From e231a129a349ea6c8bb5f51e18ee7d8717b7d82c Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 31 Jan 2025 21:12:19 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../layout/empty_line_after_magic_comment.yml |  1 -
 .../todos/components/todo_item.vue            | 20 +++++-
 .../components/work_item_actions.vue          |  2 +-
 .../concerns/projects/look_ahead_preloads.rb  |  4 +-
 .../description_template_content_resolver.rb  | 22 ++++++
 .../description_templates_resolver.rb         | 56 +++++++++++----
 app/graphql/types/query_type.rb               |  7 ++
 ...description_template_content_input_type.rb | 16 +++++
 .../work_items/description_template_type.rb   |  6 +-
 app/models/ci/runner.rb                       | 20 ------
 .../fe_search_build_by_name.yml               |  2 +-
 .../populate_and_use_build_names_table.yml    |  4 +-
 ...enable-gitlab-advanced-sast-by-default.yml | 22 ++++++
 ...eys_from_application_settings_if_exists.rb | 19 +++++
 db/schema_migrations/20250130100818           |  1 +
 doc/administration/incoming_email.md          |  4 +-
 doc/administration/load_balancer.md           |  2 +-
 doc/administration/object_storage.md          |  4 +-
 doc/api/graphql/reference/index.md            | 34 +++++++--
 doc/api/group_access_tokens.md                |  2 +-
 doc/api/personal_access_tokens.md             | 40 ++++++++---
 doc/api/project_access_tokens.md              |  4 +-
 doc/api/project_import_export.md              |  2 +-
 doc/development/ai_architecture.md            |  2 +-
 doc/development/api_graphql_styleguide.md     |  2 +-
 doc/development/api_styleguide.md             |  6 +-
 doc/development/cascading_settings.md         |  2 +-
 doc/development/chatops_on_gitlabcom.md       |  2 +-
 .../site_architecture/global_nav.md           | 21 +-----
 doc/development/features_inside_dot_gitlab.md |  2 +-
 doc/development/index.md                      |  2 +-
 doc/development/tracing.md                    |  2 +-
 doc/development/ux/index.md                   |  2 +-
 doc/integration/clickhouse.md                 |  2 +-
 doc/update/breaking_windows.md                |  1 +
 doc/update/deprecations.md                    | 24 +++++++
 .../sast/gitlab_advanced_sast.md              |  7 ++
 doc/user/gitlab_duo/data_usage.md             |  2 +-
 lib/api/ci/helpers/runner.rb                  |  6 --
 lib/api/ci/runner.rb                          |  4 --
 lib/web_ide/settings_sync.rb                  | 24 ++++++-
 locale/gitlab.pot                             |  3 -
 .../work_items/work_item_detail_spec.rb       | 16 +++--
 .../todos/components/todo_item_spec.js        | 25 ++++++-
 .../components/work_item_actions_spec.js      |  6 ++
 .../description_templates_resolver_spec.rb    | 64 -----------------
 .../description_template_type_spec.rb         |  2 +-
 spec/helpers/ide_helper_spec.rb               |  2 +-
 spec/lib/api/ci/helpers/runner_spec.rb        | 22 ------
 spec/lib/web_ide/settings_sync_spec.rb        | 68 ++++++++++++++----
 .../api/ci/runner/jobs_request_post_spec.rb   | 59 ----------------
 .../api/ci/runner/runners_verify_post_spec.rb | 67 ------------------
 .../work_item_description_templates_spec.rb   | 61 ++++++++--------
 .../api/graphql/projects/projects_spec.rb     |  8 +--
 .../user/contributed_projects_query_spec.rb   |  8 +--
 .../user/starred_projects_query_spec.rb       |  8 +--
 ..._item_description_template_content_spec.rb | 70 +++++++++++++++++++
 .../types/query_type_shared_context.rb        |  1 +
 58 files changed, 508 insertions(+), 389 deletions(-)
 create mode 100644 app/graphql/resolvers/work_items/description_template_content_resolver.rb
 create mode 100644 app/graphql/types/work_items/description_template_content_input_type.rb
 rename config/feature_flags/{gitlab_com_derisk => beta}/fe_search_build_by_name.yml (93%)
 rename config/feature_flags/{gitlab_com_derisk => beta}/populate_and_use_build_names_table.yml (91%)
 create mode 100644 data/deprecations/17-9-enable-gitlab-advanced-sast-by-default.yml
 create mode 100644 db/post_migrate/20250130100818_remove_cloud_connector_keys_from_application_settings_if_exists.rb
 create mode 100644 db/schema_migrations/20250130100818
 delete mode 100644 spec/graphql/resolvers/work_items/description_templates_resolver_spec.rb
 create mode 100644 spec/requests/api/graphql/work_item_description_template_content_spec.rb

diff --git a/.rubocop_todo/layout/empty_line_after_magic_comment.yml b/.rubocop_todo/layout/empty_line_after_magic_comment.yml
index 7b4bdcf7b68..aff118f96ec 100644
--- a/.rubocop_todo/layout/empty_line_after_magic_comment.yml
+++ b/.rubocop_todo/layout/empty_line_after_magic_comment.yml
@@ -250,7 +250,6 @@ Layout/EmptyLineAfterMagicComment:
     - 'ee/spec/lib/gitlab/middleware/ip_restrictor_spec.rb'
     - 'ee/spec/lib/gitlab/search/client_spec.rb'
     - 'ee/spec/lib/gitlab/spdx/catalogue_spec.rb'
-    - 'ee/spec/lib/system_check/app/advanced_search_migrations_check_spec.rb'
     - 'ee/spec/lib/system_check/geo/http_connection_check_spec.rb'
     - 'ee/spec/models/analytics/cycle_analytics/aggregation_context_spec.rb'
     - 'ee/spec/models/ci/minutes/quota_spec.rb'
diff --git a/app/assets/javascripts/todos/components/todo_item.vue b/app/assets/javascripts/todos/components/todo_item.vue
index bedcaa0be17..872529823da 100644
--- a/app/assets/javascripts/todos/components/todo_item.vue
+++ b/app/assets/javascripts/todos/components/todo_item.vue
@@ -1,10 +1,11 @@
 <script>
-import { GlLink, GlIcon } from '@gitlab/ui';
+import { GlLink, GlIcon, GlFormCheckbox } from '@gitlab/ui';
 import { s__, sprintf } from '~/locale';
 import dateFormat from '~/lib/dateformat';
 import { formatDate, getDayDifference, fallsBefore } from '~/lib/utils/datetime_utility';
 import { localeDateFormat } from '~/lib/utils/datetime/locale_dateformat';
 import timeagoMixin from '~/vue_shared/mixins/timeago';
+import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { INSTRUMENT_TODO_ITEM_FOLLOW, TODO_STATE_DONE } from '../constants';
 import TodoItemTitle from './todo_item_title.vue';
 import TodoItemBody from './todo_item_body.vue';
@@ -21,13 +22,14 @@ export default {
   components: {
     GlLink,
     GlIcon,
+    GlFormCheckbox,
     TodoItemTitle,
     TodoItemBody,
     TodoItemTimestamp,
     TodoItemActions,
     TodoItemTitleHiddenBySaml,
   },
-  mixins: [timeagoMixin],
+  mixins: [timeagoMixin, glFeatureFlagMixin()],
   inject: ['currentTab'],
   props: {
     currentUserId: {
@@ -38,6 +40,11 @@ export default {
       type: Object,
       required: true,
     },
+    selected: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
   computed: {
     isHiddenBySaml() {
@@ -106,10 +113,17 @@ export default {
 
 <template>
   <li
-    class="gl-border-t gl-border-b gl-relative -gl-mt-px gl-flex gl-gap-3 gl-px-5 gl-py-3 hover:gl-z-1 hover:gl-cursor-pointer hover:gl-border-blue-200 hover:gl-bg-blue-50"
+    class="gl-border-t gl-border-b gl-relative -gl-mt-px gl-flex gl-gap-3 gl-px-5 gl-py-3 hover:gl-z-1 hover:gl-border-blue-200 hover:gl-bg-blue-50"
     :data-testid="`todo-item-${todo.id}`"
     :class="{ 'gl-bg-subtle': isDone }"
   >
+    <gl-form-checkbox
+      v-if="glFeatures.todosBulkActions"
+      class="gl-inline-block gl-pt-2"
+      :aria-label="__('Select')"
+      :checked="selected"
+      @change="(checked) => $emit('select-change', todo.id, checked)"
+    />
     <gl-link
       :href="targetUrl"
       :data-track-label="trackingLabel"
diff --git a/app/assets/javascripts/work_items/components/work_item_actions.vue b/app/assets/javascripts/work_items/components/work_item_actions.vue
index d3206b8b783..a69a885f71c 100644
--- a/app/assets/javascripts/work_items/components/work_item_actions.vue
+++ b/app/assets/javascripts/work_items/components/work_item_actions.vue
@@ -340,7 +340,7 @@ export default {
         : this.$options.i18n.confidentialityEnabled;
     },
     showChangeType() {
-      return !this.isEpic && this.glFeatures.workItemsBeta && this.$options.isLoggedIn;
+      return !this.isEpic && this.glFeatures.workItemsBeta && this.canUpdate;
     },
     allowedWorkItemTypes() {
       if (this.isGroup) {
diff --git a/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb b/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
index dc559ebc79b..c76aa03f636 100644
--- a/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
+++ b/app/graphql/resolvers/concerns/projects/look_ahead_preloads.rb
@@ -20,7 +20,9 @@ module Projects
         container_repositories: [:container_repositories],
         container_repositories_count: [:container_repositories],
         web_url: { namespace: [:route] },
-        is_catalog_resource: [:catalog_resource]
+        is_catalog_resource: [:catalog_resource],
+        open_merge_requests_count: [:project_feature],
+        organization_edit_path: [:organization]
       }
     end
   end
diff --git a/app/graphql/resolvers/work_items/description_template_content_resolver.rb b/app/graphql/resolvers/work_items/description_template_content_resolver.rb
new file mode 100644
index 00000000000..763caa99311
--- /dev/null
+++ b/app/graphql/resolvers/work_items/description_template_content_resolver.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Resolvers
+  module WorkItems
+    class DescriptionTemplateContentResolver < BaseResolver
+      type ::Types::WorkItems::DescriptionTemplateType, null: true
+
+      argument :template_content_input, ::Types::WorkItems::DescriptionTemplateContentInputType,
+        required: true,
+        description: "Input for fetching a specific Descriptiontemplate."
+
+      def resolve(args)
+        project = Project.find(args[:template_content_input].project_id)
+
+        ::TemplateFinder.new(:issues, project, { name: args[:template_content_input].name }).execute
+
+      rescue Gitlab::Template::Finders::RepoTemplateFinder::FileNotFoundError, ActiveRecord::RecordNotFound
+        nil
+      end
+    end
+  end
+end
diff --git a/app/graphql/resolvers/work_items/description_templates_resolver.rb b/app/graphql/resolvers/work_items/description_templates_resolver.rb
index ed562aab801..ab6a153ac14 100644
--- a/app/graphql/resolvers/work_items/description_templates_resolver.rb
+++ b/app/graphql/resolvers/work_items/description_templates_resolver.rb
@@ -7,7 +7,10 @@ module Resolvers
 
       argument :name, GraphQL::Types::String,
         required: false,
-        description: "Fetches the specific DescriptionTemplate."
+        description: "Fetches the specific DescriptionTemplate.",
+        deprecated: { milestone: '17.9',
+                      reason: 'name and project ID are both required for fetching,
+                       use DescriptionTemplateContentInputType instead' }
 
       argument :search, GraphQL::Types::String,
         required: false,
@@ -16,29 +19,58 @@ module Resolvers
 
       alias_method :namespace, :object
 
-      def resolve(**args)
-        project = fetch_templates_project(namespace)
-        return [] unless project
+      def resolve(**_args)
+        project = fetch_root_templates_project(namespace)
+        return unless project
 
