From e8360356fbb7af4aa20703448dccedc70bfbea6b Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 2 Feb 2024 03:11:42 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 Gemfile                                       |   4 +-
 Gemfile.checksum                              |   6 +-
 Gemfile.lock                                  |  11 +-
 app/assets/javascripts/crm/contacts/bundle.js |   4 +
 .../crm/contacts/components/contacts_root.vue |  29 +++-
 .../javascripts/crm/organizations/bundle.js   |   4 +
 .../components/organizations_root.vue         |  31 +++--
 .../graphql_shared/possible_types.json        |   1 +
 app/graphql/gitlab_schema.rb                  |   6 +-
 app/graphql/types/group_type.rb               |   9 ++
 .../types/work_items/widget_interface.rb      |   8 +-
 .../work_items/widgets/time_tracking_type.rb  |  27 ++++
 app/models/concerns/time_trackable.rb         |   2 +-
 app/models/work_item.rb                       |   4 +
 app/models/work_items/type.rb                 |   4 +
 app/models/work_items/widget_definition.rb    |   3 +-
 .../work_items/widgets/time_tracking.rb       |  26 ++++
 app/policies/group_policy.rb                  |   1 +
 .../work_items/callbacks/time_tracking.rb     |  20 +++
 app/views/groups/crm/contacts/index.html.haml |  11 +-
 .../groups/crm/organizations/index.html.haml  |  11 +-
 db/docs/security_trainings.yml                |  13 +-
 db/docs/terraform_state_versions.yml          |  20 ++-
 db/docs/users_security_dashboard_projects.yml |  10 +-
 db/docs/vulnerabilities.yml                   |  13 +-
 db/docs/vulnerability_feedback.yml            |  13 +-
 .../vulnerability_historical_statistics.yml   |  13 +-
 db/docs/vulnerability_identifiers.yml         |  13 +-
 db/docs/vulnerability_occurrences.yml         |  10 +-
 db/docs/vulnerability_reads.yml               |  10 +-
 db/docs/vulnerability_remediations.yml        |  10 +-
 db/docs/vulnerability_scanners.yml            |  10 +-
 db/docs/vulnerability_statistics.yml          |  10 +-
 ...ng_widget_definition_to_work_item_types.rb |  64 +++++++++
 db/schema_migrations/20240118170849           |   1 +
 doc/administration/compliance.md              |   2 +-
 .../monitoring/prometheus/gitlab_metrics.md   |   2 +-
 doc/api/graphql/reference/index.md            |  16 +++
 doc/api/settings.md                           |   2 +-
 .../blueprints/organization/index.md          |   2 +-
 .../index.md                                  |   8 +-
 doc/development/code_review.md                |   4 +-
 doc/tutorials/scan_result_policy/index.md     |  24 ++--
 doc/tutorials/secure_application.md           |   2 +-
 .../get-started-security.md                   |   2 +-
 doc/user/application_security/index.md        |   2 +-
 .../application_security/policies/index.md    |  10 +-
 .../policies/scan-result-policies.md          | 103 +++++++-------
 doc/user/crm/index.md                         |  22 +--
 .../project/merge_requests/approvals/index.md |   4 +-
 .../project/merge_requests/approvals/rules.md |   2 +-
 doc/user/project/protected_branches.md        |   2 +-
 .../work_items/base_type_importer.rb          |  24 ++--
 lib/gitlab/graphql/queries.rb                 |  37 +++--
 .../issue_and_merge_request_actions.rb        |   6 +-
 .../groups/menus/customer_relations_menu.rb   |  21 +--
 .../groups/super_sidebar_menus/plan_menu.rb   |   3 +-
 locale/gitlab.pot                             |  12 +-
 qa/gdk/entrypoint                             |   5 +
 spec/frontend/crm/contacts_root_spec.js       |  18 +++
 spec/frontend/crm/organizations_root_spec.js  |  18 +++
 spec/graphql/gitlab_schema_spec.rb            |  33 +++++
 .../mutations/custom_emoji/destroy_spec.rb    |   2 +-
 spec/graphql/types/group_type_spec.rb         |  78 +++++++++++
 .../types/work_items/widget_interface_spec.rb |   5 +
 .../widgets/time_tracking_type_spec.rb        |  11 ++
 spec/lib/gitlab/graphql/queries_spec.rb       |   2 +-
 .../super_sidebar_menus/plan_menu_spec.rb     |   3 +-
 ...dget_definition_to_work_item_types_spec.rb |  10 ++
 spec/models/work_item_spec.rb                 |  11 ++
 spec/models/work_items/type_spec.rb           |  19 +++
 .../work_items/widget_definition_spec.rb      |   3 +-
 .../work_items/widgets/time_tracking_spec.rb  |  40 ++++++
 .../mutations/work_items/update_spec.rb       |  98 +++++++++++++
 spec/requests/api/graphql/work_item_spec.rb   |   2 +-
 .../callbacks/time_tracking_spec.rb           | 131 ++++++++++++++++++
 .../helpers/navbar_structure_helper.rb        |   7 +-
 vendor/gems/sidekiq-7.1.6/.gitlab-ci.yml      |   3 +-
 78 files changed, 1038 insertions(+), 205 deletions(-)
 create mode 100644 app/graphql/types/work_items/widgets/time_tracking_type.rb
 create mode 100644 app/models/work_items/widgets/time_tracking.rb
 create mode 100644 app/services/work_items/callbacks/time_tracking.rb
 create mode 100644 db/migrate/20240118170849_add_time_tracking_widget_definition_to_work_item_types.rb
 create mode 100644 db/schema_migrations/20240118170849
 create mode 100644 spec/graphql/types/work_items/widgets/time_tracking_type_spec.rb
 create mode 100644 spec/migrations/20240118170849_add_time_tracking_widget_definition_to_work_item_types_spec.rb
 create mode 100644 spec/models/work_items/widgets/time_tracking_spec.rb
 create mode 100644 spec/services/work_items/callbacks/time_tracking_spec.rb

diff --git a/Gemfile b/Gemfile
index 4c6b0596b7d..a318a61a9d9 100644
--- a/Gemfile
+++ b/Gemfile
@@ -141,11 +141,11 @@ gem 'grape-path-helpers', '~> 2.0.0', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GraphQL API
-gem 'graphql', '~> 2.0.27', feature_category: :api
+gem 'graphql', '~> 2.2.5', feature_category: :api
 gem 'graphql-docs', '~> 4.0.0', group: [:development, :test], feature_category: :api
 gem 'graphiql-rails', '~> 1.8.0', feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.5', feature_category: :api
-gem 'graphlient', '~> 0.5.0', feature_category: :importers # Used by BulkImport feature (group::import)
+gem 'graphlient', '~> 0.6.0', feature_category: :importers # Used by BulkImport feature (group::import)
 
 # Generate Fake data
 gem 'ffaker', '~> 2.10' # rubocop:todo Gemfile/MissingFeatureCategory
diff --git a/Gemfile.checksum b/Gemfile.checksum
index f6f36ecd72c..3b69af5d85c 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -275,10 +275,10 @@
 {"name":"grape-swagger-entity","version":"0.5.1","platform":"ruby","checksum":"f51e372d00ac96cf90d948f87b3f4eb287ab053976ca57ad503d442ad8605523"},
 {"name":"grape_logging","version":"1.8.4","platform":"ruby","checksum":"efcc3e322dbd5d620a68f078733b7db043cf12680144cd03c982f14115c792d1"},
 {"name":"graphiql-rails","version":"1.8.0","platform":"ruby","checksum":"02e2c5098be2c6c29219a0e9b2910a2cd3c494301587a3199a7c4484d8038ed1"},
-{"name":"graphlient","version":"0.5.0","platform":"ruby","checksum":"0f2c9416142e50b6bd4edcd86fe6810f792951732c487f9061aee6d420e0f292"},
+{"name":"graphlient","version":"0.6.0","platform":"ruby","checksum":"b8d8664b4c8ec215012cbe3cca918a045b0a206d709712d68b6db51fd215c5c0"},
 {"name":"graphlyte","version":"1.0.0","platform":"ruby","checksum":"b5af4ab67dde6e961f00ea1c18f159f73b52ed11395bb4ece297fe628fa1804d"},
-{"name":"graphql","version":"2.0.27","platform":"ruby","checksum":"1f59be5a770248595971a261c96edef3adcf323e93387e53d1ca1ffd16448b36"},
-{"name":"graphql-client","version":"0.18.0","platform":"ruby","checksum":"98aadc810f23dce5404621903945aa584279574f87855b4301d69c90ddc6250b"},
+{"name":"graphql","version":"2.2.5","platform":"ruby","checksum":"15eeb4b4b29b8502de22e6f2794ea5b7bf75b3a8c0aa5d776f5e614ef543bc7e"},
+{"name":"graphql-client","version":"0.19.0","platform":"ruby","checksum":"fe699d81976f916bd8f989216155326449cb8475a5d69fa1dd054012a86969c7"},
 {"name":"graphql-docs","version":"4.0.0","platform":"ruby","checksum":"f68296959263db26e1b7ba7058856d67b641cf508187222268be58f09dfa02d7"},
 {"name":"grpc","version":"1.60.0","platform":"aarch64-linux","checksum":"f8b29900bf9a8f18ac362da4057983ad7fe3774bec3f308ac3f3006669c670f9"},
 {"name":"grpc","version":"1.60.0","platform":"arm64-darwin","checksum":"57e4477f85fd98822b9421a5c702c642ff8a8cc1624ec4325604867017c67ec3"},
diff --git a/Gemfile.lock b/Gemfile.lock
index 6c3c81f3d7d..4f4e332720a 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -870,13 +870,14 @@ GEM
     graphiql-rails (1.8.0)
       railties
       sprockets-rails
-    graphlient (0.5.0)
+    graphlient (0.6.0)
       faraday (>= 1.0)
       faraday_middleware
       graphql-client
     graphlyte (1.0.0)
-    graphql (2.0.27)
-    graphql-client (0.18.0)
+    graphql (2.2.5)
+      racc (~> 1.4)
+    graphql-client (0.19.0)
       activesupport (>= 3.0)
       graphql
     graphql-docs (4.0.0)
@@ -1959,9 +1960,9 @@ DEPENDENCIES
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8)
   graphiql-rails (~> 1.8.0)
-  graphlient (~> 0.5.0)
+  graphlient (~> 0.6.0)
   graphlyte (~> 1.0.0)
-  graphql (~> 2.0.27)
+  graphql (~> 2.2.5)
   graphql-docs (~> 4.0.0)
   grpc (~> 1.60.0)
   gssapi (~> 1.3.1)
diff --git a/app/assets/javascripts/crm/contacts/bundle.js b/app/assets/javascripts/crm/contacts/bundle.js
index fe62b7cfbe3..a7a3b72e87c 100644
--- a/app/assets/javascripts/crm/contacts/bundle.js
+++ b/app/assets/javascripts/crm/contacts/bundle.js
@@ -26,7 +26,9 @@ export default () => {
     basePath,
     groupFullPath,
     groupIssuesPath,
+    groupOrganizationsPath,
     canAdminCrmContact,
+    canReadCrmOrganization,
     groupId,
     textQuery,
   } = el.dataset;
@@ -44,7 +46,9 @@ export default () => {
     provide: {
       groupFullPath,
       groupIssuesPath,
+      groupOrganizationsPath,
       canAdminCrmContact: parseBoolean(canAdminCrmContact),
+      canReadCrmOrganization: parseBoolean(canReadCrmOrganization),
       groupId,
       textQuery,
     },
diff --git a/app/assets/javascripts/crm/contacts/components/contacts_root.vue b/app/assets/javascripts/crm/contacts/components/contacts_root.vue
index 90a8701cea6..1cfb5025ab9 100644
--- a/app/assets/javascripts/crm/contacts/components/contacts_root.vue
+++ b/app/assets/javascripts/crm/contacts/components/contacts_root.vue
@@ -22,7 +22,14 @@ export default {
   directives: {
     GlTooltip: GlTooltipDirective,
   },
-  inject: ['canAdminCrmContact', 'groupFullPath', 'groupIssuesPath', 'textQuery'],
+  inject: [
+    'canAdminCrmContact',
+    'canReadCrmOrganization',
+    'groupFullPath',
+    'groupIssuesPath',
+    'groupOrganizationsPath',
+    'textQuery',
+  ],
   data() {
     return {
       contacts: { list: [] },
@@ -147,6 +154,7 @@ export default {
     title: s__('Crm|Customer relations contacts'),
     newContact: s__('Crm|New contact'),
     errorMsg: __('Something went wrong. Please try again.'),
+    organizations: s__('Crm|Organizations'),
   },
   EDIT_ROUTE_NAME,
   NEW_ROUTE_NAME,
@@ -191,11 +199,20 @@ export default {
       @error-alert-dismissed="errorAlertDismissed"
     >
       <template #header-actions>
-        <router-link v-if="canAdminCrmContact" :to="{ name: $options.NEW_ROUTE_NAME }">
-          <gl-button class="gl-my-3 gl-mr-5" variant="confirm" data-testid="new-contact-button">
-            {{ $options.i18n.newContact }}
-          </gl-button>
-        </router-link>
+        <div class="gl-display-flex gl-align-items-center gl-justify-content-end gl-my-3 gl-mr-5">
+          <a
+            v-if="canReadCrmOrganization"
+            :href="groupOrganizationsPath"
+            class="gl-mr-3"
+            data-testid="organizations-link"
+            >{{ $options.i18n.organizations }}</a
+          >
+          <router-link v-if="canAdminCrmContact" :to="{ name: $options.NEW_ROUTE_NAME }">
+            <gl-button variant="confirm" data-testid="new-contact-button">
+              {{ $options.i18n.newContact }}
+            </gl-button>
+          </router-link>
+        </div>
       </template>
 
