From 8dc1b87ed1cefa5be61f2dc409f371a2d0e972d4 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 28 Feb 2024 09:11:54 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 GITLAB_SHELL_VERSION                          |   2 +-
 .../notes/components/note_header.vue          |  12 +-
 .../components/packages_protection_rules.vue  | 112 ++++++---
 ..._packages_protection_rule.mutation.graphql |  10 +
 .../omniauth_callbacks_controller.rb          |   6 -
 app/graphql/types/ci/job_token_scope_type.rb  |  22 +-
 app/models/ci/job_token/scope.rb              |   8 +
 app/models/wiki.rb                            |  46 ++--
 app/models/wiki_page.rb                       |   2 +-
 config/application.rb                         |   1 -
 doc/api/graphql/reference/index.md            |  14 +-
 .../database/not_null_constraints.md          |   5 +-
 lib/parameter_filters/saml_response.rb        |  42 ----
 locale/gitlab.pot                             |   8 +-
 qa/qa/git/repository.rb                       |   4 +-
 qa/qa/resource/repository/wiki_push.rb        |   3 +-
 .../project_based_content_creation_spec.rb    |  18 ++
 ...project_based_content_manipulation_spec.rb |  29 +++
 .../project_based_page_deletion_spec.rb       |  22 ++
 .../omniauth_callbacks_controller_spec.rb     |   6 -
 .../notes/components/note_header_spec.js      |  15 ++
 .../packages_protection_rules_spec.js         | 220 +++++++++++++++---
 .../settings/project/settings/mock_data.js    |  15 ++
 .../ci/job_token_scope_resolver_spec.rb       |  25 ++
 .../types/ci/job_token_scope_type_spec.rb     |   3 +-
 .../parameter_filters/saml_response_spec.rb   |  86 -------
 spec/models/wiki_page_spec.rb                 |  50 ++++
 .../add_group_or_project_spec.rb              |   6 +
 .../api/graphql/packages/package_spec.rb      |   2 +-
 .../api/graphql/project/merge_request_spec.rb |   6 +-
 .../models/wiki_shared_examples.rb            | 169 +++++++++++---
 31 files changed, 699 insertions(+), 270 deletions(-)
 create mode 100644 app/assets/javascripts/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql
 delete mode 100644 lib/parameter_filters/saml_response.rb
 delete mode 100644 spec/lib/parameter_filters/saml_response_spec.rb

diff --git a/GITLAB_SHELL_VERSION b/GITLAB_SHELL_VERSION
index 4589bfedddf..ad3b43598c7 100644
--- a/GITLAB_SHELL_VERSION
+++ b/GITLAB_SHELL_VERSION
@@ -1 +1 @@
-14.33.0
+14.34.0
diff --git a/app/assets/javascripts/notes/components/note_header.vue b/app/assets/javascripts/notes/components/note_header.vue
index c3701c01ee2..8ea95bdcb54 100644
--- a/app/assets/javascripts/notes/components/note_header.vue
+++ b/app/assets/javascripts/notes/components/note_header.vue
@@ -2,7 +2,7 @@
 import { GlIcon, GlBadge, GlLoadingIcon, GlTooltipDirective } from '@gitlab/ui';
 // eslint-disable-next-line no-restricted-imports
 import { mapActions } from 'vuex';
-import { getIdFromGraphQLId } from '~/graphql_shared/utils';
+import { isGid, getIdFromGraphQLId } from '~/graphql_shared/utils';
 import { __, s__ } from '~/locale';
 import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 
@@ -96,7 +96,15 @@ export default {
     noteTimestampLink() {
       if (this.noteUrl) return this.noteUrl;
 
-      return this.noteId ? `#note_${getIdFromGraphQLId(this.noteId)}` : undefined;
+      if (this.noteId) {
+        let { noteId } = this;
+
+        if (isGid(noteId)) noteId = getIdFromGraphQLId(noteId);
+
+        return `#note_${noteId}`;
+      }
+
+      return undefined;
     },
     hasAuthor() {
       return this.author && Object.keys(this.author).length;
diff --git a/app/assets/javascripts/packages_and_registries/settings/project/components/packages_protection_rules.vue b/app/assets/javascripts/packages_and_registries/settings/project/components/packages_protection_rules.vue
index 152ce8474f2..b8fc8ccb65c 100644
--- a/app/assets/javascripts/packages_and_registries/settings/project/components/packages_protection_rules.vue
+++ b/app/assets/javascripts/packages_and_registries/settings/project/components/packages_protection_rules.vue
@@ -8,21 +8,21 @@ import {
   GlKeysetPagination,
   GlModal,
   GlModalDirective,
+  GlFormSelect,
 } from '@gitlab/ui';
 import packagesProtectionRuleQuery from '~/packages_and_registries/settings/project/graphql/queries/get_packages_protection_rules.query.graphql';
 import { getPackageTypeLabel } from '~/packages_and_registries/package_registry/utils';
 import deletePackagesProtectionRuleMutation from '~/packages_and_registries/settings/project/graphql/mutations/delete_packages_protection_rule.mutation.graphql';
+import updatePackagesProtectionRuleMutation from '~/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql';
 import SettingsBlock from '~/packages_and_registries/shared/components/settings_block.vue';
 import PackagesProtectionRuleForm from '~/packages_and_registries/settings/project/components/packages_protection_rule_form.vue';
 import { s__, __ } from '~/locale';
 
 const PAGINATION_DEFAULT_PER_PAGE = 10;
 
-const ACCESS_LEVEL_GRAPHQL_VALUE_TO_LABEL = {
-  DEVELOPER: __('Developer'),
-  MAINTAINER: __('Maintainer'),
-  OWNER: __('Owner'),
-};
+const I18N_PUSH_PROTECTED_UP_TO_ACCESS_LEVEL = s__(
+  'PackageRegistry|Push protected up to access level',
+);
 
 export default {
   components: {
@@ -35,6 +35,7 @@ export default {
     PackagesProtectionRuleForm,
     GlKeysetPagination,
     GlModal,
+    GlFormSelect,
   },
   directives: {
     GlModal: GlModalDirective,
@@ -51,6 +52,7 @@ export default {
         'PackageRegistry|Users with at least the Developer role for this project will be able to publish, edit, and delete packages.',
       ),
     },
+    pushProtectedUpToAccessLevel: I18N_PUSH_PROTECTED_UP_TO_ACCESS_LEVEL,
   },
   data() {
     return {
@@ -59,11 +61,9 @@ export default {
       protectionRuleFormVisibility: false,
       packageProtectionRulesQueryPayload: { nodes: [], pageInfo: {} },
       packageProtectionRulesQueryPaginationParams: { first: PAGINATION_DEFAULT_PER_PAGE },
-      deleteInProgress: false,
-      deleteItem: null,
+      protectionRuleMutationInProgress: false,
+      protectionRuleMutationItem: null,
       alertErrorMessage: '',
-      protectionRuleDeletionInProgress: false,
-      protectionRuleDeletionItem: null,
     };
   },
   computed: {
@@ -71,12 +71,9 @@ export default {
       return this.packageProtectionRulesQueryResult.map((packagesProtectionRule) => {
         return {
           id: packagesProtectionRule.id,
+          pushProtectedUpToAccessLevel: packagesProtectionRule.pushProtectedUpToAccessLevel,
           col_1_package_name_pattern: packagesProtectionRule.packageNamePattern,
           col_2_package_type: getPackageTypeLabel(packagesProtectionRule.packageType),
-          col_3_push_protected_up_to_access_level:
-            ACCESS_LEVEL_GRAPHQL_VALUE_TO_LABEL[
-              packagesProtectionRule.pushProtectedUpToAccessLevel
-            ],
         };
       });
     },
@@ -105,6 +102,13 @@ export default {
         text: __('Cancel'),
       };
     },
+    pushProtectedUpToAccessLevelOptions() {
+      return [
+        { value: 'DEVELOPER', text: __('Developer') },
+        { value: 'MAINTAINER', text: __('Maintainer') },
+        { value: 'OWNER', text: __('Owner') },
+      ];
+    },
   },
   apollo: {
     packageProtectionRulesQueryPayload: {
@@ -146,16 +150,13 @@ export default {
         last: PAGINATION_DEFAULT_PER_PAGE,
       };
     },
-    isButtonDisabled(item) {
-      return this.protectionRuleDeletionItem === item && this.protectionRuleDeletionInProgress;
-    },
     showProtectionRuleDeletionConfirmModal(protectionRule) {
-      this.protectionRuleDeletionItem = protectionRule;
+      this.protectionRuleMutationItem = protectionRule;
     },
     deleteProtectionRule(protectionRule) {
       this.clearAlertMessage();
 
