From 32adca98b38b3a5e8780cf1e8319bad1b11af1fb Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 16 Jul 2025 21:07:42 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .rubocop_todo/gitlab/namespaced_class.yml     |  1 -
 .../rspec/factory_bot/avoid_create.yml        |  1 -
 .rubocop_todo/rspec/verified_doubles.yml      |  1 -
 .../glql/components/common/actions.vue        | 11 ++----
 .../glql/components/common/facade.vue         | 35 +++++++++++------
 .../common/{footer.vue => pagination.vue}     |  2 +-
 .../javascripts/glql/utils/copy_as_gfm.js     |  1 -
 app/models/ci/build.rb                        |  6 ---
 app/models/ci/build_metadata.rb               |  2 -
 app/models/ci/pipeline.rb                     |  6 +--
 app/models/concerns/ci/metadatable.rb         | 17 ++-------
 app/serializers/merge_request_serializer.rb   |  2 +-
 .../merge_request_sidebar_basic_entity.rb     | 15 --------
 .../ci/find_exposed_artifacts_service.rb      | 20 +++-------
 ...ing_has_exposed_artifacts_metadata_col.yml | 13 -------
 .../security_inventory/_index.md              | 36 +++++++++---------
 .../application_security/triage/_index.md     |  5 ++-
 doc/user/gitlab_com/_index.md                 |  6 ++-
 doc/user/glql/_index.md                       |  4 +-
 locale/gitlab.pot                             | 12 ++++--
 .../glql/components/common/actions_spec.js    | 20 ++--------
 .../glql/components/common/facade_spec.js     |  6 +--
 spec/models/ci/build_spec.rb                  | 38 -------------------
 ...merge_request_sidebar_basic_entity_spec.rb | 22 -----------
 spec/support/rspec_order_todo.yml             |  1 -
 25 files changed, 83 insertions(+), 200 deletions(-)
 rename app/assets/javascripts/glql/components/common/{footer.vue => pagination.vue} (98%)
 delete mode 100644 app/serializers/merge_request_sidebar_basic_entity.rb
 delete mode 100644 config/feature_flags/gitlab_com_derisk/ci_stop_using_has_exposed_artifacts_metadata_col.yml
 delete mode 100644 spec/serializers/merge_request_sidebar_basic_entity_spec.rb

diff --git a/.rubocop_todo/gitlab/namespaced_class.yml b/.rubocop_todo/gitlab/namespaced_class.yml
index cd985ec2b97..d9c7069b8f1 100644
--- a/.rubocop_todo/gitlab/namespaced_class.yml
+++ b/.rubocop_todo/gitlab/namespaced_class.yml
@@ -548,7 +548,6 @@ Gitlab/NamespacedClass:
     - 'app/serializers/merge_request_poll_cached_widget_entity.rb'
     - 'app/serializers/merge_request_poll_widget_entity.rb'
     - 'app/serializers/merge_request_serializer.rb'
-    - 'app/serializers/merge_request_sidebar_basic_entity.rb'
     - 'app/serializers/merge_request_sidebar_extras_entity.rb'
     - 'app/serializers/merge_request_user_entity.rb'
     - 'app/serializers/merge_request_widget_commit_entity.rb'
diff --git a/.rubocop_todo/rspec/factory_bot/avoid_create.yml b/.rubocop_todo/rspec/factory_bot/avoid_create.yml
index 94795161a8b..5777db87354 100644
--- a/.rubocop_todo/rspec/factory_bot/avoid_create.yml
+++ b/.rubocop_todo/rspec/factory_bot/avoid_create.yml
@@ -481,7 +481,6 @@ RSpec/FactoryBot/AvoidCreate:
     - 'spec/serializers/merge_request_poll_cached_widget_entity_spec.rb'
     - 'spec/serializers/merge_request_poll_widget_entity_spec.rb'
     - 'spec/serializers/merge_request_serializer_spec.rb'
-    - 'spec/serializers/merge_request_sidebar_basic_entity_spec.rb'
     - 'spec/serializers/merge_request_sidebar_extras_entity_spec.rb'
     - 'spec/serializers/merge_request_user_entity_spec.rb'
     - 'spec/serializers/merge_request_widget_commit_entity_spec.rb'
diff --git a/.rubocop_todo/rspec/verified_doubles.yml b/.rubocop_todo/rspec/verified_doubles.yml
index a8002f14ec8..66b2ac2bd3a 100644
--- a/.rubocop_todo/rspec/verified_doubles.yml
+++ b/.rubocop_todo/rspec/verified_doubles.yml
@@ -728,7 +728,6 @@ RSpec/VerifiedDoubles:
     - 'spec/serializers/linked_project_issue_entity_spec.rb'
     - 'spec/serializers/merge_request_poll_cached_widget_entity_spec.rb'
     - 'spec/serializers/merge_request_poll_widget_entity_spec.rb'
-    - 'spec/serializers/merge_request_sidebar_basic_entity_spec.rb'
     - 'spec/serializers/merge_request_sidebar_extras_entity_spec.rb'
     - 'spec/serializers/merge_request_widget_commit_entity_spec.rb'
     - 'spec/serializers/merge_request_widget_entity_spec.rb'
diff --git a/app/assets/javascripts/glql/components/common/actions.vue b/app/assets/javascripts/glql/components/common/actions.vue
index 55fc4b4cf1d..dd1470822c7 100644
--- a/app/assets/javascripts/glql/components/common/actions.vue
+++ b/app/assets/javascripts/glql/components/common/actions.vue
@@ -2,7 +2,6 @@
 import { GlDisclosureDropdown, GlTooltipDirective } from '@gitlab/ui';
 import { identity, uniqueId } from 'lodash';
 import { __ } from '~/locale';
-import { eventHubByKey } from '../../utils/event_hub_factory';
 