-        template_name = args.delete(:name)
+        templates = Array.wrap(::TemplateFinder.new(:issues, project).execute)
 
-        Array.wrap(::TemplateFinder.new(:issues, project, { name: template_name }).execute)
+        filter_project_templates_for_group(templates) if namespace.is_a?(Group)
+
+        return if templates.blank?
+
+        templates
 
       rescue Gitlab::Template::Finders::RepoTemplateFinder::FileNotFoundError, ActiveRecord::RecordNotFound
-        []
       end
 
       private
 
-      def fetch_templates_project(namespace)
-        return namespace.project if namespace.is_a?(::Namespaces::ProjectNamespace)
+      # When we are at project level we return the project itself to fetch the description templates.
+      # When we are at group level we fetch first found file_template_project_id from the namespace or its ancestors
 
-        project = Project.find(namespace.file_template_project_id)
+      def fetch_root_templates_project(namespace)
+        if namespace.is_a?(::Namespaces::ProjectNamespace)
+          namespace.project
+        elsif namespace.is_a?(::Group)
+          Project.find(namespace.file_template_project_id)
+        end
+      end
 
-        return unless current_user&.can?(:read_project, project)
+      def filter_project_templates_for_group(templates)
+        # Separate project templates from other templates
+        project_templates, other_templates = templates.partition { |t| t.category == "Project Templates" }
 
-        project
+        # Check if we have duplicate project and group templates from TemplateFinder where
+        # project/group results match on name + content + project_id, meaning they refer to the same file
+        # but the category returned refers to the parent group of the project
+
+        has_equivalent_group_template = other_templates.any? do |other_template|
+          project_templates.any? do |project_template|
+            project_template.project_id == other_template.project_id &&
+              project_template.name == other_template.name &&
+              project_template.content == other_template.content &&
+              other_template.category == "Group #{Project.find(project_template.project_id)&.parent&.name}"
+          end
+        end
+
+        # If the duplicates in this case exist, we omit the project level duplicates
+        templates.reject! { |t| t.category == "Project Templates" } if has_equivalent_group_template
       end
     end
   end
 end
+
+# rubocop:disable Layout/LineLength -- prepend statement is too long
+Resolvers::WorkItems::DescriptionTemplatesResolver.prepend_mod_with('Resolvers::WorkItems::DescriptionTemplatesResolver')
+# rubocop:enable Layout/LineLength
diff --git a/app/graphql/types/query_type.rb b/app/graphql/types/query_type.rb
index 0cf6c0bef9c..45dd81c82d0 100644
--- a/app/graphql/types/query_type.rb
+++ b/app/graphql/types/query_type.rb
@@ -203,6 +203,13 @@ module Types
       experiment: { milestone: '15.1' },
       description: 'Find a work item.'
 
+    field :work_item_description_template_content, WorkItems::DescriptionTemplateType,
+      null: true,
+      resolver: Resolvers::WorkItems::DescriptionTemplateContentResolver,
+      experiment: { milestone: '17.9' },
+      description: 'Find a work item description template.',
+      calls_gitaly: true
+
     field :audit_event_definitions,
       Types::AuditEvents::DefinitionType.connection_type,
       null: false,
diff --git a/app/graphql/types/work_items/description_template_content_input_type.rb b/app/graphql/types/work_items/description_template_content_input_type.rb
new file mode 100644
index 00000000000..8a81eaa456c
--- /dev/null
+++ b/app/graphql/types/work_items/description_template_content_input_type.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Types
+  module WorkItems
+    class DescriptionTemplateContentInputType < BaseInputObject
+      graphql_name 'WorkItemDescriptionTemplateContentInput'
+
+      argument :name, GraphQL::Types::String,
+        required: true,
+        description: 'Name of the description template.'
+      argument :project_id, GraphQL::Types::Int,
+        required: true,
+        description: 'ID of the project the template belongs to.'
+    end
+  end
+end
diff --git a/app/graphql/types/work_items/description_template_type.rb b/app/graphql/types/work_items/description_template_type.rb
index a9049a1e3f4..4e0a720e862 100644
--- a/app/graphql/types/work_items/description_template_type.rb
+++ b/app/graphql/types/work_items/description_template_type.rb
@@ -9,9 +9,11 @@ module Types
       field :category, GraphQL::Types::String,
         description: 'Category of description template.', null: true, calls_gitaly: true
       field :content, GraphQL::Types::String,
-        description: 'Content of Description Template.', null: false, calls_gitaly: true
+        description: 'Content of Description Template.', null: true, calls_gitaly: true
       field :name, GraphQL::Types::String,
-        description: 'Name of Description Template.', null: false, calls_gitaly: true
+        description: 'Name of Description Template.', null: true, calls_gitaly: true
+      field :project_id, GraphQL::Types::Int,
+        description: 'ID of the description template project.', null: true, calls_gitaly: true
     end
     # rubocop: enable Graphql/AuthorizeTypes
   end
diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index b5e01558fed..fdaa6f8a718 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -331,14 +331,6 @@ module Ci
       end
     end
 
-    # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-    def self.sharded_table_proxy_model
-      @sharded_table_proxy_class ||= Class.new(self) do
-        self.table_name = :ci_runners_e59bb2812d
-        self.primary_key = :id
-      end
-    end
-
     def self.taggings_join_model
       ::Ci::RunnerTagging
     end
@@ -450,14 +442,6 @@ module Ci
       tag_list.any?
     end
 
-    # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-    def ensure_partitioned_runner_record_exists
-      self.class.sharded_table_proxy_model.insert_all(
-        [attributes.except('tag_list')], unique_by: [:id, :runner_type],
-        returning: false, record_timestamps: false
-      )
-    end
-
     def predefined_variables
       Gitlab::Ci::Variables::Collection.new
         .append(key: 'CI_RUNNER_ID', value: id.to_s)
@@ -544,10 +528,6 @@ module Ci
     def ensure_manager(system_xid)
       # rubocop: disable Performance/ActiveRecordSubtransactionMethods -- This is used only in API endpoints outside of transactions
       RunnerManager.safe_find_or_create_by!(runner_id: id, system_xid: system_xid.to_s) do |m|
-        # Avoid inserting partitioned runner managers that refer to a missing ci_runners partitioned record, since
-        # the backfill is not yet finalized.
-        ensure_partitioned_runner_record_exists
-
         m.runner_type = runner_type
         m.sharding_key_id = sharding_key_id
       end
diff --git a/config/feature_flags/gitlab_com_derisk/fe_search_build_by_name.yml b/config/feature_flags/beta/fe_search_build_by_name.yml
similarity index 93%
rename from config/feature_flags/gitlab_com_derisk/fe_search_build_by_name.yml
rename to config/feature_flags/beta/fe_search_build_by_name.yml
index d8144515b8c..671f711e574 100644
--- a/config/feature_flags/gitlab_com_derisk/fe_search_build_by_name.yml
+++ b/config/feature_flags/beta/fe_search_build_by_name.yml
@@ -5,5 +5,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177192
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/512149
 milestone: '17.8'
 group: group::pipeline execution
-type: gitlab_com_derisk
+type: beta
 default_enabled: false
diff --git a/config/feature_flags/gitlab_com_derisk/populate_and_use_build_names_table.yml b/config/feature_flags/beta/populate_and_use_build_names_table.yml
similarity index 91%
rename from config/feature_flags/gitlab_com_derisk/populate_and_use_build_names_table.yml
rename to config/feature_flags/beta/populate_and_use_build_names_table.yml
index c87b32a6f4a..df0b934b416 100644
--- a/config/feature_flags/gitlab_com_derisk/populate_and_use_build_names_table.yml
+++ b/config/feature_flags/beta/populate_and_use_build_names_table.yml
@@ -2,8 +2,8 @@
 name: populate_and_use_build_names_table
 feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/423904
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/147699
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/451594
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/512149
 milestone: '16.11'
 group: group::pipeline execution
-type: gitlab_com_derisk
+type: beta
 default_enabled: false
diff --git a/data/deprecations/17-9-enable-gitlab-advanced-sast-by-default.yml b/data/deprecations/17-9-enable-gitlab-advanced-sast-by-default.yml
new file mode 100644
index 00000000000..e36137a8753
--- /dev/null
+++ b/data/deprecations/17-9-enable-gitlab-advanced-sast-by-default.yml
@@ -0,0 +1,22 @@
+- title: "GitLab Advanced SAST will be enabled by default"
+  removal_milestone: "18.0"
+  announcement_milestone: "17.9"
+  breaking_change: true
+  window: 1
+  reporter: adamcohen
+  stage: application security testing
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/513685
+  impact: medium
+  scope: instance
+  resolution_role: Developer
+  manual_task: true
+  body: |  # (required) Don't change this line.
+    In GitLab 18.0, we will update the [SAST CI/CD templates](https://docs.gitlab.com/ee/user/application_security/sast#stable-vs-latest-sast-templates) to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast) by default in projects with GitLab Ultimate.
+    Before this change, the GitLab Advanced SAST analyzer was enabled only if you set the CI/CD variable `GITLAB_ADVANCED_SAST_ENABLED` to `true`.
+
+    Advanced SAST delivers more accurate results by using cross-file, cross-function scanning and a new ruleset.
+    Advanced SAST takes over coverage for [supported languages](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast#supported-languages) and disables scanning for that language in the previous scanner.
+    An automated process migrates results from previous scanners after the first scan on each project's default branch, if they're still detected.
+
+    Because it scans your project in more detail, Advanced SAST may take more time to scan your project.
+    If needed, you can [disable GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast#disable-gitlab-advanced-sast-scanning) by setting the CI/CD variable `GITLAB_ADVANCED_SAST_ENABLED` to `false`.
diff --git a/db/post_migrate/20250130100818_remove_cloud_connector_keys_from_application_settings_if_exists.rb b/db/post_migrate/20250130100818_remove_cloud_connector_keys_from_application_settings_if_exists.rb
new file mode 100644
index 00000000000..07251ea40cd
--- /dev/null
+++ b/db/post_migrate/20250130100818_remove_cloud_connector_keys_from_application_settings_if_exists.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class RemoveCloudConnectorKeysFromApplicationSettingsIfExists < Gitlab::Database::Migration[2.2]
+  milestone '17.9'
+
+  # Follow-up to RemoveCloudConnectorKeysFromApplicationSettings.
+  #
+  # This actually removes a column that was added in a previous migration where we had
+  # to make this a no-op due to a production issue.
+  # See https://gitlab.com/gitlab-com/gl-infra/production/-/issues/19182
+  def up
+    remove_column(:application_settings, :cloud_connector_keys, if_exists: true)
+  end
+
+  def down
+    # no-op since the original migration was turned to a no-op and we don't want to
+    # add this column back. It was never used.
+  end
+end
diff --git a/db/schema_migrations/20250130100818 b/db/schema_migrations/20250130100818
new file mode 100644
index 00000000000..53340f88e34
--- /dev/null
+++ b/db/schema_migrations/20250130100818
@@ -0,0 +1 @@
+27a9652609620958c529b36430e45199fcee17abfe6a1893719a7663dd48e508
\ No newline at end of file
diff --git a/doc/administration/incoming_email.md b/doc/administration/incoming_email.md
index 544fa406d6b..9cef8d3470f 100644
--- a/doc/administration/incoming_email.md
+++ b/doc/administration/incoming_email.md
@@ -121,7 +121,7 @@ and use [an application password](https://support.google.com/mail/answer/185833)
 
