From eb90d59b8c3133fac0dce157dfb6eb26ae735454 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 11 Dec 2024 18:26:46 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 GITALY_SERVER_VERSION                         |   2 +-
 .../components/new_access_token_app.vue       |   5 +-
 app/assets/javascripts/merge_request_tabs.js  |   2 +-
 .../merge_requests/reports/components/app.vue | 113 +++++++++
 .../merge_requests/reports/constants.js       |   4 +
 .../merge_requests/reports/index.js           |  37 ++-
 .../reports/pages/blockers_page.vue           |   9 +
 .../merge_requests/reports/pages/index.vue    |   9 +
 .../merge_requests/reports/routes.js          |  31 +++
 .../pages/projects/blob/show/index.js         |   1 -
 .../projects/merge_requests/reports/index.js  |   5 +
 .../components/commit_pipeline_status.vue     |  16 +-
 .../javascripts/search/results/constants.js   |   2 +-
 .../components/queries/todo.fragment.graphql  |   1 +
 .../todos/components/todo_item_title.vue      |  61 +++--
 .../todo_item_title_hidden_by_saml.vue        |   2 +-
 .../components/list_selector/group_item.vue   |  28 +--
 .../components/list_selector/project_item.vue |  14 +-
 .../components/list_selector/user_item.vue    |  18 +-
 .../components/content_editor.scss            |   8 +-
 app/assets/stylesheets/framework.scss         |   1 -
 .../stylesheets/framework/animations.scss     |   9 -
 .../stylesheets/framework/source_editor.scss  |  29 ++-
 app/assets/stylesheets/framework/spinner.scss |  39 ---
 .../stylesheets/framework/typography.scss     |   5 +
 .../stylesheets/highlight/_white_base.scss    |  30 +--
 .../stylesheets/page_bundles/work_items.scss  |  20 +-
 app/assets/stylesheets/pages/commits.scss     |  11 -
 app/assets/stylesheets/pages/note_form.scss   |   3 +-
 app/assets/stylesheets/vendors/atwho.scss     |   5 +-
 app/controllers/application_controller.rb     |   4 +
 .../concerns/sessionless_authentication.rb    |  12 +-
 app/controllers/graphql_controller.rb         |  33 ++-
 .../user_settings/passwords_controller.rb     |   5 +-
 app/finders/ci/build_source_finder.rb         |  83 +++++++
 app/finders/ci/jobs_finder.rb                 |   5 +-
 .../resolvers/project_jobs_resolver.rb        |  26 +-
 app/graphql/types/ci/job_source_enum.rb       |  15 ++
 app/helpers/application_helper.rb             |   1 -
 app/helpers/ci/status_helper.rb               |   6 +-
 app/helpers/projects_helper.rb                |   9 -
 app/models/ci/build_source.rb                 |  11 +-
 app/models/oauth_access_token.rb              |   8 +-
 app/services/groups/transfer_service.rb       |  11 +-
 app/services/groups/update_service.rb         |  14 +-
 ...assign_placeholder_user_records_service.rb |  83 ++++++-
 .../mark_package_for_destruction_service.rb   |   2 +-
 .../application_settings/general.html.haml    |   2 +
 app/views/ci/status/_icon.html.haml           |   3 +-
 app/views/projects/commits/_commit.html.haml  |  13 +-
 .../personal_access_tokens/index.html.haml    |   2 +-
 ...eassign_placeholder_user_records_worker.rb |  14 +-
 .../bulk_import_importer_user_mapping.yml     |   4 +-
 .../gitlab_com_derisk/fix_graphql_csrf.yml    |   9 +
 .../reassignment_throttling.yml               |   9 +
 .../populate_and_use_build_source_table.yml   |   9 +
 .../backfill_resource_link_events.yml         |   2 +-
 db/docs/software_licenses.yml                 |   1 -
 ...241201092435_add_index_to_build_sources.rb |  20 ++
 ..._finalize_backfill_resource_link_events.rb |   9 +-
 db/schema_migrations/20241201092435           |   1 +
 db/structure.sql                              |   2 +
 doc/api/graphql/reference/index.md            |  28 ++-
 doc/api/group_security_settings.md            |  44 ++++
 doc/api/notes.md                              |   5 +
 doc/ci/yaml/artifacts_reports.md              |   2 +-
 .../vulnerabilities/index.md                  |   3 +-
 lib/api/npm_project_packages.rb               |  10 +-
 locale/gitlab.pot                             |  30 +++
 .../application_controller_spec.rb            |  13 +
 spec/factories/ci/builds.rb                   |   6 +
 .../personal_access_tokens_spec.rb            |   5 +
 spec/finders/ci/build_source_finder_spec.rb   |  82 +++++++
 .../reports/components/app_spec.js            |  29 +++
 .../results/components/blob_footer_spec.js    |   2 +-
 .../todos/components/todo_item_title_spec.js  |   4 +-
 spec/frontend/todos/mock_data.js              |   2 +
 .../list_selector/group_item_spec.js          |  28 +--
 .../list_selector/project_item_spec.js        |  25 +-
 .../list_selector/user_item_spec.js           |  27 ++-
 .../resolvers/project_jobs_resolver_spec.rb   |  62 +++++
 spec/graphql/types/project_type_spec.rb       |   6 +-
 spec/helpers/application_helper_spec.rb       |  39 ---
 spec/models/oauth_access_token_spec.rb        |  51 ++--
 .../graphql/mutations/snippets/update_spec.rb |  12 +-
 spec/requests/api/graphql_spec.rb             | 112 ++++++++-
 .../requests/api/npm_project_packages_spec.rb |  10 +
 .../passwords_controller_spec.rb              |  61 +++++
 spec/services/groups/transfer_service_spec.rb |  23 ++
 spec/services/groups/update_service_spec.rb   |  27 +++
 ...n_placeholder_user_records_service_spec.rb | 225 +++++++++++++++++-
 ...rk_package_for_destruction_service_spec.rb |  13 +-
 .../npm/generate_metadata_service_spec.rb     |  12 +-
 .../helpers/features/access_token_helpers.rb  |   4 +
 ...gn_placeholder_user_records_worker_spec.rb |  17 ++
 95 files changed, 1586 insertions(+), 381 deletions(-)
 create mode 100644 app/assets/javascripts/merge_requests/reports/components/app.vue
 create mode 100644 app/assets/javascripts/merge_requests/reports/constants.js
 create mode 100644 app/assets/javascripts/merge_requests/reports/pages/blockers_page.vue
 create mode 100644 app/assets/javascripts/merge_requests/reports/pages/index.vue
 create mode 100644 app/assets/javascripts/merge_requests/reports/routes.js
 create mode 100644 app/assets/javascripts/pages/projects/merge_requests/reports/index.js
 delete mode 100644 app/assets/stylesheets/framework/spinner.scss
 create mode 100644 app/finders/ci/build_source_finder.rb
 create mode 100644 app/graphql/types/ci/job_source_enum.rb
 rename config/feature_flags/{wip => beta}/bulk_import_importer_user_mapping.yml (90%)
 create mode 100644 config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml
 create mode 100644 config/feature_flags/gitlab_com_derisk/reassignment_throttling.yml
 create mode 100644 config/feature_flags/wip/populate_and_use_build_source_table.yml
 create mode 100644 db/migrate/20241201092435_add_index_to_build_sources.rb
 create mode 100644 db/schema_migrations/20241201092435
 create mode 100644 doc/api/group_security_settings.md
 create mode 100644 spec/finders/ci/build_source_finder_spec.rb
 create mode 100644 spec/frontend/merge_requests/reports/components/app_spec.js
 create mode 100644 spec/requests/user_settings/passwords_controller_spec.rb

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 49420e8c346..fd5fa34f296 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-d62dac6422b1a1e4198a14b7b4e831633e85a79a
+8fa071ac4eb77db878e85ce1fa6bb7bbad18e963
diff --git a/app/assets/javascripts/access_tokens/components/new_access_token_app.vue b/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
index d705b9a11ba..8d9a01c2a4d 100644
--- a/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
+++ b/app/assets/javascripts/access_tokens/components/new_access_token_app.vue
@@ -102,7 +102,7 @@ export default {
     onSuccess(event) {
       this.beforeDisplayResults();
 
-      const [{ newToken }] = convertEventDetail(event);
+      const [{ newToken, total }] = convertEventDetail(event);
       this.newToken = newToken;
 
       this.alert = createAlert({ message: this.alertInfoMessage, variant: VARIANT_INFO });
@@ -124,8 +124,7 @@ export default {
       document.querySelectorAll('.js-token-card').forEach((el) => {
         el.querySelector('.js-add-new-token-form').style.display = '';
         el.querySelector('.js-toggle-button').style.display = 'block';
-        el.querySelector('.js-token-count').innerText =
-          parseInt(el.querySelector('.js-token-count').innerText, 10) + 1;
+        el.querySelector('.js-token-count').innerText = total;
       });
     },
   },
diff --git a/app/assets/javascripts/merge_request_tabs.js b/app/assets/javascripts/merge_request_tabs.js
index 175fc166768..f4c79bd97bd 100644
--- a/app/assets/javascripts/merge_request_tabs.js
+++ b/app/assets/javascripts/merge_request_tabs.js
@@ -187,7 +187,7 @@ export function getActionFromHref(pathName) {
 export const pageBundles = {
   show: () => import(/* webpackPrefetch: true */ '~/mr_notes/mount_app'),
   diffs: () => import(/* webpackPrefetch: true */ '~/diffs'),
-  reports: () => import('ee_else_ce/merge_requests/reports'),
+  reports: () => import('~/merge_requests/reports'),
 };
 
 export default class MergeRequestTabs {
diff --git a/app/assets/javascripts/merge_requests/reports/components/app.vue b/app/assets/javascripts/merge_requests/reports/components/app.vue
new file mode 100644
index 00000000000..f66470dc63b
--- /dev/null
+++ b/app/assets/javascripts/merge_requests/reports/components/app.vue
@@ -0,0 +1,113 @@
+<script>
+import { GlIcon, GlBadge } from '@gitlab/ui';
+import {
+  BLOCKERS_ROUTE,
+  CODE_QUALITY_ROUTE,
+  LICENSE_COMPLIANCE_ROUTE,
+  SECURITY_ROUTE,
+} from '../constants';
+
+export default {
+  name: 'MergeRequestReportsApp',
+  components: {
+    GlIcon,
+    GlBadge,
+  },
+  routeNames: {
+    BLOCKERS_ROUTE,
+    CODE_QUALITY_ROUTE,
+    SECURITY_ROUTE,
+    LICENSE_COMPLIANCE_ROUTE,
+  },
+  data() {
+    return {
+      blockersCounter: 2,
+    };
+  },
+};
+</script>
+
+<template>
+  <div class="gl-grid gl-grid-cols-[1fr] gl-gap-5 md:gl-min-h-31 md:gl-grid-cols-[200px,1fr]">
+    <h2 class="gl-sr-only">{{ s__('MrReports|Reports') }}</h2>
+    <aside
+      class="gl-border-b gl-border-default gl-pb-3 gl-pt-5 md:gl-border-r md:gl-border-0 md:gl-pr-5"
+    >
+      <nav>
+        <router-link
+          :to="{ name: $options.routeNames.BLOCKERS_ROUTE }"
+          active-class="gl-font-bold gl-bg-gray-50"
+          exact
+          class="gl-flex gl-items-center gl-rounded-base gl-p-2 gl-text-default hover:gl-bg-gray-50 hover:gl-text-default hover:gl-no-underline"
+        >
+          <span class="gl-mr-3 gl-flex gl-rounded-full gl-bg-red-100 gl-p-2">
+            <gl-icon class="gl-rounded-full gl-bg-white gl-text-red-500" name="status-failed" />
+          </span>
+          {{ s__('MrReports|Blockers') }}
+          <gl-badge class="gl-ml-auto gl-mr-2" variant="neutral"
+            ><span data-testid="blockers-counter" class="gl-font-bold">{{
+              blockersCounter
+            }}</span></gl-badge
+          >
+        </router-link>
+        <div class="gl-border-t gl-mt-2 gl-border-default gl-pt-1">
+          <h3
+            class="gl-heading-6 gl-mb-0 gl-py-3 gl-pl-3 gl-text-sm gl-font-[700] gl-leading-normal"
+          >
+            {{ s__('MrReports|All reports') }}
+          </h3>
+          <ul class="gl-m-0 gl-list-none gl-p-0">
+            <li class="gl-my-1">
+              <router-link
+                :to="{ name: $options.routeNames.CODE_QUALITY_ROUTE }"
+                active-class="gl-font-bold gl-bg-gray-50"
+                class="gl-flex gl-items-center gl-rounded-base gl-p-2 gl-text-default hover:gl-bg-gray-50 hover:gl-text-default hover:gl-no-underline"
+              >
+                <span class="gl-mr-3 gl-flex gl-p-2">
+                  <gl-icon
+                    class="gl-rounded-full gl-bg-white gl-text-orange-500"
+                    name="status-alert"
+                  />
+                </span>
+                {{ s__('MrReports|Code quality') }}
+              </router-link>
+            </li>
+            <li class="gl-my-1">
+              <router-link
+                :to="{ name: $options.routeNames.SECURITY_ROUTE }"
+                active-class="gl-font-bold gl-bg-gray-50"
+                class="gl-flex gl-items-center gl-rounded-base gl-p-2 gl-text-default hover:gl-bg-gray-50 hover:gl-text-default hover:gl-no-underline"
+              >
+                <span class="gl-mr-3 gl-flex gl-p-2">
+                  <gl-icon
+                    class="gl-rounded-full gl-bg-white gl-text-red-500"
+                    name="status-failed"
+                  />
+                </span>
+                {{ s__('MrReports|Security') }}
+              </router-link>
+            </li>
+            <li class="gl-my-1">
+              <router-link
+                :to="{ name: $options.routeNames.LICENSE_COMPLIANCE_ROUTE }"
+                active-class="gl-font-bold gl-bg-gray-50"
+                class="gl-flex gl-items-center gl-rounded-base gl-p-2 gl-text-default hover:gl-bg-gray-50 hover:gl-text-default hover:gl-no-underline"
+              >
+                <span class="gl-mr-3 gl-flex gl-p-2">
+                  <gl-icon
+                    class="gl-rounded-full gl-bg-white gl-text-red-500"
+                    name="status-failed"
+                  />
+                </span>
+                {{ s__('MrReports|License Compliance') }}
+              </router-link>
+            </li>
+          </ul>
+        </div>
+      </nav>
+    </aside>
+    <section class="md:gl-pt-5">
+      <router-view />
+    </section>
+  </div>
+</template>
diff --git a/app/assets/javascripts/merge_requests/reports/constants.js b/app/assets/javascripts/merge_requests/reports/constants.js
new file mode 100644
index 00000000000..4cd134372c5
--- /dev/null
+++ b/app/assets/javascripts/merge_requests/reports/constants.js
@@ -0,0 +1,4 @@
+export const BLOCKERS_ROUTE = 'index';
+export const CODE_QUALITY_ROUTE = 'code-quality';
+export const SECURITY_ROUTE = 'security';
+export const LICENSE_COMPLIANCE_ROUTE = 'license-compliance';
diff --git a/app/assets/javascripts/merge_requests/reports/index.js b/app/assets/javascripts/merge_requests/reports/index.js
index 2d1ec238274..32b1e797b2b 100644
--- a/app/assets/javascripts/merge_requests/reports/index.js
+++ b/app/assets/javascripts/merge_requests/reports/index.js
@@ -1 +1,36 @@
-export default () => {};
+import Vue from 'vue';
+import VueRouter from 'vue-router';
+import VueApollo from 'vue-apollo';
+import createDefaultClient from '~/lib/graphql';
+import routes from './routes';
+import MergeRequestReportsApp from './components/app.vue';
+
+export default () => {
+  Vue.use(VueRouter);
+  Vue.use(VueApollo);
+
+  const el = document.getElementById('js-reports-tab');
+  const { projectPath, iid, basePath } = el.dataset;
+  const apolloProvider = new VueApollo({
+    defaultClient: createDefaultClient(),
+  });
+  const router = new VueRouter({
+    base: basePath,
+    mode: 'history',
+    routes,
+  });
+
+  // eslint-disable-next-line no-new
+  new Vue({
+    el,
+    router,
+    apolloProvider,
+    provide: {
+      projectPath,
+      iid,
+    },
+    render(createElement) {
+      return createElement(MergeRequestReportsApp);
+    },
+  });
+};
diff --git a/app/assets/javascripts/merge_requests/reports/pages/blockers_page.vue b/app/assets/javascripts/merge_requests/reports/pages/blockers_page.vue
new file mode 100644
index 00000000000..c3bf0782a5b
--- /dev/null
+++ b/app/assets/javascripts/merge_requests/reports/pages/blockers_page.vue
@@ -0,0 +1,9 @@
+<script>
+export default {
+  name: 'MergeRequestReportsBlockersPage',
+};
+</script>
+
+<template>
+  <div></div>
+</template>
diff --git a/app/assets/javascripts/merge_requests/reports/pages/index.vue b/app/assets/javascripts/merge_requests/reports/pages/index.vue
new file mode 100644
index 00000000000..b4f055da191
--- /dev/null
+++ b/app/assets/javascripts/merge_requests/reports/pages/index.vue
@@ -0,0 +1,9 @@
+<script>
+export default {
+  name: 'MergeRequestReportsIndexPage',
+};
+</script>
+
+<template>
+  <div></div>
+</template>
diff --git a/app/assets/javascripts/merge_requests/reports/routes.js b/app/assets/javascripts/merge_requests/reports/routes.js
new file mode 100644
index 00000000000..a3906ffbd03
--- /dev/null
+++ b/app/assets/javascripts/merge_requests/reports/routes.js
@@ -0,0 +1,31 @@
+import BlockersPage from 'ee_else_ce/merge_requests/reports/pages/blockers_page.vue';
+import IndexComponent from './pages/index.vue';
+import {
+  BLOCKERS_ROUTE,
+  CODE_QUALITY_ROUTE,
+  LICENSE_COMPLIANCE_ROUTE,
+  SECURITY_ROUTE,
+} from './constants';
+
+export default [
+  {
+    path: '/',
+    name: BLOCKERS_ROUTE,
+    component: BlockersPage,
+  },
+  {
+    path: '/?type=code-quality',
+    name: CODE_QUALITY_ROUTE,
+    component: IndexComponent,
+  },
+  {
+    path: '/?type=security',
+    name: SECURITY_ROUTE,
+    component: IndexComponent,
+  },
+  {
+    path: '/?type=license-compliance',
+    name: LICENSE_COMPLIANCE_ROUTE,
+    component: IndexComponent,
+  },
+];
diff --git a/app/assets/javascripts/pages/projects/blob/show/index.js b/app/assets/javascripts/pages/projects/blob/show/index.js
index ff799809e88..ee396cb730f 100644
--- a/app/assets/javascripts/pages/projects/blob/show/index.js
+++ b/app/assets/javascripts/pages/projects/blob/show/index.js
@@ -229,7 +229,6 @@ const initTreeHistoryLinkApp = (el) => {
         {
           attrs: {
             href: url.href,
-            class: '!gl-ml-3',
           },
         },
         [__('History')],
diff --git a/app/assets/javascripts/pages/projects/merge_requests/reports/index.js b/app/assets/javascripts/pages/projects/merge_requests/reports/index.js
new file mode 100644
index 00000000000..efd5c7ccba9
--- /dev/null
+++ b/app/assets/javascripts/pages/projects/merge_requests/reports/index.js
@@ -0,0 +1,5 @@
+import { initMrPage } from '~/pages/projects/merge_requests/page';
+import initReportsApp from '~/merge_requests/reports';
+
+initMrPage();
+initReportsApp();
diff --git a/app/assets/javascripts/projects/tree/components/commit_pipeline_status.vue b/app/assets/javascripts/projects/tree/components/commit_pipeline_status.vue
index d7c38875d86..7d376cf143c 100644
--- a/app/assets/javascripts/projects/tree/components/commit_pipeline_status.vue
+++ b/app/assets/javascripts/projects/tree/components/commit_pipeline_status.vue
@@ -99,13 +99,11 @@ export default {
 };
 </script>
 <template>
-  <div class="gl-ml-5">
-    <gl-loading-icon v-if="isLoading" size="sm" :label="__('Loading pipeline status')" />
-    <ci-icon
-      v-else-if="hasCiStatus"
-      :status="ciStatus"
-      :title="statusTitle"
-      :aria-label="statusTitle"
-    />
-  </div>
+  <gl-loading-icon v-if="isLoading" size="sm" :label="__('Loading pipeline status')" />
+  <ci-icon
+    v-else-if="hasCiStatus"
+    :status="ciStatus"
+    :title="statusTitle"
+    :aria-label="statusTitle"
+  />
 </template>
diff --git a/app/assets/javascripts/search/results/constants.js b/app/assets/javascripts/search/results/constants.js
index 23f13e9ad72..a023079a435 100644
--- a/app/assets/javascripts/search/results/constants.js
+++ b/app/assets/javascripts/search/results/constants.js
@@ -1,4 +1,4 @@
-export const DEFAULT_FETCH_CHUNKS = 50;
+export const DEFAULT_FETCH_CHUNKS = 5;
 export const PROJECT_GRAPHQL_ID_TYPE = 'Project';
 export const GROUP_GRAPHQL_ID_TYPE = 'Group';
 export const SEARCH_RESULTS_DEBOUNCE = 500;
diff --git a/app/assets/javascripts/todos/components/queries/todo.fragment.graphql b/app/assets/javascripts/todos/components/queries/todo.fragment.graphql
index f2f3149aa9a..6aa0eceb358 100644
--- a/app/assets/javascripts/todos/components/queries/todo.fragment.graphql
+++ b/app/assets/javascripts/todos/components/queries/todo.fragment.graphql
@@ -29,6 +29,7 @@ fragment Todo on Todo {
     ... on Design {
       issue {
         id
+        name
         reference
       }
     }
diff --git a/app/assets/javascripts/todos/components/todo_item_title.vue b/app/assets/javascripts/todos/components/todo_item_title.vue
index 0cebbcfd141..a2b1d2a4601 100644
--- a/app/assets/javascripts/todos/components/todo_item_title.vue
+++ b/app/assets/javascripts/todos/components/todo_item_title.vue
@@ -34,6 +34,9 @@ export default {
     isAlert() {
       return this.todo.targetType === TODO_TARGET_TYPE_ALERT;
     },
+    isDesign() {
+      return this.todo.targetType === TODO_TARGET_TYPE_DESIGN;
+    },
     isMemberAccessRequestAction() {
       return this.todo.action === TODO_ACTION_TYPE_MEMBER_ACCESS_REQUESTED;
     },
@@ -72,19 +75,49 @@ export default {
         (this.isMergeRequest || this.isIssue || this.isAlert) && this.issuableState !== STATUS_OPEN
       );
     },
-    targetTitle() {
+    /**
+     * Full title line of the todo title + full reference, joined by a middot
+     */
+    todoTitle() {
+      return [this.targetName, this.targetFullReference].filter(Boolean).join(' · ');
+    },
+    /**
+     * Right half of a todo title: Full reference to the todo (parentPath + Target Reference)
+     */
+    targetFullReference() {
+      return [this.parentPath, this.targetReference].filter(Boolean).join(' ');
+    },
+    /**
+     * Left half of a To-Do title, often the entity name
+     */
+    targetName() {
       if (this.isMemberAccessRequestAction) {
         return '';
       }
 