       <template #title>
diff --git a/app/assets/javascripts/crm/organizations/bundle.js b/app/assets/javascripts/crm/organizations/bundle.js
index 5897810a384..84ed9229f6f 100644
--- a/app/assets/javascripts/crm/organizations/bundle.js
+++ b/app/assets/javascripts/crm/organizations/bundle.js
@@ -25,6 +25,8 @@ export default () => {
   const {
     basePath,
     canAdminCrmOrganization,
+    canReadCrmContact,
+    groupContactsPath,
     groupFullPath,
     groupId,
     groupIssuesPath,
@@ -43,6 +45,8 @@ export default () => {
     apolloProvider,
     provide: {
       canAdminCrmOrganization: parseBoolean(canAdminCrmOrganization),
+      canReadCrmContact: parseBoolean(canReadCrmContact),
+      groupContactsPath,
       groupFullPath,
       groupId,
       groupIssuesPath,
diff --git a/app/assets/javascripts/crm/organizations/components/organizations_root.vue b/app/assets/javascripts/crm/organizations/components/organizations_root.vue
index 2fdb366c6d2..11c34738c33 100644
--- a/app/assets/javascripts/crm/organizations/components/organizations_root.vue
+++ b/app/assets/javascripts/crm/organizations/components/organizations_root.vue
@@ -22,7 +22,14 @@ export default {
   directives: {
     GlTooltip: GlTooltipDirective,
   },
-  inject: ['canAdminCrmOrganization', 'groupFullPath', 'groupIssuesPath', 'textQuery'],
+  inject: [
+    'canAdminCrmOrganization',
+    'canReadCrmContact',
+    'groupContactsPath',
+    'groupFullPath',
+    'groupIssuesPath',
+    'textQuery',
+  ],
   data() {
     return {
       organizations: { list: [] },
@@ -138,6 +145,7 @@ export default {
     title: s__('Crm|Customer relations organizations'),
     newOrganization: s__('Crm|New organization'),
     errorMsg: __('Something went wrong. Please try again.'),
+    contacts: s__('Crm|Contacts'),
   },
   EDIT_ROUTE_NAME,
   NEW_ROUTE_NAME,
@@ -182,15 +190,20 @@ export default {
       @error-alert-dismissed="errorAlertDismissed"
     >
       <template #header-actions>
-        <router-link v-if="canAdminCrmOrganization" :to="{ name: $options.NEW_ROUTE_NAME }">
-          <gl-button
-            class="gl-my-3 gl-mr-5"
-            variant="confirm"
-            data-testid="new-organization-button"
+        <div class="gl-display-flex gl-align-items-center gl-justify-content-end gl-my-3 gl-mr-5">
+          <a
+            v-if="canReadCrmContact"
+            :href="groupContactsPath"
+            class="gl-mr-3"
+            data-testid="contacts-link"
+            >{{ $options.i18n.contacts }}</a
           >
-            {{ $options.i18n.newOrganization }}
-          </gl-button>
-        </router-link>
+          <router-link v-if="canAdminCrmOrganization" :to="{ name: $options.NEW_ROUTE_NAME }">
+            <gl-button variant="confirm" data-testid="new-organization-button">
+              {{ $options.i18n.newOrganization }}
+            </gl-button>
+          </router-link>
+        </div>
       </template>
 
       <template #title>
diff --git a/app/assets/javascripts/graphql_shared/possible_types.json b/app/assets/javascripts/graphql_shared/possible_types.json
index 1e7903ffa19..005e3dd54f8 100644
--- a/app/assets/javascripts/graphql_shared/possible_types.json
+++ b/app/assets/javascripts/graphql_shared/possible_types.json
@@ -205,6 +205,7 @@
     "WorkItemWidgetStartAndDueDate",
     "WorkItemWidgetStatus",
     "WorkItemWidgetTestReports",
+    "WorkItemWidgetTimeTracking",
     "WorkItemWidgetWeight"
   ],
   "WorkItemWidgetDefinition": [
diff --git a/app/graphql/gitlab_schema.rb b/app/graphql/gitlab_schema.rb
index 0b56d6f4a90..2c4cbb45f97 100644
--- a/app/graphql/gitlab_schema.rb
+++ b/app/graphql/gitlab_schema.rb
@@ -79,7 +79,11 @@ class GitlabSchema < GraphQL::Schema
     def resolve_type(type, object, ctx = :__undefined__)
       return if type.respond_to?(:assignable?) && !type.assignable?(object)
 
-      super
+      if type.kind.object?
+        type
+      else
+        super
+      end
     end
 
     # Find an object by looking it up from its 'GlobalID'.
diff --git a/app/graphql/types/group_type.rb b/app/graphql/types/group_type.rb
index 0bd0f251c1a..96ebdaf9370 100644
--- a/app/graphql/types/group_type.rb
+++ b/app/graphql/types/group_type.rb
@@ -62,6 +62,11 @@ module Types
           null: true,
           description: 'Indicates if a group has email notifications disabled.'
 
+    field :emails_enabled,
+          type: GraphQL::Types::Boolean,
+          null: true,
+          description: 'Indicates if a group has email notifications enabled.'
+
     field :max_access_level, Types::AccessLevelType,
           null: false,
           description: 'The maximum access level of the current user in the group.'
@@ -365,6 +370,10 @@ module Types
       end
     end
 
+    def emails_disabled
+      !group.emails_enabled?
+    end
+
     def projects_count
       BatchLoader::GraphQL.for(object.id).batch do |group_ids, loader|
         projects_counts = Group.id_in(group_ids).projects_counts
diff --git a/app/graphql/types/work_items/widget_interface.rb b/app/graphql/types/work_items/widget_interface.rb
index 62657f38a4b..fda22db7779 100644
--- a/app/graphql/types/work_items/widget_interface.rb
+++ b/app/graphql/types/work_items/widget_interface.rb
@@ -23,7 +23,8 @@ module Types
         ::Types::WorkItems::Widgets::CurrentUserTodosType,
         ::Types::WorkItems::Widgets::AwardEmojiType,
         ::Types::WorkItems::Widgets::LinkedItemsType,
-        ::Types::WorkItems::Widgets::ParticipantsType
+        ::Types::WorkItems::Widgets::ParticipantsType,
+        ::Types::WorkItems::Widgets::TimeTrackingType
       ].freeze
 
       def self.ce_orphan_types
@@ -33,6 +34,8 @@ module Types
       # Whenever a new widget is added make sure to update the spec to avoid N + 1 queries in
       # spec/requests/api/graphql/project/work_items_spec.rb and add the necessary preloads
       # in app/graphql/resolvers/work_items_resolver.rb
+      #
+      # rubocop:disable Metrics/CyclomaticComplexity -- we'll have a lot of widgets to handle in the WidgetInterface
       def self.resolve_type(object, context)
         case object
         when ::WorkItems::Widgets::Description
@@ -59,10 +62,13 @@ module Types
           ::Types::WorkItems::Widgets::LinkedItemsType
         when ::WorkItems::Widgets::Participants
           ::Types::WorkItems::Widgets::ParticipantsType
+        when ::WorkItems::Widgets::TimeTracking
+          ::Types::WorkItems::Widgets::TimeTrackingType
         else
           raise "Unknown GraphQL type for widget #{object}"
         end
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
 
       orphan_types(*ORPHAN_TYPES)
     end
diff --git a/app/graphql/types/work_items/widgets/time_tracking_type.rb b/app/graphql/types/work_items/widgets/time_tracking_type.rb
new file mode 100644
index 00000000000..fd53aa5a92e
--- /dev/null
+++ b/app/graphql/types/work_items/widgets/time_tracking_type.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Types
+  module WorkItems
+    module Widgets
+      # rubocop:disable Graphql/AuthorizeTypes -- we already authorize the work item itself
+      class TimeTrackingType < BaseObject
+        graphql_name 'WorkItemWidgetTimeTracking'
+        description 'Represents a time tracking widget'
+
+        implements Types::WorkItems::WidgetInterface
+
+        field :time_estimate, GraphQL::Types::Int,
+          null: false,
+          description: 'Time estimate of the work item.'
+        field :total_time_spent, GraphQL::Types::Int,
+          null: false,
+          description: 'Total time (in seconds) reported as spent on the work item.'
+
+        field :timelogs, Types::TimelogType.connection_type,
+          null: false,
+          description: 'Timelogs on the work item.'
+      end
+      # rubocop:enable Graphql/AuthorizeTypes
+    end
+  end
+end
diff --git a/app/models/concerns/time_trackable.rb b/app/models/concerns/time_trackable.rb
index b90c938c5f8..cfc0853906c 100644
--- a/app/models/concerns/time_trackable.rb
+++ b/app/models/concerns/time_trackable.rb
@@ -123,6 +123,6 @@ module TimeTrackable
   end
 
   def category_id(category)
-    TimeTracking::TimelogCategory.find_by_name(project.root_namespace, category).first&.id
+    TimeTracking::TimelogCategory.find_by_name(project&.root_namespace, category).first&.id
   end
 end
diff --git a/app/models/work_item.rb b/app/models/work_item.rb
index 58e8337a9db..3193bacc9b4 100644
--- a/app/models/work_item.rb
+++ b/app/models/work_item.rb
@@ -174,6 +174,10 @@ class WorkItem < Issue
     linked_work_items(authorize: false).size
   end
 
+  def supports_time_tracking?
+    work_item_type.supports_time_tracking?
+  end
+
   private
 
   override :parent_link_confidentiality
diff --git a/app/models/work_items/type.rb b/app/models/work_items/type.rb
index 38416f6cb76..1d94443769b 100644
--- a/app/models/work_items/type.rb
+++ b/app/models/work_items/type.rb
@@ -108,6 +108,10 @@ module WorkItems
       widgets.include? ::WorkItems::Widgets::Assignees
     end
 
+    def supports_time_tracking?
+      widgets.include?(::WorkItems::Widgets::TimeTracking)
+    end
+
     def default_issue?
       name == WorkItems::Type::TYPE_NAMES[:issue]
     end
diff --git a/app/models/work_items/widget_definition.rb b/app/models/work_items/widget_definition.rb
index 1e00065b503..a8f35bec029 100644
--- a/app/models/work_items/widget_definition.rb
+++ b/app/models/work_items/widget_definition.rb
@@ -35,7 +35,8 @@ module WorkItems
       linked_items: 17,
       color: 18, # EE-only
       rolledup_dates: 19, # EE-only
-      participants: 20
+      participants: 20,
+      time_tracking: 21
     }
 
     def self.available_widgets
diff --git a/app/models/work_items/widgets/time_tracking.rb b/app/models/work_items/widgets/time_tracking.rb
new file mode 100644
index 00000000000..cdfad384530
--- /dev/null
+++ b/app/models/work_items/widgets/time_tracking.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module WorkItems
+  module Widgets
+    class TimeTracking < Base
+      delegate :time_estimate, :total_time_spent, :timelogs, to: :work_item
+
+      def self.quick_action_commands
+        [
+          # time estimation quick actions
+          :estimate, :estimate_time,
+          # remove time estimation quick actions
+          :remove_estimate, :remove_time_estimate,
+          # add spent time quick actions
+          :spend, :spent, :spend_time,
+          # remove time spent quick actions
+          :remove_time_spent
+        ]
+      end
+
+      def self.quick_action_params
+        [:time_estimate, :spend_time]
+      end
+    end
+  end
+end
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index 9edc3246949..1c9aaa61be4 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -196,6 +196,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     enable :admin_milestone
     enable :admin_issue_board_list
     enable :admin_issue
+    enable :update_issue
     enable :read_metrics_dashboard_annotation
     enable :read_prometheus
     enable :read_package
diff --git a/app/services/work_items/callbacks/time_tracking.rb b/app/services/work_items/callbacks/time_tracking.rb
new file mode 100644
index 00000000000..b33b128f3d4
--- /dev/null
+++ b/app/services/work_items/callbacks/time_tracking.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module WorkItems
+  module Callbacks
+    class TimeTracking < Base
+      def after_initialize
+        if excluded_in_new_type?
+          params.delete(:time_estimate)
+          params.delete(:spend_time)
+        end
+
+        return unless has_permission?(:admin_work_item)
+        return if !params.present? || (!params.key?(:time_estimate) && !params.key?(:spend_time))
+
+        work_item.time_estimate = params[:time_estimate] if params[:time_estimate].present?
+        work_item.spend_time = params[:spend_time] if params[:spend_time].present?
+      end
+    end
+  end
+end
diff --git a/app/views/groups/crm/contacts/index.html.haml b/app/views/groups/crm/contacts/index.html.haml
index 27f18ac1c57..f1e7c2f9818 100644
--- a/app/views/groups/crm/contacts/index.html.haml
+++ b/app/views/groups/crm/contacts/index.html.haml
@@ -1,8 +1,17 @@
 - breadcrumb_title _('Customer relations contacts')
 - page_title _('Customer relations contacts')
 - @content_wrapper_class = "gl-relative"
+- add_page_specific_style 'page_bundles/incident_management_list'
 
 = content_for :after_content do
   #js-crm-form-portal
 
-#js-crm-contacts-app{ data: { group_full_path: @group.full_path, group_issues_path: issues_group_path(@group), group_id: @group.id, can_admin_crm_contact: can?(current_user, :admin_crm_contact, @group).to_s, base_path: group_crm_contacts_path(@group), text_query: params[:search] } }
+#js-crm-contacts-app{ data: {
+  group_full_path: @group.full_path,
+  group_issues_path: issues_group_path(@group),
+  group_id: @group.id,
+  group_organizations_path: group_crm_organizations_path(@group),
+  can_admin_crm_contact: can?(current_user, :admin_crm_contact, @group).to_s,
+  can_read_crm_organization: can?(current_user, :read_crm_organization, @group).to_s,
+  base_path: group_crm_contacts_path(@group),
+  text_query: params[:search] } }
diff --git a/app/views/groups/crm/organizations/index.html.haml b/app/views/groups/crm/organizations/index.html.haml
index f7702889eef..7497f318b35 100644
--- a/app/views/groups/crm/organizations/index.html.haml
+++ b/app/views/groups/crm/organizations/index.html.haml
@@ -1,8 +1,17 @@
 - breadcrumb_title _('Customer relations organizations')
 - page_title _('Customer relations organizations')
 - @content_wrapper_class = "gl-relative"
+- add_page_specific_style 'page_bundles/incident_management_list'
 