-      this.protectionRuleDeletionInProgress = true;
+      this.protectionRuleMutationInProgress = true;
 
       return this.$apollo
         .mutate({
@@ -175,30 +176,78 @@ export default {
           this.alertErrorMessage = e.message;
         })
         .finally(() => {
-          this.protectionRuleDeletionItem = null;
-          this.protectionRuleDeletionInProgress = false;
+          this.resetProtectionRuleMutation();
+        });
+    },
+    updatePackageProtectionRule(packageProtectionRule) {
+      this.clearAlertMessage();
+
+      this.protectionRuleMutationItem = packageProtectionRule;
+      this.protectionRuleMutationInProgress = true;
+
+      return this.$apollo
+        .mutate({
+          mutation: updatePackagesProtectionRuleMutation,
+          variables: {
+            input: {
+              id: packageProtectionRule.id,
+              pushProtectedUpToAccessLevel: packageProtectionRule.pushProtectedUpToAccessLevel,
+            },
+          },
+        })
+        .then(({ data }) => {
+          const [errorMessage] = data?.updatePackagesProtectionRule?.errors ?? [];
+          if (errorMessage) {
+            this.alertErrorMessage = errorMessage;
+          }
+
+          this.$toast.show(s__('PackageRegistry|Package protection rule updated.'));
+        })
+        .catch((error) => {
+          this.alertErrorMessage = error.message;
+        })
+        .finally(() => {
+          this.resetProtectionRuleMutation();
         });
     },
     clearAlertMessage() {
       this.alertErrorMessage = '';
     },
+    resetProtectionRuleMutation() {
+      this.protectionRuleMutationItem = null;
+      this.protectionRuleMutationInProgress = false;
+    },
+    isProtectionRulePushProtectedUpToAccessLevelFormSelectDisabled(item) {
+      return this.isProtectionRuleMutationInProgress(item);
+    },
+    isProtectionRuleDeleteButtonDisabled(item) {
+      return this.isProtectionRuleMutationInProgress(item);
+    },
+    isProtectionRuleMutationInProgress(item) {
+      return this.protectionRuleMutationItem === item && this.protectionRuleMutationInProgress;
+    },
   },
-  table: {},
   fields: [
     {
       key: 'col_1_package_name_pattern',
       label: s__('PackageRegistry|Package name pattern'),
+      tdClass: 'gl-w-30',
+    },
+    {
+      key: 'col_2_package_type',
+      label: s__('PackageRegistry|Package type'),
+      tdClass: 'gl-w-10',
     },
-    { key: 'col_2_package_type', label: s__('PackageRegistry|Package type') },
     {
       key: 'col_3_push_protected_up_to_access_level',
-      label: s__('PackageRegistry|Push protected up to access level'),
+      label: I18N_PUSH_PROTECTED_UP_TO_ACCESS_LEVEL,
+      tdClass: 'gl-w-15',
     },
     {
       key: 'col_4_actions',
       label: '',
       thClass: 'gl-display-none',
-      tdClass: 'gl-w-15p',
+      tdClass: 'gl-w-10',
     },
   ],
   modal: { id: 'delete-package-protection-rule-confirmation-modal' },
@@ -262,13 +311,24 @@ export default {
               <gl-loading-icon size="sm" class="gl-my-5" />
             </template>
 
+            <template #cell(col_3_push_protected_up_to_access_level)="{ item }">
+              <gl-form-select
+                v-model="item.pushProtectedUpToAccessLevel"
+                required
+                :aria-label="$options.i18n.pushProtectedUpToAccessLevel"
+                :options="pushProtectedUpToAccessLevelOptions"
+                :disabled="isProtectionRulePushProtectedUpToAccessLevelFormSelectDisabled(item)"
+                @change="updatePackageProtectionRule(item)"
+              />
+            </template>
+
             <template #cell(col_4_actions)="{ item }">
               <gl-button
                 v-gl-modal="$options.modal.id"
                 category="secondary"
                 variant="danger"
                 size="small"
-                :disabled="isButtonDisabled(item)"
+                :disabled="isProtectionRuleDeleteButtonDisabled(item)"
                 @click="showProtectionRuleDeletionConfirmModal(item)"
                 >{{ __('Delete') }}</gl-button
               >
@@ -293,7 +353,7 @@ export default {
         :title="$options.i18n.protectionRuleDeletionConfirmModal.title"
         :action-primary="modalActionPrimary"
         :action-cancel="modalActionCancel"
-        @primary="deleteProtectionRule(protectionRuleDeletionItem)"
+        @primary="deleteProtectionRule(protectionRuleMutationItem)"
       >
         <p>{{ $options.i18n.protectionRuleDeletionConfirmModal.description }}</p>
       </gl-modal>
diff --git a/app/assets/javascripts/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql b/app/assets/javascripts/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql
new file mode 100644
index 00000000000..a1087849469
--- /dev/null
+++ b/app/assets/javascripts/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql
@@ -0,0 +1,10 @@
+mutation updatePackagesProtectionRule($input: UpdatePackagesProtectionRuleInput!) {
+  updatePackagesProtectionRule(input: $input) {
+    packageProtectionRule {
+      id
+      packageType
+      packageNamePattern
+    }
+    errors
+  }
+}
diff --git a/app/controllers/omniauth_callbacks_controller.rb b/app/controllers/omniauth_callbacks_controller.rb
index 96f02fb039c..0701b1ee977 100644
--- a/app/controllers/omniauth_callbacks_controller.rb
+++ b/app/controllers/omniauth_callbacks_controller.rb
@@ -15,7 +15,6 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   after_action :verify_known_sign_in
 
   protect_from_forgery except: [:failure] + AuthHelper.saml_providers, with: :exception, prepend: true
-  before_action :log_saml_response, only: [:saml]
 
   feature_category :system_access
 
@@ -40,7 +39,6 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   # the number of failed sign in attempts
   def failure
     update_login_counter_metric(failed_strategy.name, 'failed')
-    log_saml_response if params['SAMLResponse']
 
     if params[:username].present? && AuthHelper.form_based_provider?(failed_strategy.name)
       user = User.find_by_login(params[:username])
@@ -359,10 +357,6 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
       session.delete(:provider_2FA)
     end
   end
-
-  def log_saml_response
-    Gitlab::AuthLogger.info(payload_type: 'saml_response', saml_response: ParameterFilters::SamlResponse.filter(params['SAMLResponse'].dup))
-  end
 end
 
 OmniauthCallbacksController.prepend_mod_with('OmniauthCallbacksController')
diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index 6e91bc395e1..2c1850a4f4b 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -26,14 +26,32 @@ module Types
       field :inbound_allowlist,
             Types::ProjectType.connection_type,
             null: false,
-            description: "Allow list of projects that can access the current project through its CI Job tokens.",
+            description: "Allowlist of projects that can access the current project " \
+                         "by authenticating with a CI/CD job token.",
             method: :inbound_projects
 
       field :groups_allowlist,
             Types::GroupType.connection_type,
             null: false,
-            description: "Allow list of groups that can access the current project through its CI Job tokens.",
+            description: "Allowlist of groups that can access the current project " \
+                         "by authenticating with a CI/CD job token.",
             method: :groups
+
+      field :inbound_allowlist_count,
+            GraphQL::Types::Int,
+            null: false,
+            description: "Count of projects that can access the current project " \
+                         "by authenticating with a CI/CD job token. " \
+                         "The count does not include nested projects.",
+            method: :inbound_projects_count
+
+      field :groups_allowlist_count,
+            GraphQL::Types::Int,
+            null: false,
+            description: "Count of groups that can access the current project " \
+                         "by authenticating with a CI/CD job token. " \
+                         "The count does not include subgroups.",
+            method: :groups_count
     end
   end
   # rubocop: enable Graphql/AuthorizeTypes
diff --git a/app/models/ci/job_token/scope.rb b/app/models/ci/job_token/scope.rb
index 01aa599a799..e2493e4e3b6 100644
--- a/app/models/ci/job_token/scope.rb
+++ b/app/models/ci/job_token/scope.rb
@@ -39,10 +39,18 @@ module Ci
         inbound_allowlist.projects
       end
 
+      def inbound_projects_count
+        inbound_projects.count
+      end
+
       def groups
         inbound_allowlist.groups
       end
 
+      def groups_count
+        groups.count
+      end
+
       private
 
       def outbound_accessible?(accessed_project)
diff --git a/app/models/wiki.rb b/app/models/wiki.rb
index 39d22ea0e07..eab28a614ca 100644
--- a/app/models/wiki.rb
+++ b/app/models/wiki.rb
@@ -216,10 +216,10 @@ class Wiki
 
     pages = paths.map do |path|
       page = Gitlab::Git::WikiPage.new(
-        url_path: sluggified_title(strip_extension(path)),
+        url_path: strip_extension(path),
         title: canonicalize_filename(path),
         format: find_page_format(path),
-        path: sluggified_title(path),
+        path: path,
         raw_data: '',
         name: canonicalize_filename(path),
         historical: false
@@ -255,16 +255,17 @@ class Wiki
     path = find_matched_file(title, version)
     return if path.blank?
 
+    path = Gitlab::EncodingHelper.encode_utf8_no_detect(path)
     blob_options = load_content ? {} : { limit: 0 }
     blob = repository.blob_at(version, path, **blob_options)
     commit = repository.commit(blob.commit_id)
     format = find_page_format(path)
 
     page = Gitlab::Git::WikiPage.new(
-      url_path: sluggified_title(strip_extension(path)),
+      url_path: strip_extension(path),
       title: canonicalize_filename(path),
       format: format,
-      path: sluggified_title(path),
+      path: path,
       raw_data: blob.data,
       name: canonicalize_filename(path),
       historical: version == default_branch ? false : check_page_historical(path, commit),
@@ -288,7 +289,12 @@ class Wiki
 
   def create_page(title, content, format = :markdown, message = nil)
     with_valid_format(format) do |default_extension|
-      next duplicated_page_error if file_exists_by_regex?(title)
+      sanitized_path = sluggified_full_path(title, default_extension)
+      # cannot create two pages with:
+      # - the same title but different format
+      # - the same title but different capitalization
+      # - the same title, different capitalization, and different format
+      next duplicated_page_error(sanitized_path) if file_exists_by_regex?(title)
 
       capture_git_error(:created) do
         create_wiki_repository unless repository_exists?
@@ -299,7 +305,7 @@ class Wiki
 
         true
       rescue Gitlab::Git::Index::IndexError
-        duplicated_page_error
+        duplicated_page_error(sanitized_path)
       end
     end
   end
@@ -315,9 +321,10 @@ class Wiki
 
       capture_git_error(:updated) do
         create_wiki_repository unless repository_exists?
+        sanitized_path = sluggified_full_path(title, extension)
         repository.update_file(
           user,
-          sluggified_full_path(title, extension),
+          sanitized_path,
           content,
           previous_path: page.path,
           **multi_commit_options(:updated, message, title))
@@ -331,7 +338,7 @@ class Wiki
 
         true
       rescue Gitlab::Git::Index::IndexError
-        duplicated_page_error
+        duplicated_page_error(sanitized_path)
       end
     end
   end
@@ -467,14 +474,14 @@ class Wiki
   def file_exists_by_regex?(title)
     return false unless repository_exists?
 