-      return this.todo.targetEntity?.name ?? '';
+      const name = this.todo.targetEntity?.name ?? '';
+
+      if (this.isDesign && this.todo.targetEntity?.issue?.name) {
+        if (name) {
+          return `${this.todo.targetEntity.issue.name} › ${name}`;
+        }
+        return this.todo.targetEntity.issue.name;
+      }
+
+      return name;
     },
+    /**
+     * Reference of the target entity
+     */
     targetReference() {
-      if (this.todo.targetEntity?.issue?.reference) {
+      if (this.isDesign && this.todo.targetEntity?.issue?.reference) {
         return this.todo.targetEntity.issue.reference;
       }
       return this.todo.targetEntity?.reference ?? '';
     },
+    /**
+     * Parent path of the target entity Reference of the target entity
+     */
     parentPath() {
       if (this.todo.group) {
         return this.todo.group.fullName;
@@ -96,21 +129,6 @@ export default {
 
       return '';
     },
-    showSeparator() {
-      if (!this.targetTitle) {
-        return false;
-      }
-
-      if (this.parentPath) {
-        return true;
-      }
-
-      if (this.targetReference) {
-        return true;
-      }
-
-      return false;
-    },
     icon() {
       switch (this.todo.targetType) {
         case TODO_TARGET_TYPE_ISSUE:
@@ -122,7 +140,7 @@ export default {
         case TODO_TARGET_TYPE_ALERT:
           return 'status-alert';
         case TODO_TARGET_TYPE_DESIGN:
-          return 'issues';
+          return 'media';
         case TODO_TARGET_TYPE_SSH_KEY:
           return 'token';
         case TODO_TARGET_TYPE_EPIC:
@@ -140,10 +158,7 @@ export default {
     <status-badge v-if="showStatusBadge" :issuable-type="issuableType" :state="issuableState" />
     <gl-icon v-if="icon" :name="icon" />
     <div class="gl-overflow-hidden gl-text-ellipsis" data-testid="todo-title">
-      <span v-if="targetTitle" class="todo-target-title">{{ targetTitle }}</span>
-      <span v-if="showSeparator">&middot;</span>
-      <span>{{ parentPath }}</span>
-      <span v-if="targetReference">{{ targetReference }}</span>
+      {{ todoTitle }}
     </div>
   </div>
 </template>
diff --git a/app/assets/javascripts/todos/components/todo_item_title_hidden_by_saml.vue b/app/assets/javascripts/todos/components/todo_item_title_hidden_by_saml.vue
index 2eaa94c99cd..1a6e35a73ad 100644
--- a/app/assets/javascripts/todos/components/todo_item_title_hidden_by_saml.vue
+++ b/app/assets/javascripts/todos/components/todo_item_title_hidden_by_saml.vue
@@ -25,7 +25,7 @@ export default {
       {{ $options.i18n.hiddenTodoBadgeText }}
     </gl-badge>
     <div class="gl-overflow-hidden gl-text-ellipsis" data-testid="todo-title">
-      <span class="todo-target-title">{{ $options.i18n.hiddenTodoTitle }}</span>
+      {{ $options.i18n.hiddenTodoTitle }}
     </div>
   </div>
 </template>
diff --git a/app/assets/javascripts/vue_shared/components/list_selector/group_item.vue b/app/assets/javascripts/vue_shared/components/list_selector/group_item.vue
index 1344174cad4..a9d72356882 100644
--- a/app/assets/javascripts/vue_shared/components/list_selector/group_item.vue
+++ b/app/assets/javascripts/vue_shared/components/list_selector/group_item.vue
@@ -1,11 +1,11 @@
 <script>
-import { GlAvatar, GlButton, GlTooltipDirective } from '@gitlab/ui';
+import { GlAvatarLabeled, GlButton, GlTooltipDirective } from '@gitlab/ui';
 import { sprintf, __ } from '~/locale';
 
 export default {
   name: 'GroupItem',
   components: {
-    GlAvatar,
+    GlAvatarLabeled,
     GlButton,
     HiddenGroupsItem: () => import('ee_component/approvals/components/hidden_groups_item.vue'),
   },
@@ -46,19 +46,17 @@ export default {
 <template>
   <div class="gl-flex gl-items-center gl-gap-3">
     <hidden-groups-item v-if="isHiddenGroups" class="gl-grow" />
-    <div v-else class="gl-flex gl-grow gl-items-center gl-gap-3">
-      <gl-avatar
-        :alt="fullName"
-        :entity-name="fullName"
-        :size="32"
-        :src="avatarUrl"
-        fallback-on-error
-      />
-      <span class="gl-flex gl-flex-col">
-        <span class="gl-font-bold">{{ fullName }}</span>
-        <span class="gl-text-subtle">@{{ name }}</span>
-      </span>
-    </div>
+    <gl-avatar-labeled
+      v-else
+      class="gl-grow gl-break-all"
+      :entity-name="fullName"
+      :label="fullName"
+      :sub-label="`@${name}`"
+      :size="32"
+      shape="rect"
+      :src="avatarUrl"
+      fallback-on-error
+    />
 
     <gl-button
       v-if="canDelete"
diff --git a/app/assets/javascripts/vue_shared/components/list_selector/project_item.vue b/app/assets/javascripts/vue_shared/components/list_selector/project_item.vue
index 5a573b2c275..81c9a70a069 100644
--- a/app/assets/javascripts/vue_shared/components/list_selector/project_item.vue
+++ b/app/assets/javascripts/vue_shared/components/list_selector/project_item.vue
@@ -1,11 +1,11 @@
 <script>
-import { GlAvatar, GlButton, GlTooltipDirective } from '@gitlab/ui';
+import { GlAvatarLabeled, GlButton, GlTooltipDirective } from '@gitlab/ui';
 import { sprintf, __ } from '~/locale';
 
 export default {
   name: 'ProjectItem',
   components: {
-    GlAvatar,
+    GlAvatarLabeled,
     GlButton,
   },
   directives: {
@@ -35,18 +35,16 @@ export default {
 
 <template>
   <span class="gl-flex gl-items-center gl-gap-3" @click="$emit('select', name)">
-    <gl-avatar
-      :alt="name"
+    <gl-avatar-labeled
+      class="gl-grow gl-break-all"
       :entity-name="name"
+      :label="name"
+      :sub-label="data.nameWithNamespace"
       :size="32"
       shape="rect"
       :src="data.avatarUrl"
       fallback-on-error
     />
-    <span class="gl-flex gl-max-w-30 gl-grow gl-flex-col">
-      <span class="gl-font-bold">{{ name }}</span>
-      <span class="gl-text-subtle">{{ data.nameWithNamespace }}</span>
-    </span>
 
     <gl-button
       v-if="canDelete"
diff --git a/app/assets/javascripts/vue_shared/components/list_selector/user_item.vue b/app/assets/javascripts/vue_shared/components/list_selector/user_item.vue
index 6d66072c879..9df902927cc 100644
--- a/app/assets/javascripts/vue_shared/components/list_selector/user_item.vue
+++ b/app/assets/javascripts/vue_shared/components/list_selector/user_item.vue
@@ -1,11 +1,11 @@
 <script>
-import { GlAvatar, GlButton, GlTooltipDirective } from '@gitlab/ui';
+import { GlAvatarLabeled, GlButton, GlTooltipDirective } from '@gitlab/ui';
 import { sprintf, __ } from '~/locale';
 
 export default {
   name: 'UserItem',
   components: {
-    GlAvatar,
+    GlAvatarLabeled,
     GlButton,
   },
   directives: {
@@ -41,11 +41,15 @@ export default {
 
 <template>
   <span class="gl-flex gl-items-center gl-gap-3">
-    <gl-avatar :alt="name" :entity-name="name" :size="32" :src="avatarUrl" fallback-on-error />
-    <span class="gl-flex gl-grow gl-flex-col">
-      <span class="gl-font-bold">{{ name }}</span>
-      <span class="gl-text-subtle">@{{ username }}</span>
-    </span>
+    <gl-avatar-labeled
+      class="gl-grow gl-break-all"
+      :entity-name="name"
+      :label="name"
+      :sub-label="`@${username}`"
+      :size="32"
+      :src="avatarUrl"
+      fallback-on-error
+    />
 
     <gl-button
       v-if="canDelete"
diff --git a/app/assets/stylesheets/components/content_editor.scss b/app/assets/stylesheets/components/content_editor.scss
index f6e068f6a44..9bcb5c4ed20 100644
--- a/app/assets/stylesheets/components/content_editor.scss
+++ b/app/assets/stylesheets/components/content_editor.scss
@@ -28,17 +28,17 @@
   &:not(.ProseMirror-hideselection) .content-editor-selection,
   a.ProseMirror-selectednode,
   span.ProseMirror-selectednode {
-    background-color: $blue-100;
-    box-shadow: 0 2px 0 $blue-100, 0 -2px 0 $blue-100;
+    @apply gl-bg-blue-100;
+    box-shadow: 0 2px 0 var(--blue-100, $blue-100), 0 -2px 0 var(--blue-100, $blue-100);
 
     &.gfm-project_member, .gfm-project_member {
       &:not(.current-user) {
-        background-color: $blue-200;
+        @apply gl-bg-blue-200;
       }
     }
 
     &.gfm-project_member {
-      box-shadow: 0 0 0 2px $blue-100;
+      box-shadow: 0 0 0 2px var(--blue-100, $blue-100);
     }
   }
 
diff --git a/app/assets/stylesheets/framework.scss b/app/assets/stylesheets/framework.scss
index a9a24d43e60..267c6f7d175 100644
--- a/app/assets/stylesheets/framework.scss
+++ b/app/assets/stylesheets/framework.scss
@@ -54,7 +54,6 @@
 @import 'framework/sortable';
 @import 'framework/read_more';
 @import 'framework/system_messages';
-@import 'framework/spinner';
 @import 'framework/card';
 @import 'framework/source_editor';
 @import 'framework/diffs';
diff --git a/app/assets/stylesheets/framework/animations.scss b/app/assets/stylesheets/framework/animations.scss
index fee1f69170f..0f13afa9ed7 100644
--- a/app/assets/stylesheets/framework/animations.scss
+++ b/app/assets/stylesheets/framework/animations.scss
@@ -56,15 +56,6 @@
   transition: $unfolded-transitions;
 }
 
-@mixin disable-all-animation {
-  /*CSS transitions*/
-  transition-property: none !important;
-  /*CSS transforms*/
-  transform: none !important;
-  /*CSS animations*/
-  animation: none !important;
-}
-
 @function unfold-transition ($transition) {
   // Default values
   $property: all;
diff --git a/app/assets/stylesheets/framework/source_editor.scss b/app/assets/stylesheets/framework/source_editor.scss
index 0dcf18d6643..edb6131cad8 100644
--- a/app/assets/stylesheets/framework/source_editor.scss
+++ b/app/assets/stylesheets/framework/source_editor.scss
@@ -1,3 +1,13 @@
+@keyframes source-editor-spinner-rotate {
+  0% {
+    transform: rotate(0deg);
+  }
+
+  100% {
+    transform: rotate(360deg);
+  }
+}
+
 [data-editor-loading] {
   position: relative;
   display: flex;
@@ -10,8 +20,25 @@
   }
 
   &::before {
+    $size: 32px;
+    $border-width: 3px;
+    $color: $gray-700;
+
     content: '';
-    @include spinner-deprecated(32px, 3px);
+    @include webkit-prefix(transform-origin, 50% 50% calc((#{$size} / 2) + #{$border-width}));
+    width: $size;
+    height: $size;
+    border-width: $border-width;
+    border-color: rgba($color, 0.25);
+    border-top-color: $color;
+    border-radius: 50%;
+    margin: 0 auto;
+    animation-name: source-editor-spinner-rotate;
+    animation-duration: 0.6s;
+    animation-timing-function: linear;
+    animation-iteration-count: infinite;
+    border-style: solid;
+    display: inline-flex;
     position: absolute;
     z-index: 1;
   }
diff --git a/app/assets/stylesheets/framework/spinner.scss b/app/assets/stylesheets/framework/spinner.scss
deleted file mode 100644
index afd2e7ff757..00000000000
--- a/app/assets/stylesheets/framework/spinner.scss
+++ /dev/null
@@ -1,39 +0,0 @@
-/**
-* Do not use these spinner mixins. Rely on GitLab UI
-* GlLoadingIcon component instead.
-*/
-@mixin spinner-color-deprecated($color) {
-  border-color: rgba($color, 0.25);
-  border-top-color: $color;
-}
-
-@mixin spinner-size-deprecated($size, $border-width) {
-  width: $size;
-  height: $size;
-  border-width: $border-width;
-  @include webkit-prefix(transform-origin, 50% 50% calc((#{$size} / 2) + #{$border-width}));
-}
-
-@keyframes spinner-rotate-deprecated {
-  0% {
-    transform: rotate(0);
-  }
-
-  100% {
-    transform: rotate(360deg);
-  }
-}
-
-@mixin spinner-deprecated($size: 16px, $border-width: 2px, $color: $gray-700) {
-  border-radius: 50%;
-  position: relative;
-  margin: 0 auto;
-  animation-name: spinner-rotate-deprecated;
-  animation-duration: 0.6s;
-  animation-timing-function: linear;
-  animation-iteration-count: infinite;
-  border-style: solid;
-  display: inline-flex;
-  @include spinner-size-deprecated($size, $border-width);
-  @include spinner-color-deprecated($color);
-}
diff --git a/app/assets/stylesheets/framework/typography.scss b/app/assets/stylesheets/framework/typography.scss
index 9752d229994..422b601e6d6 100644
--- a/app/assets/stylesheets/framework/typography.scss
+++ b/app/assets/stylesheets/framework/typography.scss
@@ -88,6 +88,11 @@
     @apply gl-inline-block gl-mb-0;
   }
 
