ -235,12 +229,11 @@ On your GitLab server:
 DETAILS:
 **Offering:** Self-managed
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/212313) in GitLab 13.7 [with a flag](../../../administration/feature_flags.md) named `forti_token_cloud`. Disabled by default.
-
 FLAG:
 On self-managed GitLab, by default this feature is not available. To make it available per user, an administrator can
-[enable the feature flag](../../../administration/feature_flags.md) named `forti_token_cloud`. On GitLab.com and GitLab Dedicated, this
-feature is not available. This feature is not ready for production use.
+[enable the feature flag](../../../administration/feature_flags.md) named `forti_token_cloud`.
+On GitLab.com and GitLab Dedicated, this feature is not available.
+This feature is not ready for production use.
 
 You can use FortiToken Cloud as a one-time password (OTP) provider in GitLab. Users must:
 
@@ -292,16 +285,8 @@ Configure FortiToken Cloud in GitLab. On your GitLab server:
 
 ### Set up a WebAuthn device
 
-> - WebAuthn devices [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/22506) in GitLab 13.4 [with a flag](../../../administration/feature_flags.md) named `webauthn`. Disabled by default.
-> - WebAuthn devices [enabled on GitLab.com and self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/232671) in GitLab 14.6.
 > - Optional one-time password authentication for WebAuthn devices [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/378844) in GitLab 15.10 [with a flag](../../../administration/feature_flags.md) named `webauthn_without_topt`. [Enabled on GitLab.com and self-managed by default](https://gitlab.com/gitlab-org/gitlab/-/issues/232671).
 
-FLAG:
-On self-managed GitLab, by default, WebAuthn devices are available. To disable the feature, an administrator can
-[disable the feature flag](../../../administration/feature_flags.md) named `webauthn`. If you disable the WebAuthn
-feature flag after WebAuthn devices have been registered, these devices are not usable until you re-enable this feature.
-On GitLab.com, WebAuthn devices are available.
-
 FLAG:
 On self-managed GitLab, by default, optional one-time password authentication for WebAuthn devices is not available. To enable the feature, an administrator can [enable the feature flag](../../../administration/feature_flags.md) named `webauthn_without_totp`.
 On GitLab.com, this feature is available. On GitLab Dedicated, this feature is not available.
@@ -348,8 +333,6 @@ You can lose access to your account if you clear your browser data.
 
 ## Recovery codes
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/267730) in GitLab 13.7, **Copy codes** and **Print codes** buttons.
-
 Immediately after successfully enabling 2FA with a one-time password, you're prompted to download
 a set of generated recovery codes. If you ever lose access to your one-time password authenticator, you can use one of
 these recovery codes to sign in to your account.
diff --git a/doc/user/profile/index.md b/doc/user/profile/index.md
index 8fd2d5404e4..2c5e9ee0e07 100644
--- a/doc/user/profile/index.md
+++ b/doc/user/profile/index.md
@@ -129,8 +129,6 @@ user profiles are only visible to authenticated users.
 
 ## Add details to your profile with a README
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/232157) in GitLab 14.5.
-
 You can add more information to your profile page with a README file. When you populate
 the README file with information, it's included on your profile page.
 
@@ -194,8 +192,6 @@ To show private contributions:
 
 ## Add your gender pronouns
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/332405) in GitLab 14.0.
-
 You can add your gender pronouns to your GitLab account to be displayed next to
 your name in your profile.
 
@@ -208,8 +204,6 @@ To specify your pronouns:
 
 ## Add your name pronunciation
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/25742) in GitLab 14.2.
-
 You can add your name pronunciation to your GitLab account. This is displayed in your profile, below
 your name.
 
@@ -222,8 +216,6 @@ To add your name pronunciation:
 
 ## Set your current status
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/56649) in GitLab 13.10, users can schedule the clearing of their status.
-
 You can provide a custom status message for your user profile along with an emoji that describes it.
 This may be helpful when you are out of office or otherwise not available.
 
@@ -244,11 +236,6 @@ If you select the **Busy** checkbox, remember to clear it when you become availa
 
 ## Set a busy status indicator
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/259649) in GitLab 13.6.
-> - It was [deployed behind a feature flag](../feature_flags.md), disabled by default.
-> - [Became enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/281073) in GitLab 13.8.
-> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/329163) in GitLab 13.12.
-
 To indicate to others that you are busy, you can set an indicator.
 
 To set the busy status indicator, either:
@@ -271,7 +258,6 @@ You can set your local time zone to:
 
 - Display your local time on your profile, and in places where hovering over your name shows information about you.
 - Align your contribution calendar with your local time to better reflect when your contributions were made
-  ([introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/335343) in GitLab 14.5).
 
 To set your time zone:
 
@@ -458,8 +444,6 @@ that require sessions to expire periodically for security or compliance purposes
 
 ### Cookies used for sign-in
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/20340) in GitLab 13.1.
-
 When you sign in, three cookies are set:
 
 - A session cookie called `_gitlab_session`.
diff --git a/doc/user/profile/personal_access_tokens.md b/doc/user/profile/personal_access_tokens.md
index 62620a95c73..7969b1cf318 100644
--- a/doc/user/profile/personal_access_tokens.md
+++ b/doc/user/profile/personal_access_tokens.md
@@ -10,11 +10,6 @@ DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 
-> - Notifications for expiring tokens [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/3649) in GitLab 12.6.
-> - Token lifetime limits [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/3649) in GitLab 12.6.
-> - Additional notifications for expiring tokens [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214721) in GitLab 13.3.
-> - Prefill for token name and scopes [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/334664) in GitLab 14.1.
-
 Personal access tokens can be an alternative to [OAuth2](../../api/oauth2.md) and used to:
 
 - Authenticate with the [GitLab API](../../api/rest/index.md#personalprojectgroup-access-tokens).
@@ -129,7 +124,7 @@ To disable the enterprise users' personal access tokens:
 
 ## View the last time a token was used
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/33162) in GitLab 13.2. Token usage information is updated every 24 hours.
+> - In GitLab 16.0 and earlier, token usage information is updated every 24 hours.
 > - The frequency of token usage information updates [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/410168) in GitLab 16.1 from 24 hours to 10 minutes.
 