 export default {
   name: 'GlqlActions',
@@ -12,7 +11,6 @@ export default {
   directives: {
     GlTooltip: GlTooltipDirective,
   },
-  inject: ['queryKey'],
   props: {
     modalTitle: {
       type: String,
@@ -27,7 +25,6 @@ export default {
   },
   data() {
     return {
-      eventHub: eventHubByKey(this.queryKey),
       toggleId: uniqueId('dropdown-toggle-btn-'),
     };
   },
@@ -36,19 +33,19 @@ export default {
       return [
         {
           text: __('View source'),
-          action: () => this.eventHub.$emit('viewSource', { title: this.modalTitle }),
+          action: () => this.$emit('viewSource', { title: this.modalTitle }),
         },
         {
           text: __('Copy source'),
-          action: () => this.eventHub.$emit('copySource'),
+          action: () => this.$emit('copySource'),
         },
         this.showCopyContents && {
           text: __('Copy contents'),
-          action: () => this.eventHub.$emit('copyAsGFM'),
+          action: () => this.$emit('copyAsGFM'),
         },
         {
           text: __('Reload'),
-          action: () => this.eventHub.$emit('reload'),
+          action: () => this.$emit('reload'),
         },
       ].filter(identity);
     },
diff --git a/app/assets/javascripts/glql/components/common/facade.vue b/app/assets/javascripts/glql/components/common/facade.vue
index 36e22c18cbb..a0417322bc7 100644
--- a/app/assets/javascripts/glql/components/common/facade.vue
+++ b/app/assets/javascripts/glql/components/common/facade.vue
@@ -9,6 +9,8 @@ import {
   GlSprintf,
   GlExperimentBadge,
 } from '@gitlab/ui';
+import { uniqueId } from 'lodash';
+import { sha256 } from '~/lib/utils/text_utility';
 import { __, sprintf } from '~/locale';
 import CrudComponent from '~/vue_shared/components/crud_component.vue';
 import { renderMarkdown } from '~/notes/utils';
@@ -19,7 +21,7 @@ import { copyGLQLNodeAsGFM } from '../../utils/copy_as_gfm';
 import { executeAndPresentQuery, presentPreview, loadMore } from '../../core';
 import Counter from '../../utils/counter';
 import { eventHubByKey } from '../../utils/event_hub_factory';
-import GlqlFooter from './footer.vue';
+import GlqlPagination from './pagination.vue';
 import GlqlActions from './actions.vue';
 import GlqlFootnote from './footnote.vue';
 
@@ -37,7 +39,7 @@ export default {
     GlExperimentBadge,
     GlIntersectionObserver,
     CrudComponent,
-    GlqlFooter,
+    GlqlPagination,
     GlqlFootnote,
     GlqlActions,
   },
@@ -55,9 +57,10 @@ export default {
   data() {
     return {
       eventHub: eventHubByKey(this.queryKey),
+      crudComponentId: uniqueId('glql-crud-'),
 
       queryModalSettings: {
-        id: `glql-${this.queryKey}`,
+        id: uniqueId('glql-modal-'),
         show: false,
         title: '',
         primaryAction: { text: __('Copy source') },
@@ -109,13 +112,14 @@ export default {
       return `\`\`\`glql\n${this.query}\n\`\`\``;
     },
   },
+  watch: {
+    previewPresenter(previewPresenter) {
+      this.isCollapsed = previewPresenter?.config?.collapsed || false;
+    },
+  },
   async mounted() {
     this.loadOnClick = this.glFeatures.glqlLoadOnClick;
 
