diff --git a/.gitlab/ci/cng/main.gitlab-ci.yml b/.gitlab/ci/cng/main.gitlab-ci.yml
index 550d062b711..22d699462a8 100644
--- a/.gitlab/ci/cng/main.gitlab-ci.yml
+++ b/.gitlab/ci/cng/main.gitlab-ci.yml
@@ -69,10 +69,17 @@ include:
     CACHE_BUSTER: "false"
     # link component version shas to current project instead of default CI_PIPELINE_CREATED_AT which forces rebuilds on each pipeline run
     CONTAINER_VERSION_SUFFIX: "${CI_PROJECT_NAME}"
-    # skip no-op final-list pipeline stage
-    SKIP_JOB_REGEX: final-list
+    # skip no-op final-images-listing job
+    SKIP_JOB_REGEX: /final-images-listing/
     # disable buildx cluster while it's not supported on mirrors
     DISABLE_BUILDX_CLUSTER: "true"
+    # disable external gem caching and rely on docker layer caching
+    RAILS_DISABLE_VENDOR_CACHE: "true"
+    # skip short lived dev image signing and verification to save time
+    SKIP_IMAGE_SIGNING: "true"
+    SKIP_IMAGE_VERIFICATION: "true"
+    # set specific arch list
+    ARCH_LIST: amd64
   trigger:
     project: '${CI_PROJECT_NAMESPACE}/$[[ inputs.cng_path ]]'
     branch: $TRIGGER_BRANCH
diff --git a/.gitlab/ci/test-on-cng/main.gitlab-ci.yml b/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
index 1e6f9917655..12dbbbe66a3 100644
--- a/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
+++ b/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
@@ -102,7 +102,7 @@ build-cng:
   needs: [build-cng-env]
   variables:
     # use larger runner for complex rails build jobs
-    RAILS_BUILD_RUNNER_TAG: e2e
+    HIGH_CAPACITY_RUNNER_TAG: e2e
   # quality specific fork, see: https://gitlab.com/gitlab-org/quality/quality-engineering/team-tasks/-/issues/2839
   trigger:
     project: ${CI_PROJECT_NAMESPACE}/quality/quality-engineering/CNG-mirror
diff --git a/Gemfile.lock b/Gemfile.lock
index 79831845502..7f9b170df96 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -27,10 +27,22 @@ PATH
   remote: gems/gitlab-backup-cli
   specs:
     gitlab-backup-cli (0.0.1)
-      activesupport (< 7.2)
+      activesupport (~> 7.0.8.4)
+      addressable (~> 2.8)
+      concurrent-ruby (~> 1.1)
+      faraday (~> 2)
       google-cloud-storage_transfer (~> 1.2.0)
+      google-protobuf (~> 3.25, >= 3.25.3)
       googleauth (~> 1.8.1)
+      grpc (= 1.63.0)
+      json (~> 2.7.2)
+      jwt (~> 2.5)
+      logger (~> 1.5.3)
+      minitest (~> 5.11.0)
+      parallel (~> 1.19)
+      rack (~> 2.2.9)
       rainbow (~> 3.0)
+      rexml (~> 3.3.2)
       thor (~> 1.3)
 
 PATH
diff --git a/app/assets/javascripts/boards/components/board_app.vue b/app/assets/javascripts/boards/components/board_app.vue
index f242011e072..fec1bcf6ba1 100644
--- a/app/assets/javascripts/boards/components/board_app.vue
+++ b/app/assets/javascripts/boards/components/board_app.vue
@@ -1,5 +1,6 @@
 <script>
 import { omit } from 'lodash';
+import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import AccessorUtilities from '~/lib/utils/accessor';
 import { historyPushState, parseBoolean } from '~/lib/utils/common_utils';
 import {
@@ -29,6 +30,7 @@ export default {
     BoardSettingsSidebar,
     BoardTopBar,
   },
+  mixins: [glFeatureFlagsMixin()],
   inject: [
     'fullPath',
     'initialBoardId',
@@ -89,6 +91,9 @@ export default {
   },
 
   computed: {
+    issuesDrawerEnabled() {
+      return Boolean(this.glFeatures.issuesListDrawer);
+    },
     listQueryVariables() {
       return {
         ...(this.isIssueBoard && {
@@ -201,7 +206,10 @@ export default {
 </script>
 
 <template>
-  <div class="boards-app gl-relative" :class="{ 'is-compact': isAnySidebarOpen }">
+  <div
+    class="boards-app gl-relative"
+    :class="{ 'is-compact': isAnySidebarOpen && !issuesDrawerEnabled }"
+  >
     <board-top-bar
       :board-id="boardId"
       :is-swimlanes-on="isSwimlanesOn"
@@ -213,6 +221,10 @@ export default {
       @updateBoard="refetchLists"
     />
     <board-content
+      :class="{
+        'lg:gl-w-[calc(100%-480px)] xl:gl-w-[calc(100%-768px)] min-[1440px]:gl-w-[calc(100%-912px)]':
+          isAnySidebarOpen && issuesDrawerEnabled,
+      }"
       :board-id="boardId"
       :add-column-form-visible="addColumnFormVisible"
       :is-swimlanes-on="isSwimlanesOn"
@@ -220,6 +232,7 @@ export default {
       :board-lists="boardLists"
       :error="error"
       :list-query-variables="listQueryVariables"
+      :use-work-item-drawer="issuesDrawerEnabled"
       @setActiveList="setActiveId"
       @setAddColumnFormVisibility="addColumnFormVisible = $event"
       @setFilters="setFilters"
diff --git a/app/assets/javascripts/boards/components/board_card.vue b/app/assets/javascripts/boards/components/board_card.vue
index ce9c44272ba..f8cf0ef526e 100644
--- a/app/assets/javascripts/boards/components/board_card.vue
+++ b/app/assets/javascripts/boards/components/board_card.vue
@@ -143,7 +143,7 @@ export default {
         'multi-select gl-border-blue-200 gl-bg-blue-50': multiSelectVisible,
         'gl-cursor-grab': isDraggable,
         'is-disabled': isDisabled,
-        'is-active gl-bg-blue-50': isActive,
+        'is-active gl-bg-blue-50 hover:!gl-bg-blue-50': isActive,
         'gl-cursor-not-allowed gl-bg-gray-10': item.isLoading,
         'gl-border-l-4 gl-pl-4 gl-border-l-solid': itemColor,
       },
@@ -154,7 +154,7 @@ export default {
     :data-item-path="item.referencePath"
     :style="cardStyle"
     data-testid="board-card"
-    class="board-card gl-border gl-relative gl-mb-3 gl-rounded-base gl-p-4 gl-leading-normal"
+    class="board-card gl-border gl-relative gl-mb-3 gl-rounded-base gl-p-4 gl-leading-normal hover:gl-bg-gray-10"
     @click="toggleIssue($event)"
   >
     <board-card-inner
diff --git a/app/assets/javascripts/boards/components/board_content.vue b/app/assets/javascripts/boards/components/board_content.vue
index 9f15f2bcbf0..c867137d427 100644
--- a/app/assets/javascripts/boards/components/board_content.vue
+++ b/app/assets/javascripts/boards/components/board_content.vue
@@ -81,6 +81,10 @@ export default {
       type: Boolean,
       required: true,
     },
+    useWorkItemDrawer: {
+      type: Boolean,
+      required: true,
+    },
   },
   data() {
     return {
@@ -127,9 +131,6 @@ export default {
       const closedList = this.boardListsToUse.find((list) => list.listType === ListType.closed);
       return closedList?.id || '';
     },
-    issuesDrawerEnabled() {
-      return this.glFeatures.issuesListDrawer;
-    },
     namespace() {
       return this.isGroupBoard ? BoardType.group : BoardType.project;
     },
@@ -330,7 +331,7 @@ export default {
       </div>
     </epics-swimlanes>
     <board-drawer-wrapper
-      v-if="issuesDrawerEnabled"
+      v-if="useWorkItemDrawer"
       :backlog-list-id="backlogListId"
       :closed-list-id="closedListId"
     >
diff --git a/app/assets/javascripts/users_select/index.js b/app/assets/javascripts/users_select/index.js
index b619c661ea9..acf9bec8c8f 100644
--- a/app/assets/javascripts/users_select/index.js
+++ b/app/assets/javascripts/users_select/index.js
@@ -637,7 +637,7 @@ function UsersSelect(currentUser, els, options = {}) {
             )}</a></li>`;
           } else {
             // 0 margin, because it's now handled by a wrapper
-            img = `<img src='${avatar}' alt='' class='avatar avatar-inline !gl-m-0' width='32' />`;
+            img = `<img src='${avatar}' class='avatar avatar-inline !gl-m-0' width='32' />`;
           }
 
           return userSelect.renderRow(
@@ -728,7 +728,7 @@ UsersSelect.prototype.renderRow = function (
           </strong>
           ${
             username
-              ? `<span class="dropdown-menu-user-username gl-text-subtle">${escape(
+              ? `<span class="dropdown-menu-user-username gl-text-gray-400">${escape(
                   username,
                 )}</span>`
               : ''
diff --git a/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationship_list.vue b/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationship_list.vue
index 06b85d74b16..586757fe113 100644
--- a/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationship_list.vue
+++ b/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationship_list.vue
@@ -1,16 +1,43 @@
 <script>
+import DraggableList from 'vuedraggable';
+
+import { isLoggedIn } from '~/lib/utils/common_utils';
+import { ESC_KEY_CODE } from '~/lib/utils/keycodes';
+import { defaultSortableOptions, DRAG_DELAY } from '~/sortable/constants';
+import * as Sentry from '~/sentry/sentry_browser_wrapper';
+import { sortableStart, sortableEnd } from '~/sortable/utils';
+
 import WorkItemLinkChildContents from '../shared/work_item_link_child_contents.vue';
 