 Token usage information is updated every 10 minutes. GitLab considers a token used when the token is used to:
@@ -157,11 +152,11 @@ A personal access token can perform actions based on the assigned scopes.
 |--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `api`              | Grants complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry. Also grants complete read/write access to the registry and repository using Git over HTTP.                                                                                                                                                           |
 | `read_user`        | Grants read-only access to the authenticated user's profile through the `/user` API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under [`/users`](../../api/users.md).                                                                            |
-| `read_api`         | Grants read access to the API, including all groups and projects, the container registry, and the package registry. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/28944) in GitLab 12.10.)                                                                                                   |
+| `read_api`         | Grants read access to the API, including all groups and projects, the container registry, and the package registry.                    |
 | `read_repository`  | Grants read-only access to repositories on private projects using Git-over-HTTP or the Repository Files API.                                                                                                                                                                                                       |
 | `write_repository` | Grants read-write access to repositories on private projects using Git-over-HTTP (not using the API).                                                                                                                                                                                                              |
 | `read_registry`    | Grants read-only (pull) access to [container registry](../packages/container_registry/index.md) images if a project is private and authorization is required. Available only when the container registry is enabled.                                                                                               |
-| `write_registry`   | Grants read-write (push) access to [container registry](../packages/container_registry/index.md) images if a project is private and authorization is required. Available only when the container registry is enabled. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/28958) in GitLab 12.10.) |
+| `write_registry`   | Grants read-write (push) access to [container registry](../packages/container_registry/index.md) images if a project is private and authorization is required. Available only when the container registry is enabled.  |
 | `sudo`             | Grants permission to perform API actions as any user in the system, when authenticated as an administrator.                                                                                                                                                                                                        |
 | `admin_mode`       | Grants permission to perform API actions as an administrator, when Admin Mode is enabled. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/107875) in GitLab 15.8.)                                                                                                                             |
 | `create_runner`    | Grants permission to create runners.                                                                                                                                                                                                                                                                               |
diff --git a/doc/user/project/settings/project_access_tokens.md b/doc/user/project/settings/project_access_tokens.md
index 04532f99ef7..bf0f6e41d4f 100644
--- a/doc/user/project/settings/project_access_tokens.md
+++ b/doc/user/project/settings/project_access_tokens.md
@@ -6,10 +6,6 @@ info: "To determine the technical writer assigned to the Stage/Group associated
 
 # Project access tokens
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/210181) in GitLab 13.0.
-> - [Became available on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/235765) in GitLab 13.5 for paid groups only.
-> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/235765) in GitLab 13.5.
-> - [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/342327) in GitLab 14.5. Default prefix added.
 > - [Became available in trial subscriptions](https://gitlab.com/gitlab-org/gitlab/-/issues/386041) in GitLab 16.1. Default prefix added.
 
 Project access tokens are similar to passwords, except you can [limit access to resources](#scopes-for-a-project-access-token),
@@ -101,8 +97,6 @@ See the warning in [create a project access token](#create-a-project-access-toke
 
 ## Enable or disable project access token creation
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/287707) in GitLab 13.11.
-
 To enable or disable project access token creation for all projects in a top-level group:
 
 1. On the left sidebar, select **Search or go to** and find your group.
@@ -114,9 +108,6 @@ Even when creation is disabled, you can still use and revoke existing project ac
 
 ## Bot users for projects
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/210181) in GitLab 13.0.
-> - [Excluded from license seat use](https://gitlab.com/gitlab-org/gitlab/-/issues/223695) in GitLab 13.5.
-
 Bot users for projects are [GitLab-created service accounts](../../../subscriptions/self_managed/index.md#billable-users).
 Each time you create a project access token, a bot user is created and added to the project.
 This user is not a billable user, so it does not count toward the license limit.
diff --git a/doc/user/ssh.md b/doc/user/ssh.md
index 53c5b3b1e46..5f132ba302b 100644
--- a/doc/user/ssh.md
+++ b/doc/user/ssh.md
@@ -46,10 +46,9 @@ To view the version of SSH installed on your system, run `ssh -V`.
 To communicate with GitLab, you can use the following SSH key types:
 
 - [ED25519](#ed25519-ssh-keys)
-- [ED25519_SK](#ed25519_sk-ssh-keys) (Available in GitLab 14.8 and later.)
-- [ECDSA_SK](#ecdsa_sk-ssh-keys) (Available in GitLab 14.8 and later.)
+- [ED25519_SK](#ed25519_sk-ssh-keys)
+- [ECDSA_SK](#ecdsa_sk-ssh-keys)
 - [RSA](#rsa-ssh-keys)
-- DSA ([Deprecated](https://about.gitlab.com/releases/2018/06/22/gitlab-11-0-released/#support-for-dsa-ssh-keys) in GitLab 11.0.)
 - ECDSA (As noted in [Practical Cryptography With Go](https://leanpub.com/gocrypto/read#leanpub-auto-ecdsa), the security issues related to DSA also apply to ECDSA.)
 
 Administrators can [restrict which keys are permitted and their minimum lengths](../security/ssh_keys_restrictions.md).
@@ -64,15 +63,11 @@ operating systems.
 
 ### ED25519_SK SSH keys
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78934) in GitLab 14.8.
-
 To use ED25519_SK SSH keys on GitLab, your local client and GitLab server
 must have [OpenSSH 8.2](https://www.openssh.com/releasenotes.html#8.2) or later installed.
 
 ### ECDSA_SK SSH keys
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78934) in GitLab 14.8.
-
 To use ECDSA_SK SSH keys on GitLab, your local client and GitLab server
 must have [OpenSSH 8.2](https://www.openssh.com/releasenotes.html#8.2) or later installed.
 
@@ -344,12 +339,10 @@ To use SSH with GitLab, copy your public key to your GitLab account:
    `Home Workstation`.
 1. Optional. Select the **Usage type** of the key. It can be used either for `Authentication` or `Signing` or both. `Authentication & Signing` is the default value.
 1. Optional. Update **Expiration date** to modify the default expiration date.
-   In:
-   - GitLab 13.12 and earlier, the expiration date is informational only. It doesn't prevent
-     you from using the key. Administrators can view expiration dates and use them for
+   - Administrators can view expiration dates and use them for
      guidance when [deleting keys](../administration/credentials_inventory.md#delete-a-users-ssh-key).
-   - GitLab checks all SSH keys at 02:00 AM UTC every day. It emails an expiration notice for all SSH keys that expire on the current date. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/322637) in GitLab 13.11.)
-   - GitLab checks all SSH keys at 01:00 AM UTC every day. It emails an expiration notice for all SSH keys that are scheduled to expire seven days from now. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/322637) in GitLab 13.11.)
+   - GitLab checks all SSH keys at 01:00 AM UTC every day. It emails an expiration notice for all SSH keys that are scheduled to expire seven days from now.
+   - GitLab checks all SSH keys at 02:00 AM UTC every day. It emails an expiration notice for all SSH keys that expire on the current date.
 1. Select **Add key**.
 
 ## Verify that you can connect
diff --git a/keeps/helpers/groups.rb b/keeps/helpers/groups.rb
index 68faf0a37a2..3350b69cbb3 100644
--- a/keeps/helpers/groups.rb
+++ b/keeps/helpers/groups.rb
@@ -7,6 +7,8 @@ module Keeps
       Error = Class.new(StandardError)
 
       def group_for_feature_category(category)
+        return unless category
+
         groups.find do |_, group|
           group['categories'].present? && group['categories'].include?(category)
         end&.last
@@ -19,13 +21,32 @@ module Keeps
       end
 
       def pick_reviewer(group, identifiers)
+        return unless group
         return if group['backend_engineers'].empty?
 