 = content_for :after_content do
   #js-crm-form-portal
 
-#js-crm-organizations-app{ data: { base_path: group_crm_organizations_path(@group), can_admin_crm_organization: can?(current_user, :admin_crm_organization, @group).to_s, group_full_path: @group.full_path, group_id: @group.id, group_issues_path: issues_group_path(@group), text_query: params[:search] } }
+#js-crm-organizations-app{ data: {
+  base_path: group_crm_organizations_path(@group),
+  can_admin_crm_organization: can?(current_user, :admin_crm_organization, @group).to_s,
+  can_read_crm_contact: can?(current_user, :read_crm_contact, @group).to_s,
+  group_contacts_path: group_crm_contacts_path(@group),
+  group_full_path: @group.full_path,
+  group_id: @group.id,
+  group_issues_path: issues_group_path(@group),
+  text_query: params[:search] } }
diff --git a/db/docs/security_trainings.yml b/db/docs/security_trainings.yml
index 6c55b6912e8..93de5a36048 100644
--- a/db/docs/security_trainings.yml
+++ b/db/docs/security_trainings.yml
@@ -4,7 +4,16 @@ classes:
 - Security::Training
 feature_categories:
 - vulnerability_management
-description: Stores information about the primary security training provider for a given project
+description: Stores information about the primary security training provider for a
+  given project
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/78195
 milestone: '14.7'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/terraform_state_versions.yml b/db/docs/terraform_state_versions.yml
index ba5578ebe9f..0731dfd38f2 100644
--- a/db/docs/terraform_state_versions.yml
+++ b/db/docs/terraform_state_versions.yml
@@ -4,7 +4,23 @@ classes:
 - Terraform::StateVersion
 feature_categories:
 - infrastructure_as_code
-description: Represents a Terraform state file at a point in time, with a corresponding file stored in object storage
+description: Represents a Terraform state file at a point in time, with a corresponding
+  file stored in object storage
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/35211
 milestone: '13.4'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+desired_sharding_key:
+  project_id:
+    references: projects
+    backfill_via:
+      parent:
+        foreign_key: terraform_state_id
+        table: terraform_states
+        sharding_key: project_id
+        belongs_to: terraform_state
diff --git a/db/docs/users_security_dashboard_projects.yml b/db/docs/users_security_dashboard_projects.yml
index 9d5d8cfbe2b..2ecf597b598 100644
--- a/db/docs/users_security_dashboard_projects.yml
+++ b/db/docs/users_security_dashboard_projects.yml
@@ -7,4 +7,12 @@ feature_categories:
 description: Stores projects which users select to appear in their Security Dashboard
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/18708
 milestone: '12.5'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerabilities.yml b/db/docs/vulnerabilities.yml
index 11e7885f7cc..202fa1d5f12 100644
--- a/db/docs/vulnerabilities.yml
+++ b/db/docs/vulnerabilities.yml
@@ -4,7 +4,16 @@ classes:
 - Vulnerability
 feature_categories:
 - vulnerability_management
-description: Stores information about vulnerabilites present in the project's source code
+description: Stores information about vulnerabilites present in the project's source
+  code
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/16181
 milestone: '12.4'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_feedback.yml b/db/docs/vulnerability_feedback.yml
index 473ae398531..812954e3dd0 100644
--- a/db/docs/vulnerability_feedback.yml
+++ b/db/docs/vulnerability_feedback.yml
@@ -4,7 +4,16 @@ classes:
 - Vulnerabilities::Feedback
 feature_categories:
 - vulnerability_management
-description: Stores information about the confirm, dismiss, or create issue to investigate actions taken on vulnerabilities
+description: Stores information about the confirm, dismiss, or create issue to investigate
+  actions taken on vulnerabilities
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/5452
 milestone: '10.8'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_historical_statistics.yml b/db/docs/vulnerability_historical_statistics.yml
index 5efa7a51e0f..43a16334ee6 100644
--- a/db/docs/vulnerability_historical_statistics.yml
+++ b/db/docs/vulnerability_historical_statistics.yml
@@ -4,7 +4,16 @@ classes:
 - Vulnerabilities::HistoricalStatistic
 feature_categories:
 - vulnerability_management
-description: Stores aggregate vulnerability statistics which are used in the Security Dashboard
+description: Stores aggregate vulnerability statistics which are used in the Security
+  Dashboard
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/36955
 milestone: '13.3'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_identifiers.yml b/db/docs/vulnerability_identifiers.yml
index fa8f63507e1..ae6fa48bd26 100644
--- a/db/docs/vulnerability_identifiers.yml
+++ b/db/docs/vulnerability_identifiers.yml
@@ -4,7 +4,16 @@ classes:
 - Vulnerabilities::Identifier
 feature_categories:
 - vulnerability_management
-description: Stores identifiers (like CVE or CWE) for vulnerabilities that have been found
+description: Stores identifiers (like CVE or CWE) for vulnerabilities that have been
+  found
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/6896
 milestone: '11.4'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_occurrences.yml b/db/docs/vulnerability_occurrences.yml
index 90795b94c45..63eef337ccf 100644
--- a/db/docs/vulnerability_occurrences.yml
+++ b/db/docs/vulnerability_occurrences.yml
@@ -7,4 +7,12 @@ feature_categories:
 description: Stores information about findings for a given vulnerability
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/6896
 milestone: '11.4'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_reads.yml b/db/docs/vulnerability_reads.yml
index a7f589bf74e..f9b9083f319 100644
--- a/db/docs/vulnerability_reads.yml
+++ b/db/docs/vulnerability_reads.yml
@@ -7,4 +7,12 @@ feature_categories:
 description: Denormalized version of the vulnerabilites table used for faster reads
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74733
 milestone: '14.6'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_remediations.yml b/db/docs/vulnerability_remediations.yml
index e2de83561d1..91ae5d32fdf 100644
--- a/db/docs/vulnerability_remediations.yml
+++ b/db/docs/vulnerability_remediations.yml
@@ -8,4 +8,12 @@ feature_categories:
 description: Stores remediation information, such as diffs, for a given vulnerability
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/47166
 milestone: '13.7'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_scanners.yml b/db/docs/vulnerability_scanners.yml
index 90e8808e929..38031e14cd1 100644
--- a/db/docs/vulnerability_scanners.yml
+++ b/db/docs/vulnerability_scanners.yml
@@ -7,4 +7,12 @@ feature_categories:
 description: Stores information about the vulnerability scanners used by projects
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/6896
 milestone: '11.4'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/docs/vulnerability_statistics.yml b/db/docs/vulnerability_statistics.yml
index fbe1f07fbcc..60cfd54e550 100644
--- a/db/docs/vulnerability_statistics.yml
+++ b/db/docs/vulnerability_statistics.yml
@@ -7,4 +7,12 @@ feature_categories:
 description: Stores pre-calculated vulnerability statistics for projects
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/34289
 milestone: '13.2'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+sharding_key:
+  project_id: projects
diff --git a/db/migrate/20240118170849_add_time_tracking_widget_definition_to_work_item_types.rb b/db/migrate/20240118170849_add_time_tracking_widget_definition_to_work_item_types.rb
new file mode 100644
index 00000000000..be24355fbb0
--- /dev/null
+++ b/db/migrate/20240118170849_add_time_tracking_widget_definition_to_work_item_types.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+class AddTimeTrackingWidgetDefinitionToWorkItemTypes < Gitlab::Database::Migration[2.2]
+  milestone '16.9'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+  disable_ddl_transaction!
+
+  WIDGET_NAME = 'Time Tracking'
+  WIDGET_ENUM_VALUE = 21
+
+  # WorkItemTypes that would support Time tracking are provided in: https://gitlab.com/groups/gitlab-org/-/epics/12396
+  WORK_ITEM_TYPES = [
+    "Issue",
+    "Task",
+    "Epic",
+    "Requirement",
+    "Test Case",
+    "Ticket",
+    "Incident"
+  ].freeze
+
+  class WorkItemType < MigrationRecord
+    self.table_name = 'work_item_types'
+    self.inheritance_column = :_type_disabled
+  end
+
+  def up
+    widgets = []
+
+    WORK_ITEM_TYPES.each do |type_name|
+      type = WorkItemType.find_by_name_and_namespace_id(type_name, nil)
+
+      unless type
+        Gitlab::AppLogger.warn("type #{type_name} is missing, not adding widget")
+
+        next
+      end
+
+      widgets << {
+        work_item_type_id: type.id,
+        name: WIDGET_NAME,
+        widget_type: WIDGET_ENUM_VALUE
+      }
+    end
+
+    return if widgets.empty?
+
+    work_item_widget_definitions.upsert_all(
+      widgets,
+      unique_by: :index_work_item_widget_definitions_on_default_witype_and_name
+    )
+  end
+
+  def down
+    work_item_widget_definitions.where(name: WIDGET_NAME).delete_all
+  end
+
+  private
+
+  def work_item_widget_definitions
+    define_batchable_model('work_item_widget_definitions')
+  end
+end
diff --git a/db/schema_migrations/20240118170849 b/db/schema_migrations/20240118170849
new file mode 100644
index 00000000000..d604d0df3b2
--- /dev/null
+++ b/db/schema_migrations/20240118170849
@@ -0,0 +1 @@
+a1df0ace59e3eecb27d4911c7169b59d2ad3407736b66a9c4c485bf9c793e026
\ No newline at end of file
diff --git a/doc/administration/compliance.md b/doc/administration/compliance.md
index 567156a99bb..1c3e74539c6 100644
--- a/doc/administration/compliance.md
+++ b/doc/administration/compliance.md
@@ -45,7 +45,7 @@ compliance:
 |:------------------------------------------------------------------------------------|:-----------------------|:-----------------------|:-----------------------|:-------------------------------------------------------------------------------------------|
 | [Compliance frameworks](../user/group/compliance_frameworks.md)                     | **{dotted-circle}** No | **{check-circle}** Yes | **{dotted-circle}** No | Describe the type of compliance requirements projects must follow.                         |
 | [Compliance pipelines](../user/group/compliance_frameworks.md#compliance-pipelines) | **{dotted-circle}** No | **{check-circle}** Yes | **{dotted-circle}** No | Define a pipeline configuration to run for any projects with a given compliance framework. |
-| [Scan result policy approval settings](../user/application_security/policies/scan-result-policies.md#approval_settings) | **{dotted-circle}** Yes | **{check-circle}** Yes | **{dotted-circle}** Yes | Enforce a scan result policy enforcing multiple approvers and override various project settings in all enforced groups or projects across your GitLab instance or group. |
+| [Merge request approval policy approval settings](../user/application_security/policies/scan-result-policies.md#approval_settings) | **{dotted-circle}** Yes | **{check-circle}** Yes | **{dotted-circle}** Yes | Enforce a merge request approval policy enforcing multiple approvers and override various project settings in all enforced groups or projects across your GitLab instance or group. |
 
 ## Audit management
 
diff --git a/doc/administration/monitoring/prometheus/gitlab_metrics.md b/doc/administration/monitoring/prometheus/gitlab_metrics.md
index 4ad0ff28807..fd0d75c57da 100644
--- a/doc/administration/monitoring/prometheus/gitlab_metrics.md
+++ b/doc/administration/monitoring/prometheus/gitlab_metrics.md
@@ -182,7 +182,7 @@ The following metrics are available:
 | `gitlab_ci_queue_retrieval_duration_seconds` | Histogram | 16.3 | Time it takes to execute a SQL query to retrieve builds queue |
 | `gitlab_connection_pool_size` | Gauge | 16.7 | Size of connection pool |
 | `gitlab_connection_pool_available_count` | Gauge | 16.7 | Number of available connections in the pool |
-| `gitlab_security_policies_scan_result_process_duration_seconds` | Histogram | 16.7 | The amount of time to process scan result policies |
+| `gitlab_security_policies_scan_result_process_duration_seconds` | Histogram | 16.7 | The amount of time to process merge request approval policies |
 | `gitlab_highlight_usage` | Counter | 16.8 | The number of times `Gitlab::Highlight` is used | `used_on` |
 | `dependency_linker_usage` | Counter | 16.8 | The number of times dependency linker is used | `used_on` |
 
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index bc7898f8a58..5e35b12fd27 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -19482,6 +19482,7 @@ GPG signature for a signed commit.
 | <a id="groupdescriptionhtml"></a>`descriptionHtml` | [`String`](#string) | GitLab Flavored Markdown rendering of `description`. |
 | <a id="groupdora"></a>`dora` | [`Dora`](#dora) | Group's DORA metrics. |
 | <a id="groupemailsdisabled"></a>`emailsDisabled` | [`Boolean`](#boolean) | Indicates if a group has email notifications disabled. |
+| <a id="groupemailsenabled"></a>`emailsEnabled` | [`Boolean`](#boolean) | Indicates if a group has email notifications enabled. |
 | <a id="groupenforcefreeusercap"></a>`enforceFreeUserCap` | [`Boolean`](#boolean) | Indicates whether the group has limited users for a free plan. |
 | <a id="groupepicboards"></a>`epicBoards` | [`EpicBoardConnection`](#epicboardconnection) | Find epic boards. (see [Connections](#connections)) |
 | <a id="groupepicsenabled"></a>`epicsEnabled` | [`Boolean`](#boolean) | Indicates if Epics are enabled for namespace. |
@@ -29507,6 +29508,19 @@ Represents a test reports widget.
 | <a id="workitemwidgettestreportstestreports"></a>`testReports` | [`TestReportConnection`](#testreportconnection) | Test reports of the work item. (see [Connections](#connections)) |
 | <a id="workitemwidgettestreportstype"></a>`type` | [`WorkItemWidgetType`](#workitemwidgettype) | Widget type. |
 
+### `WorkItemWidgetTimeTracking`
+
+Represents a time tracking widget.
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="workitemwidgettimetrackingtimeestimate"></a>`timeEstimate` | [`Int!`](#int) | Time estimate of the work item. |
+| <a id="workitemwidgettimetrackingtimelogs"></a>`timelogs` | [`TimelogConnection!`](#timelogconnection) | Timelogs on the work item. (see [Connections](#connections)) |
+| <a id="workitemwidgettimetrackingtotaltimespent"></a>`totalTimeSpent` | [`Int!`](#int) | Total time (in seconds) reported as spent on the work item. |
+| <a id="workitemwidgettimetrackingtype"></a>`type` | [`WorkItemWidgetType`](#workitemwidgettype) | Widget type. |
+
 ### `WorkItemWidgetWeight`
 
 Represents a weight widget.
@@ -32440,6 +32454,7 @@ Type of a work item widget.
 | <a id="workitemwidgettypestart_and_due_date"></a>`START_AND_DUE_DATE` | Start And Due Date widget. |
 | <a id="workitemwidgettypestatus"></a>`STATUS` | Status widget. |
 | <a id="workitemwidgettypetest_reports"></a>`TEST_REPORTS` | Test Reports widget. |
+| <a id="workitemwidgettypetime_tracking"></a>`TIME_TRACKING` | Time Tracking widget. |
 | <a id="workitemwidgettypeweight"></a>`WEIGHT` | Weight widget. |
 
 ## Scalar types
@@ -34134,6 +34149,7 @@ Implementations:
 - [`WorkItemWidgetStartAndDueDate`](#workitemwidgetstartandduedate)
 - [`WorkItemWidgetStatus`](#workitemwidgetstatus)
 - [`WorkItemWidgetTestReports`](#workitemwidgettestreports)
+- [`WorkItemWidgetTimeTracking`](#workitemwidgettimetracking)
 - [`WorkItemWidgetWeight`](#workitemwidgetweight)
 
 ##### Fields
diff --git a/doc/api/settings.md b/doc/api/settings.md
index 60189ff76b3..6653695731c 100644
--- a/doc/api/settings.md
+++ b/doc/api/settings.md
@@ -555,7 +555,7 @@ listed in the descriptions of the relevant settings.
 | `restricted_visibility_levels`           | array of strings | no                                   | Selected levels cannot be used by non-Administrator users for groups, projects or snippets. Can take `private`, `internal` and `public` as a parameter. Default is `null` which means there is no restriction.[Changed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131203) in GitLab 16.4: cannot select levels that are set as `default_project_visibility` and `default_group_visibility`. |
 | `rsa_key_restriction`                    | integer          | no                                   | The minimum allowed bit length of an uploaded RSA key. Default is `0` (no restriction). `-1` disables RSA keys. |
 | `session_expire_delay`                   | integer          | no                                   | Session duration in minutes. GitLab restart is required to apply changes. |
-| `security_policy_global_group_approvers_enabled` | boolean  | no                                   | Whether to look up scan result policy approval groups globally or within project hierarchies. |
+| `security_policy_global_group_approvers_enabled` | boolean  | no                                   | Whether to look up merge request approval policy approval groups globally or within project hierarchies. |
 | `security_txt_content`                    | string          | no                                   | [Public security contact information](../administration/settings/security_contact_information.md). [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/433210) in GitLab 16.7. |
 | `service_access_tokens_expiration_enforced` | boolean | no | Flag to indicate if token expiry date can be optional for service account users |
 | `shared_runners_enabled`                 | boolean          | no                                   | (**If enabled, requires:** `shared_runners_text` and `shared_runners_minutes`) Enable shared runners for new projects. |
diff --git a/doc/architecture/blueprints/organization/index.md b/doc/architecture/blueprints/organization/index.md
index f9a250e1205..c20b8000ebe 100644
--- a/doc/architecture/blueprints/organization/index.md
+++ b/doc/architecture/blueprints/organization/index.md
@@ -360,7 +360,7 @@ After the initial rollout of Organizations, the following functionality will be
 1. Security policies at the Organization level.
 1. Vulnerability Report and Dependency List at the Organization level.
 1. Cascading Organization setting to enforce security scans.
-1. Scan result policies at the Organization level.
+1. Merge request approval policies at the Organization level.
 1. Compliance frameworks.
 1. [Support the agent for Kubernetes sharing at the Organization level](https://gitlab.com/gitlab-org/gitlab/-/issues/382731).
 