+import removeLinkedItemsMutation from '../../graphql/remove_linked_items.mutation.graphql';
+import addLinkedItemsMutation from '../../graphql/add_linked_items.mutation.graphql';
+
+import { RELATIONSHIP_TYPE_ENUM } from '../../constants';
+
 export default {
+  RELATIONSHIP_TYPE_ENUM,
   components: {
     WorkItemLinkChildContents,
   },
   props: {
+    parentWorkItemId: {
+      type: String,
+      required: true,
+    },
+    parentWorkItemIid: {
+      type: String,
+      required: true,
+    },
     linkedItems: {
       type: Array,
       required: false,
       default: () => [],
     },
+    relationshipType: {
+      type: String,
+      required: true,
+      validator: (value) => Object.keys(RELATIONSHIP_TYPE_ENUM).includes(value),
+    },
     heading: {
       type: String,
       required: true,
@@ -29,6 +56,132 @@ export default {
       required: true,
     },
   },
+  data() {
+    return {
+      dragCancelled: false,
+      updateInProgress: false,
+    };
+  },
+  computed: {
+    canReorder() {
+      return isLoggedIn() && this.canUpdate;
+    },
+    listRootComponent() {
+      return this.canReorder ? DraggableList : 'ul';
+    },
+    listOptions() {
+      return {
+        ...defaultSortableOptions,
+        animation: 0,
+        fallbackOnBody: false,
+        group: 'work-item-linked-items',
+        tag: 'ul',
+        value: this.linkedItems,
+        delay: DRAG_DELAY,
+        delayOnTouchOnly: true,
+        sort: false,
+        'data-relationship-type': this.relationshipType,
+      };
+    },
+  },
+  methods: {
+    handleKeyUp(e) {
+      if (e.keyCode === ESC_KEY_CODE) {
+        this.dragCancelled = true;
+        // Sortable.js internally listens for `mouseup` event on document
+        // to register drop event, see https://github.com/SortableJS/Sortable/blob/master/src/Sortable.js#L625
+        // We need to manually trigger it to simulate cancel behaviour as VueDraggable doesn't
+        // natively support it, see https://github.com/SortableJS/Vue.Draggable/issues/968.
+        document.dispatchEvent(new Event('mouseup'));
+      }
+    },
+    handleDragStart({ to }) {
+      sortableStart();
+      this.dragCancelled = false;
+
+      // Attach listener to detect `ESC` key press to cancel drag.
+      document.addEventListener('keyup', this.handleKeyUp.bind(this));
+
+      // Ignore click events originating from anchor elements on the next event loop
+      // Firefox fires a click event on anchor elements inside the draggable item.
+      const ignoreClickEvent = (event) => event.preventDefault();
+      to.addEventListener('click', ignoreClickEvent, { capture: true, once: true });
+
+      setTimeout(() => to.removeEventListener('click', ignoreClickEvent), 1);
+    },
+    /**
+     * Always insert to the top of the target list
+     */
+    handleMove({ from, to, dragged }) {
+      if (from.dataset.relationshipType !== to.dataset.relationshipType) {
+        // When from and to relationship types differ, allow dropping item
+        // by showing ghost element to the top of the list and cancel any
+        // other drop operation by returning false.
+        to.prepend(dragged);
+        return false;
+      }
+      // Allow item to be placed back to its original list
+      // in case user doesn't want to change relationship type by returning true.
+      return true;
+    },
+    async handleDragEnd({ from, to, item }) {
+      const fromRelationshipType = from.dataset.relationshipType;
+      const toRelationshipType = to.dataset.relationshipType;
+      const { workItemId } = item.dataset;
+      const linkedItem = this.linkedItems.find((i) => i.workItem.id === workItemId);
+
+      sortableEnd();
+
+      // Detach listener as soon as drag ends.
+      document.removeEventListener('keyup', this.handleKeyUp.bind(this));
+      // Drag was cancelled, prevent moving.
+      if (this.dragCancelled) return;
+      // Relationship type didn't change, prevent moving.
+      if (fromRelationshipType === toRelationshipType) return;
+
+      this.$emit('updateLinkedItem', {
+        linkedItem,
+        fromRelationshipType,
+        toRelationshipType,
+      });
+
+      try {
+        // Replace below two mutation calls with one when https://gitlab.com/gitlab-org/gitlab/-/issues/481896 is resolved.
+        // Remove item from the list of its original relationship type.
+        const removeRes = await this.$apollo.mutate({
+          mutation: removeLinkedItemsMutation,
+          variables: {
+            input: {
+              id: this.parentWorkItemId,
+              workItemsIds: [workItemId],
+            },
+          },
+        });
+
+        if (removeRes.data.workItemRemoveLinkedItems.errors.length) {
+          throw new Error(removeRes.data.workItemRemoveLinkedItems.errors);
+        }
+
+        // Add item to the list of its new relationship type.
+        const addRes = await this.$apollo.mutate({
+          mutation: addLinkedItemsMutation,
+          variables: {
+            input: {
+              id: this.parentWorkItemId,
+              linkType: this.$options.RELATIONSHIP_TYPE_ENUM[toRelationshipType],
+              workItemsIds: [workItemId],
+            },
+          },
+        });
+
+        if (addRes.data.workItemAddLinkedItems.errors.length) {
+          throw new Error(addRes.data.workItemAddLinkedItems.errors);
+        }
+      } catch (error) {
+        Sentry.captureException(error);
+      }
+    },
+  },
 };
 </script>
 <template>
@@ -40,12 +193,25 @@ export default {
     >
       {{ heading }}
     </h3>
-    <ul ref="list" class="work-items-list content-list">
+    <component
+      :is="listRootComponent"
+      v-bind="listOptions"
+      ref="list"
+      class="work-items-list content-list"
+      :class="{
+        'sortable-container gl-cursor-grab': canReorder,
+        'disabled-content': updateInProgress,
+      }"
+      :move="handleMove"
+      @start="handleDragStart"
+      @end="handleDragEnd"
+    >
       <li
         v-for="linkedItem in linkedItems"
         :key="linkedItem.workItem.id"
         data-testid="link-child-contents-container"
-        class="!gl-border-x-0 !gl-border-b-1 !gl-border-t-0 !gl-border-solid !gl-px-0 !gl-py-2 last:!gl-border-b-0"
+        class="linked-item !gl-border-x-0 !gl-border-b-1 !gl-border-t-0 !gl-border-solid !gl-px-0 !gl-py-2 last:!gl-border-b-0"
+        :data-work-item-id="linkedItem.workItem.id"
       >
         <work-item-link-child-contents
           :child-item="linkedItem.workItem"
@@ -56,6 +222,6 @@ export default {
           @removeChild="$emit('removeLinkedItem', linkedItem.workItem)"
         />
       </li>
-    </ul>
+    </component>
   </div>
 </template>
diff --git a/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationships.vue b/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationships.vue
index ec038113b2a..011133e3fdf 100644
--- a/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationships.vue
+++ b/app/assets/javascripts/work_items/components/work_item_relationships/work_item_relationships.vue
@@ -1,6 +1,7 @@
 <script>
 import { produce } from 'immer';
 import { GlAlert, GlButton, GlLink, GlBadge } from '@gitlab/ui';
+import { cloneDeep } from 'lodash';
 
 import { s__, n__, sprintf } from '~/locale';
 import { helpPagePath } from '~/helpers/help_page_helper';
@@ -25,6 +26,7 @@ import WorkItemRelationshipList from './work_item_relationship_list.vue';
 import WorkItemAddRelationshipForm from './work_item_add_relationship_form.vue';
 
 export default {
+  linkedCategories: LINKED_CATEGORIES_MAP,
   helpPath: helpPagePath('/user/okrs.md#linked-items-in-okrs'),
   components: {
     GlAlert,
@@ -160,6 +162,51 @@ export default {
       this.showLabels = !this.showLabels;
       saveShowLabelsToLocalStorage(this.showLabelsLocalStorageKey, this.showLabels);
     },
+    /**
+     * We are relying on calling two mutations sequentially to achieve drag and drop
+     * until https://gitlab.com/gitlab-org/gitlab/-/issues/481896 is resolved.
+     * So to update placement of item on UI, we need to manually remove it from source
+     * list and put it to target list.
+     */
+    updateLinkedItem({ linkedItem, fromRelationshipType, toRelationshipType }) {
+      // Remove from source list
+      switch (fromRelationshipType) {
+        case this.$options.linkedCategories.RELATES_TO:
+          this.linksRelatesTo = this.linksRelatesTo.filter(
+            (item) => item.linkId !== linkedItem.linkId,
+          );
+          break;
+        case this.$options.linkedCategories.IS_BLOCKED_BY:
+          this.linksIsBlockedBy = this.linksIsBlockedBy.filter(
+            (item) => item.linkId !== linkedItem.linkId,
+          );
+          break;
+        case this.$options.linkedCategories.BLOCKS:
+          this.linksBlocks = this.linksBlocks.filter((item) => item.linkId !== linkedItem.linkId);
+          break;
+        default:
+          break;
+      }
+
+      // Clone the object before updating its relationship type
+      const updatingLinkedItem = cloneDeep(linkedItem);
+      updatingLinkedItem.linkType = toRelationshipType;
+
+      // Add to target list
+      switch (toRelationshipType) {
+        case this.$options.linkedCategories.RELATES_TO:
+          this.linksRelatesTo.unshift(updatingLinkedItem);
+          break;
+        case this.$options.linkedCategories.IS_BLOCKED_BY:
+          this.linksIsBlockedBy.unshift(updatingLinkedItem);
+          break;
+        case this.$options.linkedCategories.BLOCKS:
+          this.linksBlocks.unshift(updatingLinkedItem);
+          break;
+        default:
+          break;
+      }
+    },
     async removeLinkedItem(linkedItem) {
       try {
         const {
@@ -297,7 +344,10 @@ export default {
 