 If you want to use Office 365, and two-factor authentication is enabled, make sure
 you're using an
-[app password](https://support.microsoft.com/en-us/account-billing/manage-app-passwords-for-two-step-verification-d6dc8c6d-4bf7-4851-ad95-6d07799387e9)
+[app password](https://support.microsoft.com/en-us/account-billing/app-passwords-for-a-work-or-school-account-d6dc8c6d-4bf7-4851-ad95-6d07799387e9)
 instead of the regular password for the mailbox.
 
 To set up a basic Postfix mail server with IMAP access on Ubuntu, follow the
@@ -808,7 +808,7 @@ incoming_email:
 #### Microsoft Graph
 
 GitLab can read incoming email using the Microsoft Graph API instead of
-IMAP. Because [Microsoft is deprecating IMAP usage with Basic Authentication](https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-oauth-2-0-support-for-imap-and-smtp-auth-protocols-in/ba-p/1330432), the Microsoft Graph API is be required for new Microsoft Exchange Online mailboxes.
+IMAP. Because [Microsoft is deprecating IMAP usage with Basic Authentication](https://techcommunity.microsoft.com/blog/exchange/announcing-oauth-2-0-support-for-imap-and-smtp-auth-protocols-in-exchange-online/1330432), the Microsoft Graph API is be required for new Microsoft Exchange Online mailboxes.
 
 To configure GitLab for Microsoft Graph, you need to register an
 OAuth 2.0 application in your Azure Active Directory that has the
diff --git a/doc/administration/load_balancer.md b/doc/administration/load_balancer.md
index 8a9cfcb984e..daace3d7784 100644
--- a/doc/administration/load_balancer.md
+++ b/doc/administration/load_balancer.md
@@ -128,7 +128,7 @@ Using the `all=1` parameter with the readiness check in GitLab versions 15.4 to
 
 If you are using the [AWS Classic Load Balancer](https://docs.aws.amazon.com/en_en/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html#ssl-ciphers)
 in GitLab 15.0 or later, you must to enable the `AES256-GCM-SHA384` cipher in NGINX.
-See [AES256-GCM-SHA384 SSL cipher no longer allowed by default by NGINX](https://docs.gitlab.com/omnibus/update/gitlab_15_changes.html#aes256-gcm-sha384-ssl-cipher-no-longer-allowed-by-default-by-nginx)
+See [AES256-GCM-SHA384 SSL cipher no longer allowed by default by NGINX](../update/versions/gitlab_15_changes.md#1500)
 for more information.
 
 The default ciphers for a GitLab version can be
diff --git a/doc/administration/object_storage.md b/doc/administration/object_storage.md
index 99255a40ab6..fc2c4c75ffc 100644
--- a/doc/administration/object_storage.md
+++ b/doc/administration/object_storage.md
@@ -257,7 +257,7 @@ To set up an instance profile:
 
 When configured either with an instance profile or with the consolidated
 form, GitLab Workhorse properly uploads files to S3
-buckets that have [SSE-S3 or SSE-KMS encryption enabled by default](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html).
+buckets that have [SSE-S3 or SSE-KMS encryption enabled by default](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html).
 AWS KMS keys and SSE-C encryption are
 [not supported since this requires sending the encryption keys in every request](https://gitlab.com/gitlab-org/gitlab/-/issues/226006).
 
@@ -272,7 +272,7 @@ in the `storage_options` configuration section:
 | Setting                             | Description                              |
 |-------------------------------------|------------------------------------------|
 | `server_side_encryption`            | Encryption mode (`AES256` or `aws:kms`). |
-| `server_side_encryption_kms_key_id` | Amazon Resource Name. Only needed when `aws:kms` is used in `server_side_encryption`. See the [Amazon documentation on using KMS encryption](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html). |
+| `server_side_encryption_kms_key_id` | Amazon Resource Name. Only needed when `aws:kms` is used in `server_side_encryption`. See the [Amazon documentation on using KMS encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html). |
 
 As with the case for default encryption, these options only work when
 the Workhorse S3 client is enabled. One of the following two conditions
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 1453ff25e2a..feec178ccf1 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1505,6 +1505,22 @@ Returns [`WorkItem`](#workitem).
 | ---- | ---- | ----------- |
 | <a id="queryworkitemid"></a>`id` | [`WorkItemID!`](#workitemid) | Global ID of the work item. |
 
+### `Query.workItemDescriptionTemplateContent`
+
+Find a work item description template.
+
+DETAILS:
+**Introduced** in GitLab 17.9.
+**Status**: Experiment.
+
+Returns [`WorkItemDescriptionTemplate`](#workitemdescriptiontemplate).
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="queryworkitemdescriptiontemplatecontenttemplatecontentinput"></a>`templateContentInput` | [`WorkItemDescriptionTemplateContentInput!`](#workitemdescriptiontemplatecontentinput) | Input for fetching a specific Descriptiontemplate. |
+
 ### `Query.workItemsByReference`
 
 Find work items by their reference.
@@ -27094,7 +27110,7 @@ four standard [pagination arguments](#pagination-arguments):
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="groupworkitemdescriptiontemplatesname"></a>`name` | [`String`](#string) | Fetches the specific DescriptionTemplate. |
+| <a id="groupworkitemdescriptiontemplatesname"></a>`name` **{warning-solid}** | [`String`](#string) | **Deprecated** in GitLab 17.9. name and project ID are both required for fetching, use DescriptionTemplateContentInputType instead. |
 | <a id="groupworkitemdescriptiontemplatessearch"></a>`search` **{warning-solid}** | [`String`](#string) | **Deprecated** in GitLab 17.8. search on template names is performed on the FE only. |
 
 ##### `Group.workItemStateCounts`
@@ -31054,7 +31070,7 @@ four standard [pagination arguments](#pagination-arguments):
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="namespaceworkitemdescriptiontemplatesname"></a>`name` | [`String`](#string) | Fetches the specific DescriptionTemplate. |
+| <a id="namespaceworkitemdescriptiontemplatesname"></a>`name` **{warning-solid}** | [`String`](#string) | **Deprecated** in GitLab 17.9. name and project ID are both required for fetching, use DescriptionTemplateContentInputType instead. |
 | <a id="namespaceworkitemdescriptiontemplatessearch"></a>`search` **{warning-solid}** | [`String`](#string) | **Deprecated** in GitLab 17.8. search on template names is performed on the FE only. |
 
 ##### `Namespace.workItemTypes`
@@ -38495,8 +38511,9 @@ Returns [`String!`](#string).
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="workitemdescriptiontemplatecategory"></a>`category` | [`String`](#string) | Category of description template. |
-| <a id="workitemdescriptiontemplatecontent"></a>`content` | [`String!`](#string) | Content of Description Template. |
-| <a id="workitemdescriptiontemplatename"></a>`name` | [`String!`](#string) | Name of Description Template. |
+| <a id="workitemdescriptiontemplatecontent"></a>`content` | [`String`](#string) | Content of Description Template. |
+| <a id="workitemdescriptiontemplatename"></a>`name` | [`String`](#string) | Name of Description Template. |
+| <a id="workitemdescriptiontemplateprojectid"></a>`projectId` | [`Int`](#int) | ID of the description template project. |
 
 ### `WorkItemLinkedResource`
 
@@ -46192,6 +46209,15 @@ Attributes for value stream stage.
 | <a id="workitemconverttaskinputtitle"></a>`title` | [`String!`](#string) | Full string of the task to be replaced. New title for the created work item. |
 | <a id="workitemconverttaskinputworkitemtypeid"></a>`workItemTypeId` | [`WorkItemsTypeID!`](#workitemstypeid) | Global ID of the work item type used to create the new work item. |
 
+### `WorkItemDescriptionTemplateContentInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="workitemdescriptiontemplatecontentinputname"></a>`name` | [`String!`](#string) | Name of the description template. |
+| <a id="workitemdescriptiontemplatecontentinputprojectid"></a>`projectId` | [`Int!`](#int) | ID of the project the template belongs to. |
+
 ### `WorkItemResolveDiscussionsInput`
 
 #### Arguments
diff --git a/doc/api/group_access_tokens.md b/doc/api/group_access_tokens.md
index 067fdd9da0e..d841547fc41 100644
--- a/doc/api/group_access_tokens.md
+++ b/doc/api/group_access_tokens.md
@@ -244,7 +244,7 @@ DELETE /groups/:id/access_tokens/:token_id
 | `token_id` | integer           | yes      | ID of a group access token. |
 
 ```shell
-curl --request DELETE
+curl --request DELETE \
   --header "PRIVATE-TOKEN: <your_access_token>" \
   --url "https://gitlab.example.com/api/v4/groups/<group_id>/access_tokens/<token_id>"
 ```
diff --git a/doc/api/personal_access_tokens.md b/doc/api/personal_access_tokens.md
index df5bcc40ff0..fc21e61a7b3 100644
--- a/doc/api/personal_access_tokens.md
+++ b/doc/api/personal_access_tokens.md
@@ -59,7 +59,9 @@ Supported attributes:
 Example request:
 
 ```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens"
 ```
 
 Example response:
@@ -86,7 +88,9 @@ Example response:
 Example request:
 
 ```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens?user_id=3"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens?user_id=3"
 ```
 
 Example response:
@@ -113,7 +117,9 @@ Example response:
 Example request:
 
 ```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens?revoked=true"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens?revoked=true"
 ```
 
 Example response:
@@ -166,7 +172,9 @@ GET /personal_access_tokens/:id
 | `id` | integer/string | yes | ID of personal access token |
 
 ```shell
-curl --request GET --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/<id>"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/<id>"
 ```
 
 #### Responses
@@ -189,7 +197,9 @@ GET /personal_access_tokens/self
 ```
 
 ```shell
-curl --request GET --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/self"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/self"
 ```
 
 Example response:
@@ -239,7 +249,9 @@ NOTE:
 Non-administrators can rotate their own tokens. Administrators can rotate tokens of any user.
 