-    escaped_title = Regexp.escape(sluggified_title(title))
-    regex = Regexp.new("^#{escaped_title}\.#{ALLOWED_EXTENSIONS_REGEX}$", 'i')
-
-    repository.ls_files(default_branch).any? { |s| s =~ regex }
+    find_matched_file(title, default_branch).present?
   end
 
-  def duplicated_page_error
-    @error_message = _("Duplicate page: A page with that title already exists")
+  def duplicated_page_error(file)
+    @error_message = format(
+      _("Duplicate page: A page with that title already exists in the file %{file}"),
+      file: file)
+
     false
   end
 
@@ -491,15 +498,18 @@ class Wiki
   end
 
   def find_matched_file(title, version)
-    escaped_path = RE2::Regexp.escape(sluggified_title(title))
+    find_file_by_title(title, version) ||
+      find_file_by_title(sluggified_title(title), version)
+  end
+
+  def find_file_by_title(title, version)
+    escaped_path = RE2::Regexp.escape(title)
     path_regexp = Gitlab::EncodingHelper.encode_utf8_no_detect("(?i)^#{escaped_path}\\.(#{file_extension_regexp})$")
 
     matched_files = capture_git_error(:find) do
       repository.search_files_by_regexp(path_regexp, version, limit: 1)
     end
-    return if matched_files.blank?
-
-    Gitlab::EncodingHelper.encode_utf8_no_detect(matched_files.first)
+    matched_files.first
   end
 
   def find_page_format(path)
diff --git a/app/models/wiki_page.rb b/app/models/wiki_page.rb
index 3dd8f334a68..51d68b30442 100644
--- a/app/models/wiki_page.rb
+++ b/app/models/wiki_page.rb
@@ -381,7 +381,7 @@ class WikiPage
       return false
     end
 
-    @page = wiki.find_page(title).page
+    @page = wiki.find_page(::Wiki.sluggified_title(title)).page
     set_attributes
 
     true
diff --git a/config/application.rb b/config/application.rb
index 46f2241ca86..270a8260bc1 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -230,7 +230,6 @@ module Gitlab
       sharedSecret
       redirect
       question
-      SAMLResponse
     ]
 
     # This config option can be removed after Rails 7.1 by https://gitlab.com/gitlab-org/gitlab/-/issues/416270
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 84ce099c158..df2e53bda31 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -6805,7 +6805,7 @@ Input type: `ProvisionGoogleCloudRunnerInput`
 | <a id="mutationprovisiongooglecloudrunnerdryrun"></a>`dryRun` | [`Boolean`](#boolean) | If true, returns the Terraform script without executing it. Defaults to false. True is currently not supported. |
 | <a id="mutationprovisiongooglecloudrunnerephemeralmachinetype"></a>`ephemeralMachineType` | [`GoogleCloudMachineType!`](#googlecloudmachinetype) | Name of the machine type to use for running jobs. |
 | <a id="mutationprovisiongooglecloudrunnerprojectpath"></a>`projectPath` | [`ID!`](#id) | Project to create the runner in. |
-| <a id="mutationprovisiongooglecloudrunnerprovisioningprojectid"></a>`provisioningProjectId` | [`String!`](#string) | Identifier of the project where the runner is provisioned. |
+| <a id="mutationprovisiongooglecloudrunnerprovisioningprojectid"></a>`provisioningProjectId` | [`GoogleCloudProject!`](#googlecloudproject) | Identifier of the project where the runner is provisioned. |
 | <a id="mutationprovisiongooglecloudrunnerprovisioningregion"></a>`provisioningRegion` | [`GoogleCloudRegion!`](#googlecloudregion) | Name of the region to provision the runner in. |
 | <a id="mutationprovisiongooglecloudrunnerprovisioningzone"></a>`provisioningZone` | [`GoogleCloudZone!`](#googlecloudzone) | Name of the zone to provision the runner in. |
 | <a id="mutationprovisiongooglecloudrunnerrunnertoken"></a>`runnerToken` | [`String`](#string) | Authentication token of the runner. |
@@ -16387,8 +16387,10 @@ CI/CD variables for a GitLab instance.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allow list of groups that can access the current project through its CI Job tokens. (see [Connections](#connections)) |
-| <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allow list of projects that can access the current project through its CI Job tokens. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allowlist of groups that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypegroupsallowlistcount"></a>`groupsAllowlistCount` | [`Int!`](#int) | Count of groups that can access the current project by authenticating with a CI/CD job token. The count does not include subgroups. |
+| <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypeinboundallowlistcount"></a>`inboundAllowlistCount` | [`Int!`](#int) | Count of projects that can access the current project by authenticating with a CI/CD job token. The count does not include nested projects. |
 | <a id="cijobtokenscopetypeoutboundallowlist"></a>`outboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allow list of projects that are accessible using the current project's CI Job tokens. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypeprojects"></a>`projects` **{warning-solid}** | [`ProjectConnection!`](#projectconnection) | **Deprecated** in GitLab 15.9. The `projects` attribute is being deprecated. Use `outbound_allowlist`. |
 
@@ -26575,7 +26577,7 @@ Returns [`CiRunnerCloudProvisioningOptions`](#cirunnercloudprovisioningoptions).
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="projectrunnercloudprovisioningoptionscloudprojectid"></a>`cloudProjectId` | [`String!`](#string) | Identifier of the cloud project. |
+| <a id="projectrunnercloudprovisioningoptionscloudprojectid"></a>`cloudProjectId` | [`GoogleCloudProject!`](#googlecloudproject) | Identifier of the cloud project. |
 | <a id="projectrunnercloudprovisioningoptionsprovider"></a>`provider` | [`CiRunnerCloudProvider!`](#cirunnercloudprovider) | Identifier of the cloud provider. |
 
 ##### `Project.runners`
@@ -33887,6 +33889,10 @@ Global identifiers are encoded as strings.
 
 Represents a Google Cloud Compute machine type.
 
+### `GoogleCloudProject`
+
+Represents a Google Cloud Compute project.
+
 ### `GoogleCloudRegion`
 
 Represents a Google Cloud Compute region.
diff --git a/doc/development/database/not_null_constraints.md b/doc/development/database/not_null_constraints.md
index f682f34575b..daddada8758 100644
--- a/doc/development/database/not_null_constraints.md
+++ b/doc/development/database/not_null_constraints.md
@@ -65,7 +65,10 @@ The steps required are:
 
    1. Ensure $ATTRIBUTE value is being set at the application level.
       1. If the attribute has a default value, add the default value to the model so the default value is set for new records.
-      1. Update all places in the code where the attribute is being set to `nil`, if any, for new and existing records.
+      1. Update all places in the code where the attribute would be set to `nil`, if any, for new and existing records. Note that
+         using ActiveRecord callbacks such as `before_save` and `before_validation` may not be sufficient, as some processes
+         skip these callbacks. `update_column`, `update_columns`, and bulk operations such as `insert_all` and `update_all` are some
+         examples of methods to look out for.
    1. Add a post-deployment migration to fix the existing records.
 
      NOTE:
diff --git a/lib/parameter_filters/saml_response.rb b/lib/parameter_filters/saml_response.rb
deleted file mode 100644
index ab5a21b97bd..00000000000
--- a/lib/parameter_filters/saml_response.rb
+++ /dev/null
@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-module ParameterFilters
-  class SamlResponse
-    def self.filter(value)
-      return value unless value.presence
-
-      raw_response = if Base64.decode64(value).scan(/[^[:ascii:]]/).count == 0
-                       Base64.decode64(value)
-                     else
-                       value
-                     end
-
-      response = Nokogiri::XML(raw_response) do |config|
-        config.options = Nokogiri::XML::ParseOptions::NONET
-      end
-
-      [
-        '/samlp:Response/@IssueInstant',
-        '/samlp:Response/saml:Assertion/@IssueInstant',
-        '/samlp:Response/saml:Assertion/saml:Conditions/@NotBefore',
-        '/samlp:Response/saml:Assertion/saml:Conditions/@NotOnOrAfter',
-        '/samlp:Response/saml:Assertion/saml:AuthnStatement/@AuthnInstant',
-        '/samlp:Response/saml:Assertion/saml:AuthnStatement/@SessionNotOnOrAfter'
-      ].each do |xpath|
-        response.at_xpath(xpath).value = 'REDACTED'
-      end
-
-      [
-        ['//ds:Signature/ds:SignatureValue', { ds: 'http://www.w3.org/2000/09/xmldsig#' }],
-        ['//ds:Signature/ds:SignedInfo/ds:Reference/ds:DigestValue', { ds: 'http://www.w3.org/2000/09/xmldsig#' }]
-      ].each do |xpath, namespace|
-        response.at_xpath(xpath, namespace.presence).content = 'REDACTED'
-      end
-
-      response.to_xml
-
-    rescue Nokogiri::XML::SyntaxError
-      'REDACTED'
-    end
-  end
-end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 615923ceb79..4f48f1f7cef 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -18505,7 +18505,7 @@ msgstr ""
 msgid "DuoProTrial|We just need some additional information to activate your trial."
 msgstr ""
 
-msgid "Duplicate page: A page with that title already exists"
+msgid "Duplicate page: A page with that title already exists in the file %{file}"
 msgstr ""
 
 msgid "Duration"
@@ -35441,6 +35441,9 @@ msgstr ""
 msgid "PackageRegistry|Package protection rule deleted."
 msgstr ""
 
+msgid "PackageRegistry|Package protection rule updated."
+msgstr ""
+
 msgid "PackageRegistry|Package protection rules"
 msgstr ""
 
@@ -35885,6 +35888,9 @@ msgstr ""
 msgid "Pending sync…"
 msgstr ""
 