+  // make default paragraph of summary text behave nicely with the summary marker
+  summary > p {
+    max-width: calc(100% - 1rem);
+  }
+
   // Single code lines should wrap
   code {
     @apply gl-font-monospace;
diff --git a/app/assets/stylesheets/highlight/_white_base.scss b/app/assets/stylesheets/highlight/_white_base.scss
index e212961146b..f6718f33f06 100644
--- a/app/assets/stylesheets/highlight/_white_base.scss
+++ b/app/assets/stylesheets/highlight/_white_base.scss
@@ -78,22 +78,6 @@ $white-gc-bg: #eaf2f5;
   background-color: $gl-color-neutral-10;
 }
 
-@mixin diff-match-line {
-  &.expansion {
-    &.match .diff-td {
-      color: $gl-color-neutral-400;
-    }
-
-    .diff-td {
-      background-color: $gl-color-neutral-50;
-
-      &:first-child {
-        border-color: $gl-color-neutral-100;
-      }
-    }
-  }
-}
-
 @mixin white-base {
   // Line numbers
   .file-line-blame {
@@ -155,7 +139,19 @@ $white-gc-bg: #eaf2f5;
     &.diff-grid-row {
       --diff-expansion-background-color: #{$gl-color-neutral-100};
 
-      @include diff-match-line;
+      &.expansion {
+        &.match .diff-td {
+          color: $gl-color-neutral-400;
+        }
+
+        .diff-td {
+          background-color: $gl-color-neutral-50;
+
+          &:first-child {
+            border-color: $gl-color-neutral-100;
+          }
+        }
+      }
     }
 
     &:not(.match) .diff-grid-left:hover,
diff --git a/app/assets/stylesheets/page_bundles/work_items.scss b/app/assets/stylesheets/page_bundles/work_items.scss
index 2c1a62b4fb8..b5bf536de49 100644
--- a/app/assets/stylesheets/page_bundles/work_items.scss
+++ b/app/assets/stylesheets/page_bundles/work_items.scss
@@ -147,17 +147,6 @@ $disclosure-hierarchy-chevron-dimension: 1.2rem;
   }
 }
 
-@mixin hierarchy-path-chevron {
-  content: '';
-  position: absolute;
-  background-color: inherit;
-  top: 0.39rem;
-  right: px-to-rem(-9px);
-  width: $disclosure-hierarchy-chevron-dimension;
-  height: $disclosure-hierarchy-chevron-dimension;
-  transform: rotate(45deg) skew(14deg, 14deg);
-}
-
 .disclosure-hierarchy {
   @include media-breakpoint-up(sm) {
     margin-right: $gl-spacing-scale-7;
@@ -189,7 +178,14 @@ $disclosure-hierarchy-chevron-dimension: 1.2rem;
 
   &::before,
   &::after {
-    @include hierarchy-path-chevron;
+    content: '';
+    position: absolute;
+    background-color: inherit;
+    top: 0.39rem;
+    right: px-to-rem(-9px);
+    width: $disclosure-hierarchy-chevron-dimension;
+    height: $disclosure-hierarchy-chevron-dimension;
+    transform: rotate(45deg) skew(14deg, 14deg);
     border: 1px solid var(--gray-100, $gray-100);
     border-color: inherit;
     border-bottom-color: transparent;
diff --git a/app/assets/stylesheets/pages/commits.scss b/app/assets/stylesheets/pages/commits.scss
index 1d10414284e..b524fb631f3 100644
--- a/app/assets/stylesheets/pages/commits.scss
+++ b/app/assets/stylesheets/pages/commits.scss
@@ -68,17 +68,6 @@
   }
 }
 
-.commit-actions {
-  .ci-status-icon svg {
-    vertical-align: text-bottom;
-  }
-
-  > .btn,
-  > .commit-sha-group {
-    margin-left: $gl-padding;
-  }
-}
-
 .commit-nav-buttons {
   margin: 0 0.5rem;
 
diff --git a/app/assets/stylesheets/pages/note_form.scss b/app/assets/stylesheets/pages/note_form.scss
index 7d667f6452f..4c3267689c9 100644
--- a/app/assets/stylesheets/pages/note_form.scss
+++ b/app/assets/stylesheets/pages/note_form.scss
@@ -42,8 +42,7 @@
 }
 
 .gfm-form .note-textarea, .md .ProseMirror {
-  resize: vertical !important;
-  max-height: unset !important;
+  overflow-y: auto !important;
 }
 
 .note-image-attach {
diff --git a/app/assets/stylesheets/vendors/atwho.scss b/app/assets/stylesheets/vendors/atwho.scss
index 4bfe656dc69..3ad2ee18b14 100644
--- a/app/assets/stylesheets/vendors/atwho.scss
+++ b/app/assets/stylesheets/vendors/atwho.scss
@@ -36,7 +36,10 @@
 
   .cur {
     .avatar {
-      @include disable-all-animation;
+      transition-property: none !important;
+      transform: none !important;
+      animation: none !important;
+      border: 1px solid $white;
     }
   }
 
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 2f36f5a6b4e..d9840a45e00 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -90,6 +90,10 @@ class ApplicationController < BaseActionController
     render_403
   end
 
+  rescue_from ActionController::InvalidAuthenticityToken do
+    render_403
+  end
+
   rescue_from Browser::Error do |e|
     render plain: e.message, status: :forbidden
   end
diff --git a/app/controllers/concerns/sessionless_authentication.rb b/app/controllers/concerns/sessionless_authentication.rb
index 7ec9be6baaf..3cb6325ac9e 100644
--- a/app/controllers/concerns/sessionless_authentication.rb
+++ b/app/controllers/concerns/sessionless_authentication.rb
@@ -16,10 +16,16 @@ module SessionlessAuthentication
   end
 
   def sessionless_user?
-    current_user && !session.key?('warden.user.user.key')
+    if Feature.enabled?(:fix_graphql_csrf, Feature.current_request)
+      current_user && @sessionless_sign_in # rubocop:disable Gitlab/ModuleWithInstanceVariables -- This is only used within this module
+    else
+      current_user && !session.key?('warden.user.user.key')
+    end
   end
 
   def sessionless_sign_in(user)
+    @sessionless_sign_in = true # rubocop:disable Gitlab/ModuleWithInstanceVariables -- This is only used within this module
+
     signed_in_user =
       if user.can_log_in_with_non_expired_password?
         # Notice we are passing store false, so the user is not
@@ -32,7 +38,9 @@ module SessionlessAuthentication
         sign_in(user, store: false, message: :sessionless_sign_in, run_callbacks: false)
       end
 
-    reset_auth_user! if respond_to?(:reset_auth_user!, true)
+    if respond_to?(:reset_auth_user!, true) && Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
+      reset_auth_user!
+    end
 
     signed_in_user
   end
diff --git a/app/controllers/graphql_controller.rb b/app/controllers/graphql_controller.rb
index 0f1a3098f34..a64dd127291 100644
--- a/app/controllers/graphql_controller.rb
+++ b/app/controllers/graphql_controller.rb
@@ -5,6 +5,14 @@ class GraphqlController < ApplicationController
 
   # Unauthenticated users have access to the API for public data
   skip_before_action :authenticate_user!
+  # This is already handled by authorize_access_api!
+  skip_before_action :active_user_check
+  # CSRF protection is only necessary when the request is authenticated via a session cookie.
+  # Also, we allow anonymous users to access the API without a CSRF token so that it is easier for users
+  # to get started with our GraphQL API.
+  skip_before_action :verify_authenticity_token, if: -> {
+    Feature.enabled?(:fix_graphql_csrf, Feature.current_request) && (current_user.nil? || sessionless_user?)
+  }
 
   # Header can be passed by tests to disable SQL query limits.
   DISABLE_SQL_QUERY_LIMIT_HEADER = 'HTTP_X_GITLAB_DISABLE_SQL_QUERY_LIMIT'
@@ -20,17 +28,29 @@ class GraphqlController < ApplicationController
   # storage, since the admin-mode check is session wide.
   # We can't enable this for anonymous users because that would cause users using
   # enforced SSO from using an auth token to access the API.
-  skip_around_action :set_session_storage, unless: :current_user
+  skip_around_action :set_session_storage, if: -> {
+    Feature.disabled?(:fix_graphql_csrf, Feature.current_request) && current_user.nil?
+  }
 
   # Allow missing CSRF tokens, this would mean that if a CSRF is invalid or missing,
   # the user won't be authenticated but can proceed as an anonymous user.
   #
   # If a CSRF is valid, the user is authenticated. This makes it easier to play
   # around in GraphiQL.
-  protect_from_forgery with: :null_session, only: :execute
+  prepend_before_action do
+    if Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
+      self.forgery_protection_strategy = ProtectionMethods::NullSession
+    end
+  end
 
   # must come first: current_user is set up here
-  before_action(only: [:execute]) { authenticate_sessionless_user!(:graphql_api) }
+  prepend_before_action(if: -> {
+    Feature.enabled?(:fix_graphql_csrf, Feature.current_request)
+  }) { authenticate_sessionless_user!(:graphql_api) }
+
+  before_action(if: -> {
+    Feature.disabled?(:fix_graphql_csrf, Feature.current_request)
+  }) { authenticate_sessionless_user!(:graphql_api) }
 
   before_action :authorize_access_api!
   before_action :set_user_last_activity
@@ -82,6 +102,13 @@ class GraphqlController < ApplicationController
     end
   end
 
+  # ApplicationController has similar rescues but we declare these again here because the
+  # `rescue_from StandardError` above would prevent these from bubbling up to ApplicationController.
+  # These also return errors in a JSON format similar to GraphQL errors.
+  rescue_from ActionController::InvalidAuthenticityToken do |exception|
+    render_error(exception.message, status: :forbidden)
+  end
+
   rescue_from Gitlab::Auth::TooManyIps do |exception|
     log_exception(exception)
 
diff --git a/app/controllers/user_settings/passwords_controller.rb b/app/controllers/user_settings/passwords_controller.rb
index 464fef42b2b..032a01b41d7 100644
--- a/app/controllers/user_settings/passwords_controller.rb
+++ b/app/controllers/user_settings/passwords_controller.rb
@@ -6,6 +6,7 @@ module UserSettings
 
     skip_before_action :check_password_expiration, only: [:new, :create]
     skip_before_action :check_two_factor_requirement, only: [:new, :create]
+    skip_before_action :active_user_check, only: [:new, :create]
 
     before_action :set_user
     before_action :authorize_change_password!
@@ -14,7 +15,9 @@ module UserSettings
 
     feature_category :system_access
 
-    def new; end
+    def new
+      current_user.activate if user_signed_in? && current_user.deactivated?
+    end
 
     def create
       unless @user.password_automatically_set || @user.valid_password?(user_params[:password])
diff --git a/app/finders/ci/build_source_finder.rb b/app/finders/ci/build_source_finder.rb
new file mode 100644
index 00000000000..5eac3bd5223
--- /dev/null
+++ b/app/finders/ci/build_source_finder.rb
@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Ci
+  class BuildSourceFinder
+    def initialize(relation:, sources:, project:, params: {})
+      raise ArgumentError, 'Only Ci::Builds are source searchable' unless relation.klass == Ci::Build
+
+      @relation = relation
+      @sources = sources
+      @project = project
+      @params = params
+    end
+
+    def execute
+      return relation unless sources.present?
+
+      filter_by_source
+    end
+
+    private
+
+    attr_reader :relation, :sources, :project, :params
+
+    # rubocop: disable CodeReuse/ActiveRecord -- Need specialized queries for database optimizations
+    def filter_by_source
+      relation
+        .from("(#{build_source_scope.to_sql}) p_ci_build_sources, LATERAL (#{ci_builds_query.to_sql}) p_ci_builds")
+    end
+
+    def order
+      Gitlab::Pagination::Keyset::Order.build(
+        [
+          Gitlab::Pagination::Keyset::ColumnOrderDefinition.new(
+            attribute_name: 'build_id',
+            order_expression: Ci::BuildSource.arel_table[:build_id].desc
+          ),
+          Gitlab::Pagination::Keyset::ColumnOrderDefinition.new(
+            attribute_name: 'partition_id',
+            order_expression: Ci::BuildSource.arel_table[:partition_id].desc
+          )
+        ])
+    end
+
+    def build_source_scope
+      Gitlab::Pagination::Keyset::InOperatorOptimization::QueryBuilder.new(
+        scope: scope,
+        array_scope: array_scope,
+        array_mapping_scope: array_mapping_scope
+      ).execute
+    end
+
+    def ci_builds_query
+      relation
+        .where("id = p_ci_build_sources.build_id and partition_id = p_ci_build_sources.partition_id")
+        .limit(1)
+    end
+
+    def scope
+      Ci::BuildSource.where(project_id: project.id).order(order)
+    end
+
+    def array_scope
+      Ci::BuildSource
+        .where(project_id: project.id)
+        .loose_index_scan(column: :source)
+        .select(:source).where(source: sources)
+    end
+
+    def array_mapping_scope
+      ->(source) { Ci::BuildSource.where(Ci::BuildSource.arel_table[:source].eq(source)) }
+    end
+
+    def get_source_ids_from_names(source_names)
+      source_ids = []
+      source_names.each do |source_name|
+        source_ids << Ci::BuildSource.sources[source_name] if Ci::BuildSource.sources.key?(source_name)
+      end
+
+      source_ids
+    end
+    # rubocop: enable CodeReuse/ActiveRecord
+  end
+end
diff --git a/app/finders/ci/jobs_finder.rb b/app/finders/ci/jobs_finder.rb
index efacd8143bc..d846448fefc 100644
--- a/app/finders/ci/jobs_finder.rb
+++ b/app/finders/ci/jobs_finder.rb
@@ -15,7 +15,10 @@ module Ci
     end
 
     def execute
-      builds = init_collection.order_id_desc
+      # params[:skip_ordering] needed when using in conjunction with Ci::BuildSourceFinder
+      # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170899
+      builds = params[:skip_ordering] ? init_collection : init_collection.order_id_desc
+
       filter_builds(builds)
     rescue Gitlab::Access::AccessDeniedError
       type.none
diff --git a/app/graphql/resolvers/project_jobs_resolver.rb b/app/graphql/resolvers/project_jobs_resolver.rb
index 796a4e615a5..b130679aaed 100644
--- a/app/graphql/resolvers/project_jobs_resolver.rb
+++ b/app/graphql/resolvers/project_jobs_resolver.rb
@@ -23,16 +23,27 @@ module Resolvers
       experiment: { milestone: '17.1' },
       description: 'Filter jobs by name.'
 
+    argument :sources, [::Types::Ci::JobSourceEnum],
+      required: false,
+      experiment: { milestone: '17.7' },
+      description: "Filter jobs by source. Ignored if " \
+        "'populate_and_use_build_source_table' feature flag is disabled."
+
     alias_method :project, :object
 
     def resolve_with_lookahead(**args)
+      filter_by_name = Feature.enabled?(:populate_and_use_build_names_table, project) && args[:name].to_s.present?
+      filter_by_sources = Feature.enabled?(:populate_and_use_build_source_table, project) && args[:sources].present?
+
       jobs = ::Ci::JobsFinder.new(
         current_user: current_user, project: project, params: {
-          scope: args[:statuses], with_artifacts: args[:with_artifacts]
+          scope: args[:statuses], with_artifacts: args[:with_artifacts],
+          skip_ordering: filter_by_sources
         }
       ).execute
 
-      if Feature.enabled?(:populate_and_use_build_names_table, project)
+      # These job filters are currently exclusive with each other
+      if filter_by_name
         jobs = ::Ci::BuildNameFinder.new(
           relation: jobs,
           name: args[:name],
@@ -42,6 +53,14 @@ module Resolvers
             asc: args[:last].present?, invert_ordering: true
           }
         ).execute
+      elsif filter_by_sources
+        jobs = ::Ci::BuildSourceFinder.new(
+          relation: jobs,
+          sources: args[:sources],
+          project: project
+        ).execute
+
+        return offset_pagination(apply_lookahead(jobs))
       end
 
       apply_lookahead(jobs)
@@ -61,7 +80,8 @@ module Resolvers
       {
         previous_stage_jobs_or_needs: [:needs, :pipeline],
         artifacts: [:job_artifacts],
-        pipeline: [:user]
+        pipeline: [:user],
+        build_source: [:source]
       }
     end
   end
diff --git a/app/graphql/types/ci/job_source_enum.rb b/app/graphql/types/ci/job_source_enum.rb
new file mode 100644
index 00000000000..deddd99c023
--- /dev/null
+++ b/app/graphql/types/ci/job_source_enum.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Types
+  module Ci
+    class JobSourceEnum < BaseEnum
+      graphql_name 'CiJobSource'
+
+      ::Ci::BuildSource.sources.keys.map(&:to_s).each do |source|
+        value source.upcase,
+          description: "A job initiated by #{source.tr('_', ' ')}.",
+          value: source
+      end
+    end
+  end
+end
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 6a7a245af11..caf19796ae6 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -135,7 +135,6 @@ module ApplicationHelper
     {
       page: body_data_page,
       page_type_id: controller.params[:id],
-      find_file: find_file_path(ref_type: @ref_type),
       group: @group&.path,
       group_full_path: @group&.full_path
     }.merge(project_data)
diff --git a/app/helpers/ci/status_helper.rb b/app/helpers/ci/status_helper.rb
index 20ec71879e6..c7f8e88c42a 100644
--- a/app/helpers/ci/status_helper.rb
+++ b/app/helpers/ci/status_helper.rb
@@ -58,8 +58,7 @@ module Ci
       render_ci_icon(
         status,
         path,
-        tooltip_placement: tooltip_placement,
-        option_css_classes: 'gl-ml-3'
+        tooltip_placement: tooltip_placement
       )
     end
 