 ```shell
-curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/<personal_access_token_id>/rotate"
+curl --request POST \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/<personal_access_token_id>/rotate"
 ```
 
 Example response:
@@ -284,7 +296,9 @@ POST /personal_access_tokens/self/rotate
 ```
 
 ```shell
-curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/self/rotate"
+curl --request POST \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/self/rotate"
 ```
 
 Example response:
@@ -355,7 +369,9 @@ NOTE:
 Non-administrators can revoke their own tokens. Administrators can revoke tokens of any user.
 
 ```shell
-curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/<personal_access_token_id>"
+curl --request DELETE \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/<personal_access_token_id>"
 ```
 
 #### Responses
@@ -380,7 +396,9 @@ DELETE /personal_access_tokens/self
 ```
 
 ```shell
-curl --request DELETE --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/self"
+curl --request DELETE \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/self"
 ```
 
 #### Responses
@@ -412,7 +430,9 @@ Supported attributes:
 Example request:
 
 ```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/personal_access_tokens/self/associations"
+curl --request GET \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/personal_access_tokens/self/associations"
 ```
 
 Example response:
diff --git a/doc/api/project_access_tokens.md b/doc/api/project_access_tokens.md
index a26e4bdd9a5..dfc8890586a 100644
--- a/doc/api/project_access_tokens.md
+++ b/doc/api/project_access_tokens.md
@@ -32,8 +32,8 @@ GET projects/:id/access_tokens?state=inactive
 
 ```shell
 curl --request GET \
- --header "PRIVATE-TOKEN: <your_access_token>" \
- --url "https://gitlab.example.com/api/v4/projects/<project_id>/access_tokens"
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/projects/<project_id>/access_tokens"
 ```
 
 ```json
diff --git a/doc/api/project_import_export.md b/doc/api/project_import_export.md
index f2501446457..5db32423f5c 100644
--- a/doc/api/project_import_export.md
+++ b/doc/api/project_import_export.md
@@ -370,7 +370,7 @@ POST /projects/remote-import-s3
 | `file_key`          | string         | yes      | [AWS S3 file key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingObjects.html) to identify the file. |
 | `path`              | string         | yes      | The full path of the new project. |
 | `region`            | string         | yes      | [AWS S3 region name](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html#Regions) where the file is stored. |
-| `secret_access_key` | string         | yes      | [AWS S3 secret access key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys). |
+| `secret_access_key` | string         | yes      | [AWS S3 secret access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#access-keys-and-secret-access-keys). |
 | `name`              | string         | no       | The name of the project to import. If not provided, defaults to the path of the project. |
 | `namespace`         | integer or string | no       | The ID or path of the namespace to import the project to. Defaults to the current user's namespace. |
 
diff --git a/doc/development/ai_architecture.md b/doc/development/ai_architecture.md
index 80f8f6ee6a4..40610166bd1 100644
--- a/doc/development/ai_architecture.md
+++ b/doc/development/ai_architecture.md
@@ -106,7 +106,7 @@ It is possible to utilize other models or technologies, however they will need t
 The following models have been approved for use:
 
 - Google's [Vertex AI](https://cloud.google.com/vertex-ai) and [model garden](https://cloud.google.com/model-garden)
-- [Anthropic models](https://docs.anthropic.com/claude/docs/models-overview)
+- [Anthropic models](https://docs.anthropic.com/en/docs/about-claude/models)
 - [Suggested reviewer](https://gitlab.com/gitlab-org/modelops/applied-ml/applied-ml-updates/-/issues/10)
 
 ### Embeddings
diff --git a/doc/development/api_graphql_styleguide.md b/doc/development/api_graphql_styleguide.md
index 533b210de51..2cddc4cb28c 100644
--- a/doc/development/api_graphql_styleguide.md
+++ b/doc/development/api_graphql_styleguide.md
@@ -22,7 +22,7 @@ Backend engineers who wish to learn GraphQL at GitLab should read this guide in
 [guides for the GraphQL Ruby gem](https://graphql-ruby.org/guides).
 Those guides teach you the features of the gem, and the information in it is generally not reproduced here.
 
-To learn about the design and features of GraphQL itself read [the guide on `graphql.org`](https://graphql.org/learn)
+To learn about the design and features of GraphQL itself read [the guide on `graphql.org`](https://graphql.org/learn/)
 which is an accessible but shortened version of information in the [GraphQL spec](https://spec.graphql.org).
 
 ### Deep Dive
diff --git a/doc/development/api_styleguide.md b/doc/development/api_styleguide.md
index f242492422d..458ef25bf38 100644
--- a/doc/development/api_styleguide.md
+++ b/doc/development/api_styleguide.md
@@ -31,7 +31,7 @@ to access them as we do in Rails views), local variables are fine.
 
 ## Entities
 
-Always use an [Entity](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/api/entities) to present the endpoint's payload.
+Always use an [Entity](https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/api/entities) to present the endpoint's payload.
 
 ## Documentation
 
@@ -349,7 +349,7 @@ them to platform for further processing. It saves some back-and-forth
 from the server to the platform if we identify invalid parameters at the beginning.
 
 If you need to add a custom validator, it would be added to
-it's own file in the [`validators`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/api/validations/validators) directory.
+it's own file in the [`validators`](https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/api/validations/validators) directory.
 Since we use [Grape](https://github.com/ruby-grape/grape) to add our API
 we inherit from the `Grape::Validations::Validators::Base` class in our validator class.
 Now, all you have to do is define the `validate_param!` method which takes
@@ -365,7 +365,7 @@ Grape::Validations.register_validator(<validator name as symbol>, ::API::Helpers
 ```
 
 Once you add the validator, make sure you add the `rspec`s for it into
-it's own file in the [`validators`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/spec/lib/api/validations/validators) directory.
+it's own file in the [`validators`](https://gitlab.com/gitlab-org/gitlab/-/tree/master/spec/lib/api/validations/validators) directory.
 
 ## Internal API
 
diff --git a/doc/development/cascading_settings.md b/doc/development/cascading_settings.md
index e47d401eef2..f7a757bbbf7 100644
--- a/doc/development/cascading_settings.md
+++ b/doc/development/cascading_settings.md
@@ -218,7 +218,7 @@ Renders the label for a `fieldset` setting.
 | `settings_path_helper` | Lambda function that generates a path to the ancestor setting. For example, `-> (locked_ancestor) { edit_group_path(locked_ancestor, anchor: 'js-permissions-settings') }`                                           | `Lambda`             | `true`                   |
 | `help_text`            | Text shown below the checkbox.                                                                                                                                                                                       | `String`             | `false` (`nil`)          |
 
-[`_lock_tooltips.html.haml`](https://gitlab.com/gitlab-org/gitlab/-/blob/b73353e47e283a7d9c9eda5bdedb345dcfb685b6/app/views/shared/namespaces/cascading_settings/_lock_tooltips.html.haml)
+[`_lock_tooltips.html.haml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/views/shared/namespaces/cascading_settings/_lock_tooltips.html.haml)
 
 Renders the mount element needed to initialize the JavaScript used to display the tooltip when hovering over the lock icon. This partial is only needed once per page.
 
diff --git a/doc/development/chatops_on_gitlabcom.md b/doc/development/chatops_on_gitlabcom.md
index c959b428845..68fb3240a39 100644
--- a/doc/development/chatops_on_gitlabcom.md
+++ b/doc/development/chatops_on_gitlabcom.md
@@ -26,7 +26,7 @@ To request access to ChatOps on GitLab.com:
    - Selecting the **Sign in with Google** button to sign in with your GitLab.com email address.
 
 1. Confirm that your username in [Internal GitLab for Operations](https://ops.gitlab.net/)
-   is the same as your username in [GitLab.com](https://gitlab.com/). If the usernames
+   is the same as your username in [GitLab.com](https://gitlab.com). If the usernames
    don't match, update the username in [User Settings/Account for the Ops instance](https://ops.gitlab.net/-/profile/account). Matching usernames are required to reduce the administrative effort of running multiple platforms. Matching usernames also help with tasks like managing access requests and offboarding.
 
 1. Comment in your onboarding issue, and tag your onboarding buddy and your manager.
diff --git a/doc/development/documentation/site_architecture/global_nav.md b/doc/development/documentation/site_architecture/global_nav.md
index f6212ac157f..bf5517b4659 100644
--- a/doc/development/documentation/site_architecture/global_nav.md
+++ b/doc/development/documentation/site_architecture/global_nav.md
@@ -238,15 +238,6 @@ Example with multiple docs:
       doc_url: 'doc-2-link'
 ```
 
-If you need to add a document in an external URL, add the attribute `external_url`
-below the doc link:
-
-```yaml
-- doc_title: Document 2 title
-  doc_url: 'doc-2-link'
-  external_url: true
-```
-
 All nav links are selectable. If the higher-level link does not have a link
 of its own, it must link to its first sub-item link, mimicking the navigation in GitLab.
 This must be avoided so that we don't have duplicated links nor two `.active` links
@@ -278,7 +269,7 @@ and the following syntax rules.
 
 ##### URLs
 
-URLs can be either relative or external, and the following apply:
+URLs must be relative. In addition:
 
 - All links in the data file must end with `.html` (with the exception
   of `index.html` files), and not `.md`.
@@ -287,14 +278,8 @@ URLs can be either relative or external, and the following apply:
 - As convention, always wrap URLs in single quotes `'url'`.
 - Always use the project prefix depending on which project the link you add
   lives in. To find the global nav link, from the full URL remove `https://docs.gitlab.com/`.
-- If a URL links to an external URL, like the [GitLab Design System](https://design.gitlab.com),
-  add the attribute `external_url: true`, for example:
-
-  ```yaml
-  - category_title: GitLab Design System
-    category_url: 'https://design.gitlab.com'
-    external_url: true
-  ```
+- Do not link to external URLs. We don't have link checking for external URLs, and
+  leaving the docs site by clicking the left navigation is a confusing user experience.
 