diff --git a/doc/architecture/blueprints/security_policies_database_read_model/index.md b/doc/architecture/blueprints/security_policies_database_read_model/index.md
index 507191d854b..1d6bb16f008 100644
--- a/doc/architecture/blueprints/security_policies_database_read_model/index.md
+++ b/doc/architecture/blueprints/security_policies_database_read_model/index.md
@@ -36,9 +36,9 @@ The current architecture of synchronising policies from YAML to approval rules i
 ### Goals
 
 1. Reduce the calls to Gitaly and depend on reading from the database. The YAML data will be mirrored on a database table and a read-only ActiveRecord model allows us to build features without performance concerns.
-1. Remove duplicated columns related to scan result policies in approval_project_rules and approval_merge_request_rules
+1. Remove duplicated columns related to merge request approval policies in approval_project_rules and approval_merge_request_rules
 1. Change the current process in [UpdateOrchestrationPolicyConfiguration](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/workers/concerns/update_orchestration_policy_configuration.rb) not to delete and recreate all related records, but rather update/recreate only the affected records
-1. Reduce the average propagation duration of scan result policy changes
+1. Reduce the average propagation duration of merge request approval policy changes
 1. Reduce the number of queries to the database performed by workers from Security Policies
 
 ## Proposal
@@ -47,7 +47,7 @@ The current architecture of synchronising policies from YAML to approval rules i
 
 Security policy project that are linked to a group or a project has a corresponding entry in `security_orchestration_policy_configurations` table. In order to read/query policies, the YAML has to be read from policy project which involves a RPC call to Gitaly. This does not perform well when there are huge number of projects/groups configured with security policies.
 
-Scan result policy that are stored in the policy project as YAML file gets synchronised to approval rules through `approval_project_rules` table. Currently we are storing these fields related to scan result policy in the table:
+Merge request approval policy that are stored in the policy project as YAML file gets synchronised to approval rules through `approval_project_rules` table. Currently we are storing these fields related to merge request approval policy in the table:
 
 - `scanners`
 - `vulnerabilities_allowed`
@@ -73,7 +73,7 @@ This worker is called whenever these events happen:
 - Protected branch is added/removed from a project
 - Policy is created/updated/deleted for a project
 
-To avoid this, we have created the `scan_result_policies` table (`Security::ScanResultPolicyRead` model) which acts as a read model for scan result policies to avoid reading from policy project. But currently, we don't store all the required fields in the table, we only store `role_approvers` , `license_state` and `match_on_inclusion`.
+To avoid this, we have created the `scan_result_policies` table (`Security::ScanResultPolicyRead` model) which acts as a read model for merge request approval policies to avoid reading from policy project. But currently, we don't store all the required fields in the table, we only store `role_approvers` , `license_state` and `match_on_inclusion`.
 
 ```mermaid
 erDiagram
diff --git a/doc/development/code_review.md b/doc/development/code_review.md
index 7ea4f798a09..f4e7900bf49 100644
--- a/doc/development/code_review.md
+++ b/doc/development/code_review.md
@@ -280,8 +280,8 @@ See the [test engineering process](https://handbook.gitlab.com/handbook/engineer
 
 1. You have confirmed that if this MR contains changes to processing or storing of credentials or tokens, authorization, and authentication methods, or other items described in [the security review guidelines](https://handbook.gitlab.com/handbook/security/product-security/application-security/appsec-reviews/#what-should-be-reviewed), you have added the `~security` label and you have `@`-mentioned `@gitlab-com/gl-security/appsec`.
 1. You have reviewed the documentation regarding [internal application security reviews](https://handbook.gitlab.com/handbook/security/product-security/application-security/appsec-reviews/#internal-application-security-reviews) for **when** and **how** to request a security review and requested a security review if this is warranted for this change.
-1. If there are security scan results that are blocking the MR (due to the [scan result policies](https://gitlab.com/gitlab-com/gl-security/security-policies)):
-    - For true positive findings, they should be corrected before the merge request is merged. This will remove the AppSec approval required by the scan result policy.
+1. If there are security scan results that are blocking the MR (due to the [merge request approval policies](https://gitlab.com/gitlab-com/gl-security/security-policies)):
+    - For true positive findings, they should be corrected before the merge request is merged. This will remove the AppSec approval required by the merge request approval policy.
     - For false positive findings, something that should be discussed for risk acceptance, or anything questionable, ping `@gitlab-com/gl-security/appsec`.
 
 ##### Deployment
diff --git a/doc/tutorials/scan_result_policy/index.md b/doc/tutorials/scan_result_policy/index.md
index d5fea473b16..da035cb62fb 100644
--- a/doc/tutorials/scan_result_policy/index.md
+++ b/doc/tutorials/scan_result_policy/index.md
@@ -4,20 +4,20 @@ group: Security Policies
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
 
-# Tutorial: Set up a scan result policy
+# Tutorial: Set up a merge request approval policy
 
 DETAILS:
 **Tier:** Ultimate
 **Offering:** SaaS, self-managed
 
-This tutorial shows you how to create and configure a [scan result policy](../../user/application_security/policies/scan-result-policies.md). These policies can be set to take action based on scan results.
+This tutorial shows you how to create and configure a [merge request approval policy](../../user/application_security/policies/scan-result-policies.md). These policies can be set to take action based on scan results.
 For example, in this tutorial, you'll set up a policy that requires approval from two specified users if a vulnerability is detected in a merge request.
 
-To set up a scan result policy:
+To set up a merge request approval policy:
 
 1. [Create a test project](#create-a-test-project).
-1. [Add a scan result policy](#add-a-scan-result-policy).
-1. [Test the scan result policy](#test-the-scan-result-policy).
+1. [Add a merge request approval policy](#add-a-merge-request-approval-policy).
+1. [Test the merge request approval policy](#test-the-merge-request-approval-policy).
 
 ## Before you begin
 
@@ -36,14 +36,14 @@ The namespace used for this tutorial must:
 1. Select **Create project**.
 1. Go to the newly created project and create [protected branches](../../user/project/protected_branches.md).
 
-## Add a scan result policy
+## Add a merge request approval policy
 
-Next, you'll add a scan result policy to your test project:
+Next, you'll add a merge request approval policy to your test project:
 
 1. On the left sidebar, select **Search or go to** and find the `sast-scan-result-policy` project.
 1. Select **Secure > Policies**.
 1. Select **New policy**.
-1. In **Scan result policy**, select **Select policy**.
+1. In **Merge request approval policy**, select **Select policy**.
 1. Complete the fields.
    - **Name**: `sast-scan-result-policy`
    - **Policy status**: **Enabled**
@@ -70,9 +70,9 @@ Next, you'll add a scan result policy to your test project:
 
    You can see the list of policies added in the previous steps.
 
-## Test the scan result policy
+## Test the merge request approval policy
 
-Nice work, you've created a scan result policy. To test it, create some vulnerabilities and check the result:
+Nice work, you've created a merge request approval policy. To test it, create some vulnerabilities and check the result:
 
 1. On the left sidebar, select **Search or go to** and find the `sast-scan-result-policy` project.
 1. Select **Code > Repository**.
@@ -123,7 +123,7 @@ Nice work, you've created a scan result policy. To test it, create some vulnerab
    Wait for the pipeline to complete. This could be a few minutes.
 
 The merge request security widget confirms that security scanning detected one potential
-vulnerability. As defined in the scan result policy, the merge request is blocked and waiting for
+vulnerability. As defined in the merge request approval policy, the merge request is blocked and waiting for
 approval.
 
-You now know how to set up and use scan result policies to catch vulnerabilities!
+You now know how to set up and use merge request approval policies to catch vulnerabilities!
diff --git a/doc/tutorials/secure_application.md b/doc/tutorials/secure_application.md
index ac139a88cf1..42a7eda2dff 100644
--- a/doc/tutorials/secure_application.md
+++ b/doc/tutorials/secure_application.md
@@ -14,7 +14,7 @@ GitLab can check your application for security vulnerabilities and that it meets
 | [Set up dependency scanning](dependency_scanning.md) | Learn how to detect vulnerabilities in an application's dependencies. | **{star}** |
 | [Export Dependency List in SBOM format](export_sbom.md) | Learn how to export an application's dependencies to the CycloneDX SBOM format. | **{star}** |
 | [Create a compliance pipeline](compliance_pipeline/index.md) | Learn how to create compliance pipelines for your groups. | **{star}** |
-| [Set up a scan result policy](scan_result_policy/index.md) | Learn how to configure a scan result policy that takes action based on scan results. | **{star}** |
+| [Set up a merge request approval policy](scan_result_policy/index.md) | Learn how to configure a merge request approval policy that takes action based on scan results. | **{star}** |
 | [Set up a scan execution policy](scan_execution_policy/index.md) | Learn how to create a scan execution policy to enforce security scanning of your project. | **{star}** |
 | [Scan a Docker container for vulnerabilities](container_scanning/index.md) | Learn how to use container scanning templates to add container scanning to your projects. | **{star}** |
 | [Get started with GitLab application security](../user/application_security/get-started-security.md) | Follow recommended steps to set up security tools. | |
diff --git a/doc/user/application_security/get-started-security.md b/doc/user/application_security/get-started-security.md
index 7909d10c96f..c8386d13268 100644
--- a/doc/user/application_security/get-started-security.md
+++ b/doc/user/application_security/get-started-security.md
@@ -49,7 +49,7 @@ After you've gotten familiar with how scanning works, you can then choose to:
    - These scheduled jobs run independently from any other security scans you may have defined in a compliance framework pipeline or in the project's `.gitlab-ci.yml` file.
    - Running regular dependency and [container scans](container_scanning/index.md) surface newly-discovered vulnerabilities that already exist in your repository.
    - Scheduled scans are most useful for projects or important branches with low development activity where pipeline scans are infrequent.
-1. Create a [scan result policy](policies/index.md) to limit new vulnerabilities from being merged
+1. Create a [merge request approval policy](policies/index.md) to limit new vulnerabilities from being merged
    into your [default branch](../project/repository/branches/default.md).
 1. Enable other scan types such as [SAST](sast/index.md), [DAST](dast/index.md),
    [Fuzz testing](coverage_fuzzing/index.md), or [Container Scanning](container_scanning/index.md).
diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md
index 94d3fa3bca9..f5f25c97cfd 100644
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@@ -340,7 +340,7 @@ For more details, see [extension page](https://marketplace.visualstudio.com/item
 You can enforce an additional approval for merge requests that would introduce one of the following
 security issues:
 
-- A security vulnerability. For more details, read [Scan result policies](policies/scan-result-policies.md).
+- A security vulnerability. For more details, read [Merge request approval policies](policies/scan-result-policies.md).
 
 ## Using private Maven repositories
 
diff --git a/doc/user/application_security/policies/index.md b/doc/user/application_security/policies/index.md
index f4b19de4fe6..6b876c91c78 100644
--- a/doc/user/application_security/policies/index.md
+++ b/doc/user/application_security/policies/index.md
@@ -317,11 +317,11 @@ The workaround is to amend your group or instance push rules to allow branches f
   Security Policies are designed to require approval when there are no results (no security report),
   as this ensures that no vulnerabilities are introduced. We cannot know if there are any
   vulnerabilities unless the scans enforced by the policy complete successfully and are evaluated.
-- For scan result policies, we require artifacts for each scanner defined in the policy for both the
-  source and target branch. To ensure scan result policies capture the necessary results, confirm
+- For merge request approval policies, we require artifacts for each scanner defined in the policy for both the
+  source and target branch. To ensure merge request approval policies capture the necessary results, confirm
   your scan execution is properly implemented and enforced. If using scan execution policies,
   enforcing on `all branches` often addresses this need.
-- Comparison in scan result policies depends on a successful and completed merge base pipeline. If the merge base pipeline is [skipped](../../../ci/pipelines/index.md#skip-a-pipeline), merge requests with the merge base pipeline are blocked.
+- Comparison in merge request approval policies depends on a successful and completed merge base pipeline. If the merge base pipeline is [skipped](../../../ci/pipelines/index.md#skip-a-pipeline), merge requests with the merge base pipeline are blocked.
 - When running scan execution policies based on a SAST action, ensure target repositories contain
   proper code files. SAST runs different analyzers
   [based on the types of files in the repository](../sast/index.md#supported-languages-and-frameworks),
@@ -333,7 +333,7 @@ The workaround is to amend your group or instance push rules to allow branches f
   is not applied for the latter. You can define policies to enforce rules generically on `default`
   branches regardless of the name used in the project or on `all protected branches` to address this
   issue.
-- Scan result policies created at the group or subgroup level can take some time to apply to all
+- Merge request approval policies created at the group or subgroup level can take some time to apply to all
   the merge requests in the group.
 - Scheduled scan execution policies run with a minimum 15 minute cadence. Learn more [about the schedule rule type](../policies/scan-execution-policies.md#schedule-rule-type).
 - When scheduling pipelines, keep in mind that CRON scheduling is based on UTC on GitLab SaaS and is
@@ -348,7 +348,7 @@ The workaround is to amend your group or instance push rules to allow branches f
 - When creating a Scan Result Policy, neither the array `severity_levels` nor the array
   `vulnerability_states` in the [`scan_finding` rule](../policies/scan-result-policies.md#scan_finding-rule-type)
   can be left empty. For a working rule, at least one entry must exist.
-- When configuring pipeline and scan result policies, it's important to remember that security scans
+- When configuring pipeline and merge request approval policies, it's important to remember that security scans
   performed in manual jobs are not verified to determine whether MR approval is required. When you
   run a manual job with security scans, it does not ensure approval even if vulnerabilities are
   introduced.
diff --git a/doc/user/application_security/policies/scan-result-policies.md b/doc/user/application_security/policies/scan-result-policies.md
index f510fa51a7e..974e420c92d 100644
--- a/doc/user/application_security/policies/scan-result-policies.md
+++ b/doc/user/application_security/policies/scan-result-policies.md
@@ -4,25 +4,29 @@ group: Security Policies
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
 
-# Scan result policies
+# Merge request approval policies (Previously: Scan result policies)
 
 DETAILS:
 **Tier:** Ultimate
 **Offering:** SaaS, Self-managed
 
-> Group-level scan result policies [introduced](https://gitlab.com/groups/gitlab-org/-/epics/7622) in GitLab 15.6.
-
-You can use scan result policies to take action based on scan results. For example, one type of scan
-result policy is a security approval policy that allows approval to be required based on the
-findings of one or more security scan jobs. Scan result policies are evaluated after a CI scanning job is fully executed and both vulnerability and license type policies are evaluated based on the job artifact reports that are published in the completed pipeline.
+> - Group-level scan result policies [introduced](https://gitlab.com/groups/gitlab-org/-/epics/7622) in GitLab 15.6.
+> - Scan result policies feature was renamed to merge request approval policies in GitLab 16.9.
 
 NOTE:
-Scan result policies are applicable only to [protected](../../project/protected_branches.md) target branches.
+Scan result policies feature was renamed to merge request approval policies in GitLab 16.9.
+
+You can use merge request approval policies to enforce project level settings and create approval rules based on scan results. For example, one type of scan
+result policy is a security approval policy that allows approval to be required based on the
+findings of one or more security scan jobs. Merge request approval policies are evaluated after a CI scanning job is fully executed and both vulnerability and license type policies are evaluated based on the job artifact reports that are published in the completed pipeline.
+
+NOTE:
+Merge request approval policies are applicable only to [protected](../../project/protected_branches.md) target branches.
 
 NOTE:
 When a protected branch is created or deleted, the policy approval rules synchronize, with a delay of 1 minute.
 
-The following video gives you an overview of GitLab scan result policies:
+The following video gives you an overview of GitLab merge request approval policies (previously scan result policies):
 
 <div class="video-fallback">
   See the video: <a href="https://youtu.be/w5I9gcUgr9U">Overview of GitLab Scan Result Policies</a>.
@@ -34,11 +38,11 @@ The following video gives you an overview of GitLab scan result policies:
 ## Requirements and limitations
 
 - You must add the respective [security scanning tools](../index.md#application-coverage).
-  Otherwise, scan result policies do not have any effect.
-- The maximum number of scan result policies is five per security policy project.
+  Otherwise, merge request approval policies cannot get evaluated and the corresonding approvals stay required.
+- The maximum number of merge request approval policies is five per security policy project.
 - Each policy can have a maximum of five rules.
 - All configured scanners must be present in the merge request's latest pipeline. If not, approvals are required even if some vulnerability criteria have not been met.
-- Scan result policies evaluate findings and determine approval requirements based on the job artifact reports published in a completed pipeline. However, scan result policies do not check the integrity or authenticity of the scan results generated in the artifact reports.
+- Merge request approval policies evaluate findings and determine approval requirements based on the job artifact reports published in a completed pipeline. However, merge request approval policies do not check the integrity or authenticity of the scan results generated in the artifact reports.
 
 ## Merge request with multiple pipelines
 
@@ -49,12 +53,12 @@ A project can have multiple pipeline types configured. A single commit can initi
 pipelines, each of which may contain a security scan.
 
 - In GitLab 16.3 and later, the results of all completed pipelines for the latest commit in
-  the merge request's source and target branch are evaluated and used to enforce the scan result policy.
+  the merge request's source and target branch are evaluated and used to enforce the merge request approval policy.
   Parent-child pipelines and on-demand DAST pipelines are not considered.
 - In GitLab 16.2 and earlier, only the results of the latest completed pipeline were evaluated
-  when enforcing scan result policies.
+  when enforcing merge request approval policies.
 
-## Scan result policy editor
+## Merge request approval policy editor
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77814) in GitLab 14.8.
 > - [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/369473) in GitLab 15.6.
@@ -76,23 +80,26 @@ before the policy changes take effect.
 The [policy editor](index.md#policy-editor) supports YAML mode and rule mode.
 
 NOTE:
-Propagating scan result policies created for groups with a large number of projects take a while to complete.
+Propagating merge request approval policies created for groups with a large number of projects take a while to complete.
 
-## Scan result policies schema
+## Merge request approval policies schema
 
-The YAML file with scan result policies consists of an array of objects matching the scan result
-policy schema nested under the `scan_result_policy` key. You can configure a maximum of five
-policies under the `scan_result_policy` key.
+The YAML file with merge request approval policies consists of an array of objects matching the merge request approval
+policy schema nested under the `approval_policy` key. You can configure a maximum of five policies under the `approval_policy` key.
+
+NOTE:
+Merge request approval policies were defined under the `scan_result_policy` key. Until GitLab 17.0, policies can be
+defined under both keys. Starting from GitLab 17.0, only `approval_policy` key is supported.
 
 When you save a new policy, GitLab validates its contents against [this JSON schema](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/validators/json_schemas/security_orchestration_policy.json).
 If you're not familiar with how to read [JSON schemas](https://json-schema.org/),
 the following sections and tables provide an alternative.
 
-| Field                | Type                          | Required | Possible values | Description                               |
-|----------------------|-------------------------------|----------|-----------------|-------------------------------------------|
-| `scan_result_policy` | `array` of Scan Result Policy | true     |                 | List of scan result policies (maximum 5). |
+| Field             | Type                          | Required | Possible values | Description                               |
+|-------------------|-------------------------------|----------|-----------------|-------------------------------------------|
+| `approval_policy` | `array` of Merge Request Approval Policy | true     |                 | List of merge request approval policies (maximum 5). |
 
-## Scan result policy schema
+## Merge request approval policy schema
 
 > - The `approval_settings` fields were [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/418752) in GitLab 16.4 [with flags](../../../administration/feature_flags.md) named `scan_result_policies_block_unprotecting_branches`, `scan_result_any_merge_request`, or `scan_result_policies_block_force_push`. See the `approval_settings` section below for more information.
 
@@ -107,8 +114,8 @@ the following sections and tables provide an alternative.
 
 ## `scan_finding` rule type
 
-> - The scan result policy field `vulnerability_attributes` was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123052) in GitLab 16.2 [with a flag](../../../administration/feature_flags.md) named `enforce_vulnerability_attributes_rules`. [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/418784) in GitLab 16.3. Feature flag removed.
-> - The scan result policy field `vulnerability_age` was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123956) in GitLab 16.2.
+> - The merge request approval policy field `vulnerability_attributes` was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123052) in GitLab 16.2 [with a flag](../../../administration/feature_flags.md) named `enforce_vulnerability_attributes_rules`. [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/418784) in GitLab 16.3. Feature flag removed.
+> - The merge request approval policy field `vulnerability_age` was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123956) in GitLab 16.2.
 > - The `branch_exceptions` field was [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/418741) in GitLab 16.3 [with a flag](../../../administration/feature_flags.md) named `security_policies_branch_exceptions`. [Generally available](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/133753) in GitLab 16.5. Feature flag removed.
 
 This rule enforces the defined actions based on security scan findings.
@@ -206,14 +213,14 @@ The settings set in the policy overwrite settings in the project.
 | `require_password_to_approve`       | `boolean`             | false    | `true`, `false`                                               | `Any merge request`  | When enabled, there will be password confirmation on approvals. Password confirmation adds an extra layer of security.                                                                                                                                                                           |
 | `prevent_pushing_and_force_pushing` | `boolean`             | false    | `true`, `false`                                               | All                  | When enabled, prevents users from pushing and force pushing to a protected branch if that branch is included in the security policy. This ensures users do not bypass the merge request process to add vulnerable code to a branch.                                                              |
 
-## Example security scan result policies project
+## Example security merge request approval policies project
 
 You can use this example in a `.gitlab/security-policies/policy.yml` file stored in a
 [security policy project](index.md#security-policy-project):
 