       <work-item-relationship-list
         v-if="linksBlocks.length"
+        :parent-work-item-id="workItemId"
+        :parent-work-item-iid="workItemIid"
         :linked-items="linksBlocks"
+        :relationship-type="$options.linkedCategories.BLOCKS"
         :heading="$options.i18n.blockingTitle"
         :can-update="canAdminWorkItemLink"
         :show-labels="showLabels"
@@ -310,10 +360,14 @@ export default {
           })
         "
         @removeLinkedItem="removeLinkedItem"
+        @updateLinkedItem="updateLinkedItem"
       />
       <work-item-relationship-list
         v-if="linksIsBlockedBy.length"
+        :parent-work-item-id="workItemId"
+        :parent-work-item-iid="workItemIid"
         :linked-items="linksIsBlockedBy"
+        :relationship-type="$options.linkedCategories.IS_BLOCKED_BY"
         :heading="$options.i18n.blockedByTitle"
         :can-update="canAdminWorkItemLink"
         :show-labels="showLabels"
@@ -326,10 +380,14 @@ export default {
           })
         "
         @removeLinkedItem="removeLinkedItem"
+        @updateLinkedItem="updateLinkedItem"
       />
       <work-item-relationship-list
         v-if="linksRelatesTo.length"
+        :parent-work-item-id="workItemId"
+        :parent-work-item-iid="workItemIid"
         :linked-items="linksRelatesTo"
+        :relationship-type="$options.linkedCategories.RELATES_TO"
         :heading="$options.i18n.relatedToTitle"
         :can-update="canAdminWorkItemLink"
         :show-labels="showLabels"
@@ -342,6 +400,7 @@ export default {
           })
         "
         @removeLinkedItem="removeLinkedItem"
+        @updateLinkedItem="updateLinkedItem"
       />
     </template>
   </crud-component>
diff --git a/app/assets/javascripts/work_items/constants.js b/app/assets/javascripts/work_items/constants.js
index 59de4d3ff80..7f3e7778ee3 100644
--- a/app/assets/javascripts/work_items/constants.js
+++ b/app/assets/javascripts/work_items/constants.js
@@ -297,6 +297,12 @@ export const LINKED_CATEGORIES_MAP = {
   BLOCKS: 'blocks',
 };
 
+export const RELATIONSHIP_TYPE_ENUM = {
+  relates_to: 'RELATED',
+  blocks: 'BLOCKS',
+  is_blocked_by: 'BLOCKED_BY',
+};
+
 export const LINKED_ITEM_TYPE_VALUE = {
   RELATED: 'RELATED',
   BLOCKED_BY: 'BLOCKED_BY',
diff --git a/app/assets/stylesheets/framework/dropdowns.scss b/app/assets/stylesheets/framework/dropdowns.scss
index 0339f488bd9..113f2935850 100644
--- a/app/assets/stylesheets/framework/dropdowns.scss
+++ b/app/assets/stylesheets/framework/dropdowns.scss
@@ -752,7 +752,7 @@
 
 .dropdown-toggle-text {
   &.is-default {
-    color: var(--gl-text-color-subtle);
+    color: $gl-text-color-secondary;
   }
 }
 
diff --git a/app/assets/stylesheets/framework/sortable.scss b/app/assets/stylesheets/framework/sortable.scss
index 91781bfe539..693c6353341 100644
--- a/app/assets/stylesheets/framework/sortable.scss
+++ b/app/assets/stylesheets/framework/sortable.scss
@@ -52,11 +52,14 @@
   }
 }
 
-.tree-item.is-dragging {
-  border-top: 0;
+.tree-item,
+.linked-item {
+  &.is-dragging {
+    border-top: 0;
 
-  .item-body {
-    background-color: $white;
-    border: 2px solid $gray-200;
+    .item-body {
+      background-color: $white;
+      border: 2px solid $gray-200;
+    }
   }
 }
diff --git a/app/components/pajamas/spinner_component.html.haml b/app/components/pajamas/spinner_component.html.haml
index 624bc9654c6..b319f3b1632 100644
--- a/app/components/pajamas/spinner_component.html.haml
+++ b/app/components/pajamas/spinner_component.html.haml
@@ -1,3 +1,2 @@
 = content_tag (@inline ? :span : :div), **html_options do
-  %span{ class: spinner_class, aria: {hidden: true} }>
-  %span{ class: 'gl-sr-only !gl-absolute' }= @label
+  %span{ class: spinner_class, aria: {label: @label} }>
diff --git a/app/graphql/mutations/projects/blobs_remove.rb b/app/graphql/mutations/projects/blobs_remove.rb
index c219caa1924..4d6c00dd053 100644
--- a/app/graphql/mutations/projects/blobs_remove.rb
+++ b/app/graphql/mutations/projects/blobs_remove.rb
@@ -31,7 +31,12 @@ module Mutations
       def resolve(project_path:, blob_oids:)
         project = authorized_find!(project_path)
 
-        result = Repositories::RewriteHistoryService.new(project, current_user).execute(blob_oids: blob_oids)
+        result =
+          if Feature.enabled?(:async_rewrite_history, project)
+            Repositories::RewriteHistoryService.new(project, current_user).async_execute(blob_oids: blob_oids)
+          else
+            Repositories::RewriteHistoryService.new(project, current_user).execute(blob_oids: blob_oids)
+          end
 
         return { errors: result.errors } if result.error?
 
diff --git a/app/graphql/mutations/projects/text_replace.rb b/app/graphql/mutations/projects/text_replace.rb
index 949d9fbb7f7..1103a09c19b 100644
--- a/app/graphql/mutations/projects/text_replace.rb
+++ b/app/graphql/mutations/projects/text_replace.rb
@@ -40,7 +40,12 @@ module Mutations
       def resolve(project_path:, replacements:)
         project = authorized_find!(project_path)
 
-        result = Repositories::RewriteHistoryService.new(project, current_user).execute(redactions: replacements)
+        result =
+          if Feature.enabled?(:async_rewrite_history, project)
+            Repositories::RewriteHistoryService.new(project, current_user).async_execute(redactions: replacements)
+          else
+            Repositories::RewriteHistoryService.new(project, current_user).execute(redactions: replacements)
+          end
 
         return { errors: result.errors } if result.error?
 
diff --git a/app/helpers/todos_helper.rb b/app/helpers/todos_helper.rb
index 2813a5e6b6c..5252b89ea11 100644
--- a/app/helpers/todos_helper.rb
+++ b/app/helpers/todos_helper.rb
@@ -235,7 +235,7 @@ module TodosHelper
     is_overdue = todo.target.overdue?
     css_class =
       if is_due_today
-        'gl-text-warning'
+        'text-warning'
       elsif is_overdue
         'gl-text-danger'
       else
diff --git a/app/models/projects/triggered_hooks.rb b/app/models/projects/triggered_hooks.rb
index 1f51ced5b57..e3aa3d106b7 100644
--- a/app/models/projects/triggered_hooks.rb
+++ b/app/models/projects/triggered_hooks.rb
@@ -17,8 +17,6 @@ module Projects
       # Assumes that the relations implement TriggerableHooks
       @relations.each do |hooks|
         hooks.hooks_for(@scope).select_active(@scope, @data).each do |hook|
-          next if @scope == :emoji_hooks && Feature.disabled?(:emoji_webhooks, hook.parent)
-
           hook.async_execute(@data, @scope.to_s)
         end
       end
diff --git a/app/services/repositories/rewrite_history_service.rb b/app/services/repositories/rewrite_history_service.rb
index 0c393aa1955..db56e3f4e4f 100644
--- a/app/services/repositories/rewrite_history_service.rb
+++ b/app/services/repositories/rewrite_history_service.rb
@@ -6,8 +6,8 @@
 module Repositories
   class RewriteHistoryService < ::BaseService
     def execute(blob_oids: [], redactions: [])
-      return ServiceResponse.error(message: _('Access Denied')) unless allowed?
-      return ServiceResponse.error(message: _('not enough arguments')) if blob_oids.blank? && redactions.blank?
+      result = validate_input(blob_oids: blob_oids, redactions: redactions)
+      return result if result.error?
 
       result = mark_repository_read_only
       return result if result.error?
@@ -15,8 +15,29 @@ module Repositories
       rewrite_history(blob_oids: blob_oids, redactions: redactions)
     end
 
+    def async_execute(blob_oids: [], redactions: [])
+      result = validate_input(blob_oids: blob_oids, redactions: redactions)
+      return result if result.error?
+
+      Repositories::RewriteHistoryWorker.perform_async(
+        project_id: project.id,
+        user_id: current_user.id,
+        blob_oids: blob_oids,
+        redactions: redactions
+      )
+
+      ServiceResponse.success
+    end
+
     private
 
+    def validate_input(blob_oids:, redactions:)
+      return ServiceResponse.error(message: _('Access Denied')) unless allowed?
+      return ServiceResponse.error(message: _('not enough arguments')) if blob_oids.blank? && redactions.blank?
+
+      ServiceResponse.success
+    end
+
     def allowed?
       Ability.allowed?(current_user, :owner_access, project)
     end
diff --git a/app/views/dashboard/todos/_todo.html.haml b/app/views/dashboard/todos/_todo.html.haml
index fe7e0a414e4..0e543ee59fd 100644
--- a/app/views/dashboard/todos/_todo.html.haml
+++ b/app/views/dashboard/todos/_todo.html.haml
@@ -1,7 +1,7 @@
 %li.todo.gl-border-t.gl-border-gray-50.hover:gl-border-blue-200.hover:gl-bg-blue-50.hover:gl-cursor-pointer.gl-relative{ class: "hover:gl-z-1 todo-#{todo.done? ? 'done' : 'pending'}", id: dom_id(todo) }
   .gl-flex.gl-flex-col.sm:gl-flex-row.sm:gl-items-center
     .todo-item.gl-overflow-hidden.gl-overflow-x-auto.gl-self-center.gl-w-full{ data: { testid: "todo-item-container" } }
-      .todo-title.gl-pt-2.gl-pb-3.gl-px-2.gl-md-mb-1.gl-text-sm.gl-text-subtle
+      .todo-title.gl-pt-2.gl-pb-3.gl-px-2.gl-md-mb-1.gl-text-sm.gl-text-secondary
 