+msgid "PendingMembers|There are no pending members left to approve. High five!"
+msgstr ""
+
 msgid "People without permission will never get a notification and won't be able to comment."
 msgstr ""
 
diff --git a/qa/qa/git/repository.rb b/qa/qa/git/repository.rb
index 966cc596a08..8e551976cd3 100644
--- a/qa/qa/git/repository.rb
+++ b/qa/qa/git/repository.rb
@@ -94,11 +94,11 @@ module QA
         ::File.write(name, contents)
 
         if use_lfs?
-          git_lfs_track_result = run_git(%(git lfs track #{name} --lockable))
+          git_lfs_track_result = run_git(%(git lfs track "#{name}" --lockable))
           return git_lfs_track_result.response unless git_lfs_track_result.success?
         end
 
-        git_add_result = run_git(%(git add #{name}))
+        git_add_result = run_git(%(git add "#{name}"))
 
         git_lfs_track_result.to_s + git_add_result.to_s
       end
diff --git a/qa/qa/resource/repository/wiki_push.rb b/qa/qa/resource/repository/wiki_push.rb
index aa69d831bff..71cde69f110 100644
--- a/qa/qa/resource/repository/wiki_push.rb
+++ b/qa/qa/resource/repository/wiki_push.rb
@@ -32,7 +32,8 @@ module QA
           # workaround
           # i.e. This replaces the last occurence of the string (case sensitive)
           # and attaches everything before to the new substring
-          repository_http_uri.to_s.gsub(/(.*)\b\.wiki\.git\b/i, "\\1/-/wikis/#{@file_name.gsub('.md', '')}")
+          wiki_title = ERB::Util.url_encode(@file_name.gsub('.md', ''))
+          repository_http_uri.to_s.gsub(/(.*)\b\.wiki\.git\b/i, "\\1/-/wikis/#{wiki_title}")
         end
       end
     end
diff --git a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_creation_spec.rb b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_creation_spec.rb
index c8d500a4c83..4bd0d659691 100644
--- a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_creation_spec.rb
+++ b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_creation_spec.rb
@@ -5,6 +5,8 @@ module QA
     describe 'Testing wiki content creation inside a project' do
       let(:new_wiki_title) { "just_another_wiki_page" }
       let(:new_wiki_content) { "this content is changed or added" }
+      let(:new_wiki_page_with_spaces_in_the_path) { "a wiki page with spaces in the path" }
+      let(:new_wiki_page_with_spaces_in_the_path_content) { "content for the wiki page with spaces in the path" }
       let(:commit_message) { "this is a new addition to the wiki" }
 
       let(:project) { create(:project) }
@@ -88,6 +90,22 @@ module QA
           expect(wiki).to have_content new_wiki_content
         end
       end
+
+      it 'by adding a wiki page with spaces in the path using git push',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/442387' do
+        Resource::Repository::WikiPush.fabricate! do |push|
+          push.file_name = "#{new_wiki_page_with_spaces_in_the_path}.md"
+          push.file_content = new_wiki_page_with_spaces_in_the_path_content
+          push.commit_message = commit_message
+          push.wiki = wiki
+          push.new_branch = false
+        end.visit!
+
+        Page::Project::Wiki::Show.perform do |wiki|
+          expect(wiki).to have_title new_wiki_page_with_spaces_in_the_path
+          expect(wiki).to have_content new_wiki_page_with_spaces_in_the_path_content
+        end
+      end
     end
   end
 end
diff --git a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_manipulation_spec.rb b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_manipulation_spec.rb
index 4b103d06e84..4c86634ec98 100644
--- a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_manipulation_spec.rb
+++ b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_content_manipulation_spec.rb
@@ -5,6 +5,9 @@ module QA
     describe 'Testing wiki content manipulation inside a project' do
       let(:new_wiki_title) { "just_another_wiki_page" }
       let(:new_wiki_content) { "this content is changed or added" }
+      let(:new_wiki_page_with_spaces_in_the_path) { "a wiki page with spaces in the path" }
+      let(:new_wiki_page_with_dashes_in_the_path) { "a-wiki-page-with-spaces-in-the-path" }
+      let(:new_wiki_page_with_spaces_in_the_path_content) { "content for the wiki page with spaces in the path" }
       let(:commit_message) { "this is a new addition to the wiki" }
 
       let(:wiki) { create(:project_wiki_page) }
@@ -33,6 +36,32 @@ module QA
         end
       end
 
+      it 'by manipulating content on the page with spaces',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/442390' do
+        Resource::Repository::WikiPush.fabricate! do |push|
+          push.file_name = "#{new_wiki_page_with_spaces_in_the_path}.md"
+          push.file_content = new_wiki_page_with_spaces_in_the_path_content
+          push.commit_message = commit_message
+          push.wiki = wiki
+          push.new_branch = false
+        end.visit!
+
+        Page::Project::Wiki::Show.perform(&:click_edit)
+
+        Page::Project::Wiki::Edit.perform do |edit|
+          edit.set_content new_wiki_content
+          edit.set_message commit_message
+        end
+
+        Page::Project::Wiki::Edit.perform(&:click_submit)
+
+        Page::Project::Wiki::Show.perform do |wiki|
+          expect(page).to have_current_path(/#{new_wiki_page_with_dashes_in_the_path}$/)
+          expect(wiki).to have_title new_wiki_page_with_spaces_in_the_path
+          expect(wiki).to have_content new_wiki_content
+        end
+      end
+
       it 'by manipulating content on the page using git push',
         testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347811' do
         Resource::Repository::WikiPush.fabricate! do |push|
diff --git a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_page_deletion_spec.rb b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_page_deletion_spec.rb
index abec393d9c0..1fd7c548b21 100644
--- a/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_page_deletion_spec.rb
+++ b/qa/qa/specs/features/browser_ui/2_plan/project_wiki/project_based_page_deletion_spec.rb
@@ -4,6 +4,9 @@ module QA
   RSpec.describe 'Plan' do
     describe 'Testing project wiki', product_group: :knowledge do
       let(:initial_wiki) { create(:project_wiki_page) }
+      let(:new_wiki_page_with_spaces_in_the_path) { "a wiki page with spaces in the path" }
+      let(:new_wiki_page_with_spaces_in_the_path_content) { "content for the wiki page with spaces in the path" }
+      let(:commit_message) { "this is a new addition to the wiki" }
 
       before do
         Flow::Login.sign_in
@@ -19,6 +22,25 @@ module QA
           expect(wiki).to have_no_page
         end
       end
+
+      it 'can delete a page with spaces in the path',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/442389' do
+        Resource::Repository::WikiPush.fabricate! do |push|
+          push.file_name = "#{new_wiki_page_with_spaces_in_the_path}.md"
+          push.file_content = new_wiki_page_with_spaces_in_the_path_content
+          push.commit_message = commit_message
+          push.wiki = initial_wiki
+          push.new_branch = false
+        end.visit!
+
+        Page::Project::Wiki::Show.perform(&:click_edit)
+        Page::Project::Wiki::Edit.perform(&:delete_page)
+
+        Page::Project::Wiki::Show.perform do |wiki|
+          expect(wiki).to have_page_listed("Home")
+          expect(wiki).not_to have_page_listed(new_wiki_page_with_spaces_in_the_path)
+        end
+      end
     end
   end
 end
diff --git a/spec/controllers/omniauth_callbacks_controller_spec.rb b/spec/controllers/omniauth_callbacks_controller_spec.rb
index 8070ae554b3..e99d9e949a8 100644
--- a/spec/controllers/omniauth_callbacks_controller_spec.rb
+++ b/spec/controllers/omniauth_callbacks_controller_spec.rb
@@ -668,12 +668,6 @@ RSpec.describe OmniauthCallbacksController, type: :controller, feature_category:
 
         expect(flash[:alert]).to start_with 'Signing in using your saml account without a pre-existing GitLab account is not allowed.'
       end
-
-      it 'logs saml_response for debugging' do
-        expect(Gitlab::AuthLogger).to receive(:info).with(payload_type: 'saml_response', saml_response: anything)
-
-        post :saml, params: { SAMLResponse: mock_saml_response }
-      end
     end
 
     context 'with GitLab initiated request' do
diff --git a/spec/frontend/notes/components/note_header_spec.js b/spec/frontend/notes/components/note_header_spec.js
index 54f2bcd09ed..e069127f47a 100644
--- a/spec/frontend/notes/components/note_header_spec.js
+++ b/spec/frontend/notes/components/note_header_spec.js
@@ -196,6 +196,21 @@ describe('NoteHeader component', () => {
       expect(findTimestamp().exists()).toBe(false);
     });
 
+    it('generates correct link for alphanumeric noteId', () => {
+      createComponent({
+        createdAt: new Date().toISOString(),
+        noteId: 'afccb75d1ce204bd6f96c3a58dfb4be906b14a6e',
+      });
+      expect(findTimestampLink().attributes('href')).toBe(
+        '#note_afccb75d1ce204bd6f96c3a58dfb4be906b14a6e',
+      );
+    });
+
+    it('generates correct link for GraphQL GID', () => {
+      createComponent({ createdAt: new Date().toISOString(), noteId: 'gid://gitlab/Note/123' });
+      expect(findTimestampLink().attributes('href')).toBe('#note_123');
+    });
+
     it('shows timestamp as plain text if a noteId was not provided', () => {
       createComponent({ createdAt: new Date().toISOString() });
       expect(findTimestampLink().exists()).toBe(false);
diff --git a/spec/frontend/packages_and_registries/settings/project/settings/components/packages_protection_rules_spec.js b/spec/frontend/packages_and_registries/settings/project/settings/components/packages_protection_rules_spec.js
index 45088d49c82..2939739f430 100644
--- a/spec/frontend/packages_and_registries/settings/project/settings/components/packages_protection_rules_spec.js
+++ b/spec/frontend/packages_and_registries/settings/project/settings/components/packages_protection_rules_spec.js
@@ -1,5 +1,4 @@
 import { GlLoadingIcon, GlKeysetPagination, GlModal } from '@gitlab/ui';
-import { shallowMount } from '@vue/test-utils';
 import Vue from 'vue';
 import VueApollo from 'vue-apollo';
 import { mountExtended, extendedWrapper } from 'helpers/vue_test_utils_helper';
@@ -11,10 +10,12 @@ import PackagesProtectionRuleForm from '~/packages_and_registries/settings/proje
 import SettingsBlock from '~/packages_and_registries/shared/components/settings_block.vue';
 import packagesProtectionRuleQuery from '~/packages_and_registries/settings/project/graphql/queries/get_packages_protection_rules.query.graphql';
 import deletePackagesProtectionRuleMutation from '~/packages_and_registries/settings/project/graphql/mutations/delete_packages_protection_rule.mutation.graphql';
+import updatePackagesProtectionRuleMutation from '~/packages_and_registries/settings/project/graphql/mutations/update_packages_protection_rule.mutation.graphql';
 import {
   packagesProtectionRuleQueryPayload,
   packagesProtectionRulesData,
   deletePackagesProtectionRuleMutationPayload,
+  updatePackagesProtectionRuleMutationPayload,
 } from '../mock_data';
 