 Examples of relative URLs:
 
diff --git a/doc/development/features_inside_dot_gitlab.md b/doc/development/features_inside_dot_gitlab.md
index b3e0efddcb3..49b7e2e6152 100644
--- a/doc/development/features_inside_dot_gitlab.md
+++ b/doc/development/features_inside_dot_gitlab.md
@@ -11,7 +11,7 @@ When implementing new features, refer to these existing features to avoid confli
 
 - [Issue Templates](../user/project/description_templates.md#create-an-issue-template): `.gitlab/issue_templates/`.
 - [Merge request Templates](../user/project/description_templates.md#create-a-merge-request-template): `.gitlab/merge_request_templates/`.
-- [GitLab agent](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/blob/master/doc/configuration_repository.md#layout): `.gitlab/agents/`.
+- [GitLab agent](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent): `.gitlab/agents/`.
 - [CODEOWNERS](../user/project/codeowners/index.md#set-up-code-owners): `.gitlab/CODEOWNERS`.
 - [Route Maps](../ci/review_apps/index.md#route-maps): `.gitlab/route-map.yml`.
 - [Customize Auto DevOps Helm Values](../topics/autodevops/customize.md#customize-helm-chart-values): `.gitlab/auto-deploy-values.yaml`.
diff --git a/doc/development/index.md b/doc/development/index.md
index b3a3729ed10..d07a6b1a382 100644
--- a/doc/development/index.md
+++ b/doc/development/index.md
@@ -15,5 +15,5 @@ This content is intended for both GitLab team members and members of the wider c
 - [Contribute to GitLab Runner development](https://docs.gitlab.com/runner/development/)
 - [Contribute to GitLab Pages development](pages/index.md)
 - [Contribute to GitLab distribution development](distribution/index.md)
-- [Contribute to the GitLab Design System](https://design.gitlab.com/get-started/contributing)
+- [Contribute to the GitLab Design System](https://design.gitlab.com/get-started/contributing/)
 - [Contribute to the GitLab documentation](documentation/index.md)
diff --git a/doc/development/tracing.md b/doc/development/tracing.md
index 5101455e88a..bdd51068a6b 100644
--- a/doc/development/tracing.md
+++ b/doc/development/tracing.md
@@ -26,7 +26,7 @@ This feature is available for testing, but not ready for production use.
 
 With distributed tracing, you can troubleshoot application performance issues by inspecting how a request moves through different services and systems, the timing of each operation, and any errors or logs as they occur. Tracing is particularly useful in the context of microservice applications, which group multiple independent services collaborating to fulfill user requests.
 
-This feature is in [beta](../policy/development_stages_support.md). For more information, see the [group direction page](https://about.gitlab.com/direction/monitor/observability/). To leave feedback about tracing bugs or functionality, comment in the [feedback issue](https://gitlab.com/gitlab-org/opstrace/opstrace/-/issues/2590) or open a [new issue](https://gitlab.com/gitlab-org/opstrace/opstrace/-/issues/new).
+This feature is in [beta](../policy/development_stages_support.md). For more information, see the [group direction page](https://about.gitlab.com/direction/monitor/platform-insights/). To leave feedback about tracing bugs or functionality, comment in the [feedback issue](https://gitlab.com/gitlab-org/opstrace/opstrace/-/issues/2590) or open a [new issue](https://gitlab.com/gitlab-org/opstrace/opstrace/-/issues/new).
 
 ## Tracing ingestion limits
 
diff --git a/doc/development/ux/index.md b/doc/development/ux/index.md
index 032853cb7c1..efe00c92e38 100644
--- a/doc/development/ux/index.md
+++ b/doc/development/ux/index.md
@@ -16,7 +16,7 @@ You may leverage the [Pajamas UI Kit](https://www.figma.com/community/file/78115
 
 ## Contributing to Pajamas
 
-To contribute to [Pajamas design system](https://design.gitlab.com/) and the [UI kit](https://www.figma.com/community/file/781156790581391771/component-library), follow the [contribution guidelines](https://design.gitlab.com/get-started/contributing) documented in the handbook. While the instructions are code-focused, they will help you understand the overall process of contributing.
+To contribute to [Pajamas design system](https://design.gitlab.com/) and the [UI kit](https://www.figma.com/community/file/781156790581391771/component-library), follow the [contribution guidelines](https://design.gitlab.com/get-started/contributing/) documented in the handbook. While the instructions are code-focused, they will help you understand the overall process of contributing.
 
 ## Contributing to other issues
 
diff --git a/doc/integration/clickhouse.md b/doc/integration/clickhouse.md
index a77402984a7..cd26d996d7d 100644
--- a/doc/integration/clickhouse.md
+++ b/doc/integration/clickhouse.md
@@ -23,7 +23,7 @@ To set up ClickHouse as the GitLab data storage:
 
 ### Run and configure ClickHouse
 
-The most straightforward way to run ClickHouse is with [ClickHouse Cloud](https://clickhouse.cloud/).
+The most straightforward way to run ClickHouse is with [ClickHouse Cloud](https://console.clickhouse.cloud/).
 You can also [run ClickHouse on your own server](https://clickhouse.com/docs/en/install). Refer to the ClickHouse
 documentation regarding [recommendations for self-managed instances](https://clickhouse.com/docs/en/install#recommendations-for-self-managed-clickhouse).
 
diff --git a/doc/update/breaking_windows.md b/doc/update/breaking_windows.md
index 7f40a3d69e5..f6e0352b911 100644
--- a/doc/update/breaking_windows.md
+++ b/doc/update/breaking_windows.md
@@ -50,6 +50,7 @@ This window takes place on April 21 - 23, 2025 from 09:00 UTC to 22:00 UTC.
 | [`maxHoursBeforeTermination` GraphQL field is deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/509787) | Low | Create | Project |
 | [`RemoteDevelopmentAgentConfig` GraphQL type is deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/509787) | Low | Create | Project |
 | [`defaultMaxHoursBeforeTermination` and `maxHoursBeforeTerminationLimit` fields are deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/509787) | Low | Create | Project |
+| [GitLab Advanced SAST will be enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/513685) | Medium | Application security testing | Instance |
 | [SAST jobs no longer use global cache settings](https://gitlab.com/gitlab-org/gitlab/-/issues/512564) | Medium | Application security testing | Instance |
 | [Application Security Testing analyzers major version update](https://gitlab.com/gitlab-org/gitlab/-/issues/513417) | Low | Application security testing | Project |
 
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index f395aab324b..ef59de7603f 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -696,6 +696,30 @@ To fix a typo in an audit event type, in GitLab 18.0 we'll rename the `user_prof
 
 <div class="deprecation breaking-change" data-milestone="18.0">
 
+### GitLab Advanced SAST will be enabled by default
+
+<div class="deprecation-notes">
+
+- Announced in GitLab <span class="milestone">17.9</span>
+- Removal in GitLab <span class="milestone">18.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/513685).
+
+</div>
+
+In GitLab 18.0, we will update the [SAST CI/CD templates](https://docs.gitlab.com/ee/user/application_security/sast#stable-vs-latest-sast-templates) to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast) by default in projects with GitLab Ultimate.
+Before this change, the GitLab Advanced SAST analyzer was enabled only if you set the CI/CD variable `GITLAB_ADVANCED_SAST_ENABLED` to `true`.
+
+Advanced SAST delivers more accurate results by using cross-file, cross-function scanning and a new ruleset.
+Advanced SAST takes over coverage for [supported languages](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast#supported-languages) and disables scanning for that language in the previous scanner.
+An automated process migrates results from previous scanners after the first scan on each project's default branch, if they're still detected.
+
+Because it scans your project in more detail, Advanced SAST may take more time to scan your project.
+If needed, you can [disable GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast#disable-gitlab-advanced-sast-scanning) by setting the CI/CD variable `GITLAB_ADVANCED_SAST_ENABLED` to `false`.
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="18.0">
+
 ### GitLab Runner platforms and setup instructions in GraphQL API
 
 <div class="deprecation-notes">
diff --git a/doc/user/application_security/sast/gitlab_advanced_sast.md b/doc/user/application_security/sast/gitlab_advanced_sast.md
index 9289b148370..a814e3cc014 100644
--- a/doc/user/application_security/sast/gitlab_advanced_sast.md
+++ b/doc/user/application_security/sast/gitlab_advanced_sast.md
@@ -136,6 +136,13 @@ To enable GitLab Advanced SAST by using the pipeline editor:
 
 Pipelines now include a GitLab Advanced SAST job.
 
+### Disable GitLab Advanced SAST scanning
+
+Advanced SAST scanning is not enabled by default, but it may be enabled at the group level or in another way that affects multiple projects.
+
+To explicitly disable Advanced SAST scanning in a project, set the CI/CD variable `GITLAB_ADVANCED_SAST_ENABLED` to `false`.
+You can set this variable anywhere you can configure CI/CD variables, including the same ways you can [enable Advanced SAST scanning](#enable-gitlab-advanced-sast-scanning).
+
 ## Vulnerability code flow
 
 > - Introduced in GitLab 17.3 [with several flags](../../../administration/feature_flags.md). Enabled by default.
diff --git a/doc/user/gitlab_duo/data_usage.md b/doc/user/gitlab_duo/data_usage.md
index ab8533c17fe..d9ab138e90c 100644
--- a/doc/user/gitlab_duo/data_usage.md
+++ b/doc/user/gitlab_duo/data_usage.md
@@ -40,7 +40,7 @@ GitLab does not train generative AI models.
 For more information on our AI [sub-processors](https://about.gitlab.com/privacy/subprocessors/#third-party-sub-processors), see:
 
 - Google Vertex AI models API [data governance](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance), [responsible AI](https://cloud.google.com/vertex-ai/generative-ai/docs/learn/responsible-ai), [details about foundation model training](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance#foundation_model_training), Google [Secure AI Framework (SAIF)](https://safety.google/cybersecurity-advancements/saif/), and [release notes](https://cloud.google.com/vertex-ai/docs/release-notes).
-- Anthropic Claude's [constitution](https://www.anthropic.com/news/claudes-constitution), training data [FAQ](https://support.anthropic.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training), [models overview](https://docs.anthropic.com/claude/docs/models-overview), and [data recency article](https://support.anthropic.com/en/articles/8114494-how-up-to-date-is-claude-s-training-data).
+- Anthropic Claude's [constitution](https://www.anthropic.com/news/claudes-constitution), training data [FAQ](https://support.anthropic.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training), [models overview](https://docs.anthropic.com/en/docs/about-claude/models), and [data recency article](https://support.anthropic.com/en/articles/8114494-how-up-to-date-is-claude-s-training-data).
 