 ```yaml
 ---
-scan_result_policy:
+approval_policy:
 - name: critical vulnerability CS approvals
   description: critical severity level only for container scanning
   enabled: true
@@ -269,13 +276,13 @@ In this example:
 - Every MR that contains more than one preexisting `low` or `unknown` vulnerability older than 30 days identified by
   container scanning requires one approval from a project member with the Owner role.
 
-## Example for Scan Result Policy editor
+## Example for Merge Request Approval Policy editor
 
-You can use this example in the YAML mode of the [Scan Result Policy editor](#scan-result-policy-editor).
+You can use this example in the YAML mode of the [Merge Request Approval Policy editor](#merge-request-approval-policy-editor).
 It corresponds to a single object from the previous example:
 
 ```yaml
-type: scan_result_policy
+type: approval_policy
 name: critical vulnerability CS approvals
 description: critical severity level only for container scanning
 enabled: true
@@ -297,23 +304,23 @@ actions:
   - adalberto.dare
 ```
 
-## Understanding scan result policy approvals
+## Understanding merge request approval policy approvals
 
 > - The branch comparison logic for `scan_finding` was [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/428518) in GitLab 16.8 [with a flag](../../../administration/feature_flags.md) named `scan_result_policy_merge_base_pipeline`. Disabled by default.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/435297) in GitLab 16.9. Feature flag `scan_result_policy_merge_base_pipeline` removed.
 
-### Scope of scan result policy comparison
+### Scope of merge request approval policy comparison
 
 - To determine when approval is required on a merge request, we compare completed pipelines for each supported pipeline source for the source and target branch (for example, `feature`/`main`). This ensures the most comprehensive evaluation of scan results.
 - For the source branch, the comparison pipeline is its latest completed `HEAD` pipeline.
 - For the target branch, we compare to a common ancestor's latest completed pipeline.
-- Scan result policies considers all supported pipeline sources (based on the [`CI_PIPELINE_SOURCE` variable](../../../ci/variables/predefined_variables.md)) when comparing results from both the source and target branches when determining if a merge request requires approval. Pipeline sources `webide` and `parent_pipeline` are not supported.
+- Merge request approval policies considers all supported pipeline sources (based on the [`CI_PIPELINE_SOURCE` variable](../../../ci/variables/predefined_variables.md)) when comparing results from both the source and target branches when determining if a merge request requires approval. Pipeline sources `webide` and `parent_pipeline` are not supported.
 
 ### Accepting risk and ignoring vulnerabilities in future merge requests
 
-For scan result policies that are scoped to `newly_detected` findings, it's important to understand the implications of this vulnerability state. A finding is considered `newly_detected` if it exists on the merge request's branch but not on the default branch. When a merge request whose branch contains `newly_detected` findings is approved and merged, approvers are "accepting the risk" of those vulnerabilities. If one or more of the same vulnerabilities were detected after this time, their status would be `previously_detected` and so not be out of scope of a policy aimed at `newly_detected` findings. For example:
+For merge request approval policies that are scoped to `newly_detected` findings, it's important to understand the implications of this vulnerability state. A finding is considered `newly_detected` if it exists on the merge request's branch but not on the default branch. When a merge request whose branch contains `newly_detected` findings is approved and merged, approvers are "accepting the risk" of those vulnerabilities. If one or more of the same vulnerabilities were detected after this time, their status would be `previously_detected` and so not be out of scope of a policy aimed at `newly_detected` findings. For example:
 
-- A scan result policy is created to block critical SAST findings. If a SAST finding for CVE-1234 is approved, future merge requests with the same violation will not require approval in the project.
+- A merge request approval policy is created to block critical SAST findings. If a SAST finding for CVE-1234 is approved, future merge requests with the same violation will not require approval in the project.
 
 When using license approval policies, the combination of project, component (dependency), and license are considered in the evaluation. If a license is approved as an exception, future merge requests don't require approval for the same combination of project, component (dependency), and license. The component's version is not be considered in this case. If a previously approved package is updated to a new version, approvers will not need to re-approve. For example:
 
@@ -321,17 +328,17 @@ When using license approval policies, the combination of project, component (dep
 
 ### Multiple approvals
 
-There are several situations where the scan result policy requires an additional approval step. For example:
+There are several situations where the merge request approval policy requires an additional approval step. For example:
 
 - The number of security jobs is reduced in the working branch and no longer matches the number of
   security jobs in the target branch. Users can't skip the Scanning Result Policies by removing
   scanning jobs from the CI/CD configuration. Only the security scans that are configured in the
-  scan result policy rules are checked for removal.
+  merge request approval policy rules are checked for removal.
 
   For example, consider a situation where the default branch pipeline has four security scans:
-  `sast`, `secret_detection`, `container_scanning`, and `dependency_scanning`. A scan result
+  `sast`, `secret_detection`, `container_scanning`, and `dependency_scanning`. A merge request approval
   policy enforces two scanners: `container_scanning` and `dependency_scanning`. If an MR removes a
-  scan that is configured in scan result policy, `container_scanning` for example, an additional
+  scan that is configured in merge request approval policy, `container_scanning` for example, an additional
   approval is required.
 - Someone stops a pipeline security job, and users can't skip the security scan.
 - A job in a merge request fails and is configured with `allow_failure: false`. As a result, the pipeline is in a blocked state.
@@ -339,9 +346,9 @@ There are several situations where the scan result policy requires an additional
 
 ### Managing scan findings used to evaluate approval requirements
 
-Scan result policies evaluate the artifact reports generated by scanners in your pipelines after the pipeline has completed. Scan result policies focus on evaluating the results and determining approvals based on the scan result findings to identify potential risks, block merge requests, and require approval.
+Merge request approval policies evaluate the artifact reports generated by scanners in your pipelines after the pipeline has completed. Merge request approval policies focus on evaluating the results and determining approvals based on the scan result findings to identify potential risks, block merge requests, and require approval.
 
-Scan result policies do not extend beyond that scope to reach into artifact files or scanners. Instead, we trust the results from artifact reports. This gives teams flexibility in managing their scan execution and supply chain, and customizing scan results generated in artifact reports (for example, to filter out false positives) if needed.
+Merge request approval policies do not extend beyond that scope to reach into artifact files or scanners. Instead, we trust the results from artifact reports. This gives teams flexibility in managing their scan execution and supply chain, and customizing scan results generated in artifact reports (for example, to filter out false positives) if needed.
 
 Lock file tampering, for example, is outside of the scope of security policy management, but may be mitigated through use of [Code owners](../../project/codeowners/index.md#codeowners-file) or [external status checks](../../project/merge_requests/status_checks.md). For more information, see [issue 433029](https://gitlab.com/gitlab-org/gitlab/-/issues/433029).
 
@@ -352,7 +359,7 @@ Lock file tampering, for example, is outside of the scope of security policy man
 We have identified in [epic 11020](https://gitlab.com/groups/gitlab-org/-/epics/11020) common areas of confusion in scan result findings that need to be addressed. Below are a few of the known issues:
 
 - When using `newly_detected`, some findings may require approval when they are not introduced by the merge request (such as a new CVE on a related dependency). We currently use `main tip` of the target branch for comparison. In the future, we plan to use `merge base` for `newly_detected` policies (see [issue 428518](https://gitlab.com/gitlab-org/gitlab/-/issues/428518)).
-- Findings or errors that cause approval to be required on a scan result policy may not be evident in the Security MR Widget. By using `merge base` in [issue 428518](https://gitlab.com/gitlab-org/gitlab/-/issues/428518) some cases will be addressed. We will additionally be [displaying more granular details](https://gitlab.com/groups/gitlab-org/-/epics/11185) about what caused security policy violations.
+- Findings or errors that cause approval to be required on a merge request approval policy may not be evident in the Security MR Widget. By using `merge base` in [issue 428518](https://gitlab.com/gitlab-org/gitlab/-/issues/428518) some cases will be addressed. We will additionally be [displaying more granular details](https://gitlab.com/groups/gitlab-org/-/epics/11185) about what caused security policy violations.
 - Security policy violations are distinct compared to findings displayed in the MR widgets. Some violations may not be present in the MR widget. We are working to harmonize our features in [epic 11020](https://gitlab.com/groups/gitlab-org/-/epics/11020) and to display policy violations explicitly in merge requests in [epic 11185](https://gitlab.com/groups/gitlab-org/-/epics/11185).
 