+        # Use the change identifiers as a stable way to pick the same reviewer. Otherwise we'd assign a new reviewer
+        # every time we re-ran housekeeper.
         random_engineer = Digest::SHA256.hexdigest(identifiers.join).to_i(16) % group['backend_engineers'].size
 
         group['backend_engineers'][random_engineer]
       end
 
+      def pick_reviewer_for_feature_category(category, identifiers, fallback_feature_category: nil)
+        pick_reviewer(
+          group_for_feature_category(category),
+          identifiers
+        ) || pick_reviewer(
+          group_for_feature_category(fallback_feature_category),
+          identifiers
+        )
+      end
+
+      def labels_for_feature_category(category)
+        Array(
+          group_for_feature_category(category)&.dig('label')
+        )
+      end
+
       private
 
       def groups
diff --git a/keeps/overdue_finalize_background_migration.rb b/keeps/overdue_finalize_background_migration.rb
index 19d4735e489..c3870a3d279 100644
--- a/keeps/overdue_finalize_background_migration.rb
+++ b/keeps/overdue_finalize_background_migration.rb
@@ -3,6 +3,7 @@
 require_relative '../config/environment'
 require_relative '../lib/generators/post_deployment_migration/post_deployment_migration_generator'
 require_relative './helpers/postgres_ai'
+require_relative 'helpers/groups'
 require 'rubocop'
 
 module Keeps
@@ -30,48 +31,18 @@ module Keeps
         next unless before_cuttoff_milestone?(migration['milestone'])
 
         job_name = migration['migration_job_name']
-
         next if migration_finalized?(job_name)
 
         migration_record = fetch_migration_status(job_name)
-
         next unless migration_record
 
-        # Finalize the migration
-        change = ::Gitlab::Housekeeper::Change.new
-        change.title = "Finalize migration #{job_name}"
-
-        change.identifiers = [self.class.name.demodulize, job_name]
-
         last_migration_file = last_migration_for_job(job_name)
         next unless last_migration_file
 
-        # rubocop:disable Gitlab/DocUrl -- Not running inside rails application
-        change.description = <<~MARKDOWN
-        This migration was finished at `#{migration_record.finished_at || migration_record.updated_at}`, you can confirm
-        the status using our
-        [batched background migration chatops commands](https://docs.gitlab.com/ee/development/database/batched_background_migrations.html#monitor-the-progress-and-status-of-a-batched-background-migration).
-          To confirm it is finished you can run:
-
-          ```
-        /chatops run batched_background_migrations status #{migration_record.id}
-        ```
-
-        The last time this background migration was triggered was in [#{last_migration_file}](https://gitlab.com/gitlab-org/gitlab/-/blob/master/#{last_migration_file})
-
-          You can read more about the process for finalizing batched background migrations in
-        https://docs.gitlab.com/ee/development/database/batched_background_migrations.html .
-
-          As part of our process we want to ensure all batched background migrations have had at least one
-        [required stop](https://docs.gitlab.com/ee/development/database/required_stops.html)
-        to process the migration. Therefore we can finalize any batched background migration that was added before the
-        last required stop.
-        MARKDOWN
-        # rubocop:enable Gitlab/DocUrl
+        change = initialize_change(migration, migration_record, job_name, last_migration_file)
 
         queue_method_node = find_queue_method_node(last_migration_file)
 
-        # TODO: Can runner figure out what changed during this block?
         migration_name = truncate_migration_name("Finalize#{migration['migration_job_name']}")
         PostDeploymentMigration::PostDeploymentMigrationGenerator
           .source_root('generator_templates/post_deployment_migration/post_deployment_migration/')
@@ -95,6 +66,47 @@ module Keeps
       end
     end
 
+    def initialize_change(migration, migration_record, job_name, last_migration_file)
+      # Finalize the migration
+      change = ::Gitlab::Housekeeper::Change.new
+      change.title = "Finalize migration #{job_name}"
+
+      change.identifiers = [self.class.name.demodulize, job_name]
+
+      # rubocop:disable Gitlab/DocUrl -- Not running inside rails application
+      change.description = <<~MARKDOWN
+      This migration was finished at `#{migration_record.finished_at || migration_record.updated_at}`, you can confirm
+      the status using our
+      [batched background migration chatops commands](https://docs.gitlab.com/ee/development/database/batched_background_migrations.html#monitor-the-progress-and-status-of-a-batched-background-migration).
+        To confirm it is finished you can run:
+
+        ```
+      /chatops run batched_background_migrations status #{migration_record.id}
+      ```
+
+      The last time this background migration was triggered was in [#{last_migration_file}](https://gitlab.com/gitlab-org/gitlab/-/blob/master/#{last_migration_file})
+
+        You can read more about the process for finalizing batched background migrations in
+      https://docs.gitlab.com/ee/development/database/batched_background_migrations.html .
+
+        As part of our process we want to ensure all batched background migrations have had at least one
+      [required stop](https://docs.gitlab.com/ee/development/database/required_stops.html)
+      to process the migration. Therefore we can finalize any batched background migration that was added before the
+      last required stop.
+      MARKDOWN
+      # rubocop:enable Gitlab/DocUrl
+
+      feature_category = migration['feature_category']
+
+      change.labels = groups_helper.labels_for_feature_category(feature_category) + [
+        'maintenance::removal'
+      ]
+
+      change.reviewers = groups_helper.pick_reviewer_for_feature_category(feature_category, change.identifiers)
+
+      change
+    end
+
     def truncate_migration_name(migration_name)
       # File names not allowed to exceed 100 chars due to Cop/FilenameLength so we truncate to 70 because there will be
       # underscores added.
@@ -218,5 +230,9 @@ module Keeps
     def all_batched_background_migration_files
       Dir.glob("db/docs/batched_background_migrations/*.yml")
     end
+
+    def groups_helper
+      @groups_helper ||= ::Keeps::Helpers::Groups.new
+    end
   end
 end
diff --git a/keeps/remove_duplicated_indexes.rb b/keeps/remove_duplicated_indexes.rb
index 15dc4282a13..6143b90e387 100644
--- a/keeps/remove_duplicated_indexes.rb
+++ b/keeps/remove_duplicated_indexes.rb
@@ -23,9 +23,9 @@ module Keeps
   # ```
   class RemoveDuplicatedIndexes < ::Gitlab::Housekeeper::Keep
     MIGRATION_TEMPLATE = 'generator_templates/active_record/migration/'
-    DEFAULT_REVIEWER_GROUP = 'database'
+    FALLBACK_REVIEWER_FEATURE_CATEGORY = 'database'
 
-    def initialize
+    def initialize(...)
       ::Gitlab::Application.load_tasks
       ::ActiveRecord::Generators::MigrationGenerator.source_root(MIGRATION_TEMPLATE)
 
@@ -162,19 +162,16 @@ module Keeps
       table_info = Gitlab::Database::Dictionary.entries.find_by_table_name(table_name)
 
       table_info.feature_categories.map do |feature_category|
-        group = groups_helper.group_for_feature_category(feature_category)
-
-        group = groups_helper.group_for_feature_category(DEFAULT_REVIEWER_GROUP) if group['backend_engineers'].empty?
-
-        groups_helper.pick_reviewer(group, identifiers)
+        groups_helper.pick_reviewer_for_feature_category(feature_category, identifiers,
+          fallback_feature_category: FALLBACK_REVIEWER_FEATURE_CATEGORY)
       end
     end
 
     def labels(table_name)
       table_info = Gitlab::Database::Dictionary.entries.find_by_table_name(table_name)
 