-    this.eventHub.$on('viewSource', this.viewSource.bind(this));
-    this.eventHub.$on('copySource', this.copySource.bind(this));
-    this.eventHub.$on('copyAsGFM', this.copyAsGFM.bind(this));
-    this.eventHub.$on('reload', this.reload.bind(this));
     this.eventHub.$on('loadMore', this.loadMore.bind(this));
   },
 
@@ -223,7 +227,7 @@ export default {
     renderMarkdown,
     async trackRender() {
       try {
-        this.trackEvent('render_glql_block', { label: this.queryKey });
+        this.trackEvent('render_glql_block', { label: await sha256(this.query) });
       } catch (e) {
         // ignore any tracking errors
       }
@@ -292,19 +296,26 @@ export default {
     <gl-intersection-observer v-else @appear="loadGlqlBlock">
       <template v-if="finalPresenter || previewPresenter">
         <crud-component
-          :anchor-id="queryKey"
+          :anchor-id="crudComponentId"
           :title="title"
           :description="config.description"
           :count="data.count"
           is-collapsible
-          persist-collapsed-state
+          :collapsed="isCollapsed"
           class="!gl-mt-5"
           :body-class="{ '!gl-m-0 !gl-p-0': data.count || isPreview }"
           @collapsed="isCollapsed = true"
           @expanded="isCollapsed = false"
         >
           <template #actions>
-            <glql-actions :show-copy-contents="showCopyContentsAction" :modal-title="title" />
+            <glql-actions
+              :show-copy-contents="showCopyContentsAction"
+              :modal-title="title"
+              @viewSource="viewSource"
+              @copySource="copySource"
+              @copyAsGFM="copyAsGFM"
+              @reload="reload"
+            />
           </template>
 
           <component :is="finalPresenter.component" v-if="finalPresenter" ref="presenter" />
@@ -313,7 +324,7 @@ export default {
             v-if="data.count && data.nodes.length < data.count"
             class="gl-border-t gl-border-section gl-p-3"
           >
-            <glql-footer :count="data.nodes.length" :total-count="data.count" />
+            <glql-pagination :count="data.nodes.length" :total-count="data.count" />
           </div>
 
           <template v-if="showEmptyState" #empty>
diff --git a/app/assets/javascripts/glql/components/common/footer.vue b/app/assets/javascripts/glql/components/common/pagination.vue
similarity index 98%
rename from app/assets/javascripts/glql/components/common/footer.vue
rename to app/assets/javascripts/glql/components/common/pagination.vue
index da6d8a9fdad..9452c8fdd32 100644
--- a/app/assets/javascripts/glql/components/common/footer.vue
+++ b/app/assets/javascripts/glql/components/common/pagination.vue
@@ -5,7 +5,7 @@ import { eventHubByKey } from '../../utils/event_hub_factory';
 import { DEFAULT_PAGE_SIZE } from '../../constants';
 
 export default {
-  name: 'GlqlFooter',
+  name: 'GlqlPagination',
   components: {
     GlButton,
   },
diff --git a/app/assets/javascripts/glql/utils/copy_as_gfm.js b/app/assets/javascripts/glql/utils/copy_as_gfm.js
index 43fbb77b360..754d067857d 100644
--- a/app/assets/javascripts/glql/utils/copy_as_gfm.js
+++ b/app/assets/javascripts/glql/utils/copy_as_gfm.js
@@ -6,7 +6,6 @@ export async function copyGLQLNodeAsGFM(el) {
       // eslint-disable-next-line no-param-reassign
       time.textContent = time.title;
     });
-    [...e.querySelectorAll('.gl-new-dropdown')].forEach((dropdown) => dropdown.remove());
   };
 
   const div = document.createElement('div');
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 8c6642112fe..ef0a519356a 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -169,12 +169,6 @@ module Ci
       )
     end
 
-    # TODO: Remove this scope when FF `ci_stop_using_has_exposed_artifacts_metadata_col` is removed
-    scope :with_exposed_artifacts, -> do
-      joins(:metadata).merge(Ci::BuildMetadata.with_exposed_artifacts)
-        .includes(:metadata, :job_artifacts_metadata)
-    end
-
     scope :with_artifacts_not_expired, -> { with_downloadable_artifacts.where('artifacts_expire_at IS NULL OR artifacts_expire_at > ?', Time.current) }
     scope :with_pipeline_locked_artifacts, -> { joins(:pipeline).where('pipeline.locked': Ci::Pipeline.lockeds[:artifacts_locked]) }
     scope :last_month, -> { where('created_at > ?', Date.today - 1.month) }
diff --git a/app/models/ci/build_metadata.rb b/app/models/ci/build_metadata.rb
index bffefb53eb5..db6456884cb 100644
--- a/app/models/ci/build_metadata.rb
+++ b/app/models/ci/build_metadata.rb
@@ -39,8 +39,6 @@ module Ci
     end
 