 ## Experimental features
@@ -403,7 +410,7 @@ You can refine a security policy's scope to:
 
 ```yaml
 ---
-scan_result_policy:
+approval_policy:
 - name: critical vulnerability CS approvals
   description: critical severity level only for container scanning
   enabled: true
@@ -437,15 +444,15 @@ scan_result_policy:
 
 ## Troubleshooting
 
-### Merge request rules widget shows a scan result policy is invalid or duplicated
+### Merge request rules widget shows a merge request approval policy is invalid or duplicated
 
 DETAILS:
 **Tier:** Ultimate
 **Offering:** Self-managed
 
-On GitLab self-managed from 15.0 to 16.4, the most likely cause is that the project was exported from a group and imported into another, and had scan result policy rules. These rules are stored in a separate project to the one that was exported. As a result, the project contains policy rules that reference entities that don't exist in the imported project's group. The result is policy rules that are invalid, duplicated, or both.
+On GitLab self-managed from 15.0 to 16.4, the most likely cause is that the project was exported from a group and imported into another, and had merge request approval policy rules. These rules are stored in a separate project to the one that was exported. As a result, the project contains policy rules that reference entities that don't exist in the imported project's group. The result is policy rules that are invalid, duplicated, or both.
 
-To remove all invalid scan result policy rules from a GitLab instance, an administrator can run the following script in the [Rails console](../../../administration/operations/rails_console.md).
+To remove all invalid merge request approval policy rules from a GitLab instance, an administrator can run the following script in the [Rails console](../../../administration/operations/rails_console.md).
 
 ```ruby
 Project.joins(:approval_rules).where(approval_rules: { report_type: %i[scan_finding license_scanning] }).where.not(approval_rules: { security_orchestration_policy_configuration_id: nil }).find_in_batches.flat_map do |batch|
@@ -468,7 +475,7 @@ end
 
 ### Debugging security approval policy approvals
 
-GitLab SaaS users may submit a [support ticket](https://about.gitlab.com/support/) titled "Scan result approval policy debugging". Provide the following details:
+GitLab SaaS users may submit a [support ticket](https://about.gitlab.com/support/) titled "Merge request approval policy debugging". Provide the following details:
 
 - Group path, project path and optionally merge request ID
 - Severity
@@ -491,4 +498,4 @@ Support teams will investigate [logs](https://log.gprd.gitlab.net/) (`pubsub-sid
 
 Common failure reasons:
 
-- Scanner removed by MR: Scan result policy expect that the scanners defined in the policy are present and that they successfully produce an artifact for comparison.
+- Scanner removed by MR: Merge request approval policy expects that the scanners defined in the policy are present and that they successfully produce an artifact for comparison.
diff --git a/doc/user/crm/index.md b/doc/user/crm/index.md
index f12f4bb539f..d552b540c89 100644
--- a/doc/user/crm/index.md
+++ b/doc/user/crm/index.md
@@ -57,7 +57,7 @@ Prerequisites:
 To view a group's contacts:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer contacts**.
+1. Select **Plan > Customer relations**.
 
 ![Contacts list](crm_contacts_v14_10.png)
 
@@ -70,7 +70,7 @@ Prerequisites:
 To create a contact:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer contacts**.
+1. Select **Plan > Customer relations**.
 1. Select **New contact**.
 1. Complete all required fields.
 1. Select **Create new contact**.
@@ -87,7 +87,7 @@ Prerequisites:
 To edit an existing contact:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer contacts**.
+1. Select **Plan > Customer relations**.
 1. Next to the contact you wish to edit, select **Edit** (**{pencil}**).
 1. Edit the required fields.
 1. Select **Save changes**.
@@ -105,7 +105,7 @@ Each contact can be in one of two states:
 To change the state of a contact:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer contacts**.
+1. Select **Plan > Customer relations**.
 1. Next to the contact you wish to edit, select **Edit** (**{pencil}**).
 1. Select or clear the **Active** checkbox.
 1. Select **Save changes**.
@@ -121,7 +121,8 @@ Prerequisites:
 To view a group's organizations:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer organizations**.
+1. Select **Plan > Customer relations**.
+1. In the upper right, select **Organizations**.
 
 ![Organizations list](crm_organizations_v14_10.png)
 
@@ -134,7 +135,8 @@ Prerequisites:
 To create an organization:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer organizations**.
+1. Select **Plan > Customer relations**.
+1. In the upper right, select **Organizations**.
 1. Select **New organization**.
 1. Complete all required fields.
 1. Select **Create new organization**.
@@ -151,7 +153,8 @@ Prerequisites:
 To edit an existing organization:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer organizations**.
+1. Select **Plan > Customer relations**.
+1. In the upper right, select **Organizations**.
 1. Next to the organization you wish to edit, select **Edit** (**{pencil}**).
 1. Edit the required fields.
 1. Select **Save changes**.
@@ -173,7 +176,7 @@ Prerequisites:
 To view a contact's issues, select a contact from the issue sidebar, or:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer contacts**.
+1. Select **Plan > Customer relations**.
 1. Next to the contact whose issues you wish to view, select **View issues** (**{issues}**).
 
 ### View issues linked to an organization
@@ -185,7 +188,8 @@ Prerequisites:
 To view an organization's issues:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Plan > Customer organizations**.
+1. Select **Plan > Customer relations**.
+1. In the upper right, select **Organizations**.
 1. Next to the organization whose issues you wish to view, select **View issues** (**{issues}**).
 
 ### View contacts linked to an issue
diff --git a/doc/user/project/merge_requests/approvals/index.md b/doc/user/project/merge_requests/approvals/index.md
index 3d716b019bd..3ae6492d198 100644
--- a/doc/user/project/merge_requests/approvals/index.md
+++ b/doc/user/project/merge_requests/approvals/index.md
@@ -126,8 +126,8 @@ Whenever an approval rule cannot be satisfied, the rule is displayed as **Auto a
 - The number of required approvals is more than the number of eligible approvers.
 
 These rules are automatically approved to unblock their respective merge requests, unless they were
-created through a [scan result policy](../../../application_security/policies/scan-result-policies.md).
-Invalid approval rules created through a scan result policy are presented with
+created through a [merge request approval policy](../../../application_security/policies/scan-result-policies.md).
+Invalid approval rules created through a merge request approval policy are presented with
 **Action required** and are not automatically approved, blocking their respective merge requests.
 
 ## Related topics
diff --git a/doc/user/project/merge_requests/approvals/rules.md b/doc/user/project/merge_requests/approvals/rules.md
index 0d1ac036d3d..48d30befa66 100644
--- a/doc/user/project/merge_requests/approvals/rules.md
+++ b/doc/user/project/merge_requests/approvals/rules.md
@@ -285,7 +285,7 @@ DETAILS:
 > - Bot comment for approvals [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/411656) in GitLab 16.2 [with a flag](../../../../administration/feature_flags.md) named `security_policy_approval_notification`. Enabled by default.
 > - Bot comment for approvals [generally available](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/130827) in GitLab 16.3. Feature flag `security_policy_approval_notification` removed.
 
-You can use [scan result policies](../../../application_security/policies/scan-result-policies.md#scan-result-policy-editor) to define security approvals based on the status of vulnerabilities in the merge request and the default branch.
+You can use [merge request approval policies](../../../application_security/policies/scan-result-policies.md#merge-request-approval-policy-editor) to define security approvals based on the status of vulnerabilities in the merge request and the default branch.
 Details for each security policy is shown in the Security Approvals section of your Merge Request configuration.
 
 The security approval rules are applied to all merge requests until the pipeline is complete. The application of the
diff --git a/doc/user/project/protected_branches.md b/doc/user/project/protected_branches.md
index 29a6809d1d6..2fdab23eaa3 100644
--- a/doc/user/project/protected_branches.md
+++ b/doc/user/project/protected_branches.md
@@ -47,7 +47,7 @@ When a branch is protected, the default behavior enforces these restrictions on
    for that branch at the project level are ignored. All other protections continue
    to use project level settings.
 
-You can implement a [scan result policy](../application_security/policies/scan-result-policies.md#approval_settings)
+You can implement a [merge request approval policy](../application_security/policies/scan-result-policies.md#approval_settings)
 to prevent protected branches being unprotected or deleted.
 
 ### When a branch matches multiple rules
diff --git a/lib/gitlab/database_importers/work_items/base_type_importer.rb b/lib/gitlab/database_importers/work_items/base_type_importer.rb
index 50a9a0e8245..3cf5072eb6c 100644
--- a/lib/gitlab/database_importers/work_items/base_type_importer.rb
+++ b/lib/gitlab/database_importers/work_items/base_type_importer.rb
@@ -25,7 +25,8 @@ module Gitlab
           linked_items: 'Linked items',
           color: 'Color',
           rolledup_dates: 'Rolledup dates',
-          participants: 'Participants'
+          participants: 'Participants',
+          time_tracking: 'Time tracking'
         }.freeze
 
         WIDGETS_FOR_TYPE = {
@@ -44,7 +45,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ],
           incident: [
             :assignees,
@@ -55,7 +57,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ],
           test_case: [
             :description,
@@ -64,7 +67,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ],
           requirement: [
             :description,
@@ -76,7 +80,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ],
           task: [
             :assignees,
@@ -92,7 +97,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ],
           objective: [
             :assignees,
@@ -139,7 +145,8 @@ module Gitlab
             :linked_items,
             :color,
             :rolledup_dates,
-            :participants
+            :participants,
+            :time_tracking
           ],
           ticket: [
             :assignees,
@@ -156,7 +163,8 @@ module Gitlab
             :current_user_todos,
             :award_emoji,
             :linked_items,
-            :participants
+            :participants,
+            :time_tracking
           ]
         }.freeze
 
diff --git a/lib/gitlab/graphql/queries.rb b/lib/gitlab/graphql/queries.rb
index fc569bdc5dc..72a74c93257 100644
--- a/lib/gitlab/graphql/queries.rb
+++ b/lib/gitlab/graphql/queries.rb
@@ -69,12 +69,16 @@ module Gitlab
 
         def print_operation_definition(op, indent: "")
           @in_operation = true
-          out = +"#{indent}#{op.operation_type}"
-          out << " #{op.name}" if op.name
+          print_string("#{indent}#{op.operation_type}")
+          print_string(" #{op.name}") if op.name
 
-          # Do these first, so that we detect any skipped arguments
-          dirs = print_directives(op.directives)
-          sels = print_selections(op.selections, indent: indent)
+          # Do these on a temp instance, so that we detect any skipped arguments
+          # without actually printing the output to the current buffer
+          temp_printer = self.class.new
+          op.directives.each { |d| temp_printer.print(d) }
+          op.selections.each { |s| temp_printer.print(s) }
+          @skipped_arguments |= temp_printer.skipped_arguments
+          @printed_arguments |= temp_printer.printed_arguments
 
           # remove variable definitions only used in skipped (client) fields
           vars = op.variables.reject do |v|
@@ -82,10 +86,16 @@ module Gitlab
           end
 
           if vars.any?
-            out << "(#{vars.map { |v| print_variable_definition(v) }.join(", ")})"
+            print_string("(")
+            vars.each_with_index do |v, i|
+              print_variable_definition(v)
+              print_string(", ") if i < vars.size - 1
+            end
+            print_string(")")
           end
 
-          out + dirs + sels
+          print_directives(op.directives)
+          print_selections(op.selections, indent: indent)
         ensure
           @in_operation = false
         end
@@ -94,24 +104,21 @@ module Gitlab
           if skips? &&
               (field.directives.any? { |d| d.name == 'client' || d.name == 'persist' } || field.name == '__persist')
             skipped = self.class.new(false)
-
-            skipped.print_node(field)
+            skipped.print(field)
             @skipped_fragments |= skipped.used_fragments
             @skipped_arguments |= skipped.printed_arguments
 
-            return ''
+            return
           end
 
-          ret = super
+          super
 
-          @fields_printed += 1 if @in_operation && ret != ''
-
-          ret
+          @fields_printed += 1 if @in_operation
         end
 
         def print_fragment_definition(fragment_def, indent: "")
           if skips? && @skipped_fragments.include?(fragment_def.name) && !@used_fragments.include?(fragment_def.name)
-            return ''
+            return
           end
 
           super
diff --git a/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb b/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
index 1790ce36819..76327ea7007 100644
--- a/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
+++ b/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
@@ -164,7 +164,7 @@ module Gitlab
         types Issue, MergeRequest
         condition do
           quick_action_target.supports_time_tracking? &&
-            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", project)
+            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
         end
         parse_params do |raw_duration|
           Gitlab::TimeTrackingFormatter.parse(raw_duration, keep_zero: true)
@@ -214,7 +214,7 @@ module Gitlab
         types Issue, MergeRequest
         condition do
           quick_action_target.persisted? &&
-            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", project)
+            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
         end
         command :remove_estimate, :remove_time_estimate do
           @updates[:time_estimate] = 0
@@ -225,7 +225,7 @@ module Gitlab
         execution_message { _('Removed spent time.') }
         condition do
           quick_action_target.persisted? &&
-            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", project)
+            current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
         end
         types Issue, MergeRequest
         command :remove_time_spent do
diff --git a/lib/sidebars/groups/menus/customer_relations_menu.rb b/lib/sidebars/groups/menus/customer_relations_menu.rb
index ac25cb312cd..a0d89248d81 100644
--- a/lib/sidebars/groups/menus/customer_relations_menu.rb
+++ b/lib/sidebars/groups/menus/customer_relations_menu.rb
@@ -7,7 +7,6 @@ module Sidebars
         override :configure_menu_items
         def configure_menu_items
           add_item(contacts_menu_item) if can_read_contact?
-          add_item(organizations_menu_item) if can_read_organization?
 
           true
         end
@@ -26,7 +25,7 @@ module Sidebars
         def render?
           return false unless context.group.root?
 