@@ -67,13 +66,12 @@ module Ci
       status,
       path = nil,
       tooltip_placement: 'left',
-      option_css_classes: '',
       container: 'body',
       show_status_text: false
     )
       content_tag_variant = path ? :a : :span
       variant = badge_variant(status)
-      badge_classes = "ci-icon ci-icon-variant-#{variant} gl-inline-flex gl-items-center gl-text-sm #{option_css_classes}"
+      badge_classes = "ci-icon ci-icon-variant-#{variant} gl-inline-flex gl-items-center gl-text-sm"
       title = "#{_('Pipeline')}: #{ci_label_for_status(status)}"
       data = { toggle: 'tooltip', placement: tooltip_placement, container: container, testid: 'ci-icon' }
 
diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 8843b1d5f90..9c72d92a8b7 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -912,15 +912,6 @@ module ProjectsHelper
     end
   end
 
-  def find_file_path(ref_type: nil)
-    return unless @project && !@project.empty_repo?
-    return unless can?(current_user, :read_code, @project)
-
-    ref = @ref || @project.repository.root_ref
-
-    project_find_file_path(@project, ref, ref_type: ref_type)
-  end
-
   def can_show_last_commit_in_list?(project)
     can?(current_user, :read_cross_project) &&
       can?(current_user, :read_commit_status, project) &&
diff --git a/app/models/ci/build_source.rb b/app/models/ci/build_source.rb
index 8f20169fb58..4e0223c95a5 100644
--- a/app/models/ci/build_source.rb
+++ b/app/models/ci/build_source.rb
@@ -3,16 +3,17 @@
 module Ci
   class BuildSource < Ci::ApplicationRecord
     include Ci::Partitionable
+    include EachBatch
 
     self.table_name = :p_ci_build_sources
     self.primary_key = :build_id
 
-    enum source: {
-      scan_execution_policy: 1,
-      pipeline_execution_policy: 2
-    }
+    ignore_column :pipeline_source, remove_with: '17.9', remove_after: '2025-01-15'
 
-    enum pipeline_source: Enums::Ci::Pipeline.sources
+    enum source: {
+      scan_execution_policy: 1001,
+      pipeline_execution_policy: 1002
+    }.merge(::Enums::Ci::Pipeline.sources)
 
     query_constraints :build_id, :partition_id
     partitionable scope: :build, partitioned: true
diff --git a/app/models/oauth_access_token.rb b/app/models/oauth_access_token.rb
index 54f65f5c87a..8825df603ad 100644
--- a/app/models/oauth_access_token.rb
+++ b/app/models/oauth_access_token.rb
@@ -15,7 +15,7 @@ class OauthAccessToken < Doorkeeper::AccessToken
   scope :preload_application, -> { preload(:application) }
 
   # user scope format is: `user:$USER_ID`
-  SCOPED_USER_REGEX = /user:(\d+)(?:\s|$)/
+  SCOPED_USER_REGEX = /\Auser:(\d+)\z/
 
   def scopes=(value)
     if value.is_a?(Array)
@@ -53,8 +53,10 @@ class OauthAccessToken < Doorkeeper::AccessToken
   private
 
   def extract_user_id_from_scopes
-    return false unless scopes.present?
+    # scopes are an instance of Doorkeeper:OAuth::Scopes class
+    matches = scopes.grep(SCOPED_USER_REGEX)
+    return unless matches.length == 1
 
-    scopes.to_s[SCOPED_USER_REGEX, 1]&.to_i
+    matches[0][SCOPED_USER_REGEX, 1].to_i
   end
 end
diff --git a/app/services/groups/transfer_service.rb b/app/services/groups/transfer_service.rb
index 6dcdb8b8f33..a89b8fab6af 100644
--- a/app/services/groups/transfer_service.rb
+++ b/app/services/groups/transfer_service.rb
@@ -123,7 +123,16 @@ module Groups
     def group_with_namespaced_npm_packages?
       return false unless group.packages_feature_enabled?
 
-      npm_packages = ::Packages::GroupPackagesFinder.new(current_user, group, package_type: :npm, preload_pipelines: false).execute
+      npm_packages = if Feature.enabled?(:npm_extract_npm_package_model, Feature.current_request)
+                       ::Packages::GroupPackagesFinder
+                         .new(current_user, group, packages_class: ::Packages::Npm::Package, preload_pipelines: false)
+                         .execute
+                     else
+                       ::Packages::GroupPackagesFinder
+                         .new(current_user, group, package_type: :npm, preload_pipelines: false)
+                         .execute
+                     end
+
       npm_packages = npm_packages.with_npm_scope(group.root_ancestor.path)
 
       different_root_ancestor? && npm_packages.exists?
diff --git a/app/services/groups/update_service.rb b/app/services/groups/update_service.rb
index e2d75acc30e..6883ec0fe0d 100644
--- a/app/services/groups/update_service.rb
+++ b/app/services/groups/update_service.rb
@@ -78,9 +78,17 @@ module Groups
 
       # we have a path change on a root group:
       # check that we don't have any npm package with a scope set to the group path
-      npm_packages = ::Packages::GroupPackagesFinder.new(current_user, group, package_type: :npm, preload_pipelines: false)
-                       .execute
-                       .with_npm_scope(group.path)
+      npm_packages = if Feature.enabled?(:npm_extract_npm_package_model, Feature.current_request)
+                       ::Packages::GroupPackagesFinder
+                         .new(current_user, group, packages_class: ::Packages::Npm::Package, preload_pipelines: false)
+                         .execute
+                         .with_npm_scope(group.path)
+                     else
+                       ::Packages::GroupPackagesFinder
+                         .new(current_user, group, package_type: :npm, preload_pipelines: false)
+                         .execute
+                         .with_npm_scope(group.path)
+                     end
 
       return true unless npm_packages.exists?
 
diff --git a/app/services/import/reassign_placeholder_user_records_service.rb b/app/services/import/reassign_placeholder_user_records_service.rb
index 0d653a49e81..4e76ffff21b 100644
--- a/app/services/import/reassign_placeholder_user_records_service.rb
+++ b/app/services/import/reassign_placeholder_user_records_service.rb
@@ -6,7 +6,16 @@ module Import
     MEMBER_DELETE_BATCH_SIZE = 1_000
     GROUP_FINDER_MEMBER_RELATIONS = %i[direct inherited shared_from_groups].freeze
     PROJECT_FINDER_MEMBER_RELATIONS = %i[direct inherited invited_groups shared_into_ancestors].freeze
-    RELATION_BATCH_SLEEP = 5
+    RELATION_BATCH_SLEEP = 5 # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/504995
+    DATABASE_TABLE_HEALTH_INDICATORS = [Gitlab::Database::HealthStatus::Indicators::AutovacuumActiveOnTable].freeze
+    GLOBAL_DATABASE_HEALTH_INDICATORS = [
+      Gitlab::Database::HealthStatus::Indicators::WriteAheadLog,
+      Gitlab::Database::HealthStatus::Indicators::PatroniApdex,
+      Gitlab::Database::HealthStatus::Indicators::WalReceiverSaturation
+    ].freeze
+
+    DatabaseHealthStatusChecker = Struct.new(:id, :job_class_name)
+    DatabaseHealthError = Class.new(StandardError)
 
     def initialize(import_source_user)
       @import_source_user = import_source_user
@@ -18,16 +27,32 @@ module Import
       return unless import_source_user.reassignment_in_progress?
 
       warn_about_any_risky_reassignments
-      reassign_placeholder_references
 
       log_warn('Reassigned by user was not found, this may affect membership checks') unless reassigned_by_user
 
-      create_memberships
-      delete_placeholder_memberships
+      begin
+        reassign_placeholder_references
+
+        if placeholder_memberships.any?
+          db_table_health_check!(Member) if Feature.enabled?(:reassignment_throttling, reassigned_by_user)
+
+          create_memberships
+          delete_placeholder_memberships
+        end
+      rescue DatabaseHealthError => error
+        log_warn("#{error.message}. Rescheduling reassignment")
+
+        return reschedule_reassignment_response
+      end
 
       UserProjectAccessChangedService.new(import_source_user.reassign_to_user_id).execute if project_membership_created?
 
       import_source_user.complete!
+
+      ServiceResponse.success(
+        message: s_('Import|Placeholder user record reassignment complete'),
+        payload: import_source_user
+      )
     end
 
     private
@@ -73,10 +98,15 @@ module Import
           user_reference_column: reference_group.user_reference_column,
           alias_version: reference_group.alias_version
         ) do |model_relation, placeholder_references|
+          if Feature.enabled?(:reassignment_throttling, reassigned_by_user)
+            db_table_health_check!(model_relation)
+            db_health_check!
+          end
+
           reassign_placeholder_records_batch(model_relation, placeholder_references)
 
-          # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/493977
-          Kernel.sleep RELATION_BATCH_SLEEP
+          # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/504995
+          Kernel.sleep RELATION_BATCH_SLEEP unless Feature.enabled?(:reassignment_throttling, reassigned_by_user)
         end
       rescue Import::PlaceholderReferences::AliasResolver::MissingAlias => e
         ::Import::Framework::Logger.error(
@@ -202,6 +232,47 @@ module Import
       @project_membership_created == true
     end
 
+    def db_table_health_check!(model)
+      health_context = Gitlab::Database::HealthStatus::Context.new(
+        DatabaseHealthStatusChecker.new(import_source_user.id, self.class.name),
+        nil,
+        [model.table_name],
+        nil
+      )
+
+      stop_signal = Gitlab::Database::HealthStatus
+        .evaluate(health_context, DATABASE_TABLE_HEALTH_INDICATORS).any?(&:stop?)
+
+      raise DatabaseHealthError, "#{model.table_name} table unhealthy" if stop_signal
+    end
+
+    def db_health_check!
+      stop_signal = Rails.cache.fetch("reassign_placeholder_user_records_service_db_check", expires_in: 30.seconds) do
+        gitlab_schema = :gitlab_main
+
+        health_context = Gitlab::Database::HealthStatus::Context.new(
+          DatabaseHealthStatusChecker.new(import_source_user.id, self.class.name),
+          Gitlab::Database.schemas_to_base_models[gitlab_schema].first,
+          nil,
+          gitlab_schema
+        )
+
+        Gitlab::Database::HealthStatus
+          .evaluate(health_context, GLOBAL_DATABASE_HEALTH_INDICATORS).any?(&:stop?)
+      end
+
+      raise DatabaseHealthError, "Database unhealthy" if stop_signal
+    end
+
+    def reschedule_reassignment_response
+      ServiceResponse.new(
+        status: :ok,
+        message: s_('Import|Rescheduling placeholder user records reassignment: database health'),
+        payload: import_source_user,
+        reason: :db_health_check_failed
+      )
+    end
+
     def log_create_membership_skipped(message, placeholder_membership, existing_membership)
       log_info(
         message,
diff --git a/app/services/packages/mark_package_for_destruction_service.rb b/app/services/packages/mark_package_for_destruction_service.rb
index b41f1c0a291..cb7fd2826c8 100644
--- a/app/services/packages/mark_package_for_destruction_service.rb
+++ b/app/services/packages/mark_package_for_destruction_service.rb
@@ -11,7 +11,7 @@ module Packages
 
       package.mark_package_files_for_destruction
       package.sync_maven_metadata(current_user)
-      package.sync_npm_metadata_cache
+      package.sync_npm_metadata_cache if package.npm?
 
       service_response_success('Package was successfully marked as pending destruction')
     rescue StandardError => e
diff --git a/app/views/admin/application_settings/general.html.haml b/app/views/admin/application_settings/general.html.haml
index bf08a03e84d..ac730b0ad56 100644
--- a/app/views/admin/application_settings/general.html.haml
+++ b/app/views/admin/application_settings/general.html.haml
@@ -34,6 +34,8 @@
   - c.with_body do
     = render 'import_and_export'
 
+= render_if_exists 'admin/application_settings/integrations_settings'
+
 = render ::Layouts::SettingsBlockComponent.new(_('Diff limits'),
   id: 'js-merge-request-settings',
   expanded: expanded_by_default?) do |c|
diff --git a/app/views/ci/status/_icon.html.haml b/app/views/ci/status/_icon.html.haml
index bcb83874bfb..6770cdc707d 100644
--- a/app/views/ci/status/_icon.html.haml
+++ b/app/views/ci/status/_icon.html.haml
@@ -1,7 +1,6 @@
 - status             = local_assigns.fetch(:status)
 - path               = local_assigns.fetch(:path, status.has_details? ? status.details_path : nil)
 - tooltip_placement  = local_assigns.fetch(:tooltip_placement, "left")
-- option_css_classes = local_assigns.fetch(:option_css_classes, nil)
 - show_status_text   = local_assigns.fetch(:show_status_text, false)
 
-= render_ci_icon(status, path, tooltip_placement: tooltip_placement, option_css_classes: option_css_classes, show_status_text: show_status_text)
+= render_ci_icon(status, path, tooltip_placement: tooltip_placement, show_status_text: show_status_text)
diff --git a/app/views/projects/commits/_commit.html.haml b/app/views/projects/commits/_commit.html.haml
index 5c49188e244..ddc781f4e48 100644
--- a/app/views/projects/commits/_commit.html.haml
+++ b/app/views/projects/commits/_commit.html.haml
@@ -30,9 +30,9 @@
     = author_avatar(commit, size: 32, has_tooltip: false, css_class: 'gl-inline-block')
 
   .commit-detail.flex-list.gl-flex.gl-justify-between.gl-items-start.gl-grow.gl-min-w-0.gl-mb-3
-    .commit-content{ data: { testid: 'commit-content' } }
+    .commit-content.gl-self-center{ data: { testid: 'commit-content' } }
       - if is_blob_page
-        .gl-flex.sm:gl-hidden.gl-gap-4.gl-pt-3
+        .gl-flex.sm:gl-hidden.gl-gap-3.gl-items-center
           .committer.gl-text-sm
             - commit_authored_timeago = time_ago_with_tooltip(commit.authored_date, placement: 'bottom')
             = commit_authored_timeago.html_safe
@@ -57,8 +57,8 @@
           %pre{ class: ["commit-row-description gl-whitespace-pre-wrap", (collapsible ? "js-toggle-content" : "!gl-block")] }
             = preserve(markdown_field(commit, :description))
 
-    .commit-actions.gl-flex.gl-items-center
-      %div{ class: is_blob_page ? "gl-hidden sm:gl-flex gl-items-center": "gl-block" }
+    .commit-actions.gl-flex.gl-items-center.gl-gap-3
+      %div{ class: is_blob_page ? "gl-hidden sm:gl-flex gl-items-center gl-gap-3": "gl-flex gl-items-center gl-gap-3" }
         - if tags.present?
           = gl_badge_tag(variant: :neutral, icon: 'tag', class: 'gl-font-monospace') do
             - if tags.size > 1
@@ -80,10 +80,9 @@
           = link_to_browse_code(project, commit)
 
       - if is_blob_page
-        .gl-block.sm:gl-hidden.gl-pt-3
+        .gl-block.sm:gl-hidden
           = render Pajamas::ButtonComponent.new(icon: 'ellipsis_h', button_options: { class: 'button-ellipsis-horizontal text-expander js-toggle-button', data: { toggle: 'tooltip', container: 'body', collapse_title: toggle_commit_message, expand_title: toggle_commit_message }, title: toggle_commit_message, aria: { label: toggle_commit_message }})
-        .gl-pt-3.sm:gl-pt-0
-          #js-commit-history-link{ data: { history_link: project_commits_path(@project, @id, ref_type: @ref_type), event_tracking: 'click_history_control_on_blob_page' } }
+        #js-commit-history-link{ data: { history_link: project_commits_path(@project, @id, ref_type: @ref_type), event_tracking: 'click_history_control_on_blob_page' } }
 
   - if is_blob_page
     .gl-block.sm:gl-hidden
diff --git a/app/views/user_settings/personal_access_tokens/index.html.haml b/app/views/user_settings/personal_access_tokens/index.html.haml
index 6557bba3286..fab7bd8fe6f 100644
--- a/app/views/user_settings/personal_access_tokens/index.html.haml
+++ b/app/views/user_settings/personal_access_tokens/index.html.haml
@@ -15,7 +15,7 @@
     = render ::Layouts::CrudComponent.new(_('Active personal access tokens'),
       icon: 'token',
       count: @active_access_tokens_size,
-      count_options: { class: 'js-token-count' },
+      count_options: { class: 'js-token-count', data: { testid: 'active-token-count' } },
       toggle_text: _('Add new token'),
       toggle_options: { data: { testid: 'add-new-token-button' } },
       form_options: { class: 'js-add-new-token-form' },
diff --git a/app/workers/import/reassign_placeholder_user_records_worker.rb b/app/workers/import/reassign_placeholder_user_records_worker.rb
index 43947e827fc..f3e38fb6c5e 100644
--- a/app/workers/import/reassign_placeholder_user_records_worker.rb
+++ b/app/workers/import/reassign_placeholder_user_records_worker.rb
@@ -5,6 +5,8 @@ module Import
     include ApplicationWorker
     include Gitlab::Utils::StrongMemoize
 
+    BACKOFF_PERIOD = 1.minute.freeze
+
     idempotent!
     data_consistency :sticky
     feature_category :importers
@@ -12,19 +14,23 @@ module Import
     sidekiq_options retry: 5, dead: false
     sidekiq_options max_retries_after_interruption: 20
 
-    # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/493977
+    # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/504995
     concurrency_limit -> { 4 }
 
     sidekiq_retries_exhausted do |msg, exception|
       new.perform_failure(exception, msg['args'])
     end
 
-    def perform(import_source_user_id, _params = {})
+    def perform(import_source_user_id, params = {})
       @import_source_user = Import::SourceUser.find_by_id(import_source_user_id)
-
       return unless import_source_user_valid?
 