     scope :with_interruptible, -> { where(interruptible: true) }
-    # TODO: Remove this scope when FF `ci_stop_using_has_exposed_artifacts_metadata_col` is removed
-    scope :with_exposed_artifacts, -> { where(has_exposed_artifacts: true) }
 
     enum :timeout_source, {
       unknown_timeout_source: 1,
diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index 9b112053ce8..2cfc24d2c9b 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -1296,11 +1296,7 @@ module Ci
     end
 
     def has_exposed_artifacts?
-      if Feature.enabled?(:ci_stop_using_has_exposed_artifacts_metadata_col, project)
-        complete? && builds.latest.any_with_exposed_artifacts?
-      else
-        complete? && builds.latest.with_exposed_artifacts.exists?
-      end
+      complete? && builds.latest.any_with_exposed_artifacts?
     end
 
     def has_erasable_artifacts?
diff --git a/app/models/concerns/ci/metadatable.rb b/app/models/concerns/ci/metadatable.rb
index 0051f463c2b..6e24815059d 100644
--- a/app/models/concerns/ci/metadatable.rb
+++ b/app/models/concerns/ci/metadatable.rb
@@ -32,10 +32,9 @@ module Ci
       def self.any_with_exposed_artifacts?
         found_exposed_artifacts = false
 
-        # TODO: Remove :project preload when FF `ci_stop_using_has_exposed_artifacts_metadata_col` is removed
-        includes(:project).each_batch do |batch|
+        each_batch do |batch|
           # We only load what we need for `has_exposed_artifacts?`
-          records = batch.select(:id, :partition_id, :project_id, :options).to_a
+          records = batch.select(:id, :partition_id, :options).to_a
 
           ActiveRecord::Associations::Preloader.new(
             records: records,
@@ -58,11 +57,7 @@ module Ci
     end
 
     def has_exposed_artifacts?
-      if Feature.enabled?(:ci_stop_using_has_exposed_artifacts_metadata_col, project)
-        options.dig(:artifacts, :expose_as).present?
-      else
-        !!metadata&.has_exposed_artifacts?
-      end
+      options.dig(:artifacts, :expose_as).present?
     end
 
     def ensure_metadata
@@ -92,12 +87,6 @@ module Ci
 
     def options=(value)
       write_metadata_attribute(:options, :config_options, value)
-
-      # TODO: Remove code below when FF `ci_stop_using_has_exposed_artifacts_metadata_col` is removed
-      ensure_metadata.tap do |metadata|
-        # Store presence of exposed artifacts in build metadata to make it easier to query
-        metadata.has_exposed_artifacts = value&.dig(:artifacts, :expose_as).present?
-      end
     end
 
     def yaml_variables=(value)
diff --git a/app/serializers/merge_request_serializer.rb b/app/serializers/merge_request_serializer.rb
index 2805a9a7ccc..6412e5416b7 100644
--- a/app/serializers/merge_request_serializer.rb
+++ b/app/serializers/merge_request_serializer.rb
@@ -13,7 +13,7 @@ class MergeRequestSerializer < BaseSerializer
   def identified_entity(opts)
     case opts[:serializer]
     when 'sidebar'
-      MergeRequestSidebarBasicEntity
+      IssuableSidebarBasicEntity
     when 'sidebar_extras'
       MergeRequestSidebarExtrasEntity
     when 'basic'
diff --git a/app/serializers/merge_request_sidebar_basic_entity.rb b/app/serializers/merge_request_sidebar_basic_entity.rb
deleted file mode 100644
index 4b6cd50421a..00000000000
--- a/app/serializers/merge_request_sidebar_basic_entity.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-class MergeRequestSidebarBasicEntity < IssuableSidebarBasicEntity
-  expose :current_user, if: ->(_issuable) { current_user } do
-    expose :can_merge do |merge_request|
-      merge_request.can_be_merged_by?(current_user)
-    end
-
-    expose :can_update_merge_request do |merge_request|
-      current_user.can?(:update_merge_request, merge_request)
-    end
-  end
-end
-
-MergeRequestSidebarBasicEntity.prepend_mod_with('MergeRequestSidebarBasicEntity')
diff --git a/app/services/ci/find_exposed_artifacts_service.rb b/app/services/ci/find_exposed_artifacts_service.rb
index 27358a1da24..722782864d5 100644
--- a/app/services/ci/find_exposed_artifacts_service.rb
+++ b/app/services/ci/find_exposed_artifacts_service.rb
@@ -15,25 +15,15 @@ module Ci
     def for_pipeline(pipeline, limit: MAX_EXPOSED_ARTIFACTS)
       results = []
 