         = todo_target_state_pill(todo)
 
@@ -16,7 +16,7 @@
 
         %span.todo-label
           - if todo.target
-            = link_to todo_target_name(todo), todo_target_path(todo), class: 'todo-target-link !gl-text-subtle !gl-no-underline', :'aria-describedby' => dom_id(todo) + "_describer", :'aria-label' => todo_target_aria_label(todo)
+            = link_to todo_target_name(todo), todo_target_path(todo), class: 'todo-target-link !gl-text-secondary !gl-no-underline', :'aria-describedby' => dom_id(todo) + "_describer", :'aria-label' => todo_target_aria_label(todo)
           - else
             = _("(removed)")
 
@@ -48,7 +48,7 @@
             = first_line_in_markdown(todo, :body, 125, project: todo.project, group: todo.group)
 
     .todo-timestamp.gl-whitespace-nowrap.sm:gl-ml-3.gl-mt-2.gl-mb-2.gl-sm-my-0.gl-px-2.gl-sm-px-0
-      %span.todo-timestamp.gl-text-sm.gl-text-subtle
+      %span.todo-timestamp.gl-text-sm.gl-text-secondary
         = todo_due_date(todo)
         #{time_ago_with_tooltip(todo.created_at)}
 
diff --git a/app/views/shared/web_hooks/_form.html.haml b/app/views/shared/web_hooks/_form.html.haml
index 1228789085c..16420867004 100644
--- a/app/views/shared/web_hooks/_form.html.haml
+++ b/app/views/shared/web_hooks/_form.html.haml
@@ -70,12 +70,11 @@
       = form.gitlab_ui_checkbox_component :releases_events,
           integration_webhook_event_human_name(:releases_events),
           help_text: s_('Webhooks|A release is created, updated, or deleted.')
-    - if Feature.enabled?(:emoji_webhooks, hook.parent)
-      %li.gl-pb-3
-        - emoji_help_link = link_to s_('Which emoji events trigger webhooks'), help_page_path('user/project/integrations/webhook_events.md', anchor: 'emoji-events')
-        = form.gitlab_ui_checkbox_component :emoji_events,
-            integration_webhook_event_human_name(:emoji_events),
-            help_text: s_('Webhooks|An emoji is awarded or revoked. %{help_link}?').html_safe % { help_link: emoji_help_link }
+    %li.gl-pb-3
+      - emoji_help_link = link_to s_('Which emoji events trigger webhooks'), help_page_path('user/project/integrations/webhook_events.md', anchor: 'emoji-events')
+      = form.gitlab_ui_checkbox_component :emoji_events,
+          integration_webhook_event_human_name(:emoji_events),
+          help_text: s_('Webhooks|An emoji is awarded or revoked. %{help_link}?').html_safe % { help_link: emoji_help_link }
     %li.gl-pb-3
       - access_token_help_link = link_to s_('Which project or group access token events trigger webhooks'), help_page_path('user/project/integrations/webhook_events.md', anchor: 'project-and-group-access-token-events')
       = form.gitlab_ui_checkbox_component :resource_access_token_events,
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index e2fb8693af6..384e0dbdeaf 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -4071,6 +4071,15 @@
   :weight: 2
   :idempotent: false
   :tags: []
+- :name: repositories_rewrite_history
+  :worker_name: Repositories::RewriteHistoryWorker
+  :feature_category: :source_code_management
+  :has_external_dependencies: false
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: repository_cleanup
   :worker_name: RepositoryCleanupWorker
   :feature_category: :source_code_management
diff --git a/app/workers/repositories/rewrite_history_worker.rb b/app/workers/repositories/rewrite_history_worker.rb
new file mode 100644
index 00000000000..79aade6ee86
--- /dev/null
+++ b/app/workers/repositories/rewrite_history_worker.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Repositories
+  class RewriteHistoryWorker
+    include ApplicationWorker
+
+    idempotent!
+    deduplicate :until_executed
+    data_consistency :sticky
+
+    feature_category :source_code_management
+
+    def perform(args = {})
+      args = args.with_indifferent_access
+
+      project = Project.find_by_id(args[:project_id])
+      return unless project
+
+      user = User.find_by_id(args[:user_id])
+      return unless user
+
+      Repositories::RewriteHistoryService.new(project, user).execute(
+        blob_oids: args.fetch(:blob_oids, []),
+        redactions: args.fetch(:redactions, [])
+      )
+    end
+  end
+end
diff --git a/config/feature_flags/beta/async_rewrite_history.yml b/config/feature_flags/beta/async_rewrite_history.yml
new file mode 100644
index 00000000000..b30ff6b0633
--- /dev/null
+++ b/config/feature_flags/beta/async_rewrite_history.yml
@@ -0,0 +1,9 @@
+---
+name: async_rewrite_history
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475250
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/162306
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/481484
+milestone: '17.4'
+group: group::source code
+type: beta
+default_enabled: false
diff --git a/config/feature_flags/development/emoji_webhooks.yml b/config/feature_flags/development/emoji_webhooks.yml
deleted file mode 100644
index 3c84f19ab48..00000000000
--- a/config/feature_flags/development/emoji_webhooks.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: emoji_webhooks
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123952
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/417288
-milestone: '16.2'
-type: development
-group: group::import and integrate
-default_enabled: true
diff --git a/config/sidekiq_queues.yml b/config/sidekiq_queues.yml
index 95a8fa5a83e..42737951b55 100644
--- a/config/sidekiq_queues.yml
+++ b/config/sidekiq_queues.yml
@@ -699,6 +699,8 @@
   - 1
 - - remote_mirror_notification
   - 2
+- - repositories_rewrite_history
+  - 1
 - - repository_check
   - 1
 - - repository_cleanup
diff --git a/db/migrate/20240919065854_add_max_number_of_vulnerabilities_to_project_settings.rb b/db/migrate/20240919065854_add_max_number_of_vulnerabilities_to_project_settings.rb
new file mode 100644
index 00000000000..29ca3c521b7
--- /dev/null
+++ b/db/migrate/20240919065854_add_max_number_of_vulnerabilities_to_project_settings.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class AddMaxNumberOfVulnerabilitiesToProjectSettings < Gitlab::Database::Migration[2.2]
+  TABLE_NAME = :project_settings
+  COLUMN_NAME = :max_number_of_vulnerabilities
+
+  milestone '17.5'
+  disable_ddl_transaction!
+
+  def up
+    with_lock_retries do
+      add_column TABLE_NAME, COLUMN_NAME, :integer
+    end
+  end
+
+  def down
+    with_lock_retries do
+      remove_column TABLE_NAME, COLUMN_NAME
+    end
+  end
+end
diff --git a/db/schema_migrations/20240919065854 b/db/schema_migrations/20240919065854
new file mode 100644
index 00000000000..0d185fad075
--- /dev/null
+++ b/db/schema_migrations/20240919065854
@@ -0,0 +1 @@
+52382a92f2f8b349e4f14137440f07e3d13f9b89d59e85c78218c690b11ed4c7
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 4e305a6e396..42da97f050a 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -16963,6 +16963,7 @@ CREATE TABLE project_settings (
     require_reauthentication_to_approve boolean,
     observability_alerts_enabled boolean DEFAULT true NOT NULL,
     spp_repository_pipeline_access boolean,
+    max_number_of_vulnerabilities integer,
     CONSTRAINT check_1a30456322 CHECK ((char_length(pages_unique_domain) <= 63)),
     CONSTRAINT check_3a03e7557a CHECK ((char_length(previous_default_branch) <= 4096)),
     CONSTRAINT check_3ca5cbffe6 CHECK ((char_length(issue_branch_template) <= 255)),
diff --git a/doc/administration/auth/oidc.md b/doc/administration/auth/oidc.md
index 4c9124267a2..3a822f65390 100644
--- a/doc/administration/auth/oidc.md
+++ b/doc/administration/auth/oidc.md
@@ -399,6 +399,8 @@ gitlab_rails['omniauth_providers'] = [
 
 For Helm installations:
 
+Add the [provider's configuration](https://docs.gitlab.com/charts/charts/globals.html#providers) in a YAML file (for example, `provider.yaml`):
+
 ::Tabs
 
 :::TabTitle Azure OAuth 2.0
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 06f3a63f1df..dca5fc938db 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -21892,6 +21892,7 @@ Events that describe the history and progress of a Duo Workflow.
 | <a id="duoworkfloweventmetadata"></a>`metadata` | [`JsonString`](#jsonstring) | Metadata associated with the event. |
 | <a id="duoworkfloweventparenttimestamp"></a>`parentTimestamp` | [`Time`](#time) | Time of the parent event. |
 | <a id="duoworkfloweventtimestamp"></a>`timestamp` | [`Time`](#time) | Time of the event. |
+| <a id="duoworkfloweventworkflowstatus"></a>`workflowStatus` | [`DuoWorkflowStatus`](#duoworkflowstatus) | Status of the workflow. |
 
 ### `EgressNode`
 
@@ -36825,6 +36826,18 @@ All possible ways that DORA metrics can be aggregated.
 | <a id="dorametricbucketingintervaldaily"></a>`DAILY` | Data points are combined into chunks by day. |
 | <a id="dorametricbucketingintervalmonthly"></a>`MONTHLY` | Data points are combined into chunks by month. |
 
+### `DuoWorkflowStatus`
+
+The status of the workflow.
+
+| Value | Description |
+| ----- | ----------- |
+| <a id="duoworkflowstatuscreated"></a>`CREATED` | The workflow is created. |
+| <a id="duoworkflowstatusfailed"></a>`FAILED` | The workflow is failed. |
+| <a id="duoworkflowstatusfinished"></a>`FINISHED` | The workflow is finished. |
+| <a id="duoworkflowstatuspaused"></a>`PAUSED` | The workflow is paused. |
+| <a id="duoworkflowstatusrunning"></a>`RUNNING` | The workflow is running. |
+
 ### `EntryType`
 