 Vue.use(VueApollo);
@@ -41,7 +42,7 @@ describe('Packages protection rules project settings', () => {
   const findAlert = () => wrapper.findByRole('alert');
   const findModal = () => wrapper.findComponent(GlModal);
 
-  const mountComponent = (mountFn = shallowMount, provide = defaultProvidedValues, config) => {
+  const mountComponent = (mountFn = mountExtended, provide = defaultProvidedValues, config) => {
     wrapper = mountFn(PackagesProtectionRules, {
       stubs: {
         SettingsBlock,
@@ -56,7 +57,7 @@ describe('Packages protection rules project settings', () => {
   };
 
   const createComponent = ({
-    mountFn = shallowMount,
+    mountFn = mountExtended,
     provide = defaultProvidedValues,
     packagesProtectionRuleQueryResolver = jest
       .fn()
@@ -64,11 +65,15 @@ describe('Packages protection rules project settings', () => {
     deletePackagesProtectionRuleMutationResolver = jest
       .fn()
       .mockResolvedValue(deletePackagesProtectionRuleMutationPayload()),
+    updatePackagesProtectionRuleMutationResolver = jest
+      .fn()
+      .mockResolvedValue(updatePackagesProtectionRuleMutationPayload()),
     config = {},
   } = {}) => {
     const requestHandlers = [
       [packagesProtectionRuleQuery, packagesProtectionRuleQueryResolver],
       [deletePackagesProtectionRuleMutation, deletePackagesProtectionRuleMutationResolver],
+      [updatePackagesProtectionRuleMutation, updatePackagesProtectionRuleMutationResolver],
     ];
 
     fakeApollo = createMockApollo(requestHandlers);
@@ -80,7 +85,7 @@ describe('Packages protection rules project settings', () => {
   };
 
   it('renders the setting block with table', async () => {
-    createComponent({ mountFn: mountExtended });
+    createComponent();
 
     await waitForPromises();
 
@@ -90,7 +95,7 @@ describe('Packages protection rules project settings', () => {
 
   describe('table "package protection rules"', () => {
     it('renders table with packages protection rules', async () => {
-      createComponent({ mountFn: mountExtended });
+      createComponent();
 
       await waitForPromises();
 
@@ -106,7 +111,7 @@ describe('Packages protection rules project settings', () => {
     });
 
     it('displays table in busy state and shows loading icon inside table', async () => {
-      createComponent({ mountFn: mountExtended });
+      createComponent();
 
       expect(findTableLoadingIcon().exists()).toBe(true);
       expect(findTableLoadingIcon().attributes('aria-label')).toBe('Loading');
@@ -134,7 +139,7 @@ describe('Packages protection rules project settings', () => {
       const findPagination = () => wrapper.findComponent(GlKeysetPagination);
 
       it('renders pagination', async () => {
-        createComponent({ mountFn: mountExtended });
+        createComponent();
 
         await waitForPromises();
 
@@ -181,7 +186,7 @@ describe('Packages protection rules project settings', () => {
           extendedWrapper(findPagination()).findByRole('button', { name: 'Previous' });
 
         beforeEach(async () => {
-          createComponent({ mountFn: mountExtended, packagesProtectionRuleQueryResolver });
+          createComponent({ packagesProtectionRuleQueryResolver });
 
           await waitForPromises();
 
@@ -220,7 +225,7 @@ describe('Packages protection rules project settings', () => {
           extendedWrapper(findPagination()).findByRole('button', { name: 'Next' });
 
         beforeEach(async () => {
-          createComponent({ mountFn: mountExtended, packagesProtectionRuleQueryResolver });
+          createComponent({ packagesProtectionRuleQueryResolver });
 
           await waitForPromises();
 
@@ -240,10 +245,164 @@ describe('Packages protection rules project settings', () => {
       });
     });
 
-    describe('table rows', () => {
+    describe('column "Push protected up to access level" with selectbox (combobox)', () => {
+      const findComboboxInTableRow = (i) =>
+        extendedWrapper(
+          findTableRow(i).findByRole('combobox', { name: /push protected up to access level/i }),
+        );
+
+      it('contains combobox with respective access level', async () => {
+        createComponent();
+
+        await waitForPromises();
+
+        expect(findComboboxInTableRow(0).isVisible()).toBe(true);
+        expect(findComboboxInTableRow(0).attributes('disabled')).toBeUndefined();
+        expect(findComboboxInTableRow(0).element.value).toBe(
+          packagesProtectionRulesData[0].pushProtectedUpToAccessLevel,
+        );
+      });
+
+      it('contains combobox with allowed access levels', async () => {
+        createComponent();
+
+        await waitForPromises();
+
+        ['Developer', 'Maintainer', 'Owner'].forEach((optionName) => {
+          const selectOption = findComboboxInTableRow(0).findByRole('option', { name: optionName });
+          expect(selectOption.exists()).toBe(true);
+        });
+      });
+
+      describe('when value changes', () => {
+        const accessLevelValueOwner = 'OWNER';
+        const accessLevelValueMaintainer = 'MAINTAINER';
+        const accessLevelValueDeveloper = 'DEVELOPER';
+
+        it('only changes the value of the selectbox in the same row', async () => {
+          createComponent();
+
+          await waitForPromises();
+
+          expect(findComboboxInTableRow(0).props('value')).toBe(accessLevelValueMaintainer);
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+          expect(findComboboxInTableRow(0).props('value')).toBe(accessLevelValueOwner);
+
+          expect(findComboboxInTableRow(1).props('value')).toBe(accessLevelValueMaintainer);
+          await findComboboxInTableRow(1).setValue(accessLevelValueDeveloper);
+          expect(findComboboxInTableRow(1).props('value')).toBe(accessLevelValueDeveloper);
+
+          expect(findComboboxInTableRow(0).props('value')).toBe(accessLevelValueOwner);
+        });
+
+        it('sends graphql mutation', async () => {
+          const updatePackagesProtectionRuleMutationResolver = jest
+            .fn()
+            .mockResolvedValue(updatePackagesProtectionRuleMutationPayload());
+
+          createComponent({ updatePackagesProtectionRuleMutationResolver });
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          expect(updatePackagesProtectionRuleMutationResolver).toHaveBeenCalledTimes(1);
+          expect(updatePackagesProtectionRuleMutationResolver).toHaveBeenCalledWith({
+            input: {
+              id: packagesProtectionRulesData[0].id,
+              pushProtectedUpToAccessLevel: accessLevelValueOwner,
+            },
+          });
+        });
+
+        it('disables only the changed selectbox and keeps other selectboxes in other table rows active when graphql mutation is in progress', async () => {
+          createComponent();
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          expect(findComboboxInTableRow(0).props('disabled')).toBe(true);
+          expect(findComboboxInTableRow(1).props('disabled')).toBe(false);
+
+          await waitForPromises();
+
+          expect(findComboboxInTableRow(0).props('disabled')).toBe(false);
+          expect(findComboboxInTableRow(1).props('disabled')).toBe(false);
+        });
+
+        it('disables selectbox (and other interactive elements in table row) when graphql mutation is in progress', async () => {
+          createComponent();
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          expect(findComboboxInTableRow(0).props('disabled')).toBe(true);
+          expect(findTableRowButtonDelete(0).props('disabled')).toBe(true);
+
+          await waitForPromises();
+
+          expect(findComboboxInTableRow(1).props('disabled')).toBe(false);
+          expect(findTableRowButtonDelete(1).props('disabled')).toBe(false);
+        });
+
+        it('handles erroneous graphql mutation', async () => {
+          const updatePackagesProtectionRuleMutationResolver = jest
+            .fn()
+            .mockRejectedValue(new Error('error'));
+
+          createComponent({ updatePackagesProtectionRuleMutationResolver });
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          await waitForPromises();
+
+          expect(findAlert().isVisible()).toBe(true);
+          expect(findAlert().text()).toBe('error');
+        });
+
+        it('handles graphql mutation with error response', async () => {
+          const serverErrorMessage = 'Server error message';
+          const updatePackagesProtectionRuleMutationResolver = jest.fn().mockResolvedValue(
+            updatePackagesProtectionRuleMutationPayload({
+              packageProtectionRule: null,
+              errors: [serverErrorMessage],
+            }),
+          );
+
+          createComponent({ updatePackagesProtectionRuleMutationResolver });
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          await waitForPromises();
+
+          expect(findAlert().isVisible()).toBe(true);
+          expect(findAlert().text()).toBe(serverErrorMessage);
+        });
+
+        it('shows a toast with success message', async () => {
+          createComponent();
+
+          await waitForPromises();
+
+          await findComboboxInTableRow(0).setValue(accessLevelValueOwner);
+
+          await waitForPromises();
+
+          expect($toast.show).toHaveBeenCalledWith('Package protection rule updated.');
+        });
+      });
+    });
+
+    describe('column "Actions"', () => {
       describe('button "Delete"', () => {
         it('exists in table', async () => {
-          createComponent({ mountFn: mountExtended });
+          createComponent();
 
           await waitForPromises();
 