 ## Telemetry
 
diff --git a/lib/api/ci/helpers/runner.rb b/lib/api/ci/helpers/runner.rb
index 429f6a4627d..7dd3d804450 100644
--- a/lib/api/ci/helpers/runner.rb
+++ b/lib/api/ci/helpers/runner.rb
@@ -12,9 +12,6 @@ module API
         JOB_TOKEN_PARAM = :token
         LEGACY_SYSTEM_XID = '<legacy>'
 
-        # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-        UnknownRunnerOwnerError = Class.new(StandardError)
-
         def authenticate_runner!(ensure_runner_manager: true, update_contacted_at: true)
           track_runner_authentication
           forbidden! unless current_runner
@@ -56,9 +53,6 @@ module API
         end
 
         def current_runner_manager
-          # NOTE: Avoid orphaned runners, since we're not allowed to created records with a nil sharding_key_id
-          raise UnknownRunnerOwnerError if !current_runner.instance_type? && current_runner.sharding_key_id.nil?
-
           strong_memoize(:current_runner_manager) do
             system_xid = params.fetch(:system_id, LEGACY_SYSTEM_XID)
             current_runner&.ensure_manager(system_xid)
diff --git a/lib/api/ci/runner.rb b/lib/api/ci/runner.rb
index de71077ad11..b19ff706fcd 100644
--- a/lib/api/ci/runner.rb
+++ b/lib/api/ci/runner.rb
@@ -128,8 +128,6 @@ module API
           status 200
 
           present current_runner, with: Entities::Ci::RunnerRegistrationDetails
-        rescue ::API::Ci::Helpers::Runner::UnknownRunnerOwnerError
-          unprocessable_entity!('Runner is orphaned')
         end
 
         desc 'Reset runner authentication token with current token' do
@@ -228,8 +226,6 @@ module API
             Gitlab::Metrics.add_event(:build_invalid)
             conflict!
           end
-        rescue ::API::Ci::Helpers::Runner::UnknownRunnerOwnerError
-          unprocessable_entity!('Runner is orphaned')
         end
 
         desc 'Update a job' do
diff --git a/lib/web_ide/settings_sync.rb b/lib/web_ide/settings_sync.rb
index 098f7bba968..d2a8769cabf 100644
--- a/lib/web_ide/settings_sync.rb
+++ b/lib/web_ide/settings_sync.rb
@@ -3,6 +3,15 @@
 module WebIde
   module SettingsSync
     class << self
+      # Due to a bug where resource url template was not included
+      # "web_ide_https://open-vsx.org/vscode/gallery_https://open-vsx.org/vscode/item_"
+      # This hash is used out in the wild, so we don't want to change it...
+      # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178491
+      CURRENT_DEFAULT_SETTINGS_HASH = "2e0d3e8c1107f9ccc5ea"
+
+      # The actual hash we calculate for default settings, but needs to be mapped to the CURRENT one for compatability
+      DEFAULT_SETTINGS_HASH = "e36c431c0e2e1ee82c86"
+
       def settings_context_hash(extensions_gallery_settings:)
         return unless extensions_gallery_settings[:enabled]
 
@@ -10,8 +19,19 @@ module WebIde
 
         # This value determines the extensions settings context.
         # Modifying this value could clear the set of installed extensions for users.
-        key = "web_ide_#{settings[:service_url]}_#{settings[:item_url]}_#{settings[:resource_template_url]}"
-        Digest::SHA256.hexdigest(key).first(20)
+        key = "web_ide_#{settings[:service_url]}_#{settings[:item_url]}_#{settings[:resource_url_template]}"
+
+        hash_value = Digest::SHA256.hexdigest(key).first(20)
+
+        optionally_transform_hash(hash_value)
+      end
+
+      private
+
+      def optionally_transform_hash(hash)
+        return CURRENT_DEFAULT_SETTINGS_HASH if hash == DEFAULT_SETTINGS_HASH
+
+        hash
       end
     end
   end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 938849e8567..d862ddb2d5e 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -68307,9 +68307,6 @@ msgstr ""
 msgid "mrWidget|%{boldHeaderStart}Looks like there's no pipeline here.%{boldHeaderEnd}"
 msgstr ""
 
-msgid "mrWidget|%{boldStart}Merge blocked:%{boldEnd} a Jira issue key must be mentioned in the title or description."
-msgstr ""
-
 msgid "mrWidget|%{boldStart}Merge blocked:%{boldEnd} denied licenses must be removed."
 msgstr ""
 
diff --git a/spec/features/work_items/work_item_detail_spec.rb b/spec/features/work_items/work_item_detail_spec.rb
index 0f96ab1878a..371a7c77b88 100644
--- a/spec/features/work_items/work_item_detail_spec.rb
+++ b/spec/features/work_items/work_item_detail_spec.rb
@@ -23,6 +23,14 @@ RSpec.describe 'Work item detail', :js, feature_category: :team_planning do
   let(:list_path) { project_issues_path(project) }
   let(:work_items_path) { project_work_item_path(project, work_item.iid) }
 
+  shared_examples 'change type action is not displayed' do
+    it 'change type action is not displayed' do
+      click_button _('More actions'), match: :first
+
+      expect(find_by_testid('work-item-actions-dropdown')).not_to have_button(s_('WorkItem|Change type'))
+    end
+  end
+
   context 'for signed in user' do
     let(:linked_item) { task }
 
@@ -120,9 +128,11 @@ RSpec.describe 'Work item detail', :js, feature_category: :team_planning do
     before do
       sign_in(user)
       visit work_items_path
+      wait_for_all_requests
     end
 
     it_behaves_like 'work items comment actions for guest users'
+    it_behaves_like 'change type action is not displayed'
   end
 
   context 'for user not signed in' do
@@ -146,10 +156,6 @@ RSpec.describe 'Work item detail', :js, feature_category: :team_planning do
       expect(page).to have_content(note.note)
     end
 
-    it 'change type action is not displayed' do
-      click_button _('More actions'), match: :first
-
-      expect(find_by_testid('work-item-actions-dropdown')).not_to have_button(s_('WorkItem|Change type'))
-    end
+    it_behaves_like 'change type action is not displayed'
   end
 end
diff --git a/spec/frontend/todos/components/todo_item_spec.js b/spec/frontend/todos/components/todo_item_spec.js
index 39ba51d215e..c92c7d1637d 100644
--- a/spec/frontend/todos/components/todo_item_spec.js
+++ b/spec/frontend/todos/components/todo_item_spec.js
@@ -1,5 +1,5 @@
 import { shallowMount } from '@vue/test-utils';
-import { GlIcon } from '@gitlab/ui';
+import { GlIcon, GlFormCheckbox } from '@gitlab/ui';
 import TodoItem from '~/todos/components/todo_item.vue';
 import TodoItemTitle from '~/todos/components/todo_item_title.vue';
 import TodoItemTitleHiddenBySaml from '~/todos/components/todo_item_title_hidden_by_saml.vue';
@@ -24,7 +24,7 @@ describe('TodoItem', () => {
 
   const findTodoItemTimestamp = () => wrapper.findComponent(TodoItemTimestamp);
 
-  const createComponent = (props = {}) => {
+  const createComponent = (props = {}, todosBulkActions = true) => {
     wrapper = shallowMount(TodoItem, {
       propsData: {
         currentUserId: '1',
@@ -35,6 +35,7 @@ describe('TodoItem', () => {
       },
       provide: {
         currentTab: 0,
+        glFeatures: { todosBulkActions },
       },
     });
   };
@@ -95,6 +96,26 @@ describe('TodoItem', () => {
     expect(wrapper.emitted('change')).toHaveLength(1);
   });
 
+  describe('multi-select checkbox', () => {
+    it('renders a checkbox', () => {
+      createComponent();
+      expect(wrapper.findComponent(GlFormCheckbox).exists()).toBe(true);
+    });
+
+    it('emits select-change event when checkbox changes', async () => {
+      createComponent();
+      const checkbox = wrapper.findComponent(GlFormCheckbox);
+      await checkbox.vm.$emit('change', true);
+
+      expect(wrapper.emitted('select-change')[0]).toEqual([MR_REVIEW_REQUEST_TODO.id, true]);
+    });
+
+    it('does not render a checkbox with feature flag disabled', () => {
+      createComponent({}, false);
+      expect(wrapper.findComponent(GlFormCheckbox).exists()).toBe(false);
+    });
+  });
+
   describe('snoozed to-do items', () => {
     it.each`
       snoozedUntil           | expectedLabel
diff --git a/spec/frontend/work_items/components/work_item_actions_spec.js b/spec/frontend/work_items/components/work_item_actions_spec.js
index 74de019d97f..b4b82104169 100644
--- a/spec/frontend/work_items/components/work_item_actions_spec.js
+++ b/spec/frontend/work_items/components/work_item_actions_spec.js
@@ -702,6 +702,12 @@ describe('WorkItemActions component', () => {
 
       expect(findChangeTypeButton().exists()).toBe(false);
     });
+
+    it('hides the action when there is no permission', () => {
+      createComponent({ canUpdate: false });
+
+      expect(findChangeTypeButton().exists()).toBe(false);
+    });
   });
 
   it('passes the `parentId` prop down to the `WorkItemStateToggle` component', () => {
diff --git a/spec/graphql/resolvers/work_items/description_templates_resolver_spec.rb b/spec/graphql/resolvers/work_items/description_templates_resolver_spec.rb
deleted file mode 100644
index 6f8d4e0d482..00000000000
--- a/spec/graphql/resolvers/work_items/description_templates_resolver_spec.rb
+++ /dev/null
@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Resolvers::WorkItems::DescriptionTemplatesResolver, feature_category: :api do
-  include GraphqlHelpers
-
-  let_it_be(:current_user) { create(:user) }
-  let_it_be(:group)        { create(:group, developers: current_user) }
-
-  let_it_be(:template_files) do
-    {
-      ".gitlab/issue_templates/project_issues_template_a.md" => "project_issues_template_a content",
-      ".gitlab/issue_templates/project_issues_template_b.md" => "project_issues_template_b content"
-    }
-  end
-
-  let_it_be(:project) do
-    create(:project, :custom_repo, files: template_files, group: group)
-       .tap { |p| group.file_template_project_id = p.id }
-  end
-
-  let_it_be(:project_namespace) { project.project_namespace }
-
-  let(:args) { { name: nil } }
-  let(:ctx) { { current_user: current_user } }
-
-  subject(:result) do
-    resolve(described_class, obj: object, args: args, ctx: ctx,
-      field_opts: { calls_gitaly: true })
-  end
-
-  shared_examples 'a template description resolver' do
-    it 'returns all templates with content' do
-      expect(result.items[0])
-        .to have_attributes(name: 'project_issues_template_a', content: 'project_issues_template_a content')
-
-      expect(result.items[1])
-        .to have_attributes(name: 'project_issues_template_b', content: 'project_issues_template_b content')
-    end
-  end
-
-  describe '#resolve' do
-    context 'when namespace is a group' do
-      let(:object) { group }
-
-      it_behaves_like 'a template description resolver'
-
-      context 'without a file template project id' do
-        before do
-          allow(group).to receive(:file_template_project_id).and_return(nil)
-        end
-
-        it { is_expected.to be_empty }
-      end
-    end
-
-    context 'when namespace is a project' do
-      let(:object) { project_namespace }
-
-      it_behaves_like 'a template description resolver'
-    end
-  end
-end
diff --git a/spec/graphql/types/work_items/description_template_type_spec.rb b/spec/graphql/types/work_items/description_template_type_spec.rb
index fff4be89fd3..413ccaa7c2f 100644
--- a/spec/graphql/types/work_items/description_template_type_spec.rb
+++ b/spec/graphql/types/work_items/description_template_type_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Types::WorkItems::DescriptionTemplateType, feature_category: :por
   include GraphqlHelpers
 
   it 'exposes the expected fields' do
-    expected_fields = %i[content name category]
+    expected_fields = %i[content name category projectId]
 