-      Import::ReassignPlaceholderUserRecordsService.new(import_source_user).execute
+      response = Import::ReassignPlaceholderUserRecordsService.new(import_source_user).execute
+
+      if response&.reason == :db_health_check_failed
+        return self.class.perform_in(BACKOFF_PERIOD, import_source_user.id, params)
+      end
+
       Import::DeletePlaceholderUserWorker.perform_async(import_source_user.id)
     end
 
diff --git a/config/feature_flags/wip/bulk_import_importer_user_mapping.yml b/config/feature_flags/beta/bulk_import_importer_user_mapping.yml
similarity index 90%
rename from config/feature_flags/wip/bulk_import_importer_user_mapping.yml
rename to config/feature_flags/beta/bulk_import_importer_user_mapping.yml
index dd1a9935a4f..fd905948319 100644
--- a/config/feature_flags/wip/bulk_import_importer_user_mapping.yml
+++ b/config/feature_flags/beta/bulk_import_importer_user_mapping.yml
@@ -5,5 +5,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/160650
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/478054
 milestone: '17.3'
 group: group::import and integrate
-type: wip
-default_enabled: false
+type: beta
+default_enabled: true
diff --git a/config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml b/config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml
new file mode 100644
index 00000000000..e2a20884d4c
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/fix_graphql_csrf.yml
@@ -0,0 +1,9 @@
+---
+name: fix_graphql_csrf
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/379326
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173972
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/508617
+milestone: '17.7'
+group: group::project management
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/config/feature_flags/gitlab_com_derisk/reassignment_throttling.yml b/config/feature_flags/gitlab_com_derisk/reassignment_throttling.yml
new file mode 100644
index 00000000000..b8e83a49bf1
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/reassignment_throttling.yml
@@ -0,0 +1,9 @@
+---
+name: reassignment_throttling
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/493977
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173292
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/504995
+milestone: '17.7'
+group: group::import and integrate
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/config/feature_flags/wip/populate_and_use_build_source_table.yml b/config/feature_flags/wip/populate_and_use_build_source_table.yml
new file mode 100644
index 00000000000..9fa2410b9c9
--- /dev/null
+++ b/config/feature_flags/wip/populate_and_use_build_source_table.yml
@@ -0,0 +1,9 @@
+---
+name: populate_and_use_build_source_table
+feature_issue_url: https://gitlab.com/groups/gitlab-org/-/epics/11796
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170899
+rollout_issue_url:
+milestone: '17.7'
+group: group::security policies
+type: wip
+default_enabled: false
diff --git a/db/docs/batched_background_migrations/backfill_resource_link_events.yml b/db/docs/batched_background_migrations/backfill_resource_link_events.yml
index 578f2c3e406..558a966ead3 100644
--- a/db/docs/batched_background_migrations/backfill_resource_link_events.yml
+++ b/db/docs/batched_background_migrations/backfill_resource_link_events.yml
@@ -5,4 +5,4 @@ description: Backfills resource_link_events table based off system_note_metadata
 feature_category: team_planning
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/118605
 milestone: '16.1'
-finalized_by: '20241205232318'
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/software_licenses.yml b/db/docs/software_licenses.yml
index 4a58a9117f1..e7ee10ce55e 100644
--- a/db/docs/software_licenses.yml
+++ b/db/docs/software_licenses.yml
@@ -9,5 +9,4 @@ description: Normalized software licenses to use in conjunction with License Com
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/6246
 milestone: '11.2'
 gitlab_schema: gitlab_main_cell
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/480578
 table_size: small
diff --git a/db/migrate/20241201092435_add_index_to_build_sources.rb b/db/migrate/20241201092435_add_index_to_build_sources.rb
new file mode 100644
index 00000000000..1fa5b97abc7
--- /dev/null
+++ b/db/migrate/20241201092435_add_index_to_build_sources.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class AddIndexToBuildSources < Gitlab::Database::Migration[2.2]
+  include Gitlab::Database::PartitioningMigrationHelpers
+
+  milestone '17.7'
+  disable_ddl_transaction!
+
+  TABLE_NAME = :p_ci_build_sources
+  INDEX_NAME = :index_p_ci_build_sources_on_search_columns
+  COLUMNS = %i[project_id source build_id partition_id]
+
+  def up
+    add_concurrent_partitioned_index(TABLE_NAME, COLUMNS, name: INDEX_NAME)
+  end
+
+  def down
+    remove_concurrent_partitioned_index_by_name(TABLE_NAME, INDEX_NAME)
+  end
+end
diff --git a/db/post_migrate/20241205232318_finalize_backfill_resource_link_events.rb b/db/post_migrate/20241205232318_finalize_backfill_resource_link_events.rb
index a5038d42830..a76c74cc958 100644
--- a/db/post_migrate/20241205232318_finalize_backfill_resource_link_events.rb
+++ b/db/post_migrate/20241205232318_finalize_backfill_resource_link_events.rb
@@ -8,13 +8,8 @@ class FinalizeBackfillResourceLinkEvents < Gitlab::Database::Migration[2.2]
   restrict_gitlab_migration gitlab_schema: :gitlab_main
 
   def up
-    ensure_batched_background_migration_is_finished(
-      job_class_name: 'BackfillResourceLinkEvents',
-      table_name: :resource_link_events,
-      column_name: :id,
-      job_arguments: [:namespace_id, :issues, :namespace_id, :issue_id],
-      finalize: true
-    )
+    # no-op
+    # See details: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/174621#note_2250503192
   end
 
   def down; end
diff --git a/db/schema_migrations/20241201092435 b/db/schema_migrations/20241201092435
new file mode 100644
index 00000000000..ee8c29a975e
--- /dev/null
+++ b/db/schema_migrations/20241201092435
@@ -0,0 +1 @@
+8794d04a370d7f8e310158310d903f75c641b61843bec74820e3f283aec24d1b
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index a442d68c6e3..ba050cfcf52 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -31804,6 +31804,8 @@ CREATE INDEX index_p_ci_build_sources_on_pipeline_source ON ONLY p_ci_build_sour
 
 CREATE INDEX index_p_ci_build_sources_on_project_id_and_build_id ON ONLY p_ci_build_sources USING btree (project_id, build_id);
 
+CREATE INDEX index_p_ci_build_sources_on_search_columns ON ONLY p_ci_build_sources USING btree (project_id, source, build_id, partition_id);
+
 CREATE INDEX index_p_ci_build_tags_on_build_id_and_partition_id ON ONLY p_ci_build_tags USING btree (build_id, partition_id);
 
 CREATE INDEX index_p_ci_build_tags_on_project_id ON ONLY p_ci_build_tags USING btree (project_id);
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index d7566d7dd6b..b1a6800021c 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -32309,6 +32309,7 @@ four standard [pagination arguments](#pagination-arguments):
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="projectjobsname"></a>`name` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 17.1. **Status**: Experiment. Filter jobs by name. |
+| <a id="projectjobssources"></a>`sources` **{warning-solid}** | [`[CiJobSource!]`](#cijobsource) | **Introduced** in GitLab 17.7. **Status**: Experiment. Filter jobs by source. Ignored if 'populate_and_use_build_source_table' feature flag is disabled. |
 | <a id="projectjobsstatuses"></a>`statuses` | [`[CiJobStatus!]`](#cijobstatus) | Filter jobs by status. |
 | <a id="projectjobswithartifacts"></a>`withArtifacts` | [`Boolean`](#boolean) | Filter by artifacts presence. |
 
@@ -34558,7 +34559,7 @@ JSON structure of a file with matches.
 | <a id="searchblobfiletypeblameurl"></a>`blameUrl` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 17.2. **Status**: Experiment. Blame URL of the file. |
 | <a id="searchblobfiletypechunks"></a>`chunks` **{warning-solid}** | [`[SearchBlobChunk!]`](#searchblobchunk) | **Introduced** in GitLab 17.2. **Status**: Experiment. Maximum matches per file. |
 | <a id="searchblobfiletypefileurl"></a>`fileUrl` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 17.2. **Status**: Experiment. URL of the file. |
-| <a id="searchblobfiletypematchcount"></a>`matchCount` **{warning-solid}** | [`Int`](#int) | **Introduced** in GitLab 17.2. **Status**: Experiment. Matches per file in maximum 50 chunks. |
+| <a id="searchblobfiletypematchcount"></a>`matchCount` **{warning-solid}** | [`Int`](#int) | **Introduced** in GitLab 17.2. **Status**: Experiment. Matches per file up to a max of 50 chunks. Default is 3. |
 | <a id="searchblobfiletypematchcounttotal"></a>`matchCountTotal` **{warning-solid}** | [`Int`](#int) | **Introduced** in GitLab 17.2. **Status**: Experiment. Total number of matches per file. |
 | <a id="searchblobfiletypepath"></a>`path` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 17.2. **Status**: Experiment. Path of the file. |
 | <a id="searchblobfiletypeprojectpath"></a>`projectPath` **{warning-solid}** | [`String`](#string) | **Introduced** in GitLab 17.2. **Status**: Experiment. Full path of the project. |
@@ -38227,6 +38228,31 @@ Values for sorting inherited variables.
 | <a id="cijobkindbridge"></a>`BRIDGE` | Bridge CI job connecting a parent and child pipeline. |
 | <a id="cijobkindbuild"></a>`BUILD` | Standard CI job. |
 
+### `CiJobSource`
+
+| Value | Description |
+| ----- | ----------- |
+| <a id="cijobsourceapi"></a>`API` | A job initiated by api. |
+| <a id="cijobsourcechat"></a>`CHAT` | A job initiated by chat. |
+| <a id="cijobsourcecontainer_registry_push"></a>`CONTAINER_REGISTRY_PUSH` | A job initiated by container registry push. |
+| <a id="cijobsourceduo_workflow"></a>`DUO_WORKFLOW` | A job initiated by duo workflow. |
+| <a id="cijobsourceexternal"></a>`EXTERNAL` | A job initiated by external. |
+| <a id="cijobsourceexternal_pull_request_event"></a>`EXTERNAL_PULL_REQUEST_EVENT` | A job initiated by external pull request event. |
+| <a id="cijobsourcemerge_request_event"></a>`MERGE_REQUEST_EVENT` | A job initiated by merge request event. |
+| <a id="cijobsourceondemand_dast_scan"></a>`ONDEMAND_DAST_SCAN` | A job initiated by ondemand dast scan. |
+| <a id="cijobsourceondemand_dast_validation"></a>`ONDEMAND_DAST_VALIDATION` | A job initiated by ondemand dast validation. |
+| <a id="cijobsourceparent_pipeline"></a>`PARENT_PIPELINE` | A job initiated by parent pipeline. |
+| <a id="cijobsourcepipeline"></a>`PIPELINE` | A job initiated by pipeline. |
+| <a id="cijobsourcepipeline_execution_policy"></a>`PIPELINE_EXECUTION_POLICY` | A job initiated by pipeline execution policy. |
+| <a id="cijobsourcepush"></a>`PUSH` | A job initiated by push. |
+| <a id="cijobsourcescan_execution_policy"></a>`SCAN_EXECUTION_POLICY` | A job initiated by scan execution policy. |
+| <a id="cijobsourceschedule"></a>`SCHEDULE` | A job initiated by schedule. |
+| <a id="cijobsourcesecurity_orchestration_policy"></a>`SECURITY_ORCHESTRATION_POLICY` | A job initiated by security orchestration policy. |
+| <a id="cijobsourcetrigger"></a>`TRIGGER` | A job initiated by trigger. |
+| <a id="cijobsourceunknown"></a>`UNKNOWN` | A job initiated by unknown. |
+| <a id="cijobsourceweb"></a>`WEB` | A job initiated by web. |
+| <a id="cijobsourcewebide"></a>`WEBIDE` | A job initiated by webide. |
+
 ### `CiJobStatus`
 
 | Value | Description |
diff --git a/doc/api/group_security_settings.md b/doc/api/group_security_settings.md
new file mode 100644
index 00000000000..e8f00ed5024
--- /dev/null
+++ b/doc/api/group_security_settings.md
@@ -0,0 +1,44 @@
+---
+stage: Secure
+group: Secret Detection
+info: "To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments"
+---
+
+# Group security settings API
+
+DETAILS:
+**Tier:** Ultimate
+**Offering:** GitLab.com, Self-managed, GitLab Dedicated
+
+Every API call to group security settings must be [authenticated](rest/authentication.md).
+
+If a user isn't a member of a private group, requests to the private group return a `404 Not Found` status code.
+
+## Update `secret_push_protection_enabled` setting
+
+Update the `secret_push_protection_enabled` setting for the all projects in a group to the provided value.
+
+Set to `true` to enable [secret push protection](../user/application_security/secret_detection/secret_push_protection/index.md) for the all projects in the group.
+
+Prerequisites:
+
+- You must have at least the Maintainer role for the group.
+
+| Attribute           | Type              | Required   | Description                                                                                                                  |
+| ------------------- | ----------------- | ---------- | -----------------------------------------------------------------------------------------------------------------------------|
+| `id`                | integer or string | yes        | The ID or [URL-encoded path of the group](rest/index.md#namespaced-paths) which the authenticated user is a member of  |
+| `secret_push_protection_enabled`        | boolean | yes        | Whether secret push protection is enabled for the group. |
+| `projects_to_exclude`        | array of integers | no        | The IDs of projects to exclude from the feature.  |
+
+```shell
+curl --header PUT "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/groups/7/security_settings?secret_push_protection_enabled=true&projects_to_exclude=1,2,3"
+```
+
+Example response:
+
+```json
+{
+  "secret_push_protection_enabled": true,
+  "errors": []
+}
+```
diff --git a/doc/api/notes.md b/doc/api/notes.md
index ee687a10336..ec3ad107851 100644
--- a/doc/api/notes.md
+++ b/doc/api/notes.md
@@ -433,6 +433,11 @@ Parameters:
 | `internal`                    | boolean           | no       | The internal flag of a note. Default is false. |
 | `merge_request_diff_head_sha` | string            | no       | Required for the `/merge` [quick action](../user/project/quick_actions.md). The SHA of the head commit, which ensures the merge request wasn't updated after the API request was sent. |
 
+```shell
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
+  --url "https://gitlab.example.com/api/v4/projects/5/merge_requests/11/notes?body=note"
+```
+
 ### Modify existing merge request note
 
 Modify existing note of a merge request.
diff --git a/doc/ci/yaml/artifacts_reports.md b/doc/ci/yaml/artifacts_reports.md
index 00579c40db1..cccb62f0318 100644
--- a/doc/ci/yaml/artifacts_reports.md
+++ b/doc/ci/yaml/artifacts_reports.md
@@ -272,7 +272,7 @@ The exceptions to the [original dotenv rules](https://github.com/motdotla/dotenv
   This limit [can be changed on self-managed instances](../../administration/instance_limits.md#limit-dotenv-file-size).
 - On GitLab.com, [the maximum number of inherited variables](../../user/gitlab_com/index.md#gitlab-cicd)
   is 50 for Free, 100 for Premium and 150 for Ultimate. The default for
-  self-managed instances is 150, and can be changed by changing the
+  self-managed instances is 20, and can be changed by changing the
   `dotenv_variables` [application limit](../../administration/instance_limits.md#limit-dotenv-variables).
 - Variable substitution in the `.env` file is not supported.
 - [Multiline values in the `.env` file](https://github.com/motdotla/dotenv#multiline-values) are not supported.
diff --git a/doc/user/application_security/vulnerabilities/index.md b/doc/user/application_security/vulnerabilities/index.md
index cb60d8e9952..b854a21d51b 100644
--- a/doc/user/application_security/vulnerabilities/index.md
+++ b/doc/user/application_security/vulnerabilities/index.md
@@ -231,7 +231,8 @@ DETAILS:
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
 **Status:** Beta
 
-> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/10779) in GitLab 17.6. This is a [beta](../../../policy/development_stages_support.md#beta) feature.
+> [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/14862) in GitLab 17.6 with a flag named [`resolve_vulnerability_in_mr`](https://gitlab.com/gitlab-org/gitlab/-/issues/482753). Disabled by default.
+> [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175150) in GitLab 17.7.
 
 Use GitLab Duo Vulnerability resolution to automatically create a merge request suggestion comment that
 resolves the vulnerability finding. By default, it is powered by the Anthropic [`claude-3.5-sonnet`](https://console.cloud.google.com/vertex-ai/publishers/anthropic/model-garden/claude-3-5-sonnet) model.
diff --git a/lib/api/npm_project_packages.rb b/lib/api/npm_project_packages.rb
index 8ec9e3631a5..ab309f13553 100644
--- a/lib/api/npm_project_packages.rb
+++ b/lib/api/npm_project_packages.rb
@@ -64,8 +64,14 @@ module API
       get '*package_name/-/*file_name', format: false do
         authorize_read_package!(project)
 
-        package = project.packages.npm
-          .by_name_and_file_name(params[:package_name], params[:file_name])
+        package = if Feature.enabled?(:npm_extract_npm_package_model, Feature.current_request)
+                    ::Packages::Npm::Package
+                      .for_projects(project)
+                      .by_name_and_file_name(params[:package_name], params[:file_name])
+                  else
+                    project.packages.npm
+                      .by_name_and_file_name(params[:package_name], params[:file_name])
+                  end
 
         not_found!('Package') unless package
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 6cc5ed9ebc4..07df8883660 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1706,6 +1706,9 @@ msgid_plural "+%d more"
 msgstr[0] ""
 msgstr[1] ""
 
+msgid "+%{count} more"
+msgstr ""
+
 msgid "+%{more_assignees_count}"
 msgstr ""
 
@@ -4043,12 +4046,18 @@ msgstr ""
 msgid "AdminSettings|All new projects can use instance runners by default."
 msgstr ""
 
+msgid "AdminSettings|Allow all integrations"
+msgstr ""
+
 msgid "AdminSettings|Allow contribution mapping to administrators %{allow_contribution_mapping_to_admins_link_start}%{icon}%{allow_contribution_mapping_to_admins_link_end}"
 msgstr ""
 
 msgid "AdminSettings|Allow migrating GitLab groups and projects by direct transfer"
 msgstr ""
 
+msgid "AdminSettings|Allow only integrations on this allowlist"
+msgstr ""
+
 msgid "AdminSettings|Allow runner registration token"
 msgstr ""
 
@@ -4220,6 +4229,9 @@ msgstr ""
 msgid "AdminSettings|Instance runners expiration"
 msgstr ""
 
+msgid "AdminSettings|Integration settings"
+msgstr ""
+
 msgid "AdminSettings|Keep the latest artifacts for all jobs in the latest successful pipelines"
 msgstr ""
 
@@ -4232,6 +4244,9 @@ msgstr ""
 msgid "AdminSettings|Make new users' profiles private by default"
 msgstr ""
 
+msgid "AdminSettings|Manage which integrations can be enabled on this instance."
+msgstr ""
+
 msgid "AdminSettings|Maximum downstream pipeline trigger rate"
 msgstr ""
 
@@ -28650,6 +28665,12 @@ msgstr ""
 msgid "Import|Partially completed"
 msgstr ""
 