@@ -251,8 +410,8 @@ describe('Packages protection rules project settings', () => {
         });
 
         describe('when button is clicked', () => {
-          it('binds confirmation modal', async () => {
-            createComponent({ mountFn: mountExtended });
+          it('binds modal "confirmation for delete action"', async () => {
+            createComponent();
 
             await waitForPromises();
 
@@ -271,17 +430,14 @@ describe('Packages protection rules project settings', () => {
     });
   });
 
-  describe('modal "confirmation"', () => {
+  describe('modal "confirmation for delete action"', () => {
     const createComponentAndClickButtonDeleteInTableRow = async ({
       tableRowIndex = 0,
       deletePackagesProtectionRuleMutationResolver = jest
         .fn()
         .mockResolvedValue(deletePackagesProtectionRuleMutationPayload()),
     } = {}) => {
-      createComponent({
-        mountFn: mountExtended,
-        deletePackagesProtectionRuleMutationResolver,
-      });
+      createComponent({ deletePackagesProtectionRuleMutationResolver });
 
       await waitForPromises();
 
@@ -369,7 +525,6 @@ describe('Packages protection rules project settings', () => {
           .mockResolvedValue(packagesProtectionRuleQueryPayload());
 
         createComponent({
-          mountFn: mountExtended,
           packagesProtectionRuleQueryResolver,
           deletePackagesProtectionRuleMutationResolver,
         });
@@ -399,34 +554,34 @@ describe('Packages protection rules project settings', () => {
     });
   });
 
-  it('does not initially render package protection form', async () => {
-    createComponent({ mountFn: mountExtended });
-
-    await waitForPromises();
-
-    expect(findAddProtectionRuleButton().isVisible()).toBe(true);
-    expect(findProtectionRuleForm().exists()).toBe(false);
-  });
-
   describe('button "Add protection rule"', () => {
     it('button exists', async () => {
-      createComponent({ mountFn: mountExtended });
+      createComponent();
 
       await waitForPromises();
 
       expect(findAddProtectionRuleButton().isVisible()).toBe(true);
     });
 
+    it('does not initially render form "add package protection"', async () => {
+      createComponent();
+
+      await waitForPromises();
+
+      expect(findAddProtectionRuleButton().isVisible()).toBe(true);
+      expect(findProtectionRuleForm().exists()).toBe(false);
+    });
+
     describe('when button is clicked', () => {
       beforeEach(async () => {
-        createComponent({ mountFn: mountExtended });
+        createComponent();
 
         await waitForPromises();
 
         await findAddProtectionRuleButton().trigger('click');
       });
 
-      it('renders package protection form', () => {
+      it('renders form "add package protection"', () => {
         expect(findProtectionRuleForm().isVisible()).toBe(true);
       });
 
@@ -444,7 +599,7 @@ describe('Packages protection rules project settings', () => {
         .fn()
         .mockResolvedValue(packagesProtectionRuleQueryPayload());
 
-      createComponent({ packagesProtectionRuleQueryResolver, mountFn: mountExtended });
+      createComponent({ packagesProtectionRuleQueryResolver });
 
       await waitForPromises();
 
@@ -476,7 +631,6 @@ describe('Packages protection rules project settings', () => {
     it('renders alert and dismisses it correctly', async () => {
       const alertErrorMessage = 'Error message';
       createComponent({
-        mountFn: mountExtended,
         config: {
           data() {
             return {
diff --git a/spec/frontend/packages_and_registries/settings/project/settings/mock_data.js b/spec/frontend/packages_and_registries/settings/project/settings/mock_data.js
index 23a1179011d..0b6bdc76f2c 100644
--- a/spec/frontend/packages_and_registries/settings/project/settings/mock_data.js
+++ b/spec/frontend/packages_and_registries/settings/project/settings/mock_data.js
@@ -150,3 +150,18 @@ export const deletePackagesProtectionRuleMutationPayload = ({
     },
   },
 });
+
+export const updatePackagesProtectionRuleMutationPayload = ({
+  packageProtectionRule = {
+    ...packagesProtectionRulesData[0],
+    pushProtectedUpToAccessLevel: 'OWNER',
+  },
+  errors = [],
+} = {}) => ({
+  data: {
+    updatePackagesProtectionRule: {
+      packageProtectionRule,
+      errors,
+    },
+  },
+});
diff --git a/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb b/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
index a48c535e563..15e5ae4458f 100644
--- a/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/job_token_scope_resolver_spec.rb
@@ -49,6 +49,31 @@ RSpec.describe Resolvers::Ci::JobTokenScopeResolver, feature_category: :continuo
       end
     end
 
+    context 'when projects list counter is requested' do
+      let!(:link) { create(:ci_job_token_project_scope_link, source_project: project) }
+
+      before do
+        project.add_member(current_user, :maintainer)
+      end
+
+      it 'resolves projects count' do
+        expect(resolve_scope.inbound_projects_count).to eq(1)
+      end
+    end
+
+    context 'when groups list counter is requested' do
+      let_it_be(:group) { create(:group, :private) }
+      let!(:group_scope_link) { create(:ci_job_token_group_scope_link, source_project: project, target_group: group) }
+
+      before do
+        project.add_member(current_user, :maintainer)
+      end
+
+      it 'resolves groups count' do
+        expect(resolve_scope.groups_count).to eq(1)
+      end
+    end
+
     context 'when groups list is requested' do
       let_it_be(:group) { create(:group, :private) }
       let!(:group_scope_link) { create(:ci_job_token_group_scope_link, source_project: project, target_group: group) }
diff --git a/spec/graphql/types/ci/job_token_scope_type_spec.rb b/spec/graphql/types/ci/job_token_scope_type_spec.rb
index daf30b417ae..1445d17276b 100644
--- a/spec/graphql/types/ci/job_token_scope_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope_type_spec.rb
@@ -6,7 +6,8 @@ RSpec.describe GitlabSchema.types['CiJobTokenScopeType'], feature_category: :con
   specify { expect(described_class.graphql_name).to eq('CiJobTokenScopeType') }
 
   it 'has the correct fields' do
-    expected_fields = [:projects, :inboundAllowlist, :outboundAllowlist, :groupsAllowlist]
+    expected_fields = [:projects, :inboundAllowlist, :outboundAllowlist,
+      :groupsAllowlist, :inboundAllowlistCount, :groupsAllowlistCount]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
   end
diff --git a/spec/lib/parameter_filters/saml_response_spec.rb b/spec/lib/parameter_filters/saml_response_spec.rb
deleted file mode 100644
index 0a41da39771..00000000000
--- a/spec/lib/parameter_filters/saml_response_spec.rb
+++ /dev/null
@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe ParameterFilters::SamlResponse, feature_category: :system_access do
-  let(:mock_saml_response) { File.read('spec/fixtures/authentication/saml_response.xml') }
-
-  describe "filter sensitive values" do
-    let(:filtered_saml_response) do
-      described_class.filter(mock_saml_response)
-    end
-
-    it 'redacts sensitive xml attributes' do
-      expect(mock_saml_response).to include('2014-07')
-      expect(filtered_saml_response).to include('REDACTED')
-      expect(filtered_saml_response).to include('xml')
-      expect(filtered_saml_response).not_to include('2014-07')
-    end
-
-    it 'redacts entire response when parsing fails' do
-      invalid_xml = +"<invalid-xml>"
-      filtered_invalid_xml = described_class.filter(invalid_xml)
-
-      expect(filtered_invalid_xml).to eq('REDACTED')
-    end
-
-    it "decodes Base64 encoded SAMLResponse" do
-      encoded_saml_response = Base64.strict_encode64(mock_saml_response)
-      filtered_saml_response = described_class.filter(encoded_saml_response)
-
-      expect(filtered_saml_response).to include('REDACTED')
-      expect(filtered_saml_response).to include('xml')
-      expect(filtered_saml_response).not_to include('2014-07')
-      expect(filtered_saml_response).not_to include('2024-07')
-    end
-
-    it "returns XML" do
-      expect(filtered_saml_response).to be_eql(
-        <<~XML
-          <?xml version="1.0"?>
-          <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfxb9b71715-2202-9a51-8ae5-689d5b9dd25a" Version="2.0" IssueInstant="REDACTED" Destination="http://sp.example.com/demo1/index.php?acs" InResponseTo="ONELOGIN_4fee3b046395c4e751011e97f8900b5273d56685">
-            <saml:Issuer>http://idp.example.com/metadata.php</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-            <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-              <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
-              <ds:Reference URI="#pfxb9b71715-2202-9a51-8ae5-689d5b9dd25a"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>REDACTED</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>REDACTED</ds:SignatureValue>
-            <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICajCCAdOgAwIBAgIBADANBgkqhkiG9w0BAQ0FADBSMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMT25lbG9naW4gSW5jMRcwFQYDVQQDDA5zcC5leGFtcGxlLmNvbTAeFw0xNDA3MTcxNDEyNTZaFw0xNTA3MTcxNDEyNTZaMFIxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQKDAxPbmVsb2dpbiBJbmMxFzAVBgNVBAMMDnNwLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZx+ON4IUoIWxgukTb1tOiX3bMYzYQiwWPUNMp+Fq82xoNogso2bykZG0yiJm5o8zv/sd6pGouayMgkx/2FSOdc36T0jGbCHuRSbtia0PEzNIRtmViMrt3AeoWBidRXmZsxCNLwgIV6dn2WpuE5Az0bHgpZnQxTKFek0BMKU/d8wIDAQABo1AwTjAdBgNVHQ4EFgQUGHxYqZYyX7cTxKVODVgZwSTdCnwwHwYDVR0jBBgwFoAUGHxYqZYyX7cTxKVODVgZwSTdCnwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQByFOl+hMFICbd3DJfnp2Rgd/dqttsZG/tyhILWvErbio/DEe98mXpowhTkC04ENprOyXi7ZbUqiicF89uAGyt1oqgTUCD1VsLahqIcmrzgumNyTwLGWo17WDAa1/usDhetWAMhgzF/Cnf5ek0nK00m0YZGyc4LzgD0CROMASTWNg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature>
-            <samlp:Status>
-              <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
-            </samlp:Status>
-            <saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_d71a3a8e9fcc45c9e9d248ef7049393fc8f04e5f75" Version="2.0" IssueInstant="REDACTED">
-              <saml:Issuer>http://idp.example.com/metadata.php</saml:Issuer>
-              <saml:Subject>
-                <saml:NameID SPNameQualifier="http://sp.example.com/demo1/metadata.php" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7</saml:NameID>
-                <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-                  <saml:SubjectConfirmationData NotOnOrAfter="2024-01-18T06:21:48Z" Recipient="http://sp.example.com/demo1/index.php?acs" InResponseTo="ONELOGIN_4fee3b046395c4e751011e97f8900b5273d56685"/>
-                </saml:SubjectConfirmation>
-              </saml:Subject>
-              <saml:Conditions NotBefore="REDACTED" NotOnOrAfter="REDACTED">
-                <saml:AudienceRestriction>
-                  <saml:Audience>http://sp.example.com/demo1/metadata.php</saml:Audience>
-                </saml:AudienceRestriction>
-              </saml:Conditions>
-              <saml:AuthnStatement AuthnInstant="REDACTED" SessionNotOnOrAfter="REDACTED" SessionIndex="_be9967abd904ddcae3c0eb4189adbe3f71e327cf93">
-                <saml:AuthnContext>
-                  <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
-                </saml:AuthnContext>
-              </saml:AuthnStatement>
-              <saml:AttributeStatement>
-                <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
-                  <saml:AttributeValue xsi:type="xs:string">test</saml:AttributeValue>
-                </saml:Attribute>
-                <saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
-                  <saml:AttributeValue xsi:type="xs:string">test@example.com</saml:AttributeValue>
-                </saml:Attribute>
-                <saml:Attribute Name="eduPersonAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
-                  <saml:AttributeValue xsi:type="xs:string">users</saml:AttributeValue>
-                  <saml:AttributeValue xsi:type="xs:string">examplerole1</saml:AttributeValue>
-                </saml:Attribute>
-              </saml:AttributeStatement>
-            </saml:Assertion>
-          </samlp:Response>
-        XML
-      )
-    end
-  end
-end
diff --git a/spec/models/wiki_page_spec.rb b/spec/models/wiki_page_spec.rb
index f3cf8966b9a..1c55eb3c38a 100644
--- a/spec/models/wiki_page_spec.rb
+++ b/spec/models/wiki_page_spec.rb
@@ -7,6 +7,18 @@ RSpec.describe WikiPage, feature_category: :wiki do
   let(:container) { create(:project) }
   let(:wiki) { container.wiki }
 