-      if Feature.enabled?(:ci_stop_using_has_exposed_artifacts_metadata_col, project)
-        pipeline.builds.latest.each_batch do |job_batch|
-          job_batch.select_with_exposed_artifacts.each do |job|
-            exposed_artifacts = for_job(job)
-            results << exposed_artifacts if exposed_artifacts
-
-            break if results.size >= limit
-          end
+      pipeline.builds.latest.each_batch do |job_batch|
+        job_batch.select_with_exposed_artifacts.each do |job|
+          exposed_artifacts = for_job(job)
+          results << exposed_artifacts if exposed_artifacts
 
           break if results.size >= limit
         end
-      else
-        pipeline.builds.latest.with_exposed_artifacts.find_each do |job|
-          if job_exposed_artifacts = for_job(job)
-            results << job_exposed_artifacts
-          end
 
-          break if results.size >= limit
-        end
+        break if results.size >= limit
       end
 
       results
diff --git a/config/feature_flags/gitlab_com_derisk/ci_stop_using_has_exposed_artifacts_metadata_col.yml b/config/feature_flags/gitlab_com_derisk/ci_stop_using_has_exposed_artifacts_metadata_col.yml
deleted file mode 100644
index 81cda919915..00000000000
--- a/config/feature_flags/gitlab_com_derisk/ci_stop_using_has_exposed_artifacts_metadata_col.yml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-name: ci_stop_using_has_exposed_artifacts_metadata_col
-description: >
-  Updates code to stop using p_ci_builds_metadata.has_exposed_artifacts. This means that
-  finding exposed artifacts requires iterating through all latest builds of a pipeline,
-  not just ones with has_exposed_artifacts = true.
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/work_items/550223
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/195693
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/551510
-milestone: '18.2'
-group: group::ci platform
-type: gitlab_com_derisk
-default_enabled: false
diff --git a/doc/user/application_security/security_inventory/_index.md b/doc/user/application_security/security_inventory/_index.md
index 17e952f1230..19d080ec252 100644
--- a/doc/user/application_security/security_inventory/_index.md
+++ b/doc/user/application_security/security_inventory/_index.md
@@ -27,48 +27,50 @@ For more information, see the history.
 
 {{< /alert >}}
 
-The security inventory provides an overview of your organization's security posture.
-It shows:
+Use the security inventory to visualize which assets you need to secure and understand the actions you need to take to improve security. A common phrase in security is, "you can't secure what you can't see." The security inventory provides visibility into the security posture of your organization's top-level groups, helps you identify coverage gaps, and enables you to make efficient, risk-based prioritization decisions.
+
+The security inventory shows:
 
 - Your groups, subgroups, and projects.
-- Which security scanners are enabled in each project, including:
+- Security scanner coverage for each project, regardless of how the scanner is enabled. Security scanners include:
   - Static application security testing (SAST)
   - Dependency scanning
   - Container scanning
   - Secret detection
   - Dynamic application security testing (DAST)
   - Infrastructure-as-code (IaC) scanning
-- The number of vulnerabilities in each group or project, sorted by security level.
+- The number of vulnerabilities in each group or project, sorted by severity level.
 
-Use the security inventory to visualize your assets, understand coverage gaps, and triage risks to your organization.
+This feature is in beta. Track the development of the security inventory in [epic 16484](https://gitlab.com/groups/gitlab-org/-/epics/16484). Share [your feedback](https://gitlab.com/gitlab-org/gitlab/-/issues/553062) with us as we continue to develop this feature. The security inventory is enabled by default.
 
-This feature is in beta. Track the development of the security inventory in [epic 16484](https://gitlab.com/groups/gitlab-org/-/epics/16484).
-
-## Getting started
-
-The security inventory is enabled by default.
+## View the security inventory
 
 Prerequisites:
 
-- You must have at least the Developer role.
+- You must have at least the Developer role in the group to view the security inventory.
 
 To view the security inventory:
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Secure > Security inventory**.
-1. Select a group to view its subgroups, projects, and security assets.
+1. Complete one of the following actions:
+   - To view a group's subgroups, projects, and security assets, select the group.
+   - To view a group or project's scanner coverage, search for the group or project.
 
 ## Related topics
 
 - [Security Dashboard](../security_dashboard/_index.md)
 - [Vulnerability reports](../vulnerability_report/_index.md)
+- GraphQL references:
+  - [AnalyzerGroupStatusType](../../../api/graphql/reference/_index.md#analyzergroupstatustype) - Counts for each analyzer status in the group and subgroups.
+  - [AnalyzerProjectStatusType](../../../api/graphql/reference/_index.md#analyzerprojectstatustype) - Analyzer status (success/fail) for projects.
+  - [VulnerabilityNamespaceStatisticType](../../../api/graphql/reference/_index.md#vulnerabilitynamespacestatistictype) - Counts for each vulnerability severity in the group and its subgroups.
+  - [VulnerabilityStatisticType](../../../api/graphql/reference/_index.md#vulnerabilitystatistictype) - Counts for each vulnerability severity in the project.
 