-      group_labels = table_info.feature_categories.map do |feature_category|
-        groups_helper.group_for_feature_category(feature_category)['label']
+      group_labels = table_info.feature_categories.flat_map do |feature_category|
+        groups_helper.labels_for_feature_category(feature_category)
       end
 
       group_labels + %w[maintenance::scalability type::maintenance Category:Database]
@@ -188,11 +185,11 @@ module Keeps
 
     def reset_db
       ApplicationRecord.clear_all_connections!
-      ::Gitlab::Housekeeper::Shell.execute({ 'RAILS_ENV' => 'test' }, 'rails', 'db:reset')
+      ::Gitlab::Housekeeper::Shell.execute('rails', 'db:reset', env: { 'RAILS_ENV' => 'test' })
     end
 
     def migrate
-      ::Gitlab::Housekeeper::Shell.execute({ 'RAILS_ENV' => 'test' }, 'rails', 'db:migrate')
+      ::Gitlab::Housekeeper::Shell.execute('rails', 'db:migrate', env: { 'RAILS_ENV' => 'test' })
     end
 
     def groups_helper
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 324a9364761..771a101cdc6 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -384,10 +384,14 @@ module API
       authorize! :admin_group, user_group
     end
 
-    def authorize_admin_member_role!
+    def authorize_admin_member_role_on_group!
       authorize! :admin_member_role, user_group
     end
 
+    def authorize_admin_member_role_on_instance!
+      authorize! :admin_member_role
+    end
+
     def authorize_read_builds!
       authorize! :read_build, user_project
     end
diff --git a/lib/gitlab/ci/project_config.rb b/lib/gitlab/ci/project_config.rb
index fe8cb5dfe8c..a809ac89f55 100644
--- a/lib/gitlab/ci/project_config.rb
+++ b/lib/gitlab/ci/project_config.rb
@@ -24,8 +24,22 @@ module Gitlab
       def initialize(
         project:, sha:, custom_content: nil, pipeline_source: nil, pipeline_source_bridge: nil,
         triggered_for_branch: nil, ref: nil)
-        @config = find_config(project, sha, custom_content, pipeline_source, pipeline_source_bridge,
-          triggered_for_branch, ref)
+        @config = nil
+
+        sources.each do |source|
+          source_config = source.new(project: project,
+            sha: sha,
+            custom_content: custom_content,
+            pipeline_source: pipeline_source,
+            pipeline_source_bridge: pipeline_source_bridge,
+            triggered_for_branch: triggered_for_branch,
+            ref: ref)
+
+          if source_config.exists?
+            @config = source_config
+            break
+          end
+        end
       end
 
       delegate :content, :source, :url, to: :@config, allow_nil: true
@@ -37,16 +51,6 @@ module Gitlab
 
       private
 
-      def find_config(project, sha, custom_content, pipeline_source, pipeline_source_bridge, triggered_for_branch, ref)
-        sources.each do |source|
-          config = source.new(project, sha, custom_content, pipeline_source, pipeline_source_bridge,
-            triggered_for_branch, ref)
-          return config if config.exists?
-        end
-
-        nil
-      end
-
       def sources
         SOURCES
       end
diff --git a/lib/gitlab/ci/project_config/source.rb b/lib/gitlab/ci/project_config/source.rb
index 3065d16efac..0b68cd2de4a 100644
--- a/lib/gitlab/ci/project_config/source.rb
+++ b/lib/gitlab/ci/project_config/source.rb
@@ -7,8 +7,8 @@ module Gitlab
         include Gitlab::Utils::StrongMemoize
 
         def initialize(
-          project, sha, custom_content, pipeline_source, pipeline_source_bridge,
-          triggered_for_branch = false, ref = nil)
+          project:, sha:, custom_content: nil, pipeline_source: nil, pipeline_source_bridge: nil,
+          triggered_for_branch: false, ref: nil)
           @project = project
           @sha = sha
           @custom_content = custom_content
diff --git a/spec/controllers/groups/dependency_proxy_auth_controller_spec.rb b/spec/controllers/groups/dependency_proxy_auth_controller_spec.rb
index d9cfc91b33e..b8726bbfd5d 100644
--- a/spec/controllers/groups/dependency_proxy_auth_controller_spec.rb
+++ b/spec/controllers/groups/dependency_proxy_auth_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::DependencyProxyAuthController do
+RSpec.describe Groups::DependencyProxyAuthController, feature_category: :container_registry do
   include DependencyProxyHelpers
 
   describe 'GET #authenticate' do
@@ -33,21 +33,57 @@ RSpec.describe Groups::DependencyProxyAuthController do
         end
 
         context 'group bot user' do
-          let_it_be(:user) { create(:user, :project_bot) }
+          context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+            let_it_be(:user) { create(:user, :project_bot) }
 
-          it { is_expected.to have_gitlab_http_status(:success) }
+            before do
+              stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+            end
+
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
+
+          context 'with packages_dependency_proxy_pass_token_to_policy enabled' do
+            let_it_be(:bot_user) { create(:user, :project_bot) }
+            let_it_be(:user) { create(:personal_access_token, user: bot_user) }
+
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
         end
 
         context 'service account user' do
-          let_it_be(:user) { create(:user, :service_account) }
+          context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+            let_it_be(:user) { create(:user, :service_account) }
 
-          it { is_expected.to have_gitlab_http_status(:success) }
+            before do
+              stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+            end
+
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
+
+          context 'with packages_dependency_proxy_pass_token_to_policy enabled' do
+            let_it_be(:service_account_user) { create(:user, :service_account) }
+            let_it_be(:user) { create(:personal_access_token, user: service_account_user) }
+
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
         end
 
         context 'deploy token' do
           let_it_be(:user) { create(:deploy_token) }
 
-          it { is_expected.to have_gitlab_http_status(:success) }
+          context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+            before do
+              stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+            end
+
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
+
+          context 'with packages_dependency_proxy_pass_token_to_policy enabled' do
+            it { is_expected.to have_gitlab_http_status(:success) }
+          end
         end
       end
 
diff --git a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
index 9b977248435..34ca70e17fe 100644
--- a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
+++ b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
@@ -62,6 +62,8 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
 
     context 'with invalid group access token' do
       let_it_be(:user) { create(:user, :project_bot) }
+      let_it_be(:token) { create(:personal_access_token, user: user, scopes: [Gitlab::Auth::READ_API_SCOPE]) }
+      let_it_be(:jwt) { build_jwt(token) }
 
       context 'not under the group' do
         it { is_expected.to have_gitlab_http_status(:not_found) }
@@ -82,8 +84,6 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
       end
 
       context 'with insufficient scopes' do
-        let_it_be(:pat) { create(:personal_access_token, user: user, scopes: [Gitlab::Auth::READ_API_SCOPE]) }
-
         it { is_expected.to have_gitlab_http_status(:not_found) }
 
         context 'packages_dependency_proxy_containers_scope_check disabled' do
@@ -193,7 +193,19 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
         token.update_column(:scopes, Gitlab::Auth::REGISTRY_SCOPES)
       end
 
-      it_behaves_like 'sends Workhorse instructions'
+      context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+        before do
+          stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+        end
+
+        it_behaves_like 'sends Workhorse instructions'
+      end
+
+      context 'with packages_dependency_proxy_pass_token_to_policy enabled' do
+        let_it_be(:jwt) { build_jwt(token) }
+
+        it_behaves_like 'sends Workhorse instructions'
+      end
     end
 
     context 'with a deploy token' do
@@ -293,6 +305,15 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
         it_behaves_like 'a successful manifest pull'
         it_behaves_like 'a package tracking event', described_class.name, 'pull_manifest', false
 