+  def create_file_in_repository(path:)
+    wiki.create_wiki_repository
+    wiki.repository.create_file(
+      user, path, 'test content',
+      branch_name: wiki.default_branch,
+      message: 'test commit'
+    )
+
+    title = Pathname(path).sub_ext('').to_s
+    wiki.find_page(title)
+  end
+
   def create_wiki_page(container, attrs = {})
     page = build_wiki_page(container, attrs)
 
@@ -411,6 +423,26 @@ RSpec.describe WikiPage, feature_category: :wiki do
         expect(wiki.find_page(title).front_matter).to eq({ xxx: "abc" })
       end
     end
+
+    context "with existing page" do
+      let(:title) { 'Existing Page' }
+
+      it 'do not create the page with the same title' do
+        page = create_wiki_page(container, title: title, content: 'content')
+
+        subject.create(attributes.merge(title: title))
+        expect(subject.create(attributes.merge(title: title))).to be_falsy
+        expect(wiki.find_page(title).content).to eq(page.content)
+      end
+
+      it 'do not create the page with the same title, even if the orginal path contains spaces' do
+        page = create_file_in_repository(path: "#{title}.md")
+
+        subject.create(attributes.merge(title: title))
+        expect(subject.create(attributes.merge(title: title))).to be_falsy
+        expect(wiki.find_page(title).content).to eq(page.content)
+      end
+    end
   end
 
   describe "dot in the title" do
@@ -593,6 +625,14 @@ RSpec.describe WikiPage, feature_category: :wiki do
         expect(subject.content).to eq 'new_content'
       end
 
+      it 'raises an error if the page already exists even if it contains spaces in the orginal path' do
+        create_file_in_repository(path: 'foo/Existing Page.md')
+
+        expect { subject.update(title: 'foo/Existing Page', content: 'new_content') }.to raise_error(WikiPage::PageRenameError)
+        expect(subject.title).to eq original_title
+        expect(subject.content).to eq 'new_content'
+      end
+
       it 'updates the content and moves the file' do
         new_title = 'foo/Other Page'
         new_content = 'new_content'
@@ -636,6 +676,16 @@ RSpec.describe WikiPage, feature_category: :wiki do
           expect(page.update(title: 'Another Existing Page', content: 'new_content')).to be_truthy
           expect(page.slug).to eq original_path
         end
+
+        it 'moves the page to the another folder if the original path has spaces' do
+          page = create_file_in_repository(path: 'Existing Folder/Existing Page.md')
+
+          original_path = page.slug
+
+          expect(page.update(title: 'Existing Page', content: 'new_content')).to be_truthy
+          expect(page.slug).not_to eq original_path
+          expect(page.slug).to eq "Existing-Folder/Existing-Page"
+        end
       end
 
       context 'in root dir' do
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
index bc23ec206a2..131b8b2becd 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_group_or_project_spec.rb
@@ -30,6 +30,8 @@ RSpec.describe 'CiJobTokenScopeAddGroupOrProject', feature_category: :continuous
               path
             }
           }
+          inboundAllowlistCount
+          groupsAllowlistCount
         }
       QL
     end
@@ -82,6 +84,8 @@ RSpec.describe 'CiJobTokenScopeAddGroupOrProject', feature_category: :continuous
           post_graphql_mutation(mutation, current_user: current_user)
           expect(response).to have_gitlab_http_status(:success)
           expect(mutation_response.dig('ciJobTokenScope', 'groupsAllowlist', 'nodes')).not_to be_empty
+          expect(mutation_response.dig('ciJobTokenScope', 'groupsAllowlistCount')).to eq(1)
+          expect(mutation_response.dig('ciJobTokenScope', 'inboundAllowlistCount')).to eq(1)
         end.to change { Ci::JobToken::GroupScopeLink.count }.by(1)
       end
 
@@ -107,6 +111,8 @@ RSpec.describe 'CiJobTokenScopeAddGroupOrProject', feature_category: :continuous
           post_graphql_mutation(mutation, current_user: current_user)
           expect(response).to have_gitlab_http_status(:success)
           expect(mutation_response.dig('ciJobTokenScope', 'inboundAllowlist', 'nodes')).not_to be_empty
+          expect(mutation_response.dig('ciJobTokenScope', 'groupsAllowlistCount')).to eq(0)
+          expect(mutation_response.dig('ciJobTokenScope', 'inboundAllowlistCount')).to eq(2)
         end.to change { Ci::JobToken::ProjectScopeLink.count }.by(1)
       end
 
diff --git a/spec/requests/api/graphql/packages/package_spec.rb b/spec/requests/api/graphql/packages/package_spec.rb
index c8cef07c4ff..4e40fd9a399 100644
--- a/spec/requests/api/graphql/packages/package_spec.rb
+++ b/spec/requests/api/graphql/packages/package_spec.rb
@@ -16,7 +16,7 @@ RSpec.describe 'package details', feature_category: :package_registry do
   end
 
   let(:depth) { 3 }
-  let(:excluded) { %w[metadata apiFuzzingCiConfiguration pipeline packageFiles runners] }
+  let(:excluded) { %w[metadata apiFuzzingCiConfiguration pipeline packageFiles runners inboundAllowlistCount groupsAllowlistCount] }
   let(:metadata) { query_graphql_fragment('ComposerMetadata') }
   let(:package_files) { all_graphql_fields_for('PackageFile') }
   let(:package_global_id) { global_id_of(composer_package) }
diff --git a/spec/requests/api/graphql/project/merge_request_spec.rb b/spec/requests/api/graphql/project/merge_request_spec.rb
index 96933505838..b0144fc1d40 100644
--- a/spec/requests/api/graphql/project/merge_request_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request_spec.rb
@@ -24,7 +24,11 @@ RSpec.describe 'getting merge request information nested in a project', feature_
     # we exclude Project.pipeline because it needs arguments,
     # codequalityReportsComparer because it is behind a feature flag
     # and runners because the user is not an admin and therefore has no access
-    let(:excluded) { %w[jobs pipeline runners codequalityReportsComparer mlModels] }
+    # and inboundAllowlistCount, groupsAllowlistCount the user has no access
+    let(:excluded) do
+      %w[jobs pipeline runners codequalityReportsComparer mlModels inboundAllowlistCount groupsAllowlistCount]
+    end
+
     let(:mr_fields) { all_graphql_fields_for('MergeRequest', excluded: excluded) }
 
     before do
diff --git a/spec/support/shared_examples/models/wiki_shared_examples.rb b/spec/support/shared_examples/models/wiki_shared_examples.rb
index d731eec5680..394bea4e841 100644
--- a/spec/support/shared_examples/models/wiki_shared_examples.rb
+++ b/spec/support/shared_examples/models/wiki_shared_examples.rb
@@ -195,10 +195,22 @@ RSpec.shared_examples 'wiki model' do
       let(:wiki_pages) { subject.list_pages }
 