+msgid "Import|Placeholder user record reassignment complete"
+msgstr ""
+
+msgid "Import|Rescheduling placeholder user records reassignment: database health"
+msgstr ""
+
 msgid "Import|Show errors"
 msgstr ""
 
@@ -50938,6 +50959,9 @@ msgstr ""
 msgid "SecurityReports|All tools"
 msgstr ""
 
+msgid "SecurityReports|CVSS v%{version}:"
+msgstr ""
+
 msgid "SecurityReports|Change status"
 msgstr ""
 
@@ -51013,6 +51037,9 @@ msgstr ""
 msgid "SecurityReports|Download scanned URLs"
 msgstr ""
 
+msgid "SecurityReports|EPSS:"
+msgstr ""
+
 msgid "SecurityReports|Edit dismissal"
 msgstr ""
 
@@ -51079,6 +51106,9 @@ msgstr ""
 msgid "SecurityReports|Issues created from a vulnerability cannot be removed."
 msgstr ""
 
+msgid "SecurityReports|KEV:"
+msgstr ""
+
 msgid "SecurityReports|Learn more about security configuration"
 msgstr ""
 
diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index 2edd4d88b9c..b5216d11950 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -1139,6 +1139,19 @@ RSpec.describe ApplicationController, feature_category: :shared do
           .to raise_error(ActionController::InvalidAuthenticityToken)
       end
     end
+
+    controller(described_class) do
+      self.allow_forgery_protection = true
+      skip_before_action :authenticate_user!
+
+      def create; end
+    end
+
+    it 'returns a 403' do
+      post :create
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+    end
   end
 
   describe '#after_sign_in_path_for' do
diff --git a/spec/factories/ci/builds.rb b/spec/factories/ci/builds.rb
index a985e642484..61a6dac291e 100644
--- a/spec/factories/ci/builds.rb
+++ b/spec/factories/ci/builds.rb
@@ -57,6 +57,12 @@ FactoryBot.define do
       end
     end
 
+    trait :with_build_source do
+      after(:create) do |build, _|
+        create(:ci_build_source, build: build)
+      end
+    end
+
     trait :degenerated do
       options { nil }
       yaml_variables { nil }
diff --git a/spec/features/user_settings/personal_access_tokens_spec.rb b/spec/features/user_settings/personal_access_tokens_spec.rb
index 22ba1157c5c..a8d6bda2100 100644
--- a/spec/features/user_settings/personal_access_tokens_spec.rb
+++ b/spec/features/user_settings/personal_access_tokens_spec.rb
@@ -24,6 +24,8 @@ RSpec.describe 'User Settings > Personal access tokens', :js, feature_category:
 
       visit user_settings_personal_access_tokens_path
 
+      expect(active_access_tokens_counter).to have_text('0')
+
       click_button 'Add new token'
       fill_in "Token name", with: name
 
@@ -47,6 +49,7 @@ RSpec.describe 'User Settings > Personal access tokens', :js, feature_category:
       expect(active_access_tokens).to have_text('read_api')
       expect(active_access_tokens).to have_text('read_user')
       expect(created_access_token).to match(/[\w-]{20}/)
+      expect(active_access_tokens_counter).to have_text('1')
     end
 
     context "when creation fails" do
@@ -126,11 +129,13 @@ RSpec.describe 'User Settings > Personal access tokens', :js, feature_category:
 
     it "displays the newly created token" do
       visit user_settings_personal_access_tokens_path
+      expect(active_access_tokens_counter).to have_text('1')
       accept_gl_confirm(button_text: s_('AccessTokens|Rotate')) { click_on s_('AccessTokens|Rotate') }
       wait_for_all_requests
       expect(page).to have_content("Your new personal access token has been created.")
       expect(active_access_tokens).to have_text(personal_access_token.name)
       expect(created_access_token).to match(/[\w-]{20}/)
+      expect(active_access_tokens_counter).to have_text('1')
     end
 
     context "when rotation fails" do
diff --git a/spec/finders/ci/build_source_finder_spec.rb b/spec/finders/ci/build_source_finder_spec.rb
new file mode 100644
index 00000000000..0f1a76bf002
--- /dev/null
+++ b/spec/finders/ci/build_source_finder_spec.rb
@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Ci::BuildSourceFinder, feature_category: :continuous_integration do
+  let_it_be(:pipeline) { create(:ci_pipeline, source: "push") }
+
+  let_it_be(:build_non_relevant) { create(:ci_build, pipeline: pipeline, name: "unique-name") }
+  let_it_be(:old_build) { create(:ci_build, pipeline: pipeline, name: "build1") }
+  let_it_be(:old_middle_build) { create(:ci_build, pipeline: pipeline, name: "build2") }
+  let_it_be(:middle_build) { create(:ci_build, pipeline: pipeline, name: "build3") }
+  let_it_be(:middle_new_build) { create(:ci_build, pipeline: pipeline, name: "build4") }
+  let_it_be(:new_build) { create(:ci_build, pipeline: pipeline, name: "build5") }
+
+  let_it_be(:old_build_source) { create(:ci_build_source, build: old_build, source: :scan_execution_policy) }
+  let_it_be(:old_middle_build_source) { create(:ci_build_source, build: old_middle_build, source: :trigger) }
+  let_it_be(:middle_build_source) { create(:ci_build_source, build: middle_build, source: :scan_execution_policy) }
+  let_it_be(:middle_new_build_source) { create(:ci_build_source, build: middle_new_build, source: :push) }
+  let_it_be(:new_build_source) { create(:ci_build_source, build: new_build, source: :scan_execution_policy) }
+
+  describe "#execute" do
+    let(:main_relation) { Ci::Build.all }
+    let(:sources) { ["scan_execution_policy"] }
+    let(:cursor_id) { nil }
+
+    subject(:build_source_finder) do
+      described_class.new(
+        relation: main_relation,
+        sources: sources,
+        project: pipeline.project,
+        params: {
+          cursor_id: cursor_id
+        }
+      ).execute
+    end
+
+    it 'filters by source in desc order' do
+      expect(build_source_finder)
+        .to eq([new_build, middle_build, old_build])
+    end
+
+    context 'when no source is passed in' do
+      let(:sources) { [] }
+
+      it 'does not filter by source' do
+        expect(build_source_finder.count).to eq(6)
+      end
+    end
+
+    context 'with multiple source query' do
+      let(:sources) { %w[scan_execution_policy push] }
+
+      it 'returns builds from any of the given sources' do
+        expect(build_source_finder)
+          .to eq([new_build, middle_new_build, middle_build, old_build])
+      end
+    end
+
+    describe 'argument errors' do
+      context 'when relation is not Ci::Build' do
+        let(:main_relation) { Ci::Bridge.all }
+
+        it 'raises argument error for relation' do
+          expect { build_source_finder.execute }.to raise_error(ArgumentError, 'Only Ci::Builds are source searchable')
+        end
+      end
+    end
+
+    context 'with status and ref' do
+      let(:main_relation) { Ci::Build.pending.where(ref: 'master') }
+
+      it 'returns the correct builds with the filtered status and ref' do
+        expect(build_source_finder.pluck(:name))
+          .to eq(%w[build5 build3 build1])
+        expect(build_source_finder.pluck(:ref).uniq)
+          .to eq(%w[master])
+        expect(build_source_finder.pluck(:status).uniq)
+          .to eq(%w[pending])
+      end
+    end
+  end
+end
diff --git a/spec/frontend/merge_requests/reports/components/app_spec.js b/spec/frontend/merge_requests/reports/components/app_spec.js
new file mode 100644
index 00000000000..3d076374a01
--- /dev/null
+++ b/spec/frontend/merge_requests/reports/components/app_spec.js
@@ -0,0 +1,29 @@
+import Vue from 'vue';
+import VueRouter from 'vue-router';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import App from '~/merge_requests/reports/components/app.vue';
+import routes from '~/merge_requests/reports/routes';
+
+Vue.use(VueRouter);
+
+describe('Merge request reports App component', () => {
+  let wrapper;
+
+  const createComponent = () => {
+    const router = new VueRouter({ mode: 'history', routes });
+    wrapper = shallowMountExtended(App, { router });
+  };
+
+  it('should render sidebar navigation', () => {
+    createComponent();
+    expect(wrapper.findByText('Blockers').exists()).toBe(true);
+    expect(wrapper.findByText('Code quality').exists()).toBe(true);
+    expect(wrapper.findByText('Security').exists()).toBe(true);
+    expect(wrapper.findByText('License Compliance').exists()).toBe(true);
+  });
+
+  it('should render blockers counter', () => {
+    createComponent();
+    expect(wrapper.findByTestId('blockers-counter').text()).toBe('2');
+  });
+});
diff --git a/spec/frontend/search/results/components/blob_footer_spec.js b/spec/frontend/search/results/components/blob_footer_spec.js
index d3398e86202..f072d0d0a96 100644
--- a/spec/frontend/search/results/components/blob_footer_spec.js
+++ b/spec/frontend/search/results/components/blob_footer_spec.js
@@ -100,7 +100,7 @@ describe('BlobFooter', () => {
       await nextTick();
       expect(findGlLink().exists()).toBe(true);
       expect(wrapper.text()).toContain(
-        'Show less - Too many matches found. Showing 50 chunks out of 200 results. Open the file to view all.',
+        `Show less - Too many matches found. Showing 5 chunks out of 200 results. Open the file to view all.`,
       );
     });
 
diff --git a/spec/frontend/todos/components/todo_item_title_spec.js b/spec/frontend/todos/components/todo_item_title_spec.js
index c6d7cd6584a..9a1b3f203da 100644
--- a/spec/frontend/todos/components/todo_item_title_spec.js
+++ b/spec/frontend/todos/components/todo_item_title_spec.js
@@ -53,7 +53,7 @@ describe('TodoItemTitle', () => {
       ['to-do for MR', 'Update file .gitlab-ci.yml · Flightjs / Flight !17', MR_BUILD_FAILED_TODO],
       [
         'to-do for design',
-        'Screenshot_2024-11-22_at_16.11.25.png · Flightjs / Flight #35',
+        'Important issue › Screenshot_2024-11-22_at_16.11.25.png · Flightjs / Flight #35',
         DESIGN_TODO,
       ],
     ])(`renders %s as %s`, (_a, b, c) => {
@@ -66,7 +66,7 @@ describe('TodoItemTitle', () => {
     it.each`
       targetType                        | icon               | showsIcon
       ${TODO_TARGET_TYPE_ALERT}         | ${'status-alert'}  | ${true}
-      ${TODO_TARGET_TYPE_DESIGN}        | ${'issues'}        | ${true}
+      ${TODO_TARGET_TYPE_DESIGN}        | ${'media'}         | ${true}
       ${TODO_TARGET_TYPE_EPIC}          | ${'epic'}          | ${true}
       ${TODO_TARGET_TYPE_ISSUE}         | ${'issues'}        | ${true}
       ${TODO_TARGET_TYPE_MERGE_REQUEST} | ${'merge-request'} | ${true}
diff --git a/spec/frontend/todos/mock_data.js b/spec/frontend/todos/mock_data.js
index 897ea807000..e926a883c2f 100644
--- a/spec/frontend/todos/mock_data.js
+++ b/spec/frontend/todos/mock_data.js
@@ -93,7 +93,9 @@ export const DESIGN_TODO = {
   targetEntity: {
     name: 'Screenshot_2024-11-22_at_16.11.25.png',
     issue: {
+      id: 'gid://gitlab/Issue/35',
       reference: '#35',
+      name: 'Important issue',
     },
     __typename: 'Design',
   },
diff --git a/spec/frontend/vue_shared/components/list_selector/group_item_spec.js b/spec/frontend/vue_shared/components/list_selector/group_item_spec.js
index 50d1ba35503..86961414da1 100644
--- a/spec/frontend/vue_shared/components/list_selector/group_item_spec.js
+++ b/spec/frontend/vue_shared/components/list_selector/group_item_spec.js
@@ -1,5 +1,5 @@
-import { GlAvatar } from '@gitlab/ui';
-import { mountExtended } from 'helpers/vue_test_utils_helper';
+import { GlAvatarLabeled } from '@gitlab/ui';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import GroupItem from '~/vue_shared/components/list_selector/group_item.vue';
 import HiddenGroupsItem from 'ee_component/approvals/components/hidden_groups_item.vue';
 
@@ -9,7 +9,7 @@ describe('GroupItem spec', () => {
   const MOCK_GROUP = { id: 123, fullName: 'Group 1', name: 'group1', avatarUrl: 'some/avatar.jpg' };
 
   const createComponent = (props, options) => {
-    wrapper = mountExtended(GroupItem, {
+    wrapper = shallowMountExtended(GroupItem, {
       propsData: {
         data: MOCK_GROUP,
         ...props,
@@ -18,20 +18,20 @@ describe('GroupItem spec', () => {
     });
   };
 
-  const findAvatar = () => wrapper.findComponent(GlAvatar);
+  const findAvatarLabeled = () => wrapper.findComponent(GlAvatarLabeled);
   const findDeleteButton = () => wrapper.findByTestId('delete-group-btn');
 
   beforeEach(() => createComponent());
 
-  it('renders an Avatar component', () => {
-    expect(findAvatar().props('size')).toBe(32);
-    expect(findAvatar().props('src')).toBe(MOCK_GROUP.avatarUrl);
-    expect(findAvatar().attributes('alt')).toBe(MOCK_GROUP.fullName);
-  });
-
-  it('renders a fullName and name', () => {
-    expect(wrapper.text()).toContain('Group 1');
-    expect(wrapper.text()).toContain('group1');
+  it('renders AvatarLabeled component', () => {
+    expect(findAvatarLabeled().props()).toMatchObject({
+      label: 'Group 1',
+      subLabel: '@group1',
+    });
+    expect(findAvatarLabeled().attributes()).toMatchObject({
+      size: '32',
+      src: 'some/avatar.jpg',
+    });
   });
 
   it('does not render a delete button by default', () => {
@@ -62,7 +62,7 @@ describe('GroupItem spec', () => {
     });
 
     it('emits a delete event if the delete button is clicked', () => {
-      findDeleteButton().trigger('click');
+      findDeleteButton().vm.$emit('click');
 
       expect(wrapper.emitted('delete')).toEqual([[MOCK_GROUP.id]]);
     });
diff --git a/spec/frontend/vue_shared/components/list_selector/project_item_spec.js b/spec/frontend/vue_shared/components/list_selector/project_item_spec.js
index 9097b6879e6..190d34d42d8 100644
--- a/spec/frontend/vue_shared/components/list_selector/project_item_spec.js
+++ b/spec/frontend/vue_shared/components/list_selector/project_item_spec.js
@@ -1,4 +1,4 @@
-import { GlAvatar, GlButton } from '@gitlab/ui';
+import { GlAvatarLabeled, GlButton } from '@gitlab/ui';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import ProjectItem from '~/vue_shared/components/list_selector/project_item.vue';
 
@@ -18,25 +18,26 @@ describe('GroupItem spec', () => {
         data: MOCK_PROJECT,
         ...props,
       },
+      stubs: {
+        GlAvatarLabeled,
+      },
     });
   };
 
-  const findAvatar = () => wrapper.findComponent(GlAvatar);
+  const findAvatarLabeled = () => wrapper.findComponent(GlAvatarLabeled);
   const findDeleteButton = () => wrapper.findComponent(GlButton);
 
   beforeEach(() => createComponent());
 
-  it('renders an Avatar component', () => {
-    expect(findAvatar().props('size')).toBe(32);
-    expect(findAvatar().attributes()).toMatchObject({
-      src: MOCK_PROJECT.avatarUrl,
-      alt: MOCK_PROJECT.name,
+  it('renders AvatarLabeled component', () => {
+    expect(findAvatarLabeled().props()).toMatchObject({
+      label: 'Project 1',
+      subLabel: 'Group 1 / Project 1',
+    });
+    expect(findAvatarLabeled().attributes()).toMatchObject({
+      size: '32',
+      src: 'some/avatar.jpg',
     });
-  });
-
-  it('renders a name and namespace', () => {
-    expect(wrapper.text()).toContain(MOCK_PROJECT.name);
-    expect(wrapper.text()).toContain(MOCK_PROJECT.nameWithNamespace);
   });
 
   it('does not render a delete button by default', () => {
diff --git a/spec/frontend/vue_shared/components/list_selector/user_item_spec.js b/spec/frontend/vue_shared/components/list_selector/user_item_spec.js
index 3ce0fd54e23..fffc4082022 100644
--- a/spec/frontend/vue_shared/components/list_selector/user_item_spec.js
+++ b/spec/frontend/vue_shared/components/list_selector/user_item_spec.js
@@ -1,4 +1,4 @@
-import { GlAvatar } from '@gitlab/ui';
+import { GlAvatarLabeled } from '@gitlab/ui';
 import { mountExtended } from 'helpers/vue_test_utils_helper';
 import UserItem from '~/vue_shared/components/list_selector/user_item.vue';
 
@@ -13,23 +13,26 @@ describe('UserItem spec', () => {
         data: MOCK_USER,
         ...props,
       },
+      stubs: {
+        GlAvatarLabeled,
+      },
     });
   };
 
-  const findAvatar = () => wrapper.findComponent(GlAvatar);
+  const findAvatarLabeled = () => wrapper.findComponent(GlAvatarLabeled);
   const findDeleteButton = () => wrapper.findByTestId('delete-user-btn');
 
   beforeEach(() => createComponent());
 
-  it('renders an Avatar component', () => {
-    expect(findAvatar().props('size')).toBe(32);
-    expect(findAvatar().props('src')).toBe(MOCK_USER.avatarUrl);
-    expect(findAvatar().attributes('alt')).toBe(MOCK_USER.name);
-  });
-
-  it('renders a name and username', () => {
-    expect(wrapper.text()).toContain('Admin');
-    expect(wrapper.text()).toContain('@root');
+  it('renders AvatarLabeled component', () => {
+    expect(findAvatarLabeled().props()).toMatchObject({
+      label: 'Admin',
+      subLabel: '@root',
+    });
+    expect(findAvatarLabeled().attributes()).toMatchObject({
+      size: '32',
+      src: 'some/avatar.jpg',
+    });
   });
 
   it('does not render a delete button by default', () => {
@@ -45,7 +48,7 @@ describe('UserItem spec', () => {
     });
 
     it('emits a delete event if the delete button is clicked', () => {
-      findDeleteButton().trigger('click');
+      findDeleteButton().vm.$emit('click');
 
       expect(wrapper.emitted('delete')).toEqual([[MOCK_USER.id]]);
     });
diff --git a/spec/graphql/resolvers/project_jobs_resolver_spec.rb b/spec/graphql/resolvers/project_jobs_resolver_spec.rb
index 04a467cbadc..b8a4a9f62b2 100644
--- a/spec/graphql/resolvers/project_jobs_resolver_spec.rb
+++ b/spec/graphql/resolvers/project_jobs_resolver_spec.rb
@@ -39,6 +39,68 @@ RSpec.describe Resolvers::ProjectJobsResolver, feature_category: :continuous_int
         it { is_expected.to contain_exactly(successful_build, successful_build_two, failed_build, pending_build) }
       end
 