 Type of a tree entry.
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 6b0348f3e0f..2b93febebe7 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -45,6 +45,7 @@ configure the settings that are common for all providers.
 
 | Linux package, Docker, and self-compiled | Helm chart | Description | Default value |
 | ----------------------------|------------|-------------|-----------|
+| `enable`                    | `enable`           | Allows the use of OmniAuth providers. | `false`, which means that signing in using your OmniAuth providers is not allowed, and the OmniAuth provider buttons are not visible in the user interface. |
 | `allow_single_sign_on`     | `allowSingleSignOn` | List of providers that automatically create a GitLab account. The provider names are available in the **OmniAuth provider name** column in the [supported providers table](#supported-providers). | `false`, which means that signing in using your OmniAuth provider account without a pre-existing GitLab account is not allowed. You must create a GitLab account first, and then connect it to your OmniAuth provider account through your profile settings. |
 | `auto_link_ldap_user`      | `autoLinkLdapUser` | Creates an LDAP identity in GitLab for users that are created through an OmniAuth provider. You can enable this setting if you have [LDAP integration](../administration/auth/ldap/index.md) enabled. Requires the `uid` of the user to be the same in both LDAP and the OmniAuth provider. | `false` |
 | `block_auto_created_users` | `blockAutoCreatedUsers` | Places automatically-created users in a [Pending approval](../administration/moderate_users.md#users-pending-approval) state (unable to sign in) until they are approved by an administrator. | `true`. If you set the value to `false`, make sure you define providers that you can control, like SAML or Google. Otherwise, any user on the internet can sign in to GitLab without an administrator's approval. |
diff --git a/doc/user/project/integrations/webhook_events.md b/doc/user/project/integrations/webhook_events.md
index 52e955cbc1b..fa405c06669 100644
--- a/doc/user/project/integrations/webhook_events.md
+++ b/doc/user/project/integrations/webhook_events.md
@@ -2007,6 +2007,7 @@ Payload example:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/123952) in GitLab 16.2 [with a flag](../../../administration/feature_flags.md) named `emoji_webhooks`. Disabled by default.
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/417288) in GitLab 16.3.
 > - [Enabled by default](https://gitlab.com/gitlab-org/gitlab/-/issues/417288) in GitLab 16.4.
+> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/417288) in GitLab 17.5. Feature flag `emoji_webhooks` removed.
 
 FLAG:
 On self-managed GitLab, by default this feature is available. To hide the feature, an administrator can
diff --git a/doc/user/project/pages/pages_access_control.md b/doc/user/project/pages/pages_access_control.md
index f24b23ef684..6170464b73f 100644
--- a/doc/user/project/pages/pages_access_control.md
+++ b/doc/user/project/pages/pages_access_control.md
@@ -19,7 +19,7 @@ on your GitLab instance. When enabled, only authenticated
 <i class="fa fa-youtube-play youtube" aria-hidden="true"></i>
 For a demonstration, see [Pages access controls](https://www.youtube.com/watch?v=tSPAr5mQYc8).
 
-1. On the left sidebar, select **Search or go to** and find your group.
+1. On the left sidebar, select **Search or go to** and find your project.
 1. Select **Settings > General**.
 1. Expand **Visibility, project features, permissions**.
 1. Toggle the **Pages** button to enable the access control. If you don't see the toggle button,
diff --git a/doc/user/project/repository/code_suggestions/repository_xray.md b/doc/user/project/repository/code_suggestions/repository_xray.md
index 3ac5c4e4332..e1894a273b4 100644
--- a/doc/user/project/repository/code_suggestions/repository_xray.md
+++ b/doc/user/project/repository/code_suggestions/repository_xray.md
@@ -41,6 +41,7 @@ The Repository X-Ray searches a maximum of two directory levels from the reposit
 | ---------- |-----------------| -------------------- | -------------- |
 | C++        | Conan           | `conanfile.py`       | 17.5 or later  |
 | C++        | Conan           | `conanfile.txt`      | 17.4 or later  |
+| C++        | vcpkg           | `vcpkg.json`         | 17.5 or later  |
 | C#         | NuGet           | `*.csproj`           | 17.5 or later  |
 | Go         | Go Modules      | `go.mod`             | 17.4 or later  |
 | Java       | Gradle          | `build.gradle`       | 17.4 or later  |
diff --git a/doc/user/version.md b/doc/user/version.md
index 2dcaf16d53b..1f04f811417 100644
--- a/doc/user/version.md
+++ b/doc/user/version.md
@@ -11,14 +11,20 @@ Find the version of GitLab you're running.
 
 ## For self-managed GitLab
 
-- On the left sidebar, at the bottom, select **Help**.
+Prerequisites:
 
-The version is displayed at the top of the dialog.
+- You must be an authenticated user.
+
+To find the version for self-managed GitLab: 
+
+- On the left sidebar, at the bottom, select **Help > Help**.
+
+The version is displayed at the top of the page.
 
 ## For GitLab.com
 
 - Go to <https://gitlab.com/help>.
 
 The version is displayed at the top of the page. For example,
-`GitLab Enterprise Edition 16.3.0-pre 1e04d6b7fa9` indicates a pre-release
-version of GitLab 16.3.
+`GitLab Enterprise Edition 17.3.0-pre 1e04d6b7fa9` indicates a pre-release
+version of GitLab 17.3.
diff --git a/gems/gitlab-backup-cli/Gemfile b/gems/gitlab-backup-cli/Gemfile
index 551a4aea73c..9686e062c2f 100644
--- a/gems/gitlab-backup-cli/Gemfile
+++ b/gems/gitlab-backup-cli/Gemfile
@@ -7,4 +7,5 @@ gemspec
 
 group :development, :test do
   gem 'gitlab-rspec', path: '../gitlab-rspec'
+  gem 'pry'
 end
diff --git a/gems/gitlab-backup-cli/Gemfile.lock b/gems/gitlab-backup-cli/Gemfile.lock
index 2e806e947b8..c6cf54c9240 100644
--- a/gems/gitlab-backup-cli/Gemfile.lock
+++ b/gems/gitlab-backup-cli/Gemfile.lock
@@ -10,36 +10,50 @@ PATH
   remote: .
   specs:
     gitlab-backup-cli (0.0.1)
-      activesupport (< 7.2)
+      activesupport (~> 7.0.8.4)
+      addressable (~> 2.8)
+      concurrent-ruby (~> 1.1)
+      faraday (~> 2)
       google-cloud-storage_transfer (~> 1.2.0)
+      google-protobuf (~> 3.25, >= 3.25.3)
       googleauth (~> 1.8.1)
+      grpc (= 1.63.0)
+      json (~> 2.7.2)
+      jwt (~> 2.5)
+      logger (~> 1.5.3)
+      minitest (~> 5.11.0)
+      parallel (~> 1.19)
+      rack (~> 2.2.9)
       rainbow (~> 3.0)
+      rexml (~> 3.3.2)
       thor (~> 1.3)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activerecord (7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activesupport (7.0.8.1)
+    activemodel (7.0.8.4)
+      activesupport (= 7.0.8.4)
+    activerecord (7.0.8.4)
+      activemodel (= 7.0.8.4)
+      activesupport (= 7.0.8.4)
+    activesupport (7.0.8.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
     ast (2.4.2)
     base64 (0.2.0)
-    concurrent-ruby (1.2.3)
-    diff-lcs (1.5.0)
+    coderay (1.1.3)
+    concurrent-ruby (1.3.4)
+    diff-lcs (1.5.1)
     factory_bot (6.4.6)
       activesupport (>= 5.0.0)
-    faraday (2.9.0)
-      faraday-net_http (>= 2.0, < 3.2)
-    faraday-net_http (3.1.0)
+    faraday (2.11.0)
+      faraday-net_http (>= 2.0, < 3.4)
+      logger
+    faraday-net_http (3.3.0)
       net-http
     faraday-retry (2.2.1)
       faraday (~> 2.0)
@@ -57,10 +71,10 @@ GEM
       rubocop-performance (~> 1.15)
       rubocop-rails (~> 2.17)
       rubocop-rspec (~> 2.22)
-    google-cloud-core (1.7.0)
+    google-cloud-core (1.7.1)
       google-cloud-env (>= 1.0, < 3.a)
       google-cloud-errors (~> 1.0)
-    google-cloud-env (2.1.1)
+    google-cloud-env (2.2.0)
       faraday (>= 1.0, < 3.a)
     google-cloud-errors (1.4.0)
     google-cloud-storage_transfer (1.2.0)
@@ -69,15 +83,15 @@ GEM
     google-cloud-storage_transfer-v1 (0.8.0)
       gapic-common (>= 0.20.0, < 2.a)
       google-cloud-errors (~> 1.0)
-    google-protobuf (3.25.3)
-    google-protobuf (3.25.3-arm64-darwin)
-    google-protobuf (3.25.3-x86_64-linux)
-    googleapis-common-protos (1.5.0)
-      google-protobuf (~> 3.18)
+    google-protobuf (3.25.4)
+    google-protobuf (3.25.4-arm64-darwin)
+    google-protobuf (3.25.4-x86_64-linux)
+    googleapis-common-protos (1.6.0)
+      google-protobuf (>= 3.18, < 5.a)
       googleapis-common-protos-types (~> 1.7)
       grpc (~> 1.41)
-    googleapis-common-protos-types (1.14.0)
-      google-protobuf (~> 3.18)
+    googleapis-common-protos-types (1.15.0)
+      google-protobuf (>= 3.18, < 5.a)
     googleauth (1.8.1)
       faraday (>= 0.17.3, < 3.a)
       jwt (>= 1.4, < 3.0)
@@ -93,41 +107,46 @@ GEM
     grpc (1.63.0-x86_64-linux)
       google-protobuf (~> 3.25)
       googleapis-common-protos-types (~> 1.0)
-    i18n (1.14.4)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
-    json (2.6.3)
-    jwt (2.8.1)
+    json (2.7.2)
+    jwt (2.8.2)
       base64
     language_server-protocol (3.17.0.3)
-    minitest (5.22.3)
+    logger (1.5.3)
+    method_source (1.1.0)
+    minitest (5.11.3)
     multi_json (1.15.0)
     net-http (0.4.1)
       uri
     os (1.1.4)
-    parallel (1.23.0)
-    parser (3.2.2.4)
+    parallel (1.26.3)
+    parser (3.3.3.0)
       ast (~> 2.4.1)
       racc
-    public_suffix (5.0.5)
-    racc (1.7.3)
-    rack (3.0.8)
+    pry (0.14.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    public_suffix (6.0.1)
+    racc (1.8.1)
+    rack (2.2.9)
     rainbow (3.1.1)
-    rake (13.1.0)
-    regexp_parser (2.8.2)
-    rexml (3.2.6)
-    rspec (3.12.0)
-      rspec-core (~> 3.12.0)
-      rspec-expectations (~> 3.12.0)
-      rspec-mocks (~> 3.12.0)
-    rspec-core (3.12.2)
-      rspec-support (~> 3.12.0)
-    rspec-expectations (3.12.3)
+    rake (13.2.1)
+    regexp_parser (2.9.2)
+    rexml (3.3.7)
+    rspec (3.13.0)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.1)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-mocks (3.12.6)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-support (3.12.1)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.1)
     rubocop (1.57.2)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
@@ -139,22 +158,22 @@ GEM
       rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.30.0)
-      parser (>= 3.2.1.0)
-    rubocop-capybara (2.19.0)
+    rubocop-ast (1.32.3)
+      parser (>= 3.3.1.0)
+    rubocop-capybara (2.21.0)
+      rubocop (~> 1.41)
+    rubocop-factory_bot (2.25.1)
       rubocop (~> 1.41)
-    rubocop-factory_bot (2.24.0)
-      rubocop (~> 1.33)
     rubocop-graphql (0.19.0)
       rubocop (>= 0.87, < 2)
-    rubocop-performance (1.19.1)
-      rubocop (>= 1.7.0, < 2.0)
-      rubocop-ast (>= 0.4.0)
+    rubocop-performance (1.21.1)
+      rubocop (>= 1.48.1, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
     rubocop-rails (2.20.0)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
-    rubocop-rspec (2.25.0)
+    rubocop-rspec (2.27.1)
       rubocop (~> 1.40)
       rubocop-capybara (~> 2.17)
       rubocop-factory_bot (~> 2.22)
@@ -164,11 +183,11 @@ GEM
       faraday (>= 0.17.5, < 3.a)
       jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
-    thor (1.3.0)
+    thor (1.3.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
-    uri (0.13.0)
+    uri (0.13.1)
 