-          can_read_contact? || can_read_organization?
+          can_read_contact?
         end
 
         override :serialize_as_menu_item_args
@@ -38,31 +37,17 @@ module Sidebars
 
         def contacts_menu_item
           ::Sidebars::MenuItem.new(
-            title: context.is_super_sidebar ? _('Customer contacts') : _('Contacts'),
+            title: context.is_super_sidebar ? _('Customer relations') : _('Contacts'),
             link: group_crm_contacts_path(context.group),
             super_sidebar_parent: ::Sidebars::Groups::SuperSidebarMenus::PlanMenu,
-            active_routes: { controller: 'groups/crm/contacts' },
+            active_routes: { controller: %w[groups/crm/contacts groups/crm/organizations] },
             item_id: :crm_contacts
           )
         end
 
-        def organizations_menu_item
-          ::Sidebars::MenuItem.new(
-            title: context.is_super_sidebar ? _('Customer organizations') : _('Organizations'),
-            link: group_crm_organizations_path(context.group),
-            super_sidebar_parent: ::Sidebars::Groups::SuperSidebarMenus::PlanMenu,
-            active_routes: { controller: 'groups/crm/organizations' },
-            item_id: :crm_organizations
-          )
-        end
-
         def can_read_contact?
           can?(context.current_user, :read_crm_contact, context.group)
         end
-
-        def can_read_organization?
-          can?(context.current_user, :read_crm_organization, context.group)
-        end
       end
     end
   end
diff --git a/lib/sidebars/groups/super_sidebar_menus/plan_menu.rb b/lib/sidebars/groups/super_sidebar_menus/plan_menu.rb
index bf122f930a2..7bfe237c32a 100644
--- a/lib/sidebars/groups/super_sidebar_menus/plan_menu.rb
+++ b/lib/sidebars/groups/super_sidebar_menus/plan_menu.rb
@@ -25,8 +25,7 @@ module Sidebars
             :milestones,
             :iterations,
             :group_wiki,
-            :crm_contacts,
-            :crm_organizations
+            :crm_contacts
           ].each { |id| add_item(::Sidebars::NilMenuItem.new(item_id: id)) }
         end
       end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index c93aafa99e7..dcb4c417692 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -15027,6 +15027,9 @@ msgstr ""
 msgid "Crm|Contact has been updated."
 msgstr ""
 
+msgid "Crm|Contacts"
+msgstr ""
+
 msgid "Crm|Customer relations contacts"
 msgstr ""
 
@@ -15066,6 +15069,9 @@ msgstr ""
 msgid "Crm|Organization has been updated."
 msgstr ""
 
+msgid "Crm|Organizations"
+msgstr ""
+
 msgid "Cron time zone"
 msgstr ""
 
@@ -15195,15 +15201,9 @@ msgstr ""
 msgid "Custom range"
 msgstr ""
 
-msgid "Customer contacts"
-msgstr ""
-
 msgid "Customer experience improvement and third-party offers"
 msgstr ""
 
-msgid "Customer organizations"
-msgstr ""
-
 msgid "Customer relations"
 msgstr ""
 
diff --git a/qa/gdk/entrypoint b/qa/gdk/entrypoint
index 934aff35873..1b34ac8fa7c 100755
--- a/qa/gdk/entrypoint
+++ b/qa/gdk/entrypoint
@@ -22,5 +22,10 @@ else
     gdk tail $log &>${CI_BUILDS_DIR}/gdk.${log}.log &
   done
 
+  # TODO: Check if we can reconfigure gitlab to write logs directly to `BUILDS_DIR`
+  for logfile in ${HOME}/gitlab-development-kit/gitlab/log/*.log; do
+    tail -f $logfile &>${CI_BUILDS_DIR}/$(basename $logfile) &
+  done
+
   exec "$@"
 fi
diff --git a/spec/frontend/crm/contacts_root_spec.js b/spec/frontend/crm/contacts_root_spec.js
index d6092e85917..72281afe8b9 100644
--- a/spec/frontend/crm/contacts_root_spec.js
+++ b/spec/frontend/crm/contacts_root_spec.js
@@ -16,6 +16,7 @@ describe('Customer relations contacts root app', () => {
   let wrapper;
   let fakeApollo;
 
+  const findOrganizationsLink = () => wrapper.findByTestId('organizations-link');
   const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findNewContactButton = () => wrapper.findByTestId('new-contact-button');
   const findTable = () => wrapper.findComponent(PaginatedTableWithSearchAndTabs);
@@ -26,6 +27,7 @@ describe('Customer relations contacts root app', () => {
     queryHandler = successQueryHandler,
     countQueryHandler = successCountQueryHandler,
     canAdminCrmContact = true,
+    canReadCrmOrganization = true,
     textQuery = null,
   } = {}) => {
     fakeApollo = createMockApollo([
@@ -37,7 +39,9 @@ describe('Customer relations contacts root app', () => {
         groupFullPath: 'flightjs',
         groupId: 26,
         groupIssuesPath: '/issues',
+        groupOrganizationsPath: '/organizations',
         canAdminCrmContact,
+        canReadCrmOrganization,
         textQuery,
       },
       apolloProvider: fakeApollo,
@@ -75,6 +79,20 @@ describe('Customer relations contacts root app', () => {
     expect(findLoadingIcon().exists()).toBe(true);
   });
 
+  describe('organizations link', () => {
+    it('renders when canReadCrmOrganization is true', () => {
+      mountComponent();
+
+      expect(findOrganizationsLink().attributes('href')).toBe('/organizations');
+    });
+
+    it('does not render when canReadCrmOrganization is false', () => {
+      mountComponent({ canReadCrmOrganization: false });
+
+      expect(findOrganizationsLink().exists()).toBe(false);
+    });
+  });
+
   describe('new contact button', () => {
     it('should exist when user has permission', () => {
       mountComponent();
diff --git a/spec/frontend/crm/organizations_root_spec.js b/spec/frontend/crm/organizations_root_spec.js
index b6141bd9835..3ae9503f106 100644
--- a/spec/frontend/crm/organizations_root_spec.js
+++ b/spec/frontend/crm/organizations_root_spec.js
@@ -19,6 +19,7 @@ describe('Customer relations organizations root app', () => {
   let wrapper;
   let fakeApollo;
 
+  const findContactsLink = () => wrapper.findByTestId('contacts-link');
   const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findNewOrganizationButton = () => wrapper.findByTestId('new-organization-button');
   const findTable = () => wrapper.findComponent(PaginatedTableWithSearchAndTabs);
@@ -31,6 +32,7 @@ describe('Customer relations organizations root app', () => {
     queryHandler = successQueryHandler,
     countQueryHandler = successCountQueryHandler,
     canAdminCrmOrganization = true,
+    canReadCrmContact = true,
     textQuery = null,
   } = {}) => {
     fakeApollo = createMockApollo([
@@ -40,6 +42,8 @@ describe('Customer relations organizations root app', () => {
     wrapper = shallowMountExtended(OrganizationsRoot, {
       provide: {
         canAdminCrmOrganization,
+        canReadCrmContact,
+        groupContactsPath: '/contacts',
         groupFullPath: 'flightjs',
         groupIssuesPath: '/issues',
         textQuery,
@@ -79,6 +83,20 @@ describe('Customer relations organizations root app', () => {
     expect(findLoadingIcon().exists()).toBe(true);
   });
 
+  describe('contacts link', () => {
+    it('renders when canReadContact is true', () => {
+      mountComponent();
+
+      expect(findContactsLink().attributes('href')).toBe('/contacts');
+    });
+
+    it('does not render when canReadContact is false', () => {
+      mountComponent({ canReadCrmContact: false });
+
+      expect(findContactsLink().exists()).toBe(false);
+    });
+  });
+
   describe('new organization button', () => {
     it('should exist when user has permission', () => {
       mountComponent();
diff --git a/spec/graphql/gitlab_schema_spec.rb b/spec/graphql/gitlab_schema_spec.rb
index 885bbc82ecc..c9ae3dc987e 100644
--- a/spec/graphql/gitlab_schema_spec.rb
+++ b/spec/graphql/gitlab_schema_spec.rb
@@ -196,6 +196,39 @@ RSpec.describe GitlabSchema do
     end
   end
 
+  describe '.resolve_type' do
+    let(:object) { build(:user) }
+
+    let(:object_type) { Class.new(Types::BaseObject) }
+    let(:union_type) { Class.new(Types::BaseUnion) }
+
+    it 'returns the type for object types' do
+      expect(described_class.resolve_type(object_type, object, {})).to eq([object_type, object])
+    end
+
+    it 'raises an exception for non-object types' do
+      expect { described_class.resolve_type(union_type, object, {}) }.to raise_error(GraphQL::RequiredImplementationMissingError)
+    end
+
+    context 'when accepts is defined' do
+      let(:object_type) do
+        Class.new(Types::BaseObject) do
+          accepts User
+        end
+      end
+
+      it 'returns the type if the object is accepted' do
+        expect(described_class.resolve_type(object_type, object, {})).to eq([object_type, object])
+      end
+
+      it 'returns nil when object is not accepted' do
+        project = build(:project)
+
+        expect(described_class.resolve_type(object_type, project, {})).to eq([nil, project])
+      end
+    end
+  end
+
   describe 'validate_max_errors' do
     it 'reports at most 5 errors' do
       query = <<~GQL
diff --git a/spec/graphql/mutations/custom_emoji/destroy_spec.rb b/spec/graphql/mutations/custom_emoji/destroy_spec.rb
index 4667812cc80..d9fc305cf0c 100644
--- a/spec/graphql/mutations/custom_emoji/destroy_spec.rb
+++ b/spec/graphql/mutations/custom_emoji/destroy_spec.rb
@@ -13,7 +13,7 @@ RSpec.describe Mutations::CustomEmoji::Destroy do
   context 'field tests' do
     subject { described_class }
 
-    it { is_expected.to have_graphql_arguments(:id) }
+    it { is_expected.to have_graphql_arguments(:clientMutationId, :id) }
     it { is_expected.to have_graphql_field(:custom_emoji) }
   end
 
diff --git a/spec/graphql/types/group_type_spec.rb b/spec/graphql/types/group_type_spec.rb
index 7231a1e0357..e3b14287d37 100644
--- a/spec/graphql/types/group_type_spec.rb
+++ b/spec/graphql/types/group_type_spec.rb
@@ -159,4 +159,82 @@ RSpec.describe GitlabSchema.types['Group'], feature_category: :groups_and_projec
       end
     end
   end
+
+  describe 'emailsDisabled' do
+    let_it_be(:group) { create(:group) }
+
+    let(:query) do
+      %(
+        query {
+          group(fullPath: "#{group.full_path}") {
+            emailsDisabled
+          }
+        }
+      )
+    end
+
+    subject(:result) do
+      result = GitlabSchema.execute(query).as_json
+      result.dig('data', 'group', 'emailsDisabled')
+    end
+
+    it 'is not a deprecated field' do
+      expect(described_class.fields['emailsDisabled'].deprecation).to be_nil
+    end
+
+    describe 'when emails_enabled is true' do
+      before do
+        group.update!(emails_enabled: true)
+      end
+
+      it { is_expected.to eq(false) }
+    end
+
+    describe 'when emails_enabled is false' do
+      before do
+        group.update!(emails_enabled: false)
+      end
+
+      it { is_expected.to eq(true) }
+    end
+  end
+
+  describe 'emailsEnabled' do
+    let_it_be(:group) { create(:group) }
+
+    let(:query) do
+      %(
+        query {
+          group(fullPath: "#{group.full_path}") {
+            emailsEnabled
+          }
+        }
+      )
+    end
+
+    subject(:result) do
+      result = GitlabSchema.execute(query).as_json
+      result.dig('data', 'group', 'emailsEnabled')
+    end
+
+    it 'is not a deprecated field' do
+      expect(described_class.fields['emailsEnabled'].deprecation).to be_nil
+    end
+
+    describe 'when emails_enabled is true' do
+      before do
+        group.update!(emails_enabled: true)
+      end
+
+      it { is_expected.to eq(true) }
+    end
+
+    describe 'when emails_enabled is false' do
+      before do
+        group.update!(emails_enabled: false)
+      end
+
+      it { is_expected.to eq(false) }
+    end
+  end
 end
diff --git a/spec/graphql/types/work_items/widget_interface_spec.rb b/spec/graphql/types/work_items/widget_interface_spec.rb
index 645e63033c5..df871dbe9aa 100644
--- a/spec/graphql/types/work_items/widget_interface_spec.rb
+++ b/spec/graphql/types/work_items/widget_interface_spec.rb
@@ -24,6 +24,11 @@ RSpec.describe Types::WorkItems::WidgetInterface, feature_category: :team_planni
       WorkItems::Widgets::CurrentUserTodos | Types::WorkItems::Widgets::CurrentUserTodosType
       WorkItems::Widgets::AwardEmoji       | Types::WorkItems::Widgets::AwardEmojiType
       WorkItems::Widgets::LinkedItems      | Types::WorkItems::Widgets::LinkedItemsType
+      WorkItems::Widgets::LinkedItems      | Types::WorkItems::Widgets::LinkedItemsType
+      WorkItems::Widgets::StartAndDueDate  | Types::WorkItems::Widgets::StartAndDueDateType
+      WorkItems::Widgets::Milestone        | Types::WorkItems::Widgets::MilestoneType
+      WorkItems::Widgets::Participants     | Types::WorkItems::Widgets::ParticipantsType
+      WorkItems::Widgets::TimeTracking     | Types::WorkItems::Widgets::TimeTrackingType
     end
 
     with_them do
diff --git a/spec/graphql/types/work_items/widgets/time_tracking_type_spec.rb b/spec/graphql/types/work_items/widgets/time_tracking_type_spec.rb
new file mode 100644
index 00000000000..00b87517389
--- /dev/null
+++ b/spec/graphql/types/work_items/widgets/time_tracking_type_spec.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Types::WorkItems::Widgets::TimeTrackingType, feature_category: :team_planning do
+  it 'exposes the expected fields' do
+    expected_fields = %i[time_estimate total_time_spent timelogs type]
+
+    expect(described_class).to have_graphql_fields(*expected_fields)
+  end
+end
diff --git a/spec/lib/gitlab/graphql/queries_spec.rb b/spec/lib/gitlab/graphql/queries_spec.rb
index c556f507876..6365cec51f6 100644
--- a/spec/lib/gitlab/graphql/queries_spec.rb
+++ b/spec/lib/gitlab/graphql/queries_spec.rb
@@ -343,7 +343,7 @@ RSpec.describe Gitlab::Graphql::Queries do
       it_behaves_like 'an invalid GraphQL query for the blog schema' do
         let(:errors) do
           contain_exactly(
-            have_attributes(message: include('Parse error'))
+            have_attributes(message: include('Expected LCURLY, actual: RCURLY ("}") at [1, 7]'))
           )
         end
       end
diff --git a/spec/lib/sidebars/groups/super_sidebar_menus/plan_menu_spec.rb b/spec/lib/sidebars/groups/super_sidebar_menus/plan_menu_spec.rb
index 1ac2cf87236..d52cb79dc2f 100644
--- a/spec/lib/sidebars/groups/super_sidebar_menus/plan_menu_spec.rb
+++ b/spec/lib/sidebars/groups/super_sidebar_menus/plan_menu_spec.rb
@@ -23,8 +23,7 @@ RSpec.describe Sidebars::Groups::SuperSidebarMenus::PlanMenu, feature_category:
       :milestones,
       :iterations,
       :group_wiki,
-      :crm_contacts,
-      :crm_organizations
+      :crm_contacts
     ])
   end
 end
diff --git a/spec/migrations/20240118170849_add_time_tracking_widget_definition_to_work_item_types_spec.rb b/spec/migrations/20240118170849_add_time_tracking_widget_definition_to_work_item_types_spec.rb
new file mode 100644
index 00000000000..198d824f6ed
--- /dev/null
+++ b/spec/migrations/20240118170849_add_time_tracking_widget_definition_to_work_item_types_spec.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe AddTimeTrackingWidgetDefinitionToWorkItemTypes, :migration, feature_category: :team_planning do
+  it_behaves_like 'migration that adds widget to work items definitions',
+    widget_name: described_class::WIDGET_NAME,
+    work_item_types: described_class::WORK_ITEM_TYPES
+end
diff --git a/spec/models/work_item_spec.rb b/spec/models/work_item_spec.rb
index eeb1e3699d8..7ec8cdbbdc7 100644
--- a/spec/models/work_item_spec.rb
+++ b/spec/models/work_item_spec.rb
@@ -142,6 +142,17 @@ RSpec.describe WorkItem, feature_category: :portfolio_management do
     end
   end
 