 ## Troubleshooting
 
-When working with the security inventory, you might encounter the following issues.
+When working with the security inventory, you might encounter the following issues:
 
-### Inaccurate scanner coverage
+### Security inventory menu item missing
 
-Due to a known issue, scanner configuration data is still being backfilled.
-As a result, the displayed container scanning and secret detection coverage might not be entirely accurate.
-A fix for this issue is proposed in [issue 548281](https://gitlab.com/gitlab-org/gitlab/-/issues/548281).
+Some users do not have the required permissions to access the **Security Inventory** menu item. The menu item only displays for groups when the authenticated user has the Developer role or higher.
diff --git a/doc/user/application_security/triage/_index.md b/doc/user/application_security/triage/_index.md
index f2d3bc23435..5418ec7896e 100644
--- a/doc/user/application_security/triage/_index.md
+++ b/doc/user/application_security/triage/_index.md
@@ -19,7 +19,8 @@ small and manageable.
 The objective of the triage phase is to either confirm or dismiss each vulnerability. A confirmed
 vulnerability continues to the analysis phase but a dismissed vulnerability does not.
 
-Use the data contained in the [security dashboard](../security_dashboard/_index.md) and the
+Use the data contained in the [security dashboard](../security_dashboard/_index.md), the
+[security inventory](../security_inventory/_index.md), and the
 [vulnerability report](../vulnerability_report/_index.md) to help triage vulnerabilities efficiently
 and effectively.
 
@@ -66,6 +67,8 @@ Prioritize vulnerabilities according to their risk.
   to help prioritize vulnerabilities. For example, vulnerabilities in the CISA Known Exploited
   Vulnerabilities (KEV) catalogue should be analyzed and remediated as highest priority because
   these are known to have been exploited.
+- For each group, go to the **Security inventory** to visualize the assets you need to secure and to understand
+  the actions that need to be taken to improve your security posture.
 - For each group, go to the **Security dashboard** and view the **Project security status** panel. This groups
   projects by their highest-severity vulnerability. Use this grouping to prioritize triaging
   vulnerabilities in each project.
diff --git a/doc/user/gitlab_com/_index.md b/doc/user/gitlab_com/_index.md
index 5a1bd28e5fc..901ddfe0377 100644
--- a/doc/user/gitlab_com/_index.md
+++ b/doc/user/gitlab_com/_index.md
@@ -400,10 +400,11 @@ Settings related to the deletion of projects and groups.
 
 - Delayed group deletion enabled by default for GitLab Premium and GitLab Ultimate in GitLab 16.1.
 - [Moved](https://gitlab.com/groups/gitlab-org/-/epics/17208) from GitLab Premium to GitLab Free in 18.0.
+- [Increased deletion period](https://gitlab.com/groups/gitlab-org/-/epics/17375) from seven days to 30 days in 18.0.2.
 
 {{< /history >}}
 
-Groups are permanently deleted after a seven-day delay.
+Groups are permanently deleted after a 30-day delay.
 
 See how to [view and restore groups marked for deletion](../group/_index.md#restore-a-group).
 
@@ -413,10 +414,11 @@ See how to [view and restore groups marked for deletion](../group/_index.md#rest
 
 - Delayed project deletion enabled by default for GitLab Premium and GitLab Ultimate in GitLab 16.1.
 - [Moved](https://gitlab.com/groups/gitlab-org/-/epics/17208) from GitLab Premium to GitLab Free in 18.0.
+- [Increased deletion period](https://gitlab.com/groups/gitlab-org/-/epics/17375) from seven-days to 30 days in 18.0.2.
 
 {{< /history >}}
 
-Projects are permanently deleted after a seven-day delay.
+Projects are permanently deleted after a 30-day delay.
 
 See how to [view and restore projects marked for deletion](../project/working_with_projects.md#restore-a-project).
 
diff --git a/doc/user/glql/_index.md b/doc/user/glql/_index.md
index 54e1f6a6a87..d8399319d91 100644
--- a/doc/user/glql/_index.md
+++ b/doc/user/glql/_index.md
@@ -134,8 +134,9 @@ This source should render a table like the one below:
 {{< history >}}
 
 - [Changed](https://gitlab.com/gitlab-org/gitlab/-/issues/508956) in GitLab 17.7: Configuring the presentation layer using YAML front matter is deprecated.
-- Parameters `title` and `description` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/183709) in GitLab 17.10.
+- `title` and `description` parameters [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/183709) in GitLab 17.10.
 - Sorting and pagination [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/502701) in GitLab 18.2.
+- `collapsed` parameter [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197824) in GitLab 18.3.
 