 PLATFORMS
   arm64-darwin-21
@@ -181,9 +200,12 @@ DEPENDENCIES
   gitlab-backup-cli!
   gitlab-rspec!
   gitlab-styles (~> 11.0)
+  parser (= 3.3.3.0)
+  pry
   rake (~> 13.0)
   rspec (~> 3.0)
-  rubocop-rails (<= 2.20)
+  rubocop-factory_bot (~> 2.25.1)
+  rubocop-rspec (~> 2.27.1)
 
 BUNDLED WITH
    2.5.18
diff --git a/gems/gitlab-backup-cli/gitlab-backup-cli.gemspec b/gems/gitlab-backup-cli/gitlab-backup-cli.gemspec
index 7649d6419a5..b3a22b76a68 100644
--- a/gems/gitlab-backup-cli/gitlab-backup-cli.gemspec
+++ b/gems/gitlab-backup-cli/gitlab-backup-cli.gemspec
@@ -24,15 +24,32 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "activesupport", "< 7.2"
+  spec.add_dependency "activesupport", "~> 7.0.8.4"
   spec.add_dependency "googleauth", "~> 1.8.1" # https://gitlab.com/gitlab-org/gitlab/-/issues/449019
   spec.add_dependency "google-cloud-storage_transfer", "~> 1.2.0"
   spec.add_dependency "rainbow", "~> 3.0"
   spec.add_dependency "thor", "~> 1.3"
 
+  # The following gems are pinned at specific version to keep
+  # gem versions at par with gitlab/Gemfile
+  spec.add_dependency "addressable", "~> 2.8"
+  spec.add_dependency "concurrent-ruby", "~> 1.1"
+  spec.add_dependency "faraday", "~> 2"
+  spec.add_dependency "google-protobuf", "~> 3.25", ">= 3.25.3"
+  spec.add_dependency "grpc", "= 1.63.0"
+  spec.add_dependency "json", "~> 2.7.2"
+  spec.add_dependency "jwt", "~> 2.5"
+  spec.add_dependency "logger", "~> 1.5.3"
+  spec.add_dependency "minitest", "~> 5.11.0"
+  spec.add_dependency "parallel", "~> 1.19"
+  spec.add_dependency "rack", "~> 2.2.9"
+  spec.add_dependency "rexml", "~> 3.3.2"
+
   spec.add_development_dependency "factory_bot", "~> 6.4.6"
   spec.add_development_dependency "gitlab-styles", "~> 11.0"
+  spec.add_development_dependency "parser", "= 3.3.3.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.0"
-  spec.add_development_dependency "rubocop-rails", "<= 2.20" # https://github.com/rubocop/rubocop-rails/issues/1173
+  spec.add_development_dependency "rubocop-factory_bot", "~> 2.25.1" # https://github.com/rubocop/rubocop-rspec/issues/1916
+  spec.add_development_dependency "rubocop-rspec", "~> 2.27.1"
 end
diff --git a/gems/gitlab-backup-cli/spec/thor/gitlab_backup_cli_backup_spec.rb b/gems/gitlab-backup-cli/spec/thor/gitlab_backup_cli_backup_spec.rb
index f11efc14445..99b06f32d57 100644
--- a/gems/gitlab-backup-cli/spec/thor/gitlab_backup_cli_backup_spec.rb
+++ b/gems/gitlab-backup-cli/spec/thor/gitlab_backup_cli_backup_spec.rb
@@ -14,12 +14,12 @@ RSpec.describe 'gitlab-backup-cli backup subcommand', type: :thor do
         gitlab-backup-cli backup help [COMMAND]  # Describe subcommands or one specific subcommand
 
       Options:
-        [--backup-bucket=BACKUP_BUCKET]                      # When backing up object storage, this is the bucket to backup to
-        [--wait-for-completion], [--no-wait-for-completion]  # Wait for object storage backups to complete
-                                                             # Default: true
-        [--registry-bucket=REGISTRY_BUCKET]                  # When backing up registry from object storage, this is the source bucket
-        [--service-account-file=SERVICE_ACCOUNT_FILE]        # JSON file containing the Google service account credentials
-                                                             # Default: /etc/gitlab/backup-account-credentials.json
+        [--backup-bucket=BACKUP_BUCKET]                                                    # When backing up object storage, this is the bucket to backup to
+        [--wait-for-completion], [--no-wait-for-completion], [--skip-wait-for-completion]  # Wait for object storage backups to complete
+                                                                                           # Default: true
+        [--registry-bucket=REGISTRY_BUCKET]                                                # When backing up registry from object storage, this is the source bucket
+        [--service-account-file=SERVICE_ACCOUNT_FILE]                                      # JSON file containing the Google service account credentials
+                                                                                           # Default: /etc/gitlab/backup-account-credentials.json
 
     COMMAND
   end
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 4a07aead66e..2521a34e1c0 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -11,7 +11,7 @@ module API
     before { authenticate_non_get! }
 
     allow_access_with_scope :ai_workflows, if: ->(request) do
-      request.get? || request.head?
+      request.get? || request.head? || request.put?
     end
 
     rescue_from ActiveRecord::QueryCanceled do |_e|
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 26af4437be5..9596a4adea3 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -8,7 +8,9 @@ module API
 
     before { authenticate! }
 
-    allow_access_with_scope :ai_workflows
+    allow_access_with_scope :ai_workflows, if: ->(request) do
+      request.get? || request.head? || request.post?
+    end
 
     urgency :low, [
       '/projects/:id/merge_requests/:noteable_id/notes',
diff --git a/lib/bulk_imports/common/pipelines/members_pipeline.rb b/lib/bulk_imports/common/pipelines/members_pipeline.rb
index 15512c0bbc7..7a6ce4acd40 100644
--- a/lib/bulk_imports/common/pipelines/members_pipeline.rb
+++ b/lib/bulk_imports/common/pipelines/members_pipeline.rb
@@ -22,6 +22,16 @@ module BulkImports
         def load(_context, data)
           return unless data
 
+          if data[:source_user]
+            create_placeholder_membership(data)
+          else
+            create_member(data)
+          end
+        end
+
+        private
+
+        def create_member(data)
           user_id = data[:user_id]
 
           # Current user is already a member
@@ -38,7 +48,13 @@ module BulkImports
           member.save!
         end
 
-        private
+        def create_placeholder_membership(data)
+          result = Import::PlaceholderMemberships::CreateService.new(**data).execute
+
+          return unless result.error?
+
+          result.track_and_raise_exception(access_level: data[:access_level])
+        end
 
         def graphql_extractor
           @graphql_extractor ||= BulkImports::Common::Extractors::GraphqlExtractor
diff --git a/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer.rb b/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer.rb
index aa7cdb16e6c..c84c99bf885 100644
--- a/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer.rb
+++ b/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer.rb
@@ -12,23 +12,27 @@ module Import
             # they can be mapped to contributions in subsequent pipelines
             source_user = find_or_create_source_user(context, data)
 
-            # For now, members are only created on subsequent imports for users
-            # that have accepted the reassignment.
-            # https://gitlab.com/gitlab-org/gitlab/-/issues/477845 will handle
-            # membership for source_users mapped to placeholder users
-            return unless source_user.accepted_status?
-
             access_level = data.dig('access_level', 'integer_value')
             return unless valid_access_level?(access_level)
 