       before do
-        # The order is intentional
+        # The creation order below is intentional because we would like to test the sorting behavior as well.
+        # The sorting is performed based on the page's path.
         subject.create_page('index2', 'This is an index2')
-        subject.create_page('index', 'This is an index')
-        subject.create_page('index3', 'This is an index3')
+        subject.create_page('index1', 'This is an index1')
+        subject.create_page('index 2', 'This is an index 2 with spaces only in the title')
+        subject.create_page('index 1', 'This is an index 1 with spaces only in the title')
+        subject.repository.create_file(
+          user, "index 2.md", "This is an index 2 with spaces in both the title and the path",
+          branch_name: subject.default_branch,
+          message: "created page index 2"
+        )
+        subject.repository.create_file(
+          user, "index 1.md", "This is an index 1 with spaces in both the title and the path",
+          branch_name: subject.default_branch,
+          message: "created page index 1"
+        )
       end
 
       it 'returns an array of WikiPage instances' do
@@ -213,55 +225,63 @@ RSpec.shared_examples 'wiki model' do
       end
 
       it 'returns all pages by default' do
-        expect(wiki_pages.count).to eq(3)
+        expect(wiki_pages.count).to eq(6)
       end
 
       context 'with limit option' do
         it 'returns limited set of pages' do
           expect(
-            subject.list_pages(limit: 1).map(&:title)
-          ).to eql(%w[index])
+            subject.list_pages(limit: 1).map(&:path)
+          ).to eql(["index 1.md"])
         end
 
         it 'returns all set of pages if limit is more than the total pages' do
-          expect(subject.list_pages(limit: 4).count).to eq(3)
+          expect(subject.list_pages(limit: 7).count).to eq(6)
         end
 
         it 'returns all set of pages if limit is 0' do
-          expect(subject.list_pages(limit: 0).count).to eq(3)
+          expect(subject.list_pages(limit: 0).count).to eq(6)
         end
       end
 
       context 'with offset option' do
         it 'returns offset-ed set of pages' do
           expect(
-            subject.list_pages(offset: 1).map(&:title)
-          ).to eq(%w[index2 index3])
-
+            subject.list_pages(offset: 1).map(&:path)
+          ).to eq(["index 2.md", "index-1.md", "index-2.md", "index1.md", "index2.md"])
           expect(
-            subject.list_pages(offset: 2).map(&:title)
-          ).to eq(["index3"])
-          expect(subject.list_pages(offset: 3).count).to eq(0)
-          expect(subject.list_pages(offset: 4).count).to eq(0)
+            subject.list_pages(offset: 2).map(&:path)
+          ).to eq(["index-1.md", "index-2.md", "index1.md", "index2.md"])
+          expect(
+            subject.list_pages(offset: 3).map(&:path)
+          ).to eq(["index-2.md", "index1.md", "index2.md"])
+          expect(
+            subject.list_pages(offset: 4).map(&:path)
+          ).to eq(["index1.md", "index2.md"])
+          expect(
+            subject.list_pages(offset: 5).map(&:path)
+          ).to eq(["index2.md"])
+          expect(subject.list_pages(offset: 6).count).to eq(0)
+          expect(subject.list_pages(offset: 7).count).to eq(0)
         end
 
         it 'returns all set of pages if offset is 0' do
-          expect(subject.list_pages(offset: 0).count).to eq(3)
+          expect(subject.list_pages(offset: 0).count).to eq(6)
         end
 
         it 'can combines with limit' do
           expect(
-            subject.list_pages(offset: 1, limit: 1).map(&:title)
-          ).to eq(["index2"])
+            subject.list_pages(offset: 1, limit: 1).map(&:path)
+          ).to eq(["index 2.md"])
         end
       end
 
       context 'with sorting options' do
         it 'returns pages sorted by title by default' do
-          pages = %w[index index2 index3]
+          pages = ["index 1.md", "index 2.md", "index-1.md", "index-2.md", "index1.md", "index2.md"]
 
-          expect(subject.list_pages.map(&:title)).to eq(pages)
-          expect(subject.list_pages(direction: 'desc').map(&:title)).to eq(pages.reverse)
+          expect(subject.list_pages.map(&:path)).to eq(pages)
+          expect(subject.list_pages(direction: 'desc').map(&:path)).to eq(pages.reverse)
         end
       end
 
@@ -269,9 +289,16 @@ RSpec.shared_examples 'wiki model' do
         let(:pages) { subject.list_pages(load_content: true) }
 
         it 'loads WikiPage content' do
-          expect(pages.first.content).to eq('This is an index')
-          expect(pages.second.content).to eq('This is an index2')
-          expect(pages.third.content).to eq('This is an index3')
+          contents = [
+            "This is an index 1 with spaces in both the title and the path",
+            "This is an index 2 with spaces in both the title and the path",
+            "This is an index 1 with spaces only in the title",
+            "This is an index 2 with spaces only in the title",
+            "This is an index1",
+            "This is an index2"
+          ]
+
+          expect(pages.map(&:content)).to eq(contents)
         end
       end
     end
@@ -346,6 +373,30 @@ RSpec.shared_examples 'wiki model' do
         expect(page).to be_a WikiPage
       end
 
+      # The repository can contain files that were not generated by Gollum Wiki
+      # and these files can contain spaces in the path.
+      context 'pages with spaces in the path' do
+        before do
+          subject.repository.create_file(
+            user, "page with spaces in the path.md", "This is an awesome Gollum Wiki",
+            branch_name: subject.default_branch,
+            message: "created page with spaces in the path"
+          )
+        end
+
+        it 'can find a page by title' do
+          page = subject.find_page('page with spaces in the path')
+
+          expect(page.title).to eq('page with spaces in the path')
+        end
+
+        it 'cannot find a page by slug' do
+          page = subject.find_page('page-with-spaces-in-the-path')
+
+          expect(page).to be_nil
+        end
+      end
+
       context 'pages with multibyte-character title' do
         before do
           subject.create_page('autre pagé', "C'est un génial Gollum Wiki")
@@ -618,6 +669,17 @@ RSpec.shared_examples 'wiki model' do
         expect(subject.error_message).to match(/Duplicate page:/)
       end
 
+      it 'cannot create two pages with the same title, even if the existing file has no sluggified path' do
+        subject.repository.create_file(
+          user, "page with spaces in the path.md", "page created outside of Gollum Wiki",
+          branch_name: subject.default_branch,
+          message: "created page with spaces in the path"
+        )
+        subject.create_page('page with spaces in the path', 'page created by Gollum Wiki')
+
+        expect(subject.error_message).to match(/Duplicate page:/)
+      end
+
       it 'returns false if a page exists already in the repository', :aggregate_failures do
         subject.create_page('test page', 'content')
 
@@ -700,9 +762,19 @@ RSpec.shared_examples 'wiki model' do
       end
 
       with_them do
-        specify do
-          allow(subject.repository).to receive(:ls_files).and_return(existing_repo_files)
+        before do
+          subject.create_wiki_repository # Make sure the wiki repo exists
 
+          existing_repo_files.each do |path|
+            subject.repository.create_file(
+              user, path, 'content',
+              branch_name: subject.default_branch,
+              message: "Add #{new_file}"
+            )
+          end
+        end
+
+        specify do
           expect(subject.create_page(new_file, 'content', format)).to eq success
         end
       end
@@ -807,6 +879,42 @@ RSpec.shared_examples 'wiki model' do
       include_context 'extended examples'
     end
 
+    context 'when sluggified paths already exist in the repository' do
+      before do
+        subject.repository.create_file(
+          user, "folder with spaces.md", "folder created outside of Gollum Wiki",
+          branch_name: subject.default_branch,
+          message: "created folder with spaces in the path"
+        )
+        subject.repository.create_file(
+          user, "folder with spaces/page with spaces in the path.md", "page created outside of Gollum Wiki",
+          branch_name: subject.default_branch,
+          message: "created page with spaces in the path"
+        )
+      end
+
+      it 'the page path is sluggified' do
+        pages_before_update = subject.list_pages
+        expect(pages_before_update.map(&:title)).to match_array([
+          "folder with spaces", "page with spaces in the path"
+        ])
+        expect(pages_before_update.map(&:path)).to match_array([
+          "folder with spaces.md", "folder with spaces/page with spaces in the path.md"
+        ])
+
+        page = subject.find_page("folder with spaces/page with spaces in the path")
+        expect(subject.update_page(page.page, content: 'new content', format: :markdown)).to eq true
+
+        pages_after_update = subject.list_pages
+        expect(pages_after_update.map(&:title)).to match_array([
+          "folder with spaces", "page with spaces in the path"
+        ])
+        expect(pages_after_update.map(&:path)).to match_array([
+          "folder with spaces.md", "folder-with-spaces/page-with-spaces-in-the-path.md"
+        ])
+      end
+    end
+
     context 'when format is invalid' do
       let!(:page) { create(:wiki_page, wiki: subject, title: 'test page') }
 
@@ -836,7 +944,7 @@ RSpec.shared_examples 'wiki model' do
         expect(subject.update_page(page.page, content: 'new content', format: :markdown))
           .to eq(false)
         expect(subject.error_message)
-          .to match("Duplicate page: A page with that title already exists")
+          .to match("Duplicate page: A page with that title already exists in the file test-page.md")
       end
     end
 
@@ -998,13 +1106,6 @@ RSpec.shared_examples 'wiki model' do
       it do
         expect(described_class.preview_slug(title, file_extension)).to eq(expected_slug)
       end
-
-      it 'matches the slug generated by gitaly' do
-        skip('Gitaly cannot generate a slug for an empty title') unless title.present?
-
-        gitaly_slug = subject.list_pages.first.slug
-        expect(described_class.preview_slug(title, file_extension)).to eq(gitaly_slug)
-      end
     end
   end
 end