+        context 'when packages_dependency_proxy_pass_token_to_policy is disabled' do
+          before do
+            stub_feature_flags(packages_dependency_proxy_containers_scope_check: false)
+          end
+
+          it_behaves_like 'a successful manifest pull'
+          it_behaves_like 'a package tracking event', described_class.name, 'pull_manifest', false
+        end
+
         context 'with workhorse response' do
           let(:pull_response) { { status: :success, manifest: nil, from_cache: false } }
 
@@ -324,6 +345,14 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
 
         it_behaves_like 'a successful manifest pull'
 
+        context 'when packages_dependency_proxy_pass_token_to_policy is disabled' do
+          before do
+            stub_feature_flags(packages_dependency_proxy_containers_scope_check: false)
+          end
+
+          it_behaves_like 'a successful manifest pull'
+        end
+
         context 'pulling from a subgroup' do
           let_it_be_with_reload(:parent_group) { create(:group) }
           let_it_be_with_reload(:group) { create(:group, parent: parent_group) }
@@ -344,8 +373,21 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
           group.add_guest(user)
         end
 
-        it_behaves_like 'a successful manifest pull'
-        it_behaves_like 'a package tracking event', described_class.name, 'pull_manifest', false
+        context 'when packages_dependency_proxy_pass_token_to_policy is disabled' do
+          before do
+            stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+          end
+
+          it_behaves_like 'a successful manifest pull'
+          it_behaves_like 'a package tracking event', described_class.name, 'pull_manifest', false
+        end
+
+        context 'when packages_dependency_proxy_pass_token_to_policy is enabled' do
+          let_it_be(:jwt) { build_jwt(token) }
+
+          it_behaves_like 'a successful manifest pull'
+          it_behaves_like 'a package tracking event', described_class.name, 'pull_manifest', false
+        end
       end
     end
 
@@ -367,6 +409,14 @@ RSpec.describe Groups::DependencyProxyForContainersController, feature_category:
       it_behaves_like 'without a token'
       it_behaves_like 'without permission'
 
+      context 'when packages_dependency_proxy_pass_token_to_policy is disabled' do
+        before do
+          stub_feature_flags(packages_dependency_proxy_containers_scope_check: false)
+        end
+
+        it { is_expected.to have_gitlab_http_status(:not_found) }
+      end
+
       context 'a valid user' do
         before do
           group.add_guest(user)
diff --git a/spec/features/groups/packages_spec.rb b/spec/features/groups/packages_spec.rb
index 6b2a15daf72..d85b53c77b3 100644
--- a/spec/features/groups/packages_spec.rb
+++ b/spec/features/groups/packages_spec.rb
@@ -72,6 +72,13 @@ RSpec.describe 'Group Packages', feature_category: :package_registry do
           let(:packages) { [npm_package, maven_package] }
         end
       end
+
+      context 'filtering' do
+        it_behaves_like 'shared package filtering' do
+          let_it_be(:package_one) { maven_package }
+          let_it_be(:package_two) { npm_package }
+        end
+      end
     end
 
     it_behaves_like 'when there are no packages'
diff --git a/spec/features/projects/packages_spec.rb b/spec/features/projects/packages_spec.rb
index d69687fb053..aaf13970233 100644
--- a/spec/features/projects/packages_spec.rb
+++ b/spec/features/projects/packages_spec.rb
@@ -62,6 +62,13 @@ RSpec.describe 'Packages', feature_category: :package_registry do
         let_it_be(:package_one) { maven_package }
         let_it_be(:package_two) { npm_package }
       end
+
+      context 'filtering' do
+        it_behaves_like 'shared package filtering' do
+          let_it_be(:package_one) { maven_package }
+          let_it_be(:package_two) { npm_package }
+        end
+      end
     end
 
     it_behaves_like 'when there are no packages'
diff --git a/spec/frontend/vue_shared/components/registry/registry_search_spec.js b/spec/frontend/vue_shared/components/registry/registry_search_spec.js
index fc18dc6e5e4..f22e0f39ee8 100644
--- a/spec/frontend/vue_shared/components/registry/registry_search_spec.js
+++ b/spec/frontend/vue_shared/components/registry/registry_search_spec.js
@@ -20,9 +20,8 @@ describe('Registry Search', () => {
   };
 
   const defaultQueryChangedPayload = {
-    foo: '',
     orderBy: 'name',
-    search: [],
+    search: null,
     sort: 'asc',
     after: null,
     before: null,
@@ -47,7 +46,7 @@ describe('Registry Search', () => {
       expect(findFilteredSearch().props()).toMatchObject({
         value: [],
         placeholder: 'Filter results',
-        availableTokens: wrapper.vm.tokens,
+        availableTokens: defaultProps.tokens,
       });
     });
 
@@ -76,12 +75,6 @@ describe('Registry Search', () => {
       expect(wrapper.emitted('filter:submit')).toEqual([[]]);
       expect(wrapper.emitted('query:changed')).toEqual([[defaultQueryChangedPayload]]);
     });
-
-    it('binds tokens prop', () => {
-      mountComponent();
-
-      expect(findFilteredSearch().props('availableTokens')).toEqual(defaultProps.tokens);
-    });
   });
 
   describe('sorting', () => {
diff --git a/spec/keeps/helpers/groups_spec.rb b/spec/keeps/helpers/groups_spec.rb
index c3b9afdeef0..b95a8d748e5 100644
--- a/spec/keeps/helpers/groups_spec.rb
+++ b/spec/keeps/helpers/groups_spec.rb
@@ -16,6 +16,17 @@ RSpec.describe Keeps::Helpers::Groups, feature_category: :tooling do
         'slack_channel' => 'g_tenant_scale',
         'backend_engineers' => %w[be1 be2 be3 be4 be5],
         'triage_ops_config' => nil
+      },
+      'group_b' => {
+        'name' => 'Group B',
+        'section' => 'core_platform',
+        'stage' => 'data_stores',
+        'categories' => %w[category_b],
+        'label' => 'group::group b',
+        'extra_labels' => [],
+        'slack_channel' => 'g_group_b',
+        'backend_engineers' => %w[],
+        'triage_ops_config' => nil
       }
     }
   end
@@ -37,6 +48,12 @@ RSpec.describe Keeps::Helpers::Groups, feature_category: :tooling do
       it { is_expected.to eq(nil) }
     end
 