-            {
-              user_id: source_user.mapped_user_id,
-              access_level: access_level,
-              created_at: data['created_at'],
-              updated_at: data['updated_at'],
-              expires_at: data['expires_at'],
-              created_by_id: context.current_user.id
-            }
+            if source_user.accepted_status?
+              {
+                user_id: source_user.mapped_user_id,
+                access_level: access_level,
+                created_at: data['created_at'],
+                updated_at: data['updated_at'],
+                expires_at: data['expires_at'],
+                created_by_id: context.current_user.id
+              }
+            else
+              {
+                source_user: source_user,
+                access_level: access_level,
+                expires_at: data['expires_at'],
+                group: context.entity.group,
+                project: context.entity.project
+              }
+            end
           end
 
           private
diff --git a/qa/qa/specs/features/browser_ui/14_analytics/service_ping_disabled_spec.rb b/qa/qa/specs/features/browser_ui/14_analytics/service_ping_disabled_spec.rb
index 6d99943ce30..4b1f4826e5e 100644
--- a/qa/qa/specs/features/browser_ui/14_analytics/service_ping_disabled_spec.rb
+++ b/qa/qa/specs/features/browser_ui/14_analytics/service_ping_disabled_spec.rb
@@ -12,7 +12,7 @@ module QA
         end
 
         it(
-          'has service ping toggle is disabled',
+          'has service ping toggle is disabled', :blocking,
           testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/348340'
         ) do
           Page::Admin::Settings::MetricsAndProfiling.perform do |settings|
diff --git a/spec/components/pajamas/button_component_spec.rb b/spec/components/pajamas/button_component_spec.rb
index dfc87dfc788..ef7879db716 100644
--- a/spec/components/pajamas/button_component_spec.rb
+++ b/spec/components/pajamas/button_component_spec.rb
@@ -82,7 +82,7 @@ RSpec.describe Pajamas::ButtonComponent, type: :component, feature_category: :de
         end
 
         it 'does not render a spinner' do
-          expect(page).not_to have_css('.gl-sr-only', text: 'Loading')
+          expect(page).not_to have_css ".gl-spinner[aria-label='Loading']"
         end
       end
 
@@ -94,7 +94,7 @@ RSpec.describe Pajamas::ButtonComponent, type: :component, feature_category: :de
         end
 
         it 'renders a spinner' do
-          expect(page).to have_css('.gl-sr-only', text: 'Loading')
+          expect(page).to have_css ".gl-spinner[aria-label='Loading']"
         end
       end
     end
@@ -217,7 +217,7 @@ RSpec.describe Pajamas::ButtonComponent, type: :component, feature_category: :de
 
         it 'renders only a loading icon' do
           expect(page).not_to have_css "svg.gl-icon.gl-button-icon.custom-icon[data-testid='star-o-icon']"
-          expect(page).to have_css('.gl-sr-only', text: 'Loading')
+          expect(page).to have_css ".gl-spinner[aria-label='Loading']"
         end
       end
     end
diff --git a/spec/components/pajamas/spinner_component_spec.rb b/spec/components/pajamas/spinner_component_spec.rb
index da7c322028e..f03d8c9561b 100644
--- a/spec/components/pajamas/spinner_component_spec.rb
+++ b/spec/components/pajamas/spinner_component_spec.rb
@@ -50,16 +50,16 @@ RSpec.describe Pajamas::SpinnerComponent, type: :component do
 
   describe 'label' do
     context 'by default' do
-      it 'has "Loading" as screen reader available text' do
-        expect(page).to have_css('.gl-sr-only', text: 'Loading')
+      it 'has "Loading" as aria-label' do
+        expect(page).to have_css '.gl-spinner[aria-label="Loading"]'
       end
     end
 
     context 'when set to something else' do
       let(:options) { { label: "Sending" } }
 
-      it 'has a custom label as screen reader available text' do
-        expect(page).to have_css('.gl-sr-only', text: 'Sending')
+      it 'has a custom aria-label' do
+        expect(page).to have_css '.gl-spinner[aria-label="Sending"]'
       end
     end
   end
diff --git a/spec/features/dashboard/todos/accessibility_spec.rb b/spec/features/dashboard/todos/accessibility_spec.rb
deleted file mode 100644
index 3ce0085afea..00000000000
--- a/spec/features/dashboard/todos/accessibility_spec.rb
+++ /dev/null
@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe 'Dashboard Todos', :js, feature_category: :team_planning do
-  let_it_be(:user) { create(:user, username: 'john') }
-  let_it_be(:user2) { create(:user, username: 'diane') }
-  let_it_be(:author) { create(:user) }
-  let_it_be(:project) { create(:project, :public, developers: user) }
-  let_it_be(:issue) { create(:issue, project: project, due_date: Date.today, title: "Fix bug") }
-
-  context 'when user does not have todos' do
-    before do
-      sign_in(user)
-      visit dashboard_todos_path
-    end
-
-    it 'passes axe automated accessibility testing' do
-      expect(page).to be_axe_clean.within('#content-body')
-    end
-  end
-
-  context 'when user has todos' do
-    before do
-      allow(Todo).to receive(:default_per_page).and_return(2)
-      mr_merged = create(:merge_request, :simple, :merged, author: user, source_project: project)
-      note = create(
-        :note,
-        project: project,
-        note: "Check out #{mr_merged.to_reference}",
-        noteable: create(:issue, project: project)
-      )
-
-      create(:todo, :assigned, user: user, project: project, target: issue, author: user2)
-      create(:todo, :mentioned, user: user, project: project, target: mr_merged, author: author)
-      create(:todo, :mentioned, project: project, target: issue, user: user, note_id: note.id)
-
-      sign_in(user)
-      visit dashboard_todos_path
-    end
-
-    it 'passes axe automated accessibility testing' do
-      expect(page).to be_axe_clean.within('#content-body')
-    end
-
-    context 'when user has the option to undo delete action' do
-      before do
-        within first('.todo') do
-          find_by_testid('check-icon').click
-        end
-      end
-
-      it 'passes axe automated accessibility testing' do
-        expect(page).to be_axe_clean.within('#content-body')
-      end
-    end
-
-    context 'and filters with search options' do
-      it 'passes axe automated accessibility testing' do
-        click_button 'Author'
-        expect(page).to be_axe_clean.within('.todos-filters')
-      end
-    end
-
-    context 'and filters with list options' do
-      it 'passes axe automated accessibility testing' do
-        click_button 'Action'
-        expect(page).to be_axe_clean.within('.todos-filters')
-      end
-    end
-
-    context 'and sorts the list' do
-      it 'passes axe automated accessibility testing' do
-        click_button 'Last created'
-        expect(page).to be_axe_clean.within('.todos-filters')
-      end
-    end
-  end
-
-  context 'when user has todos marked as done' do
-    before do
-      create(:todo, :mentioned, :done, user: user, project: project, target: issue, author: author)
-      sign_in(user)
-      visit dashboard_todos_path(state: :done)
-    end
-
-    it 'passes axe automated accessibility testing' do
-      expect(page).to be_axe_clean.within('#content-body')
-    end
-  end
-end
diff --git a/spec/features/dashboard/todos/target_state_spec.rb b/spec/features/dashboard/todos/target_state_spec.rb
index 15d72c3bb11..8f940b50e6c 100644
--- a/spec/features/dashboard/todos/target_state_spec.rb
+++ b/spec/features/dashboard/todos/target_state_spec.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# covered by ./accessibility_spec.rb
-
 require 'spec_helper'
 
 RSpec.describe 'Dashboard > Todo target states', feature_category: :team_planning do
diff --git a/spec/features/dashboard/todos/todos_filtering_spec.rb b/spec/features/dashboard/todos/todos_filtering_spec.rb
index d6baff5ed4a..e47721bb377 100644
--- a/spec/features/dashboard/todos/todos_filtering_spec.rb
+++ b/spec/features/dashboard/todos/todos_filtering_spec.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# covered by ./accessibility_spec.rb
-
 require 'spec_helper'
 
 RSpec.describe 'Dashboard > User filters todos', :js, feature_category: :team_planning do
diff --git a/spec/features/dashboard/todos/todos_sorting_spec.rb b/spec/features/dashboard/todos/todos_sorting_spec.rb
index 18c0626c1f9..e1460e345fc 100644
--- a/spec/features/dashboard/todos/todos_sorting_spec.rb
+++ b/spec/features/dashboard/todos/todos_sorting_spec.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# covered by ./accessibility_spec.rb
-
 require 'spec_helper'
 
 RSpec.describe 'Dashboard > User sorts todos', feature_category: :team_planning do
diff --git a/spec/features/dashboard/todos/todos_spec.rb b/spec/features/dashboard/todos/todos_spec.rb
index 8f8955e11ef..fd9cb66e06c 100644
--- a/spec/features/dashboard/todos/todos_spec.rb
+++ b/spec/features/dashboard/todos/todos_spec.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# covered by ./accessibility_spec.rb
-
 require 'spec_helper'
 
 RSpec.describe 'Dashboard Todos', :js, feature_category: :team_planning do
diff --git a/spec/frontend/boards/components/board_app_spec.js b/spec/frontend/boards/components/board_app_spec.js
index 6c292f0c2c8..4db572d1f58 100644
--- a/spec/frontend/boards/components/board_app_spec.js
+++ b/spec/frontend/boards/components/board_app_spec.js
@@ -6,6 +6,7 @@ import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import BoardApp from '~/boards/components/board_app.vue';
 import BoardTopBar from '~/boards/components/board_top_bar.vue';
+import BoardContent from '~/boards/components/board_content.vue';
 import activeBoardItemQuery from 'ee_else_ce/boards/graphql/client/active_board_item.query.graphql';
 import boardListsQuery from 'ee_else_ce/boards/graphql/board_lists.query.graphql';
 import * as cacheUpdates from '~/boards/graphql/cache_updates';
@@ -16,6 +17,7 @@ describe('BoardApp', () => {
   let mockApollo;
 
   const findBoardTopBar = () => wrapper.findComponent(BoardTopBar);
+  const findBoardContent = () => wrapper.findComponent(BoardContent);
 
   const errorMessage = 'Failed to fetch lists';
   const boardListQueryHandler = jest.fn().mockResolvedValue(boardListsQueryResponse);
@@ -23,7 +25,11 @@ describe('BoardApp', () => {
 