+      context 'when filtering by source' do
+        before do
+          stub_feature_flags(populate_and_use_build_source_table: true)
+        end
+
+        let_it_be(:successful_build_source) { create(:ci_build_source, build: successful_build, source: 'scan_execution_policy') }
+        let_it_be(:pending_build_source) { create(:ci_build_source, build: pending_build, source: 'scan_execution_policy') }
+        let(:args) { { sources: %w[scan_execution_policy] } }
+
+        it { is_expected.to contain_exactly(successful_build, pending_build) }
+
+        context 'with multiple sources' do
+          let_it_be(:failed_build_source) { create(:ci_build_source, build: failed_build, source: 'trigger') }
+          let(:args) { { sources: %w[scan_execution_policy trigger] } }
+
+          it { is_expected.to contain_exactly(successful_build, pending_build, failed_build) }
+        end
+
+        context 'when FF is disabled' do
+          before do
+            stub_feature_flags(populate_and_use_build_source_table: false)
+          end
+
+          it 'does not filter by source' do
+            is_expected.to contain_exactly(successful_build, successful_build_two, failed_build, pending_build)
+          end
+        end
+
+        context 'with name filter also present' do
+          let(:args) { { name: "Three", sources: %w[scan_execution_policy] } }
+
+          before do
+            stub_feature_flags(populate_and_use_build_names_table: true)
+          end
+
+          it 'filters only by name' do
+            is_expected.to contain_exactly(failed_build, pending_build)
+          end
+        end
+
+        context 'when given pagination params' do
+          let(:cursor) { Base64.strict_encode64({ id: failed_build.id.to_s }.to_json) }
+          let(:query) do
+            <<~QUERY
+            {
+              project(fullPath: "#{project.full_path}") {
+                jobs(sources: [SCAN_EXECUTION_POLICY], first: 1, after: "#{cursor}") {
+                  nodes { id }
+                }
+              }
+            }
+            QUERY
+          end
+
+          it "returns the paginated build" do
+            graphq_response = GitlabSchema.execute(query, context: { current_user: current_user })
+            parsed_response = graphql_dig_at(graphq_response, 'data', 'project', 'jobs', 'nodes')
+            expect(parsed_response).to match_array([a_graphql_entity_for(pending_build)])
+          end
+        end
+      end
+
       context 'when filtering by build name' do
         let(:args) { { name: 'Three' } }
 
diff --git a/spec/graphql/types/project_type_spec.rb b/spec/graphql/types/project_type_spec.rb
index 464e2e8796b..6d8fc8552d2 100644
--- a/spec/graphql/types/project_type_spec.rb
+++ b/spec/graphql/types/project_type_spec.rb
@@ -541,7 +541,11 @@ RSpec.describe GitlabSchema.types['Project'], feature_category: :groups_and_proj
     subject { described_class.fields['jobs'] }
 
     it { is_expected.to have_graphql_type(Types::Ci::JobType.connection_type) }
-    it { is_expected.to have_graphql_arguments(:statuses, :with_artifacts, :name, :after, :before, :first, :last) }
+
+    it do
+      is_expected.to have_graphql_arguments(:statuses, :with_artifacts, :name, :sources,
+        :after, :before, :first, :last)
+    end
   end
 
   describe 'ci_template field' do
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 67ba469a3f6..481c8303d53 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -513,7 +513,6 @@ RSpec.describe ApplicationHelper do
           {
             page: 'application',
             page_type_id: nil,
-            find_file: nil,
             group: nil,
             group_full_path: nil
           }
@@ -530,7 +529,6 @@ RSpec.describe ApplicationHelper do
             {
               page: 'application',
               page_type_id: nil,
-              find_file: nil,
               group: group.path,
               group_full_path: group.full_path
             }
@@ -549,12 +547,10 @@ RSpec.describe ApplicationHelper do
       end
 
       it 'includes all possible body data elements and associates the project elements with project' do
-        expect(helper).to receive(:can?).with(nil, :read_code, project)
         expect(helper.body_data).to eq(
           {
             page: 'application',
             page_type_id: nil,
-            find_file: nil,
             group: nil,
             group_full_path: nil,
             project_id: project.id,
@@ -569,12 +565,10 @@ RSpec.describe ApplicationHelper do
         let_it_be(:project) { create(:project, :repository, group: create(:group)) }
 
         it 'includes all possible body data elements and associates the project elements with project' do
-          expect(helper).to receive(:can?).with(nil, :read_code, project)
           expect(helper.body_data).to eq(
             {
               page: 'application',
               page_type_id: nil,
-              find_file: nil,
               group: project.group.name,
               group_full_path: project.group.full_path,
               project_id: project.id,
@@ -597,12 +591,10 @@ RSpec.describe ApplicationHelper do
             stub_controller_method(:action_name, 'show')
             stub_controller_method(:params, { id: issue.id })
 
-            expect(helper).to receive(:can?).with(nil, :read_code, project).and_return(false)
             expect(helper.body_data).to eq(
               {
                 page: 'projects:issues:show',
                 page_type_id: issue.id,
-                find_file: nil,
                 group: nil,
                 group_full_path: nil,
                 project_id: issue.project.id,
@@ -614,37 +606,6 @@ RSpec.describe ApplicationHelper do
           end
         end
       end
-
-      describe 'find_file attribute' do
-        subject { helper.body_data[:find_file] }
-
-        before do
-          allow(helper).to receive(:current_user).and_return(user)
-        end
-
-        context 'when the project has no repository' do
-          before do
-            allow(project).to receive(:empty_repo?).and_return(true)
-          end
-
-          it { is_expected.to be_nil }
-        end
-
-        context 'when user cannot read_code for the project' do
-          before do
-            allow(helper).to receive(:can?).with(user, :read_code, project).and_return(false)
-          end
-
-          it { is_expected.to be_nil }
-        end
-
-        context 'when current_user has read_code permission' do
-          it 'returns find_file with the default branch' do
-            expect(helper).to receive(:can?).with(user, :read_code, project).and_return(true)
-            expect(subject).to end_with(project.default_branch)
-          end
-        end
-      end
     end
 
     def stub_controller_method(method_name, value)
diff --git a/spec/models/oauth_access_token_spec.rb b/spec/models/oauth_access_token_spec.rb
index 94a246eb819..7dad4130951 100644
--- a/spec/models/oauth_access_token_spec.rb
+++ b/spec/models/oauth_access_token_spec.rb
@@ -78,40 +78,23 @@ RSpec.describe OauthAccessToken, feature_category: :system_access do
 
   describe '#scope_user' do
     let_it_be(:user) { create(:user) }
-    let_it_be_with_refind(:oauth_access_token) { create(:oauth_access_token) }
-    let(:user_id) { user.id }
-
-    before do
-      allow(oauth_access_token).to receive(:scopes).and_return(scopes)
-    end
 
     context 'when scopes match expected format' do
-      context 'when scopes only include the composite scope' do
-        let(:scopes) { "user:#{user_id}" }
-
-        it 'returns the user' do
-          expect(oauth_access_token.scope_user).to eq user
-        end
+      where(:scopes) do
+        [
+          "user:%{user_id}",
+          "other:scope user:%{user_id}",
+          "user:%{user_id} other:scope",
+          "api user:%{user_id} read_api"
+        ]
       end
 
-      context 'when scopes include another scope before composite scope' do
-        let(:scopes) { "other:scope user:#{user_id}" }
-
-        it 'returns the user' do
-          expect(oauth_access_token.scope_user).to eq user
+      with_them do
+        let(:formatted_scopes) do
+          format(scopes, user_id: user.id)
         end
-      end
 
-      context "when scopes include another scope after composite scope" do
-        let(:scopes) { "user:#{user_id} other:scope" }
-
-        it 'returns the user' do
-          expect(oauth_access_token.scope_user).to eq user
-        end
-      end
-
-      context 'when scopes include another scope before and after composite scope' do
-        let(:scopes) { "api user:#{user_id} read_api" }
+        let(:oauth_access_token) { create(:oauth_access_token, scopes: formatted_scopes) }
 
         it 'returns the user' do
           expect(oauth_access_token.scope_user).to eq user
@@ -123,12 +106,24 @@ RSpec.describe OauthAccessToken, feature_category: :system_access do
       where(:scopes) do
         [
           "user:#{non_existing_record_id}",
+          'fuser:%{user_id}',
+          'user:%{user_id}f',
+          'user:%{user_id} user:2',
           'user:not_a_number',
           'some:other:scope',
           nil,
           ""
         ]
       end
+      let(:formatted_scopes) do
+        if scopes.presence
+          format(scopes, user_id: user.id)
+        else
+          scopes
+        end
+      end
+
+      let(:oauth_access_token) { create(:oauth_access_token, scopes: formatted_scopes) }
 
       with_them do
         it 'returns false' do
diff --git a/spec/requests/api/graphql/mutations/snippets/update_spec.rb b/spec/requests/api/graphql/mutations/snippets/update_spec.rb
index 0e60b047db4..1d52171aa45 100644
--- a/spec/requests/api/graphql/mutations/snippets/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/update_spec.rb
@@ -171,7 +171,7 @@ RSpec.describe 'Updating a Snippet', feature_category: :source_code_management d
 
     context 'when the author is a member of the project', :snowplow do
       before do
-        project.add_developer(current_user)
+        project.add_developer(snippet.author)
       end
 
       it_behaves_like 'graphql update actions'
@@ -196,17 +196,15 @@ RSpec.describe 'Updating a Snippet', feature_category: :source_code_management d
       end
 
       context 'when not sessionless', :clean_gitlab_redis_sessions do
+        let(:current_user) { nil }
+
         before do
-          stub_session(
-            session_data: {
-              'warden.user.user.key' => [[current_user.id], current_user.authenticatable_salt]
-            }
-          )
+          sign_in(snippet.author)
         end
 
         it_behaves_like 'internal event tracking' do
           let(:event) { 'g_edit_by_snippet_ide' }
-          let(:user) { current_user }
+          let(:user) { snippet.author }
         end
       end
     end
diff --git a/spec/requests/api/graphql_spec.rb b/spec/requests/api/graphql_spec.rb
index 17f09746952..178938b016c 100644
--- a/spec/requests/api/graphql_spec.rb
+++ b/spec/requests/api/graphql_spec.rb
@@ -235,7 +235,6 @@ RSpec.describe 'GraphQL', feature_category: :shared do
         stub_authentication_activity_metrics do |metrics|
           expect(metrics)
             .to increment(:user_authenticated_counter)
-            .and increment(:user_session_destroyed_counter)
 
           expect(metrics.user_csrf_token_invalid_counter)
             .to receive(:increment).with(controller: 'GraphqlController', auth: 'session')
@@ -243,7 +242,7 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
         post_graphql(query, headers: { 'X-CSRF-Token' => 'invalid' })
 
-        expect(graphql_data['echo']).to eq('nil says: Hello world')
+        expect(response).to have_gitlab_http_status(:forbidden)
       end
 
       it 'authenticates a user with a valid session token' do
@@ -259,6 +258,43 @@ RSpec.describe 'GraphQL', feature_category: :shared do
 
         expect(graphql_data['echo']).to eq("\"#{user.username}\" says: Hello world")
       end
+
+      context 'when fix_graphql_csrf is disabled' do
+        before do
+          stub_feature_flags(fix_graphql_csrf: false)
+        end
+
+        it 'does not authenticate a user with an invalid CSRF' do
+          login_as(user)
+
+          stub_authentication_activity_metrics do |metrics|
+            expect(metrics)
+              .to increment(:user_authenticated_counter)
+              .and increment(:user_session_destroyed_counter)
+
+            expect(metrics.user_csrf_token_invalid_counter)
+              .to receive(:increment).with(controller: 'GraphqlController', auth: 'session')
+          end
+
+          post_graphql(query, headers: { 'X-CSRF-Token' => 'invalid' })
+
+          expect(graphql_data['echo']).to eq('nil says: Hello world')
+        end
+
+        it 'authenticates a user with a valid session token' do
+          # Create a session to get a CSRF token from
+          login_as(user)
+          get('/')
+
+          stub_authentication_activity_metrics do |metrics|
+            expect(metrics.user_csrf_token_invalid_counter).not_to receive(:increment)
+          end
+
+          post '/api/graphql', params: { query: query }, headers: { 'X-CSRF-Token' => session['_csrf_token'] }
+
+          expect(graphql_data['echo']).to eq("\"#{user.username}\" says: Hello world")
+        end
+      end
     end
 
     context 'with token authentication' do
@@ -271,13 +307,7 @@ RSpec.describe 'GraphQL', feature_category: :shared do
             .and increment(:user_session_override_counter)
             .and increment(:user_sessionless_authentication_counter)
 
-          ##
-          # TODO: PAT authentication should not trigger `handle_unverified_request` on CSRF token mismatch.
-          #
-          # `auth` type is 'other' here, becase we `handle_unverified_request` before we call sessionless sign in hooks.
-          #
-          expect(metrics.user_csrf_token_invalid_counter)
-            .to receive(:increment).with(controller: 'GraphqlController', auth: 'other')
+          expect(metrics.user_csrf_token_invalid_counter).not_to receive(:increment)
         end
 
         post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token })
@@ -285,6 +315,70 @@ RSpec.describe 'GraphQL', feature_category: :shared do
         expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
       end
 
+      context 'when user also has a valid session' do
+        let_it_be(:other_user) { create(:user) }
+
+        before do
+          login_as(other_user)
+          get('/')
+        end
+
+        it 'authenticates as PAT user' do
+          post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => session['_csrf_token'] })
+
+          expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
+        end
+
+        it 'authenticates as PAT user even when CSRF token is invalid' do
+          post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => 'invalid' })
+
+          expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
+        end
+      end
+
+      context 'when fix_graphql_csrf is disabled' do
+        before do
+          stub_feature_flags(fix_graphql_csrf: false)
+        end
+
+        it 'authenticates users with a PAT' do
+          stub_authentication_activity_metrics(debug: false) do |metrics|
+            expect(metrics)
+              .to increment(:user_authenticated_counter)
+              .and increment(:user_session_override_counter)
+              .and increment(:user_sessionless_authentication_counter)
+
+            expect(metrics.user_csrf_token_invalid_counter)
+              .to receive(:increment).with(controller: 'GraphqlController', auth: 'other')
+          end
+
+          post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token })
+
+          expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
+        end
+
+        context 'when user also has a valid session' do
+          let_it_be(:other_user) { create(:user) }
+
+          before do
+            login_as(other_user)
+            get('/')
+          end
+
+          it 'authenticates as session user' do
+            post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => session['_csrf_token'] })
+
+            expect(graphql_data['echo']).to eq("\"#{other_user.username}\" says: Hello world")
+          end
+
+          it 'authenticates as PAT user when CSRF token is invalid' do
+            post_graphql(query, headers: { 'PRIVATE-TOKEN' => token.token, 'X-CSRF-Token' => 'invalid' })
+
+            expect(graphql_data['echo']).to eq("\"#{token.user.username}\" says: Hello world")
+          end
+        end
+      end
+
       shared_examples 'valid token' do
         it 'accepts from header' do
           post_graphql(query, headers: { 'Authorization' => "Bearer #{token}" })
diff --git a/spec/requests/api/npm_project_packages_spec.rb b/spec/requests/api/npm_project_packages_spec.rb
index 64977f2f805..423c9dba645 100644
--- a/spec/requests/api/npm_project_packages_spec.rb
+++ b/spec/requests/api/npm_project_packages_spec.rb
@@ -194,6 +194,16 @@ RSpec.describe API::NpmProjectPackages, feature_category: :package_registry do
 
         it_behaves_like 'successfully downloads the file'
       end
+
+      context 'when npm_extract_npm_package_model is disabled' do
+        let_it_be(:package, reload: true) { create(:npm_package_legacy, project: project, name: FFaker::Lorem.word, version: '1.2.3') }
+
+        before do
+          stub_feature_flags(npm_extract_npm_package_model: false)
+        end
+
+        it_behaves_like 'successfully downloads the file'
+      end
     end
 
     context 'private project' do
diff --git a/spec/requests/user_settings/passwords_controller_spec.rb b/spec/requests/user_settings/passwords_controller_spec.rb
new file mode 100644
index 00000000000..ea679df4cba
--- /dev/null
+++ b/spec/requests/user_settings/passwords_controller_spec.rb
@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require('spec_helper')
+
+RSpec.describe UserSettings::PasswordsController, type: :request, feature_category: :system_access do
+  let(:deactivated_user) { create(:user, :deactivated) }
+
+  let(:password) { User.random_password }
+  let(:password_confirmation) { password }
+  let(:reset_password_token) { deactivated_user.send_reset_password_instructions }
+
+  subject(:update_password) do
+    put user_settings_password_path, params: {
+      user: {
+        password: password,
+        password_confirmation: password_confirmation,
+        reset_password_token: reset_password_token
+      }
+    }
+  end
+
+  describe '#new' do
+    context 'when a deactivated user signs-in after an admin resets their password' do
+      before do
+        sign_in deactivated_user
+        get new_user_settings_password_path
+        deactivated_user.reload
+      end
+
+      it 'reactivates the user', :aggregate_failures do
+        expect(deactivated_user[:state]).to eq('active')
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'renders the update password page' do
+        expect(response.body).to include('To continue, please update your password')
+      end
+    end
+  end
+
+  describe '#create' do
+    context 'when a deactivated user signs-in after an admin resets their password' do
+      before do
+        sign_in deactivated_user
+        get new_user_settings_password_path
+        deactivated_user.reload
+      end
+
+      context 'when the user updates their password' do
+        before do
+          update_password
+          get new_user_session_path
+        end
+
+        it 'redirects backs to the root path(sign-in page)', :aggregate_failures do
+          expect(response).to redirect_to(root_path)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/services/groups/transfer_service_spec.rb b/spec/services/groups/transfer_service_spec.rb
index 2aafdd48e74..c10a4c27b7a 100644
--- a/spec/services/groups/transfer_service_spec.rb
+++ b/spec/services/groups/transfer_service_spec.rb
@@ -95,6 +95,29 @@ RSpec.describe Groups::TransferService, :sidekiq_inline, feature_category: :grou
 