+    context 'when given nil' do
+      let(:category) { nil }
+
+      it { is_expected.to eq(nil) }
+    end
+
     context 'when the request to fetch groups fails' do
       before do
         stub_request(:get, "https://about.gitlab.com/groups.json").to_return(status: 404, body: '')
@@ -56,5 +73,58 @@ RSpec.describe Keeps::Helpers::Groups, feature_category: :tooling do
     subject { described_class.new.pick_reviewer(group, identifiers) }
 
     it { is_expected.to eq(group['backend_engineers'][expected_index]) }
+
+    context 'when given nil' do
+      let(:group) { nil }
+
+      it { is_expected.to eq(nil) }
+    end
+  end
+
+  describe '#pick_reviewer_for_feature_category' do
+    let(:group) { groups['tenant_scale'] }
+    let(:identifiers) { %w[example identifier] }
+    let(:expected_index) { Digest::SHA256.hexdigest(identifiers.join).to_i(16) % group['backend_engineers'].size }
+    let(:category) { 'organization' }
+    let(:fallback_feature_category) { nil }
+
+    subject(:reviewer) do
+      described_class.new.pick_reviewer_for_feature_category(category, identifiers,
+        fallback_feature_category: fallback_feature_category)
+    end
+
+    it 'finds a matching group and picks a reviewer from the group owning that feature category' do
+      expect(reviewer).to eq(group['backend_engineers'][expected_index])
+    end
+
+    context 'when the matching group does not have backend_engineers' do
+      let(:category) { 'category_b' }
+
+      it { is_expected.to eq(nil) }
+
+      context 'when a fallback_feature_category is passed' do
+        let(:fallback_feature_category) { 'organization' }
+
+        it 'returns a reviewer from that fallback_feature_category' do
+          expect(reviewer).to eq(group['backend_engineers'][expected_index])
+        end
+      end
+    end
+  end
+
+  describe '#labels_for_feature_category' do
+    let(:category) { 'organization' }
+
+    subject(:labels) { described_class.new.labels_for_feature_category(category) }
+
+    it 'returns the group label for the matching group' do
+      expect(labels).to eq(['group::tenant scale'])
+    end
+
+    context 'when there is no matching group' do
+      let(:category) { 'not_a_category' }
+
+      it { is_expected.to eq([]) }
+    end
   end
 end
diff --git a/spec/lib/gitlab/ci/project_config/repository_spec.rb b/spec/lib/gitlab/ci/project_config/repository_spec.rb
index 7f8d135182c..0ab6c6c2a17 100644
--- a/spec/lib/gitlab/ci/project_config/repository_spec.rb
+++ b/spec/lib/gitlab/ci/project_config/repository_spec.rb
@@ -8,8 +8,7 @@ RSpec.describe Gitlab::Ci::ProjectConfig::Repository, feature_category: :continu
   let(:files) { { 'README.md' => 'hello' } }
 
   subject(:config) do
-    described_class.new(project, sha, nil, nil, nil,
-      nil)
+    described_class.new(project: project, sha: sha)
   end
 
   describe '#content' do
diff --git a/spec/lib/gitlab/ci/project_config/source_spec.rb b/spec/lib/gitlab/ci/project_config/source_spec.rb
index eefabe1babb..99238e69a3b 100644
--- a/spec/lib/gitlab/ci/project_config/source_spec.rb
+++ b/spec/lib/gitlab/ci/project_config/source_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe Gitlab::Ci::ProjectConfig::Source, feature_category: :continuous_
   let_it_be(:project) { build_stubbed(:project) }
   let_it_be(:sha) { '123456' }
 
-  subject(:custom_config) { custom_config_class.new(project, sha, nil, nil, nil) }
+  subject(:custom_config) { custom_config_class.new(project: project, sha: sha) }
 
   describe '#content' do
     subject(:content) { custom_config.content }
diff --git a/spec/models/ci/running_build_spec.rb b/spec/models/ci/running_build_spec.rb
index 6122d5c3196..77be5a577ea 100644
--- a/spec/models/ci/running_build_spec.rb
+++ b/spec/models/ci/running_build_spec.rb
@@ -29,6 +29,21 @@ RSpec.describe Ci::RunningBuild, feature_category: :continuous_integration do
       end
     end
 
+    context 'when build has been picked by a group runner' do
+      let_it_be(:group) { create(:group) }
+      let_it_be(:runner) { create(:ci_runner, :group, groups: [group]) }
+
+      it 'returns a build id as a result' do
+        expect(upsert_build.rows.dig(0, 0)).to eq build.id
+      end
+
+      it 'returns a build id as a result' do
+        upsert_build
+
+        expect(described_class.find_by_build_id(build.id)&.runner_owner_namespace_xid).to eq(group.id)
+      end
+    end
+
     context 'when build has been picked by a project runner' do
       let_it_be(:runner) { create(:ci_runner, :project, projects: [project]) }
 
diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index 1eae4ae3c15..4862e12f02f 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -1114,6 +1114,7 @@ RSpec.describe GroupPolicy, feature_category: :system_access do
     end
   end
 
+  # This block can be removed when packages_dependency_proxy_pass_token_to_policy is rolled out
   describe 'dependency proxy' do
     RSpec.shared_examples 'disabling admin_package feature flag' do
       before do
diff --git a/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb b/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb
new file mode 100644
index 00000000000..15b14d69ab0
--- /dev/null
+++ b/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb
@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Packages::Policies::DependencyProxy::GroupPolicy, feature_category: :system_access do
+  subject { described_class.new(auth_token, group.dependency_proxy_for_containers_policy_subject) }
+
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:non_group_member) { create(:user) }
+  let_it_be(:group, refind: true) { create(:group, :private, :owner_subgroup_creation_only) }
+  let_it_be(:current_user) { guest }
+
+  before do
+    group.add_guest(guest)
+  end
+
+  describe 'dependency proxy' do
+    shared_examples 'disallows dependency proxy read access' do
+      it { is_expected.to be_disallowed(:read_dependency_proxy) }
+    end
+
+    shared_examples 'allows dependency proxy read access' do
+      it { is_expected.to be_allowed(:read_dependency_proxy) }
+    end
+
+    context 'with feature disabled' do
+      let_it_be(:auth_token) { create(:personal_access_token, user: current_user) }
+
+      before do
+        stub_config(dependency_proxy: { enabled: false })
+      end
+
+      it_behaves_like 'disallows dependency proxy read access'
+    end
+
+    context 'with feature enabled' do
+      let_it_be(:auth_token) { create(:personal_access_token, user: current_user) }
+
+      before do
+        stub_config(dependency_proxy: { enabled: true }, registry: { enabled: true })
+      end
+
+      context 'with a human user personal access token' do
+        subject { described_class.new(auth_token, group.dependency_proxy_for_containers_policy_subject) }
+
+        context 'when not a member of the group' do
+          let_it_be(:current_user) { non_group_member }
+          let_it_be(:auth_token) { create(:personal_access_token, user: current_user) }
+
+          it_behaves_like 'disallows dependency proxy read access'
+        end
+
+        context 'when a member of the group' do
+          let_it_be(:current_user) { guest }
+          let_it_be(:auth_token) { create(:personal_access_token, user: current_user) }
+
+          it_behaves_like 'allows dependency proxy read access'
+        end
+      end
+
+      context 'with a deploy token user' do
+        before do
+          create(:group_deploy_token, group: group, deploy_token: auth_token)
+        end
+
+        context 'with insufficient scopes' do
+          let_it_be(:auth_token) { create(:deploy_token, :group, user: current_user) }
+
+          it_behaves_like 'disallows dependency proxy read access'
+        end
+
+        context 'with sufficient scopes' do
+          let_it_be(:auth_token) { create(:deploy_token, :group, :dependency_proxy_scopes) }
+
+          it_behaves_like 'allows dependency proxy read access'
+        end
+      end
+
+      context 'with a group access token user' do
+        let_it_be(:bot_user) { create(:user, :project_bot) }
+        let_it_be(:auth_token) do
+          create(:personal_access_token, user: bot_user, scopes: [Gitlab::Auth::READ_API_SCOPE])
+        end
+
+        context 'when not a member of the group' do
+          it_behaves_like 'disallows dependency proxy read access'
+        end
+
+        context 'when a member of the group' do
+          before do
+            group.add_guest(bot_user)
+          end
+
+          it_behaves_like 'allows dependency proxy read access'
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/jwt_controller_spec.rb b/spec/requests/jwt_controller_spec.rb
index 992c5ab0b13..539055d103e 100644
--- a/spec/requests/jwt_controller_spec.rb
+++ b/spec/requests/jwt_controller_spec.rb
@@ -92,7 +92,7 @@ RSpec.describe JwtController, feature_category: :system_access do
         context 'project with enabled CI' do
           subject! { get '/jwt/auth', params: parameters, headers: headers }
 