     expected_fields.each do |field|
       expect(described_class).to have_graphql_field(field)
diff --git a/spec/helpers/ide_helper_spec.rb b/spec/helpers/ide_helper_spec.rb
index 0721f1bb63c..a43a37d6319 100644
--- a/spec/helpers/ide_helper_spec.rb
+++ b/spec/helpers/ide_helper_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe IdeHelper, feature_category: :web_ide do
   let_it_be(:disabled_vscode_settings) { { enabled: false } }
   let_it_be(:enabled_vscode_settings) do
     { enabled: true,
-      vscode_settings: { service_url: 'https://example.com', item_url: 'https://example.com', resource_template_url: 'https://example.com' } }
+      vscode_settings: { service_url: 'https://example.com', item_url: 'https://example.com', resource_url_template: 'https://example.com' } }
   end
 
   before do
diff --git a/spec/lib/api/ci/helpers/runner_spec.rb b/spec/lib/api/ci/helpers/runner_spec.rb
index c98781c5fde..e4b2a78603e 100644
--- a/spec/lib/api/ci/helpers/runner_spec.rb
+++ b/spec/lib/api/ci/helpers/runner_spec.rb
@@ -167,28 +167,6 @@ RSpec.describe API::Ci::Helpers::Runner, feature_category: :runner do
         expect(current_runner_manager.sharding_key_id).to eq(runner.sharding_key_id)
       end
     end
-
-    context 'when project runner is missing sharding_key_id' do
-      let(:runner) { Ci::Runner.project_type.last }
-      let(:connection) { Ci::Runner.connection }
-
-      before do
-        connection.execute(<<~SQL)
-          ALTER TABLE ci_runners DISABLE TRIGGER ALL;
-
-          INSERT INTO ci_runners(created_at, runner_type, token, sharding_key_id) VALUES(NOW(), 3, 'foo', NULL);
-
-          ALTER TABLE ci_runners ENABLE TRIGGER ALL;
-        SQL
-      end
-
-      it 'fails to create a new runner manager', :aggregate_failures do
-        allow(helper).to receive(:params).and_return(token: runner.token, system_id: 'new_system_id')
-        expect(helper.current_runner).to eq(runner)
-
-        expect { current_runner_manager }.to raise_error described_class::UnknownRunnerOwnerError
-      end
-    end
   end
 
   describe '#track_runner_authentication', :prometheus, feature_category: :runner do
diff --git a/spec/lib/web_ide/settings_sync_spec.rb b/spec/lib/web_ide/settings_sync_spec.rb
index 461c9f0c338..3b65cc155b5 100644
--- a/spec/lib/web_ide/settings_sync_spec.rb
+++ b/spec/lib/web_ide/settings_sync_spec.rb
@@ -3,22 +3,66 @@
 require 'spec_helper'
 
 RSpec.describe WebIde::SettingsSync, feature_category: :web_ide do
-  using RSpec::Parameterized::TableSyntax
-
-  let_it_be(:disabled_vscode_settings) { { enabled: false } }
-  let_it_be(:enabled_vscode_settings) do
-    { enabled: true,
-      vscode_settings: { service_url: 'https://example.com', item_url: 'https://example.com', resource_template_url: 'https://example.com' } }
-  end
-
   describe '#settings_context_hash' do
-    where(:extensions_gallery_settings, :expectation) do
-      ref(:enabled_vscode_settings)  | 'c6620244fe72864fa8d8'
-      ref(:disabled_vscode_settings) | nil
+    where do
+      {
+        "disabled vscode settings" => {
+          enabled: false,
+          vscode_settings: {
+            service_url: 'https://example.com',
+            item_url: 'https://example.com',
+            resource_url_template: 'https://example.com'
+          },
+          expectation: nil
+        },
+        "enabled vscode settings" => {
+          enabled: true,
+          vscode_settings: {
+            service_url: 'https://example.com',
+            item_url: 'https://example.com',
+            resource_url_template: 'https://example.com'
+          },
+          expectation: 'c6620244fe72864fa8d8'
+        },
+        "default vscode settings" => {
+          enabled: true,
+          vscode_settings: {
+            service_url: 'https://open-vsx.org/vscode/gallery',
+            item_url: 'https://open-vsx.org/vscode/item',
+            resource_url_template: 'https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}'
+          },
+          expectation: '2e0d3e8c1107f9ccc5ea'
+        },
+        "default vscode settings (compatability after bug fix)" => {
+          # This is the default vscode settings that creates the same
+          # hash as default_vscode_settings to avoid breaking-changes.
+          # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178491
+          enabled: true,
+          vscode_settings: {
+            service_url: 'https://open-vsx.org/vscode/gallery',
+            item_url: 'https://open-vsx.org/vscode/item',
+            resource_url_template: ''
+          },
+          expectation: '2e0d3e8c1107f9ccc5ea'
+        },
+        "vscode settings with different resource_url_template" => {
+          # We want to verify that a different resource_url_template (not empty) will generate a different hash
+          enabled: true,
+          vscode_settings: {
+            service_url: 'https://open-vsx.org/vscode/gallery',
+            item_url: 'https://open-vsx.org/vscode/item',
+            resource_url_template: 'https://example.com/'
+          },
+          expectation: '576b985920ef0d6bb244'
+        }
+      }
     end
 
     subject(:settings_context_hash) do
-      described_class.settings_context_hash(extensions_gallery_settings: extensions_gallery_settings)
+      described_class.settings_context_hash(extensions_gallery_settings: {
+        enabled: enabled,
+        vscode_settings: vscode_settings
+      })
     end
 
     with_them do
diff --git a/spec/requests/api/ci/runner/jobs_request_post_spec.rb b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
index 8b579fa3d3f..0638edfc9d2 100644
--- a/spec/requests/api/ci/runner/jobs_request_post_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
@@ -151,65 +151,6 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state, feature_catego
               expect(runner_manager.runner).to eq runner
               expect(runner_manager.contacted_at).to eq Time.current
             end
-
-            # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-            context 'when runner is not yet synced to partitioned table', :aggregate_failures do
-              let(:connection) { Ci::ApplicationRecord.connection }
-              let(:non_partitioned_runner) { runner }
-
-              before do
-                # Allow creating legacy runners that are not present in the partitioned table (created when FK was not
-                # present)
-                connection.transaction do
-                  connection.execute(<<~SQL)
-                    ALTER TABLE ci_runners DISABLE TRIGGER ALL;
-                  SQL
-
-                  non_partitioned_runner
-
-                  connection.execute(<<~SQL)
-                    ALTER TABLE ci_runners ENABLE TRIGGER ALL;
-                  SQL
-                end
-              end
-
-              it 'creates respective ci_runner_machines record and syncs runner to partitioned table' do
-                expect { request }
-                  .to change { runner.runner_managers.reload.count }.from(0).to(1)
-                  .and change { partitioned_runner_exists?(non_partitioned_runner) }.from(false).to(true)
-
-                expect(response).to have_gitlab_http_status(:created)
-                expect(non_partitioned_runner.contacted_at).to be_nil
-              end
-
-              context 'when project runner is missing sharding_key_id' do
-                let(:params) { { token: 'foo' } }
-                let(:runner) { Ci::Runner.project_type.last }
-                let(:non_partitioned_runner) do
-                  connection.execute(<<~SQL)
-                    INSERT INTO ci_runners(created_at, runner_type, token, sharding_key_id) VALUES(NOW(), 3, 'foo', NULL);
-                  SQL
-
-                  runner
-                end
-
-                it 'returns unprocessable entity status code', :aggregate_failures do
-                  expect { request }.not_to change { Ci::RunnerManager.count }.from(0)
-                  expect(response).to have_gitlab_http_status(:unprocessable_entity)
-                  expect(response.body).to eq({ message: 'Runner is orphaned' }.to_json)
-                end
-              end
-
-              private
-
-              def partitioned_runner_exists?(runner)
-                result = connection.execute(<<~SQL)
-                  SELECT COUNT(*) FROM ci_runners_e59bb2812d WHERE id = #{runner.id};
-                SQL
-
-                result.first['count'].positive?
-              end
-            end
           end
 
           context 'when ci_runner_machines with same system_xid already exists', :freeze_time do
diff --git a/spec/requests/api/ci/runner/runners_verify_post_spec.rb b/spec/requests/api/ci/runner/runners_verify_post_spec.rb
index 39323c8f988..7fba350eaa3 100644
--- a/spec/requests/api/ci/runner/runners_verify_post_spec.rb
+++ b/spec/requests/api/ci/runner/runners_verify_post_spec.rb
@@ -71,50 +71,6 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state, feature_catego
           it 'does not update contacted_at' do
             expect { verify }.not_to change { runner.reload.contacted_at }.from(nil)
           end
-
-          # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-          context 'when runner is not yet synced to partitioned table' do
-            let(:connection) { Ci::ApplicationRecord.connection }
-            let(:params) { { token: non_partitioned_runner.token } }
-            let(:registration_token) { 'glrt-abcdefg123457' }
-            let(:non_partitioned_runner) do
-              create(:ci_runner, registration_type: registration_type,
-                token: registration_token, token_expires_at: 3.days.from_now)
-            end
-
-            before do
-              # Allow creating legacy runners that are not present in the partitioned table (created when FK was not
-              # present)
-              connection.transaction do
-                connection.execute(<<~SQL)
-                  ALTER TABLE ci_runners DISABLE TRIGGER ALL;
-                SQL
-
-                non_partitioned_runner
-
-                connection.execute(<<~SQL)
-                  ALTER TABLE ci_runners ENABLE TRIGGER ALL;
-                SQL
-              end
-            end
-
-            it 'does not update contacted_at but syncs runner to partitioned table', :aggregate_failures do
-              expect { verify }.to change { partitioned_runner_exists?(non_partitioned_runner) }.from(false).to(true)
-
-              expect(response).to have_gitlab_http_status(:ok)
-              expect(non_partitioned_runner.contacted_at).to be_nil
-            end
-
-            private
-
-            def partitioned_runner_exists?(runner)
-              result = connection.execute(<<~SQL)
-                SELECT COUNT(*) FROM ci_runners_e59bb2812d WHERE id = #{runner.id};
-              SQL
-
-              result.first['count'].positive?
-            end
-          end
         end
 
         it 'verifies Runner credentials' do
@@ -159,29 +115,6 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state, feature_catego
           it 'creates a runner_manager' do
             expect { verify }.to change { Ci::RunnerManager.count }.by(1)
           end
-
-          # TODO: Remove once https://gitlab.com/gitlab-org/gitlab/-/issues/504277 is closed.
-          context 'when project runner is missing sharding_key_id' do
-            let(:runner) { Ci::Runner.project_type.last }
-            let(:params) { { token: 'foo' } }
-            let(:connection) { Ci::Runner.connection }
-
-            before do
-              connection.execute(<<~SQL)
-                ALTER TABLE ci_runners DISABLE TRIGGER ALL;
-
-                INSERT INTO ci_runners(created_at, runner_type, token, sharding_key_id) VALUES(NOW(), 3, 'foo', NULL);
-
-                ALTER TABLE ci_runners ENABLE TRIGGER ALL;
-              SQL
-            end
-
-            it 'returns unprocessable entity status code', :aggregate_failures do
-              expect { verify }.not_to change { Ci::RunnerManager.count }.from(0)
-              expect(response).to have_gitlab_http_status(:unprocessable_entity)
-              expect(response.body).to eq({ message: 'Runner is orphaned' }.to_json)
-            end
-          end
         end
       end
 
diff --git a/spec/requests/api/graphql/namespace/work_item_description_templates_spec.rb b/spec/requests/api/graphql/namespace/work_item_description_templates_spec.rb
index acaa15b1c1e..a696f001926 100644
--- a/spec/requests/api/graphql/namespace/work_item_description_templates_spec.rb
+++ b/spec/requests/api/graphql/namespace/work_item_description_templates_spec.rb
@@ -12,6 +12,12 @@ RSpec.describe 'getting work item description templates', feature_category: :gro
     end
   end
 