             it_behaves_like 'transfer allowed'
           end
+
+          context 'when npm_extract_npm_package_model is disabled' do
+            before do
+              stub_feature_flags(npm_extract_npm_package_model: false)
+            end
+
+            it 'does not allow transfer' do
+              transfer_service.execute(new_group)
+
+              expect(transfer_service.error).to eq('Transfer failed: Group contains projects with NPM packages scoped to the current root level group.')
+              expect(group.parent).not_to eq(new_group)
+            end
+
+            context 'namespaced package is pending destruction' do
+              let!(:group) { create(:group) }
+
+              before do
+                package.pending_destruction!
+              end
+
+              it_behaves_like 'transfer allowed'
+            end
+          end
         end
 
         context 'when transferring a group into a root group' do
diff --git a/spec/services/groups/update_service_spec.rb b/spec/services/groups/update_service_spec.rb
index 2caa6299077..5549d081bef 100644
--- a/spec/services/groups/update_service_spec.rb
+++ b/spec/services/groups/update_service_spec.rb
@@ -334,6 +334,15 @@ RSpec.describe Groups::UpdateService, feature_category: :groups_and_projects do
 
         it_behaves_like 'not allowing a path update'
         it_behaves_like 'allowing an update', on: :name
+
+        context 'when npm_extract_npm_package_model is disabled' do
+          before do
+            stub_feature_flags(npm_extract_npm_package_model: false)
+          end
+
+          it_behaves_like 'not allowing a path update'
+          it_behaves_like 'allowing an update', on: :name
+        end
       end
 
       context 'updating the subgroup' do
@@ -352,6 +361,15 @@ RSpec.describe Groups::UpdateService, feature_category: :groups_and_projects do
 
         it_behaves_like 'allowing an update', on: :path
         it_behaves_like 'allowing an update', on: :name
+
+        context 'when npm_extract_npm_package_model is disabled' do
+          before do
+            stub_feature_flags(npm_extract_npm_package_model: false)
+          end
+
+          it_behaves_like 'allowing an update', on: :path
+          it_behaves_like 'allowing an update', on: :name
+        end
       end
 
       context 'updating the subgroup' do
@@ -370,6 +388,15 @@ RSpec.describe Groups::UpdateService, feature_category: :groups_and_projects do
 
         it_behaves_like 'allowing an update', on: :path
         it_behaves_like 'allowing an update', on: :name
+
+        context 'when npm_extract_npm_package_model is disabled' do
+          before do
+            stub_feature_flags(npm_extract_npm_package_model: false)
+          end
+
+          it_behaves_like 'allowing an update', on: :path
+          it_behaves_like 'allowing an update', on: :name
+        end
       end
 
       context 'updating the subgroup' do
diff --git a/spec/services/import/reassign_placeholder_user_records_service_spec.rb b/spec/services/import/reassign_placeholder_user_records_service_spec.rb
index cbc9635fb61..0977c8b1c02 100644
--- a/spec/services/import/reassign_placeholder_user_records_service_spec.rb
+++ b/spec/services/import/reassign_placeholder_user_records_service_spec.rb
@@ -121,9 +121,7 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsService, feature_category:
 
   describe '#execute', :aggregate_failures do
     before do
-      # Decrease the sleep in this test, so the test suite runs faster.
-      # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/493977
-      stub_const("#{described_class}::RELATION_BATCH_SLEEP", 0.01)
+      allow(service).to receive_messages(db_health_check!: nil, db_table_health_check!: nil, check_db_health?: true)
     end
 
     shared_examples 'a successful reassignment' do
@@ -151,10 +149,19 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsService, feature_category:
     context 'when a user can be reassigned without error' do
       it_behaves_like 'a successful reassignment'
 
-      it 'sleeps between processing each model relation batch' do
-        expect(Kernel).to receive(:sleep).with(0.01).exactly(8).times
+      context 'when reassignment throttling is disabled' do
+        before do
+          stub_feature_flags(reassignment_throttling: false)
+          # Decrease the sleep in this test, so the test suite runs faster.
+          # TODO: Remove with https://gitlab.com/gitlab-org/gitlab/-/issues/493977
+          stub_const("#{described_class}::RELATION_BATCH_SLEEP", 0.01)
+        end
 
-        service.execute
+        it 'sleeps between processing each model relation batch' do
+          expect(Kernel).to receive(:sleep).with(0.01).exactly(8).times
+
+          service.execute
+        end
       end
 
       it 'updates actual records from the source user\'s placeholder reference records' do
@@ -194,6 +201,35 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsService, feature_category:
         )
       end
 
+      context 'when the membership table is unhealthy' do
+        let(:db_members_table_health_failure) do
+          described_class::DatabaseHealthError.new("#{Member.table_name} table unhealthy")
+        end
+
+        it 'returns a reschedule response' do
+          allow(service).to receive(:db_table_health_check!).with(Member).and_raise(db_members_table_health_failure)
+
+          result = service.execute
+
+          expect(result.status).to eq(:ok)
+          expect(result.reason).to eq(:db_health_check_failed)
+          expect(result.message).to eq('Rescheduling placeholder user records reassignment: database health')
+        end
+
+        it 'logs a warning' do
+          allow(service).to receive(:db_table_health_check!).with(Member).and_raise(db_members_table_health_failure)
+
+          expect(::Import::Framework::Logger).to receive(:warn).with(
+            hash_including(
+              message: "members table unhealthy. Rescheduling reassignment",
+              source_user_id: source_user.id
+            )
+          )
+
+          service.execute
+        end
+      end
+
       it 'calls UserProjectAccessChangedService' do
         expect_next_instance_of(UserProjectAccessChangedService, reassign_to_user.id) do |service|
           expect(service).to receive(:execute)
@@ -226,8 +262,7 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsService, feature_category:
 
       context 'when reassigned by user no longer exists' do
         before do
-          source_user.reassigned_by_user.destroy!
-          source_user.reload
+          service.instance_variable_set(:@reassigned_by_user, nil)
         end
 
         it 'can still create memberships' do
@@ -650,6 +685,180 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsService, feature_category:
     end
   end
 
+  context 'when database is healthy' do
+    before do
+      allow(service).to receive_messages(db_health_check!: nil, db_table_health_check!: nil, check_db_health?: true)
+    end
+
+    it 'checks all tables and individual tables' do
+      expect(service).to receive(:db_health_check!).at_least(:once)
+      expect(service).to receive(:db_table_health_check!).at_least(:once)
+
+      service.execute
+    end
+
+    context 'when :reassignment_throttling is disabled' do
+      before do
+        stub_feature_flags(reassignment_throttling: false)
+      end
+
+      it 'does not check database health' do
+        expect(service).not_to receive(:db_health_check!)
+        expect(service).not_to receive(:db_table_health_check!)
+
+        service.execute
+      end
+    end
+  end
+
+  context 'when database is unhealthy' do
+    let(:db_table_health_failure) { described_class::DatabaseHealthError.new("#{User.table_name} table unhealthy") }
+    let(:db_health_failure) { described_class::DatabaseHealthError.new("Database unhealthy") }
+
+    it 'returns a reschedule response when checking global tables' do
+      allow(service).to receive(:db_health_check!).and_raise(db_health_failure)
+
+      result = service.execute
+
+      expect(result.status).to eq(:ok)
+      expect(result.reason).to eq(:db_health_check_failed)
+      expect(result.message).to eq('Rescheduling placeholder user records reassignment: database health')
+    end
+
+    it 'logs a warning' do
+      allow(service).to receive(:db_health_check!).and_raise(db_health_failure)
+
+      expect(::Import::Framework::Logger).to receive(:warn).with(
+        hash_including(
+          message: "Database unhealthy. Rescheduling reassignment",
+          source_user_id: source_user.id
+        )
+      )
+
+      service.execute
+    end
+
+    it 'returns a reschedule response when checking a single table' do
+      allow(service).to receive(:db_table_health_check!).and_raise(db_table_health_failure)
+
+      result = service.execute
+
+      expect(result.status).to eq(:ok)
+      expect(result.reason).to eq(:db_health_check_failed)
+      expect(result.message).to eq('Rescheduling placeholder user records reassignment: database health')
+    end
+
+    it 'logs a warning when checking a single table' do
+      allow(service).to receive(:db_table_health_check!).and_raise(db_table_health_failure)
+
+      expect(::Import::Framework::Logger).to receive(:warn).with(
+        hash_including(
+          message: "users table unhealthy. Rescheduling reassignment",
+          source_user_id: source_user.id
+        )
+      )
+
+      service.execute
+    end
+  end
+
+  describe '#db_table_health_check!' do
+    let(:health_status) { Gitlab::Database::HealthStatus }
+    let(:table_health_indicator_class) { health_status::Indicators::AutovacuumActiveOnTable }
+    let(:table_health_indicator) { instance_double(table_health_indicator_class) }
+    let(:stop) { true }
+    let(:stop_signal) do
+      instance_double(
+        "#{health_status}::Signals::Stop",
+        log_info?: true,
+        stop?: stop,
+        indicator_class: table_health_indicator_class,
+        short_name: 'Stop',
+        reason: 'Test Exception'
+      )
+    end
+
+    before do
+      allow(table_health_indicator_class).to receive(:new).with(anything).and_return(table_health_indicator)
+      allow(table_health_indicator).to receive(:evaluate).and_return(stop_signal)
+    end
+
+    context 'when the table is unhealthy' do
+      it 'raises an error' do
+        expect { service.send(:db_table_health_check!, User) }.to raise_error(described_class::DatabaseHealthError)
+      end
+    end
+
+    context 'when the table is healthy' do
+      let(:stop) { false }
+
+      it 'returns nil' do
+        expect(service.send(:db_table_health_check!, User)).to be_nil
+      end
+    end
+  end
+
+  describe '#db_health_check!' do
+    let(:health_status) { Gitlab::Database::HealthStatus }
+    let(:health_status_indicator_class) { health_status::Indicators::WriteAheadLog }
+    let(:health_status_indicator) { instance_double(health_status_indicator_class) }
+    let(:stop) { false }
+    let(:stop_signal) do
+      instance_double(
+        "#{health_status}::Signals::Stop",
+        log_info?: true,
+        stop?: stop,
+        indicator_class: health_status_indicator_class,
+        short_name: 'Stop',
+        reason: 'Test Exception'
+      )
+    end
+
+    before do
+      allow(service).to receive(:check_db_health?).and_return(true)
+      allow(health_status_indicator_class).to receive(:new).with(anything).and_return(health_status_indicator)
+      allow(health_status_indicator).to receive(:evaluate).and_return(stop_signal)
+      allow(Rails.cache).to receive(:fetch).and_yield
+    end
+
+    context 'when caching health status' do
+      after do
+        travel_back
+      end
+
+      it 'caches the result for 30 seconds' do
+        expect(Rails.cache).to receive(:fetch).with(
+          "reassign_placeholder_user_records_service_db_check",
+          { expires_in: 30.seconds }
+        ).thrice.and_yield
+
+        service.send(:db_health_check!)
+
+        travel 25.seconds
+        service.send(:db_health_check!)
+
+        travel 6.seconds
+        service.send(:db_health_check!)
+      end
+    end
+
+    context 'when the database is unhealthy' do
+      let(:stop) { true }
+
+      it 'raises an error' do
+        expect { service.send(:db_health_check!) }.to raise_error(described_class::DatabaseHealthError)
+      end
+    end
+
+    context 'when the database is healthy' do
+      let(:stop) { false }
+
+      it 'returns nil' do
+        expect(service.send(:db_health_check!)).to be_nil
+      end
+    end
+  end
+
   def create_placeholder_reference(source_user, object, user_column:, composite_key: nil)
     numeric_key = object.id if composite_key.nil?
 
diff --git a/spec/services/packages/mark_package_for_destruction_service_spec.rb b/spec/services/packages/mark_package_for_destruction_service_spec.rb
index bd69f995c77..c344180a532 100644
--- a/spec/services/packages/mark_package_for_destruction_service_spec.rb
+++ b/spec/services/packages/mark_package_for_destruction_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Packages::MarkPackageForDestructionService, feature_category: :package_registry do
+RSpec.describe Packages::MarkPackageForDestructionService, :aggregate_failures, feature_category: :package_registry do
   let_it_be(:user) { create(:user) }
   let_it_be_with_reload(:package) { create(:npm_package) }
 
@@ -29,6 +29,17 @@ RSpec.describe Packages::MarkPackageForDestructionService, feature_category: :pa
           expect(response).to be_success
           expect(response.message).to eq("Package was successfully marked as pending destruction")
         end
+
+        context 'when not npm package' do
+          let_it_be_with_reload(:package) { create(:pypi_package) }
+
+          it 'returns a success ServiceResponse' do
+            expect(package).to receive(:sync_maven_metadata).and_call_original
+            expect(package).to receive(:mark_package_files_for_destruction).and_call_original
+            expect(package).not_to receive(:sync_npm_metadata_cache)
+            expect(service.execute).to be_success
+          end
+        end
       end
 
       context 'when it is not successful' do
diff --git a/spec/services/packages/npm/generate_metadata_service_spec.rb b/spec/services/packages/npm/generate_metadata_service_spec.rb
index 24384fdeddc..c2b97cebbc2 100644
--- a/spec/services/packages/npm/generate_metadata_service_spec.rb
+++ b/spec/services/packages/npm/generate_metadata_service_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe ::Packages::Npm::GenerateMetadataService, feature_category: :pack
   let_it_be(:package2) { create(:npm_package, version: '2.0.6', project: project, name: package_name) }
   let_it_be(:latest_package) { create(:npm_package, version: '2.0.11', project: project, name: package_name) }
 
-  let(:packages) { project.packages.npm.with_name(package_name) }
+  let(:packages) { ::Packages::Npm::Package.for_projects(project).with_name(package_name) }
   let(:metadata) { described_class.new(package_name, packages).execute }
 
   describe '#versions' do
@@ -74,7 +74,7 @@ RSpec.describe ::Packages::Npm::GenerateMetadataService, feature_category: :pack
         end
 
         context 'when generate dependencies' do
-          let(:packages) { ::Packages::Package.where(id: package1.id) }
+          let(:packages) { ::Packages::Npm::Package.where(id: package1.id) }
 
           it 'loads grouped dependency links', :aggregate_failures do
             expect(::Packages::DependencyLink).to receive(:dependency_ids_grouped_by_type).and_call_original
@@ -166,7 +166,7 @@ RSpec.describe ::Packages::Npm::GenerateMetadataService, feature_category: :pack
           let_it_be(:package_tag1) { create(:packages_tag, package: package1, name: 'latest') }
           let_it_be(:package_tag2) { create(:packages_tag, package: package2, name: 'latest') }
 
-          let(:packages) { ::Packages::Package.for_projects([project.id, project2.id]).with_name(package_name) }
+          let(:packages) { ::Packages::Npm::Package.for_projects([project.id, project2.id]).with_name(package_name) }
 
           it "returns the tag of the latest package's version" do
             expect(subject['latest']).to eq(package2.version)
@@ -193,7 +193,7 @@ RSpec.describe ::Packages::Npm::GenerateMetadataService, feature_category: :pack
         end
 
         it 'returns all tags' do
-          expect(::Packages::Package).to receive(:preload_tags).and_call_original
+          expect(::Packages::Npm::Package).to receive(:preload_tags).and_call_original
 
           expect(subject.size).to eq(Packages::Tag.count)
         end
@@ -210,14 +210,14 @@ RSpec.describe ::Packages::Npm::GenerateMetadataService, feature_category: :pack
   end
 
   def check_n_plus_one(only_dist_tags: false)
-    pkgs = project.packages.npm.with_name(package_name).preload_files
+    pkgs = ::Packages::Npm::Package.for_projects(project).with_name(package_name).preload_files
     control = ActiveRecord::QueryRecorder.new do
       described_class.new(package_name, pkgs).execute(only_dist_tags: only_dist_tags)
     end
 
     yield
 
-    pkgs = project.packages.npm.with_name(package_name).preload_files
+    pkgs = ::Packages::Npm::Package.for_projects(project).with_name(package_name).preload_files
 
     expect do
       described_class.new(package_name, pkgs).execute(only_dist_tags: only_dist_tags)
diff --git a/spec/support/helpers/features/access_token_helpers.rb b/spec/support/helpers/features/access_token_helpers.rb
index 92d7059f478..cb7aa1bcc3e 100644
--- a/spec/support/helpers/features/access_token_helpers.rb
+++ b/spec/support/helpers/features/access_token_helpers.rb
@@ -12,5 +12,9 @@ module Features
         find_field('new-access-token').value
       end
     end
+
+    def active_access_tokens_counter
+      find_by_testid('active-token-count')
+    end
   end
 end
diff --git a/spec/workers/import/reassign_placeholder_user_records_worker_spec.rb b/spec/workers/import/reassign_placeholder_user_records_worker_spec.rb
index e946e2bf961..24156f7269c 100644
--- a/spec/workers/import/reassign_placeholder_user_records_worker_spec.rb
+++ b/spec/workers/import/reassign_placeholder_user_records_worker_spec.rb
@@ -60,6 +60,23 @@ RSpec.describe Import::ReassignPlaceholderUserRecordsWorker, feature_category: :
     end
   end
 
+  context 'when database is unhealthy' do
+    let(:service_response) { ServiceResponse.new(status: :success, reason: :db_health_check_failed) }
+    let(:backoff_period) { described_class::BACKOFF_PERIOD }
+
+    before do
+      allow_next_instance_of(Import::ReassignPlaceholderUserRecordsService) do |service|
+        allow(service).to receive(:execute).and_return(service_response)
+      end
+    end
+
+    it 're-enqueues the job' do
+      expect(described_class).to receive(:perform_in).with(backoff_period, import_source_user.id, {})
+
+      described_class.new.perform(import_source_user.id)
+    end
+  end
+
   describe '#sidekiq_retries_exhausted' do
     it 'logs the failure and sets the source user status to failed', :aggregate_failures do
       exception = StandardError.new('Some error')