-          it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters.merge(auth_type: :build, raw_token: build.token)).permit!) }
+          it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters.merge(auth_type: :build)).permit!) }
 
           it_behaves_like 'user logging'
         end
@@ -119,7 +119,7 @@ RSpec.describe JwtController, feature_category: :system_access do
               .with(
                 nil,
                 nil,
-                ActionController::Parameters.new(parameters.merge(deploy_token: deploy_token, auth_type: :deploy_token, raw_token: deploy_token.token)).permit!
+                ActionController::Parameters.new(parameters.merge(deploy_token: deploy_token, auth_type: :deploy_token)).permit!
               )
           end
 
@@ -160,7 +160,7 @@ RSpec.describe JwtController, feature_category: :system_access do
 
         subject! { get '/jwt/auth', params: parameters, headers: headers }
 
-        it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters.merge(auth_type: :gitlab_or_ldap, raw_token: user.password)).permit!) }
+        it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters.merge(auth_type: :gitlab_or_ldap)).permit!) }
 
         it_behaves_like 'rejecting a blocked user'
 
@@ -180,7 +180,7 @@ RSpec.describe JwtController, feature_category: :system_access do
             ActionController::Parameters.new({ service: service_name, scopes: %w[scope1 scope2] }).permit!
           end
 
-          it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap, raw_token: user.password)) }
+          it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap)) }
 
           it_behaves_like 'user logging'
         end
@@ -197,7 +197,7 @@ RSpec.describe JwtController, feature_category: :system_access do
             ActionController::Parameters.new({ service: service_name, scopes: %w[scope1 scope2] }).permit!
           end
 
-          it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap, raw_token: user.password)) }
+          it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap)) }
         end
 
         context 'when user has 2FA enabled' do
diff --git a/spec/services/auth/dependency_proxy_authentication_service_spec.rb b/spec/services/auth/dependency_proxy_authentication_service_spec.rb
index e81f59cff39..2cd3aad9aa8 100644
--- a/spec/services/auth/dependency_proxy_authentication_service_spec.rb
+++ b/spec/services/auth/dependency_proxy_authentication_service_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :de
   let_it_be(:user) { create(:user) }
   let_it_be(:params) { {} }
 
-  let(:authentication_abilities) { nil }
+  let(:authentication_abilities) { [] }
   let(:service) { described_class.new(nil, user, params) }
 
   before do
@@ -48,31 +48,57 @@ RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :de
     end
 
     context 'with a deploy token' do
+      let(:user) { nil }
       let_it_be(:deploy_token) { create(:deploy_token, :group, :dependency_proxy_scopes) }
       let_it_be(:params) { { deploy_token: deploy_token } }
 
       it_behaves_like 'returning a token with an encoded field', 'deploy_token'
+
+      context 'with packages_dependency_proxy_containers_scope_check disabled' do
+        before do
+          stub_feature_flags(packages_dependency_proxy_containers_scope_check: false)
+        end
+
+        it_behaves_like 'returning a token with an encoded field', 'deploy_token'
+      end
+
+      context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+        before do
+          stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+        end
+
+        it_behaves_like 'returning a token with an encoded field', 'deploy_token'
+      end
     end
 
     context 'with a human user' do
       it_behaves_like 'returning a token with an encoded field', 'user_id'
+
+      context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+        before do
+          stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+        end
+
+        it_behaves_like 'returning a token with an encoded field', 'user_id'
+      end
     end
 
-    context 'all other user types' do
-      User::USER_TYPES.except(:human, :project_bot).each_value do |user_type|
-        context "with user_type #{user_type}" do
-          before do
-            user.update!(user_type: user_type)
-          end
+    context 'with a personal access token user' do
+      let_it_be_with_reload(:token) { create(:personal_access_token, user: user) }
+      let_it_be(:params) { { raw_token: token.token } }
 
-          it_behaves_like 'returning a token with an encoded field', 'user_id'
-        end
-      end
+      it_behaves_like 'returning a token with an encoded field', 'personal_access_token'
     end
 
     context 'with a group access token' do
       let_it_be(:user) { create(:user, :project_bot) }
+      let_it_be(:group) { create(:group) }
       let_it_be_with_reload(:token) { create(:personal_access_token, user: user) }
+      let_it_be(:params) { { raw_token: token.token } }
+
+      before_all do
+        group.add_guest(user)
+      end
 
       context 'with insufficient authentication abilities' do
         it_behaves_like 'returning', status: 403, message: 'access forbidden'
@@ -82,7 +108,7 @@ RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :de
             stub_feature_flags(packages_dependency_proxy_containers_scope_check: false)
           end
 
-          it_behaves_like 'returning a token with an encoded field', 'user_id'
+          it_behaves_like 'returning a token with an encoded field', 'group_access_token'
         end
       end
 
@@ -92,7 +118,15 @@ RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :de
 
         subject { service.execute(authentication_abilities: authentication_abilities) }
 
-        it_behaves_like 'returning a token with an encoded field', 'user_id'
+        it_behaves_like 'returning a token with an encoded field', 'group_access_token'
+
+        context 'with packages_dependency_proxy_pass_token_to_policy disabled' do
+          before do
+            stub_feature_flags(packages_dependency_proxy_pass_token_to_policy: false)
+          end
+
+          it_behaves_like 'returning a token with an encoded field', 'user_id'
+        end
 
         context 'revoked' do
           before do
@@ -112,6 +146,18 @@ RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :de
       end
     end
 
+    context 'all other user types' do
+      User::USER_TYPES.except(:human, :project_bot).each_value do |user_type|
+        context "with user_type #{user_type}" do
+          before do
+            user.update!(user_type: user_type)
+          end
+
+          it_behaves_like 'returning a token with an encoded field', 'user_id'
+        end
+      end
+    end
+
     def decode(token)
       DependencyProxy::AuthTokenService.new(token).execute
     end
diff --git a/spec/services/dependency_proxy/auth_token_service_spec.rb b/spec/services/dependency_proxy/auth_token_service_spec.rb
index 2612c5765a4..43a672032b9 100644
--- a/spec/services/dependency_proxy/auth_token_service_spec.rb
+++ b/spec/services/dependency_proxy/auth_token_service_spec.rb
@@ -5,8 +5,36 @@ RSpec.describe DependencyProxy::AuthTokenService, feature_category: :dependency_
   include DependencyProxyHelpers
 
   let_it_be(:user) { create(:user) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:group_access_token) { create(:personal_access_token, user: user) }
   let_it_be(:deploy_token) { create(:deploy_token) }
 