+  let_it_be(:sub_group) do
+    create(:group, parent: group).tap do |g|
+      g.add_owner(current_user)
+    end
+  end
+
   let_it_be(:template_files) do
     {
       ".gitlab/issue_templates/project_issues_template_a.md" => "project_issues_template_a content",
@@ -19,12 +25,20 @@ RSpec.describe 'getting work item description templates', feature_category: :gro
     }
   end
 
-  let_it_be(:project) { create(:project, :custom_repo, files: template_files, group: group) }
+  let_it_be(:project) do
+    create(:project, :custom_repo, files: template_files, group: group)
+       .tap { |p| group.file_template_project_id = p.id }
+  end
+
+  let_it_be(:no_files_project) { create(:project, :custom_repo, group: group) }
+
+  let_it_be(:no_files_project_namespace) { no_files_project.project_namespace }
+
   let_it_be(:project_namespace) { project.project_namespace }
 
   let(:expected_graphql_data) { graphql_data['namespace']['workItemDescriptionTemplates']['nodes'] }
 
-  def generate_query(name: nil, full_path: project_namespace.full_path)
+  def generate_query(full_path: project_namespace.full_path)
     query = <<~QUERY
       id
       workItemDescriptionTemplates
@@ -33,17 +47,15 @@ RSpec.describe 'getting work item description templates', feature_category: :gro
           category
           name
           content
+          projectId
         }
       }
     QUERY
 
-    # Add the `name` argument conditionally to query string if it's provided
-    query = query.sub("workItemDescriptionTemplates", "workItemDescriptionTemplates(name: \"#{name}\")") if name
-
     graphql_query_for('namespace', { 'fullPath' => full_path }, query)
   end
 
-  it 'includes the content and name fields on each template' do
+  it 'includes the content, name, category, and project_id fields on each template' do
     post_graphql(generate_query, current_user: current_user)
     expect(template_files.count).to eq(expected_graphql_data.count)
 
@@ -51,41 +63,26 @@ RSpec.describe 'getting work item description templates', feature_category: :gro
       expect(".gitlab/issue_templates/#{template['name']}.md").to eq(template_files.to_a[index][0])
       expect(template["content"]).to eq(template_files.to_a[index][1])
       expect(template["category"]).to eq("Project Templates")
+      expect(template["projectId"]).to eq(project.id)
     end
   end
 
-  context 'when filtering by template name that exists' do
-    it 'returns matching template' do
-      post_graphql(generate_query(name: "project_issues_template_a"), current_user: current_user)
+  it 'returns nil when the project has no template files' do
+    post_graphql(generate_query(full_path: no_files_project_namespace.full_path), current_user: current_user)
 
-      expect(expected_graphql_data.count).to eq(1)
-
-      expect(expected_graphql_data.first["name"]).to eq("project_issues_template_a")
-
-      expect(expected_graphql_data.first["content"]).to eq("project_issues_template_a content")
-
-      expect(expected_graphql_data.first["category"]).to be_nil
-    end
+    expect(graphql_data["namespace"]["workItemDescriptionTemplates"]).to be_nil
   end
 
-  context 'when filtering by a name that does not exist' do
-    it 'returns no templates' do
-      post_graphql(generate_query(name: "false_name"), current_user: current_user)
-
-      expect(expected_graphql_data).to be_empty
+  context 'when the namespace is a Group with no file template project set' do
+    before do
+      stub_licensed_features(custom_file_templates: true, custom_file_templates_for_namespace: true)
+      group.update_columns(file_template_project_id: nil)
     end
-  end
 
-  context 'when the user has access to the namespace but not the project' do
-    it 'returns no templates' do
-      group.update_columns(file_template_project_id: project.id)
+    it 'returns nil' do
+      post_graphql(generate_query(full_path: group.full_path), current_user: current_user)
 
-      allow(Ability).to receive(:allowed?).and_call_original
-      allow(Ability).to receive(:allowed?).with(current_user, :read_project, project).and_return(false)
-
-      post_graphql(generate_query(name: nil, full_path: group.full_path), current_user: current_user)
-
-      expect(expected_graphql_data).to be_empty
+      expect(graphql_data["namespace"]["workItemDescriptionTemplates"]).to be_nil
     end
   end
 end
diff --git a/spec/requests/api/graphql/projects/projects_spec.rb b/spec/requests/api/graphql/projects/projects_spec.rb
index 90beddc4088..69961ad20fa 100644
--- a/spec/requests/api/graphql/projects/projects_spec.rb
+++ b/spec/requests/api/graphql/projects/projects_spec.rb
@@ -120,12 +120,12 @@ RSpec.describe 'getting a collection of projects', feature_category: :source_cod
         post_graphql(single_project_query, current_user: current_user)
       end
 
-      # There is an N+1 query for max_member_access_for_user_ids
-      # There is an N+1 query for duo_features_enabled cascading setting
-      # https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+      # There is an N+1 query related to custom roles - https://gitlab.com/gitlab-org/gitlab/-/issues/515675
+      # There is an N+1 query for duo_features_enabled cascading setting - https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+      # There is an N+1 query related to pipelines - https://gitlab.com/gitlab-org/gitlab/-/issues/515677
       expect do
         post_graphql(query, current_user: current_user)
-      end.not_to exceed_all_query_limit(control).with_threshold(16)
+      end.not_to exceed_all_query_limit(control).with_threshold(8)
     end
 
     it 'returns the expected projects' do
diff --git a/spec/requests/api/graphql/user/contributed_projects_query_spec.rb b/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
index a7db28e722b..343580e6584 100644
--- a/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
+++ b/spec/requests/api/graphql/user/contributed_projects_query_spec.rb
@@ -53,12 +53,12 @@ RSpec.describe 'Getting contributedProjects of the user', feature_category: :gro
       new_project.add_developer(user)
       travel_to(4.hours.from_now) { create(:push_event, project: new_project, author: user) }
 
-      # There is an N+1 query for max_member_access_for_user_ids
-      # There is an N+1 query for duo_features_enabled cascading setting
-      # https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+      # There is an N+1 query related to custom roles - https://gitlab.com/gitlab-org/gitlab/-/issues/515675
+      # There is an N+1 query for duo_features_enabled cascading setting - https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+      # There is an N+1 query related to pipelines - https://gitlab.com/gitlab-org/gitlab/-/issues/515677
       expect do
         post_graphql(query, current_user: current_user)
-      end.not_to exceed_all_query_limit(control).with_threshold(7)
+      end.not_to exceed_all_query_limit(control).with_threshold(5)
     end
   end
 
diff --git a/spec/requests/api/graphql/user/starred_projects_query_spec.rb b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
index 7a9f8acea4f..858cd650379 100644
--- a/spec/requests/api/graphql/user/starred_projects_query_spec.rb
+++ b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
@@ -77,12 +77,12 @@ RSpec.describe 'Getting starredProjects of the user', feature_category: :groups_
         project_d.add_reporter(user)
         user.toggle_star(project_d)
 
-        # There is an N+1 query for max_member_access_for_user_ids
-        # There is an N+1 query for duo_features_enabled cascading setting
-        # https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+        # There is an N+1 query related to custom roles - https://gitlab.com/gitlab-org/gitlab/-/issues/515675
+        # There is an N+1 query for duo_features_enabled cascading setting - https://gitlab.com/gitlab-org/gitlab/-/issues/442164
+        # There is an N+1 query related to pipelines - https://gitlab.com/gitlab-org/gitlab/-/issues/515677
         expect do
           post_graphql(query, current_user: current_user)
-        end.not_to exceed_all_query_limit(control).with_threshold(7)
+        end.not_to exceed_all_query_limit(control).with_threshold(5)
       end
     end
   end
diff --git a/spec/requests/api/graphql/work_item_description_template_content_spec.rb b/spec/requests/api/graphql/work_item_description_template_content_spec.rb
new file mode 100644
index 00000000000..3e3f7fd8455
--- /dev/null
+++ b/spec/requests/api/graphql/work_item_description_template_content_spec.rb
@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'getting a WorkItem description template and content', feature_category: :groups_and_projects do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:group) do
+    create(:group).tap do |g|
+      g.add_owner(current_user)
+    end
+  end
+
+  let_it_be(:template_files) do
+    {
+      ".gitlab/issue_templates/project_issues_template_a.md" => "project_issues_template_a content",
+      ".gitlab/issue_templates/project_issues_template_b.md" => "project_issues_template_b content"
+    }
+  end
+
+  let_it_be(:project) { create(:project, :custom_repo, files: template_files, group: group) }
+
+  let(:expected_graphql_data) { graphql_data['workItemDescriptionTemplateContent'] }
+
+  context 'with expected arguments' do
+    let(:query) do
+      graphql_query_for(:workItemDescriptionTemplateContent,
+        { templateContentInput: { projectId: project.id, name: "project_issues_template_a" } })
+    end
+
+    it 'returns the expected values for the template being queried' do
+      post_graphql(query, current_user: current_user)
+
+      expect(expected_graphql_data["projectId"]).to eq(project.id)
+      expect(expected_graphql_data["name"]).to eq("project_issues_template_a")
+      expect(expected_graphql_data["category"]).to be_nil
+      expect(expected_graphql_data["content"]).to eq("project_issues_template_a content")
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(graphql_errors).to be_nil
+    end
+  end
+
+  context 'with a group_id that does not exist' do
+    let(:query) do
+      graphql_query_for(:workItemDescriptionTemplateContent,
+        { templateContentInput: { projectId: -1, name: "project_issues_template_a" } })
+    end
+
+    it 'does not retrieve the template' do
+      post_graphql(query, current_user: current_user)
+
+      expect(expected_graphql_data).to be_nil
+    end
+  end
+
+  context 'with a template name that does not exist' do
+    let(:query) do
+      graphql_query_for(:workItemDescriptionTemplateContent,
+        { templateContentInput: { projectId: project.id, name: "missing template" } })
+    end
+
+    it 'does not retrieve the template' do
+      post_graphql(query, current_user: current_user)
+
+      expect(expected_graphql_data).to be_nil
+    end
+  end
+end
diff --git a/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb b/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb
index 8585ddd7f8c..60b7a446640 100644
--- a/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb
+++ b/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb
@@ -47,6 +47,7 @@ RSpec.shared_context 'with FOSS query type fields' do
       :users,
       :wiki_page,
       :work_item,
+      :work_item_description_template_content,
       :work_items_by_reference,
       :audit_event_definitions,
       :abuse_report,