+  describe '#supports_time_tracking?' do
+    Gitlab::DatabaseImporters::WorkItems::BaseTypeImporter::WIDGETS_FOR_TYPE.each_pair do |base_type, widgets|
+      specify do
+        work_item = build(:work_item, base_type)
+        supports_time_tracking = widgets.include?(:time_tracking)
+
+        expect(work_item.supports_time_tracking?).to eq(supports_time_tracking)
+      end
+    end
+  end
+
   describe '#supported_quick_action_commands' do
     let(:work_item) { build(:work_item, :task) }
 
diff --git a/spec/models/work_items/type_spec.rb b/spec/models/work_items/type_spec.rb
index 135b7b97ce9..fea0af43171 100644
--- a/spec/models/work_items/type_spec.rb
+++ b/spec/models/work_items/type_spec.rb
@@ -186,6 +186,25 @@ RSpec.describe WorkItems::Type, feature_category: :team_planning do
     end
   end
 
+  describe '#supports_time_tracking??' do
+    let_it_be_with_reload(:work_item_type) { create(:work_item_type) }
+    let_it_be_with_reload(:widget_definition) do
+      create(:widget_definition, work_item_type: work_item_type, widget_type: :time_tracking)
+    end
+
+    subject(:supports_time_tracking) { work_item_type.supports_time_tracking? }
+
+    it { is_expected.to be_truthy }
+
+    context 'when the time tracking widget is not supported' do
+      before do
+        widget_definition.update!(disabled: true)
+      end
+
+      it { is_expected.to be_falsey }
+    end
+  end
+
   describe '#default_issue?' do
     context 'when work item type is default Issue' do
       let(:work_item_type) { build(:work_item_type, name: described_class::TYPE_NAMES[:issue]) }
diff --git a/spec/models/work_items/widget_definition_spec.rb b/spec/models/work_items/widget_definition_spec.rb
index f1f498cef88..6751d331423 100644
--- a/spec/models/work_items/widget_definition_spec.rb
+++ b/spec/models/work_items/widget_definition_spec.rb
@@ -16,7 +16,8 @@ RSpec.describe WorkItems::WidgetDefinition, feature_category: :team_planning do
       ::WorkItems::Widgets::CurrentUserTodos,
       ::WorkItems::Widgets::AwardEmoji,
       ::WorkItems::Widgets::LinkedItems,
-      ::WorkItems::Widgets::Participants
+      ::WorkItems::Widgets::Participants,
+      ::WorkItems::Widgets::TimeTracking
     ]
 
     if Gitlab.ee?
diff --git a/spec/models/work_items/widgets/time_tracking_spec.rb b/spec/models/work_items/widgets/time_tracking_spec.rb
new file mode 100644
index 00000000000..21f9d8e39b4
--- /dev/null
+++ b/spec/models/work_items/widgets/time_tracking_spec.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe WorkItems::Widgets::TimeTracking, feature_category: :team_planning do
+  let_it_be(:work_item) { create(:work_item, :epic, time_estimate: 12.hours) }
+  let_it_be(:timelog1) { create(:timelog, issue: work_item, time_spent: 1.hour.to_i) }
+  let_it_be(:timelog2) { create(:timelog, issue: work_item, time_spent: 2.hours.to_i) }
+
+  describe '.quick_action_params' do
+    subject { described_class.quick_action_params }
+
+    it { is_expected.to contain_exactly(:time_estimate, :spend_time) }
+  end
+
+  describe '.quick_action_commands' do
+    subject { described_class.quick_action_commands }
+
+    it 'lists all available quick actions' do
+      is_expected.to contain_exactly(
+        :estimate, :estimate_time, :remove_estimate,
+        :remove_time_estimate, :remove_time_spent, :spend, :spend_time, :spent
+      )
+    end
+  end
+
+  describe '.type' do
+    it { expect(described_class.type).to eq(:time_tracking) }
+  end
+
+  describe '#type' do
+    it { expect(described_class.new(work_item).type).to eq(:time_tracking) }
+  end
+
+  describe 'time tracking data' do
+    it { expect(described_class.new(work_item).time_estimate).to eq(work_item.time_estimate) }
+    it { expect(described_class.new(work_item).total_time_spent).to eq(3.hours) }
+    it { expect(described_class.new(work_item).timelogs.map(&:id)).to match_array([timelog1.id, timelog2.id]) }
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/work_items/update_spec.rb b/spec/requests/api/graphql/mutations/work_items/update_spec.rb
index e835f7e8abf..9f5d0035b18 100644
--- a/spec/requests/api/graphql/mutations/work_items/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/work_items/update_spec.rb
@@ -1582,6 +1582,104 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
       end
     end
 
+    context 'with time tracking widget input' do
+      shared_examples 'mutation updating work item with time tracking data' do
+        it 'updates time tracking' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+            mutation_work_item.reload
+          end.to change { mutation_work_item.time_estimate }.from(0).to(12.hours.to_i).and(
+            change { mutation_work_item.total_time_spent }.from(0).to(2.hours.to_i)
+          )
+
+          expect(mutation_response['workItem']['widgets']).to include(
+            'timeEstimate' => 12.hours.to_i,
+            'totalTimeSpent' => 2.hours.to_i,
+            'timelogs' => {
+              'nodes' => [
+                {
+                  'timeSpent' => 2.hours.to_i
+                }
+              ]
+            },
+            'type' => 'TIME_TRACKING'
+          )
+
+          expect(mutation_response['workItem']['widgets']).to include(
+            'description' => 'some description',
+            'type' => 'DESCRIPTION'
+          )
+        end
+      end
+
+      let(:fields) do
+        <<~FIELDS
+          workItem {
+            widgets {
+              ... on WorkItemWidgetTimeTracking {
+                type
+                timeEstimate
+                totalTimeSpent
+                timelogs {
+                  nodes {
+                    timeSpent
+                  }
+                }
+              }
+              ... on WorkItemWidgetDescription {
+                type
+                description
+              }
+            }
+          }
+          errors
+        FIELDS
+      end
+
+      let_it_be(:group_work_item) { create(:work_item, :task, :group_level, namespace: group) }
+
+      context 'when adding time estimate and time spent' do
+        context 'with quick action' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "some description\n\n/estimate 12h\n/spend 2h" } } }
+
+          it_behaves_like 'mutation updating work item with time tracking data'
+        end
+
+        context 'when work item belongs to the group' do
+          let(:mutation_work_item) { group_work_item }
+          let(:input) { { 'descriptionWidget' => { 'description' => "some description\n\n/estimate 12h\n/spend 2h" } } }
+
+          it_behaves_like 'mutation updating work item with time tracking data'
+        end
+      end
+
+      context 'when the work item type does not support time tracking widget' do
+        let_it_be(:work_item) { create(:work_item, :task, project: project) }
+
+        let(:input) { { 'descriptionWidget' => { 'description' => "some description\n\n/estimate 12h\n/spend 2h" } } }
+
+        before do
+          WorkItems::Type.default_by_type(:task).widget_definitions
+            .find_by_widget_type(:time_tracking).update!(disabled: true)
+        end
+
+        it 'ignores the quick action' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+            work_item.reload
+          end.not_to change { work_item.time_estimate }
+
+          expect(mutation_response['workItem']['widgets']).to include(
+            'description' => "some description",
+            'type' => 'DESCRIPTION'
+          )
+          expect(mutation_response['workItem']['widgets']).not_to include(
+            'type' => 'TIME_TRACKING'
+          )
+        end
+      end
+    end
+
     context 'when unsupported widget input is sent' do
       let_it_be(:work_item) { create(:work_item, :test_case, project: project) }
 
diff --git a/spec/requests/api/graphql/work_item_spec.rb b/spec/requests/api/graphql/work_item_spec.rb
index e5d8131fc7e..0f667874335 100644
--- a/spec/requests/api/graphql/work_item_spec.rb
+++ b/spec/requests/api/graphql/work_item_spec.rb
@@ -650,7 +650,7 @@ RSpec.describe 'Query.work_item(id)', feature_category: :team_planning do
 
             let(:first_param) { 1 }
             let(:all_records) { [link1, link2] }
-            let(:data_path) { ['workItem', 'widgets', 'linkedItems', -2] }
+            let(:data_path) { ['workItem', 'widgets', 'linkedItems', -3] }
 
             def widget_fields(args)
               query_graphql_field(
diff --git a/spec/services/work_items/callbacks/time_tracking_spec.rb b/spec/services/work_items/callbacks/time_tracking_spec.rb
new file mode 100644
index 00000000000..bd3fe09b887
--- /dev/null
+++ b/spec/services/work_items/callbacks/time_tracking_spec.rb
@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe WorkItems::Callbacks::TimeTracking, feature_category: :team_planning do
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project) { create(:project, :private, group: group) }
+  let_it_be(:reporter) do
+    create(:user).tap { |u| group.add_reporter(u) }
+  end
+
+  let_it_be(:guest) do
+    create(:user).tap { |u| group.add_guest(u) }
+  end
+
+  let(:current_user) { reporter }
+  let(:params) do
+    {
+      time_estimate: 12.hours.to_i,
+      spend_time: {
+        duration: 2.hours.to_i,
+        user_id: current_user.id,
+        spent_at: Date.today
+      }
+    }
+  end
+
+  let(:callback) { described_class.new(issuable: issuable, current_user: current_user, params: params) }
+
+  describe '#after_initialize' do
+    shared_examples 'sets work item time tracking data' do
+      it 'correctly sets time tracking data', :aggregate_failures do
+        callback.after_initialize
+
+        expect(issuable.time_spent).to eq(2.hours.to_i)
+        expect(issuable.time_estimate).to eq(12.hours.to_i)
+        expect(issuable.timelogs.last.time_spent).to eq(2.hours.to_i)
+      end
+    end
+
+    shared_examples 'does not set work item time tracking data' do
+      it 'does not change work item time tracking data', :aggregate_failures do
+        callback.after_initialize
+
+        if issuable.persisted?
+          expect(issuable.time_estimate).to eq(2.hours.to_i)
+          expect(issuable.total_time_spent).to eq(3.hours.to_i)
+          expect(issuable.timelogs.last.time_spent).to eq(3.hours.to_i)
+        else
+          expect(issuable.time_estimate).to eq(0)
+          expect(issuable.time_spent).to eq(nil)
+          expect(issuable.timelogs).to be_empty
+        end
+      end
+    end
+
+    context 'when at project level' do
+      let(:issuable) { project_work_item }
+
+      context 'and work item is not persisted' do
+        let(:project_work_item) { build(:work_item, :incident, project: project) }
+
+        it_behaves_like 'sets work item time tracking data'
+
+        context 'when time tracking param is not present' do
+          let(:params) { {} }
+
+          it_behaves_like 'does not set work item time tracking data'
+        end
+
+        context 'when widget does not exist in new type' do
+          before do
+            allow(callback).to receive(:excluded_in_new_type?).and_return(true)
+          end
+
+          it_behaves_like 'does not set work item time tracking data'
+        end
+      end
+
+      context 'and work item is persisted' do
+        let_it_be_with_reload(:project_work_item) do
+          create(:work_item, :task, project: project, time_estimate: 2.hours.to_i)
+        end
+
+        let_it_be(:timelog) { create(:timelog, issue: project_work_item, time_spent: 3.hours.to_i) }
+
+        it_behaves_like 'sets work item time tracking data'
+
+        context 'when time tracking param is not present' do
+          let(:params) { {} }
+
+          it_behaves_like 'does not set work item time tracking data'
+        end
+
+        context 'when widget does not exist in new type' do
+          before do
+            allow(callback).to receive(:excluded_in_new_type?).and_return(true)
+          end
+
+          it_behaves_like 'does not set work item time tracking data'
+        end
+      end
+    end
+
+    context 'when at group level' do
+      let(:issuable) { group_work_item }
+
+      context 'and work item is not persisted' do
+        let(:group_work_item) { build(:work_item, :task, :group_level, namespace: group) }
+
+        it_behaves_like 'sets work item time tracking data'
+
+        context 'when time tracking param is not present' do
+          let(:params) { {} }
+
+          it_behaves_like 'does not set work item time tracking data'
+        end
+      end
+
+      context 'and work item is persisted' do
+        let_it_be_with_reload(:group_work_item) do
+          create(:work_item, :task, :group_level, namespace: group, time_estimate: 2.hours.to_i)
+        end
+
+        let_it_be(:timelog) { create(:timelog, issue: group_work_item, time_spent: 3.hours.to_i) }
+
+        it_behaves_like 'sets work item time tracking data'
+      end
+    end
+  end
+end
diff --git a/spec/support/helpers/navbar_structure_helper.rb b/spec/support/helpers/navbar_structure_helper.rb
index e4b30df063f..4f405adb5be 100644
--- a/spec/support/helpers/navbar_structure_helper.rb
+++ b/spec/support/helpers/navbar_structure_helper.rb
@@ -59,12 +59,7 @@ module NavbarStructureHelper
     insert_after_sub_nav_item(
       after,
       within: _('Plan'),
-      new_sub_nav_item_name: _("Customer contacts")
-    )
-    insert_after_sub_nav_item(
-      _("Customer contacts"),
-      within: _('Plan'),
-      new_sub_nav_item_name: _("Customer organizations")
+      new_sub_nav_item_name: _("Customer relations")
     )
   end
 
diff --git a/vendor/gems/sidekiq-7.1.6/.gitlab-ci.yml b/vendor/gems/sidekiq-7.1.6/.gitlab-ci.yml
index e381c47ebe5..f9ccfc06d6f 100644
--- a/vendor/gems/sidekiq-7.1.6/.gitlab-ci.yml
+++ b/vendor/gems/sidekiq-7.1.6/.gitlab-ci.yml
@@ -12,9 +12,10 @@ rspec:
   parallel:
     matrix:
       - RUBY_VERSION: ["3.0", "3.1", "3.2"]
+        REDIS_VERSION: ["6.0", "6.2", "7.0"]
 
 .with_redis:
   services:
-    - redis:6.0-alpine
+    - redis:${REDIS_VERSION}-alpine
   variables:
     REDIS_URL: "redis://redis"