+  shared_examples 'handling token errors' do
+    context 'with a decoding error' do
+      before do
+        allow(JWT).to receive(:decode).and_raise(JWT::DecodeError)
+      end
+
+      it { is_expected.to eq(nil) }
+    end
+
+    context 'with an immature signature error' do
+      before do
+        allow(JWT).to receive(:decode).and_raise(JWT::ImmatureSignature)
+      end
+
+      it { is_expected.to eq(nil) }
+    end
+
+    context 'with an expired signature error' do
+      it 'returns nil' do
+        travel_to(Time.zone.now + Auth::DependencyProxyAuthenticationService.token_expire_at + 1.minute) do
+          expect(subject).to eq(nil)
+        end
+      end
+    end
+  end
+
   describe '.user_or_deploy_token_from_jwt' do
     subject { described_class.user_or_deploy_token_from_jwt(token.encoded) }
 
@@ -72,4 +100,84 @@ RSpec.describe DependencyProxy::AuthTokenService, feature_category: :dependency_
       it { is_expected.to eq(nil) }
     end
   end
+
+  describe '.user_or_token_from_jwt' do
+    subject { described_class.user_or_token_from_jwt(token.encoded) }
+
+    context 'with a user' do
+      let_it_be(:token) { build_jwt(user) }
+
+      it { is_expected.to eq(user) }
+
+      context 'with an invalid user id' do
+        let_it_be(:token) { build_jwt { |jwt| jwt['user_id'] = 'this_is_not_a_user_id' } }
+
+        it 'raises an not found error' do
+          expect { subject }.to raise_error(ActiveRecord::RecordNotFound)
+        end
+      end
+
+      it_behaves_like 'handling token errors'
+    end
+
+    context 'with a personal access token' do
+      let_it_be(:token) { build_jwt(personal_access_token) }
+
+      it { is_expected.to eq(personal_access_token) }
+
+      context 'with an inactive token' do
+        before do
+          personal_access_token.revoke!
+        end
+
+        it { is_expected.to eq(nil) }
+      end
+
+      context 'with an invalid token' do
+        let_it_be(:token) { build_jwt { |jwt| jwt['personal_access_token'] = 'this_is_not_a_token' } }
+
+        it { is_expected.to eq(nil) }
+      end
+    end
+
+    context 'with a group access token' do
+      let_it_be(:token) { build_jwt(group_access_token) }
+
+      it { is_expected.to eq(group_access_token) }
+
+      context 'with an inactive token' do
+        before do
+          group_access_token.revoke!
+        end
+
+        it { is_expected.to eq(nil) }
+      end
+
+      context 'with an invalid token' do
+        let_it_be(:token) { build_jwt { |jwt| jwt['group_access_token'] = 'this_is_not_a_token' } }
+
+        it { is_expected.to eq(nil) }
+      end
+    end
+
+    context 'with a deploy token' do
+      let_it_be(:token) { build_jwt(deploy_token) }
+
+      it { is_expected.to eq(deploy_token) }
+
+      context 'with an invalid token' do
+        let_it_be(:token) { build_jwt { |jwt| jwt['deploy_token'] = 'this_is_not_a_token' } }
+
+        it { is_expected.to eq(nil) }
+      end
+
+      it_behaves_like 'handling token errors'
+    end
+
+    context 'with an empty token payload' do
+      let_it_be(:token) { build_jwt(nil) }
+
+      it { is_expected.to eq(nil) }
+    end
+  end
 end
diff --git a/spec/support/finder_collection_allowlist.yml b/spec/support/finder_collection_allowlist.yml
index 3a57ad31427..3039a0e97d8 100644
--- a/spec/support/finder_collection_allowlist.yml
+++ b/spec/support/finder_collection_allowlist.yml
@@ -63,6 +63,7 @@
 - Security::PipelineVulnerabilitiesFinder
 - Security::ScanExecutionPoliciesFinder
 - Security::ScanResultPoliciesFinder
+- Security::PipelineExecutionPoliciesFinder
 - Security::SecurityPoliciesFinder
 - SentryIssueFinder
 - ServerlessDomainFinder
diff --git a/spec/support/helpers/dependency_proxy_helpers.rb b/spec/support/helpers/dependency_proxy_helpers.rb
index 75dc09ec159..ae54c64a4d9 100644
--- a/spec/support/helpers/dependency_proxy_helpers.rb
+++ b/spec/support/helpers/dependency_proxy_helpers.rb
@@ -32,13 +32,14 @@ module DependencyProxyHelpers
       .to_return(status: status, body: body)
   end
 
-  def build_jwt(user = nil, expire_time: nil)
+  def build_jwt(user_or_token = nil, expire_time: nil)
     JSONWebToken::HMACToken.new(::Auth::DependencyProxyAuthenticationService.secret).tap do |jwt|
       if block_given?
         yield(jwt)
       else
-        jwt['user_id'] = user.id if user.is_a?(User)
-        jwt['deploy_token'] = user.token if user.is_a?(DeployToken)
+        jwt['user_id'] = user_or_token.id if user_or_token.is_a?(User)
+        jwt['personal_access_token'] = user_or_token.token if user_or_token.is_a?(PersonalAccessToken)
+        jwt['deploy_token'] = user_or_token.token if user_or_token.is_a?(DeployToken)
         jwt.expire_time = expire_time || jwt.issued_at + 1.minute
       end
     end
diff --git a/spec/support/shared_examples/features/packages_shared_examples.rb b/spec/support/shared_examples/features/packages_shared_examples.rb
index 28b9078d8da..0e3fc60481a 100644
--- a/spec/support/shared_examples/features/packages_shared_examples.rb
+++ b/spec/support/shared_examples/features/packages_shared_examples.rb
@@ -148,6 +148,43 @@ RSpec.shared_examples 'shared package sorting' do
   it_behaves_like 'correctly sorted packages list', 'Published', ascending: true do
     let(:packages) { [package_one, package_two] }
   end
+
+  context 'when sorted by name ascending' do
+    before do
+      click_sort_option('Name', true)
+    end
+
+    it 'updates query params to contain orderBy:name and sort:asc' do
+      queryparams = Rack::Utils.parse_query(URI.parse(current_url).query)
+      expect(queryparams).to include(
+        'orderBy' => 'name',
+        'sort' => 'asc'
+      )
+    end
+  end
+end
+
+RSpec.shared_examples 'shared package filtering' do
+  include FilteredSearchHelpers
+
+  context 'filters by Type' do
+    let(:packages) { [npm_package] }
+
+    before do
+      select_tokens('Type', 'npm', submit: true, input_text: 'Filter results')
+    end
+
+    it_behaves_like 'packages list'
+
+    it 'updates query params' do
+      queryparams = Rack::Utils.parse_query(URI.parse(current_url).query)
+      expect(queryparams).to eq(
+        'type' => 'npm',
+        'orderBy' => 'created_at',
+        'sort' => 'desc'
+      )
+    end
+  end
 end
 
 def packages_table_selector