 {{< /history >}}
 
@@ -146,6 +147,7 @@ Supported parameters:
 
 | Parameter     | Default                                       | Description |
 | ------------- | --------------------------------------------- | ----------- |
+| `collapsed`   | `false`                                       | Whether to collapse or expand the view. |
 | `description` | None                                          | An optional description to display below the title. |
 | `display`     | `table`                                       | How to display the data. Supported options: `table`, `list`, or `orderedList`. |
 | `fields`      | `title`                                       | A comma-separated list of [fields](fields.md#fields-in-embedded-views) to include in the view. |
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 0c9b20001fd..775dc8a4e63 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -2391,6 +2391,9 @@ msgstr ""
 msgid "AICatalog|AI Catalog"
 msgstr ""
 
+msgid "AICatalog|Agent"
+msgstr ""
+
 msgid "AICatalog|Agents"
 msgstr ""
 
@@ -2424,6 +2427,12 @@ msgstr ""
 msgid "AICatalog|Failed to run agent."
 msgstr ""
 
+msgid "AICatalog|Flow"
+msgstr ""
+
+msgid "AICatalog|Flows"
+msgstr ""
+
 msgid "AICatalog|Get started with the AI Catalog"
 msgstr ""
 
@@ -73667,9 +73676,6 @@ msgstr ""
 msgid "added a Zoom call to this issue"
 msgstr ""
 
-msgid "agent"
-msgstr ""
-
 msgid "agents"
 msgstr ""
 
diff --git a/spec/frontend/glql/components/common/actions_spec.js b/spec/frontend/glql/components/common/actions_spec.js
index 74369ec253c..6e82417ae4b 100644
--- a/spec/frontend/glql/components/common/actions_spec.js
+++ b/spec/frontend/glql/components/common/actions_spec.js
@@ -2,23 +2,13 @@ import { nextTick } from 'vue';
 import { GlDisclosureDropdown } from '@gitlab/ui';
 import { mountExtended } from 'helpers/vue_test_utils_helper';
 import GlqlActions from '~/glql/components/common/actions.vue';
-import { eventHubByKey } from '~/glql/utils/event_hub_factory';
-
-jest.mock('~/glql/utils/event_hub_factory');
 
 describe('GlqlActions', () => {
   let wrapper;
-  let mockEventHub;
 
   const findDropdown = () => wrapper.findComponent(GlDisclosureDropdown);
 
   const createComponent = (props = {}, provide = {}) => {
-    mockEventHub = {
-      $emit: jest.fn(),
-    };
-
-    eventHubByKey.mockReturnValue(mockEventHub);
-
     wrapper = mountExtended(GlqlActions, {
       propsData: {
         ...props,
@@ -67,16 +57,14 @@ describe('GlqlActions', () => {
       findDropdown().props('items')[0].action();
       await nextTick();
 
-      expect(mockEventHub.$emit).toHaveBeenCalledWith('viewSource', {
-        title: 'Test Modal',
-      });
+      expect(wrapper.emitted('viewSource').at(0)).toEqual([{ title: 'Test Modal' }]);
     });
 
     it('emits copySource event when clicked', async () => {
       findDropdown().props('items')[1].action();
       await nextTick();
 
-      expect(mockEventHub.$emit).toHaveBeenCalledWith('copySource');
+      expect(wrapper.emitted('copySource').at(0)).toEqual([]);
     });
 
     it('emits copyAsGFM event when copy contents is clicked', async () => {
@@ -85,14 +73,14 @@ describe('GlqlActions', () => {
       findDropdown().props('items')[2].action();
       await nextTick();
 
-      expect(mockEventHub.$emit).toHaveBeenCalledWith('copyAsGFM');
+      expect(wrapper.emitted('copyAsGFM').at(0)).toEqual([]);
     });
 
     it('emits reload event when clicked', async () => {
       findDropdown().props('items')[2].action();
       await nextTick();
 
-      expect(mockEventHub.$emit).toHaveBeenCalledWith('reload');
+      expect(wrapper.emitted('reload').at(0)).toEqual([]);
     });
   });
 });
diff --git a/spec/frontend/glql/components/common/facade_spec.js b/spec/frontend/glql/components/common/facade_spec.js
index ad1f9ba01a5..1f162bfb7d4 100644
--- a/spec/frontend/glql/components/common/facade_spec.js
+++ b/spec/frontend/glql/components/common/facade_spec.js
@@ -8,7 +8,6 @@ import GlqlFacade from '~/glql/components/common/facade.vue';
 import GlqlActions from '~/glql/components/common/actions.vue';
 import { executeAndPresentQuery, presentPreview } from '~/glql/core';
 import Counter from '~/glql/utils/counter';
-import { eventHubByKey } from '~/glql/utils/event_hub_factory';
 import { MOCK_ISSUES } from '../../mock_data';
 
 jest.mock('~/glql/core');
@@ -16,7 +15,6 @@ jest.mock('~/glql/core');
 describe('GlqlFacade', () => {
   let wrapper;
   const mockQueryKey = 'glql_key';
-  const mockEventHub = eventHubByKey(mockQueryKey);
 
   const { bindInternalEventDocument } = useMockInternalEventsTracking();
   const createComponent = async (props = {}, glFeatures = {}) => {
@@ -111,7 +109,7 @@ describe('GlqlFacade', () => {
 
       expect(trackEventSpy).toHaveBeenCalledWith(
         'render_glql_block',
-        { label: 'glql_key' },
+        { label: expect.any(String) },
         undefined,
       );
     });
@@ -119,7 +117,7 @@ describe('GlqlFacade', () => {
     it('reloads the query when reload event is emitted on event hub', async () => {
       jest.spyOn(wrapper.vm, 'reloadGlqlBlock');
 
-      mockEventHub.$emit('reload');
+      wrapper.findComponent(GlqlActions).vm.$emit('reload');
 
       await nextTick();
 
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index f37bdd34fe9..7ad4e29cfba 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -405,36 +405,6 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
     end
   end
 
-  describe '.with_exposed_artifacts' do
-    subject { described_class.with_exposed_artifacts }
-
-    let_it_be(:job1) { create(:ci_build, pipeline: pipeline) }
-    let_it_be(:job3) { create(:ci_build, pipeline: pipeline) }
-
-    let!(:job2) { create(:ci_build, options: options, pipeline: pipeline) }
-
-    context 'when some jobs have exposed artifacts and some not' do
-      let(:options) { { artifacts: { expose_as: 'test', paths: ['test'] } } }
-
-      before_all do
-        job1.ensure_metadata.update!(has_exposed_artifacts: nil)
-        job3.ensure_metadata.update!(has_exposed_artifacts: false)
-      end
-
-      it 'selects only the jobs with exposed artifacts' do
-        is_expected.to eq([job2])
-      end
-    end
-
-    context 'when job does not expose artifacts' do
-      let(:options) { nil }
-
-      it 'returns an empty array' do
-        is_expected.to be_empty
-      end
-    end
-  end
-
   describe '.with_artifacts' do
     subject(:builds) { described_class.with_artifacts(artifact_scope) }
 
@@ -2229,14 +2199,6 @@ RSpec.describe Ci::Build, feature_category: :continuous_integration, factory_def
     it 'does not persist data in build' do
       expect(build.read_attribute(:options)).to be_nil
     end
-
-    context 'when options include artifacts:expose_as' do
-      let(:build) { create(:ci_build, options: { artifacts: { expose_as: 'test' } }, pipeline: pipeline) }
-
-      it 'saves the presence of expose_as into build metadata' do
-        expect(build.metadata).to have_exposed_artifacts
-      end
-    end
   end
 
   describe '#other_scheduled_actions' do
diff --git a/spec/serializers/merge_request_sidebar_basic_entity_spec.rb b/spec/serializers/merge_request_sidebar_basic_entity_spec.rb
deleted file mode 100644
index 11e8837dbb7..00000000000
--- a/spec/serializers/merge_request_sidebar_basic_entity_spec.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe MergeRequestSidebarBasicEntity, feature_category: :code_review_workflow do
-  let(:project) { create :project, :repository }
-  let(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
-  let(:user) { create(:user) }
-
-  let(:request) { double('request', current_user: user, project: project) }
-
-  let(:entity) { described_class.new(merge_request, request: request).as_json }
-
-  describe '#current_user' do
-    it 'contains attributes related to the current user' do
-      expect(entity[:current_user].keys).to include(
-        :id, :name, :username, :state, :avatar_url, :web_url, :todo,
-        :can_edit, :can_move, :can_admin_label, :can_merge
-      )
-    end
-  end
-end
diff --git a/spec/support/rspec_order_todo.yml b/spec/support/rspec_order_todo.yml
index 22948979d52..0e4bc4029e3 100644
--- a/spec/support/rspec_order_todo.yml
+++ b/spec/support/rspec_order_todo.yml
@@ -7040,7 +7040,6 @@
 - './spec/serializers/merge_request_poll_cached_widget_entity_spec.rb'
 - './spec/serializers/merge_request_poll_widget_entity_spec.rb'
 - './spec/serializers/merge_request_serializer_spec.rb'
-- './spec/serializers/merge_request_sidebar_basic_entity_spec.rb'
 - './spec/serializers/merge_request_sidebar_extras_entity_spec.rb'
 - './spec/serializers/merge_requests/pipeline_entity_spec.rb'
 - './spec/serializers/merge_request_user_entity_spec.rb'