   Vue.use(VueApollo);
 
-  const createComponent = ({ issue = rawIssue, handler = boardListQueryHandler } = {}) => {
+  const createComponent = ({
+    issue = rawIssue,
+    handler = boardListQueryHandler,
+    workItemDrawerEnabled = true,
+  } = {}) => {
     mockApollo = createMockApollo([[boardListsQuery, handler]]);
     mockApollo.clients.defaultClient.cache.writeQuery({
       query: activeBoardItemQuery,
@@ -42,6 +48,9 @@ describe('BoardApp', () => {
         boardType: 'project',
         isIssueBoard: true,
         isGroupBoard: false,
+        glFeatures: {
+          issuesListDrawer: workItemDrawerEnabled,
+        },
       },
     });
   };
@@ -57,15 +66,21 @@ describe('BoardApp', () => {
     expect(boardListQueryHandler).toHaveBeenCalled();
   });
 
-  it('should have is-compact class when a card is selected', () => {
-    expect(wrapper.classes()).toContain('is-compact');
+  it('should have dynamic width classes when a card is selected', () => {
+    const classes = findBoardContent().classes();
+    expect(classes).toContain('lg:gl-w-[calc(100%-480px)]');
+    expect(classes).toContain('xl:gl-w-[calc(100%-768px)]');
+    expect(classes).toContain('min-[1440px]:gl-w-[calc(100%-912px)]');
   });
 
-  it('should not have is-compact class when no card is selected', async () => {
+  it('should not have dynamic width classes class when no card is selected', async () => {
     createComponent({ issue: {} });
     await nextTick();
 
-    expect(wrapper.classes()).not.toContain('is-compact');
+    const classes = findBoardContent().classes();
+    expect(classes).not.toContain('lg:gl-w-[calc(100%-480px)]');
+    expect(classes).not.toContain('xl:gl-w-[calc(100%-768px)]');
+    expect(classes).not.toContain('min-[1440px]:gl-w-[calc(100%-912px)]');
   });
 
   it('refetches lists when top bar emits updateBoard event', async () => {
diff --git a/spec/frontend/boards/components/board_content_spec.js b/spec/frontend/boards/components/board_content_spec.js
index cfa5d7513d8..18ccabd4f31 100644
--- a/spec/frontend/boards/components/board_content_spec.js
+++ b/spec/frontend/boards/components/board_content_spec.js
@@ -65,6 +65,7 @@ describe('BoardContent', () => {
         boardLists: mockListsById,
         listQueryVariables,
         addColumnFormVisible: false,
+        useWorkItemDrawer: workItemDrawerEnabled,
         ...props,
       },
       provide: {
@@ -76,9 +77,6 @@ describe('BoardContent', () => {
         isGroupBoard: true,
         disabled: false,
         fullPath: 'project-path',
-        glFeatures: {
-          issuesListDrawer: workItemDrawerEnabled,
-        },
       },
       stubs: {
         BoardContentSidebar: stubComponent(BoardContentSidebar, {
diff --git a/spec/frontend/work_items/components/work_item_relationships/__snapshots__/work_item_relationship_list_spec.js.snap b/spec/frontend/work_items/components/work_item_relationships/__snapshots__/work_item_relationship_list_spec.js.snap
index 765a37c7aae..7f4820e0ff3 100644
--- a/spec/frontend/work_items/components/work_item_relationships/__snapshots__/work_item_relationship_list_spec.js.snap
+++ b/spec/frontend/work_items/components/work_item_relationships/__snapshots__/work_item_relationship_list_spec.js.snap
@@ -11,12 +11,27 @@ exports[`WorkItemRelationshipList renders linked item list 1`] = `
   >
     Blocking
   </h3>
-  <ul
-    class="content-list work-items-list"
+  <draggable-stub
+    animation="0"
+    class="content-list gl-cursor-grab sortable-container work-items-list"
+    clone="[Function]"
+    data-relationship-type="blocks"
+    delay="100"
+    delayontouchonly="true"
+    element="div"
+    fallbackclass="is-dragging"
+    fallbacktolerance="1"
+    forcefallback="true"
+    ghostclass="is-ghost"
+    group="work-item-linked-items"
+    move="[Function]"
+    tag="ul"
+    value="[object Object]"
   >
     <li
-      class="!gl-border-b-1 !gl-border-solid !gl-border-t-0 !gl-border-x-0 !gl-px-0 !gl-py-2 last:!gl-border-b-0"
+      class="!gl-border-b-1 !gl-border-solid !gl-border-t-0 !gl-border-x-0 !gl-px-0 !gl-py-2 last:!gl-border-b-0 linked-item"
       data-testid="link-child-contents-container"
+      data-work-item-id="gid://gitlab/WorkItem/675"
     >
       <work-item-link-child-contents-stub
         canupdate="true"
@@ -26,6 +41,6 @@ exports[`WorkItemRelationshipList renders linked item list 1`] = `
         workitemfullpath="test-project-path"
       />
     </li>
-  </ul>
+  </draggable-stub>
 </div>
 `;
diff --git a/spec/frontend/work_items/components/work_item_relationships/work_item_relationship_list_spec.js b/spec/frontend/work_items/components/work_item_relationships/work_item_relationship_list_spec.js
index 63b4958d345..b1771ed93b4 100644
--- a/spec/frontend/work_items/components/work_item_relationships/work_item_relationship_list_spec.js
+++ b/spec/frontend/work_items/components/work_item_relationships/work_item_relationship_list_spec.js
@@ -1,28 +1,70 @@
+import DraggableList from 'vuedraggable';
+
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import waitForPromises from 'helpers/wait_for_promises';
 import WorkItemRelationshipList from '~/work_items/components/work_item_relationships/work_item_relationship_list.vue';
 import WorkItemLinkChildContents from '~/work_items/components/shared/work_item_link_child_contents.vue';
 
+import removeLinkedItemsMutation from '~/work_items/graphql/remove_linked_items.mutation.graphql';
+import addLinkedItemsMutation from '~/work_items/graphql/add_linked_items.mutation.graphql';
+
 import { mockBlockingLinkedItem } from '../../mock_data';
 
 describe('WorkItemRelationshipList', () => {
   let wrapper;
+  let mutationSpy = jest.fn();
   const mockLinkedItems = mockBlockingLinkedItem.linkedItems.nodes;
   const workItemFullPath = 'test-project-path';
 
-  const createComponent = ({ linkedItems = [], heading = 'Blocking', canUpdate = true } = {}) => {
+  const createComponent = ({
+    parentWorkItemId = 'gid://gitlab/WorkItem/1',
+    parentWorkItemIid = '2',
+    linkedItems = [],
+    relationshipType = 'blocks',
+    heading = 'Blocking',
+    canUpdate = true,
+    isLoggedIn = true,
+  } = {}) => {
+    if (isLoggedIn) {
+      window.gon.current_user_id = 1;
+    }
+
     wrapper = shallowMountExtended(WorkItemRelationshipList, {
       propsData: {
+        parentWorkItemId,
+        parentWorkItemIid,
         linkedItems,
+        relationshipType,
         heading,
         canUpdate,
         workItemFullPath,
       },
+      mocks: {
+        $apollo: {
+          mutate: mutationSpy,
+        },
+      },
     });
   };
 
   const findHeading = () => wrapper.findByTestId('work-items-list-heading');
+  const findDraggableWorkItemsList = () => wrapper.findComponent(DraggableList);
   const findWorkItemLinkChildContents = () => wrapper.findComponent(WorkItemLinkChildContents);
 
+  const mockFrom = {
+    dataset: {
+      relationshipType: 'blocks',
+    },
+  };
+  const mockTo = {
+    dataset: {
+      relationshipType: 'is_blocked_by',
+    },
+    prepend: jest.fn(),
+    addEventListener: jest.fn(),
+    removeEventListener: jest.fn(),
+  };
+
   beforeEach(() => {
     createComponent({ linkedItems: mockLinkedItems });
   });
@@ -32,6 +74,10 @@ describe('WorkItemRelationshipList', () => {
     expect(wrapper.html()).toMatchSnapshot();
   });
 
+  it('renders work item list with drag and drop ability when canUpdate is true', () => {
+    expect(findDraggableWorkItemsList().exists()).toBe(true);
+  });
+
   it('renders work item link child contents with correct props', () => {
     expect(findWorkItemLinkChildContents().props()).toMatchObject({
       childItem: mockLinkedItems[0].workItem,
@@ -40,4 +86,170 @@ describe('WorkItemRelationshipList', () => {
       showWeight: true,
     });
   });
+
+  describe('drag start', () => {
+    beforeEach(() => {
+      jest.spyOn(document, 'addEventListener');
+      findDraggableWorkItemsList().vm.$emit('start', {
+        to: mockTo,
+      });
+    });
+
+    it('adds a class `is-dragging` to document body', () => {
+      expect(document.body.classList.contains('is-dragging')).toBe(true);
+    });
+
+    it('attaches `keyup` event listener on document to support cancel on Esc key press', () => {
+      expect(document.addEventListener).toHaveBeenCalledWith('keyup', expect.any(Function));
+    });
+
+    it('ignores click events originating from anchor elements on the next event loop for Firefox', () => {
+      expect(mockTo.addEventListener).toHaveBeenCalledWith('click', expect.any(Function), {
+        capture: true,
+        once: true,
+      });
+    });
+
+    it('detaches click listener attached previously for Firefox', () => {
+      jest.runAllTimers();
+
+      expect(mockTo.removeEventListener).toHaveBeenCalled();
+    });
+  });
+
+  describe('drag move', () => {
+    beforeEach(() => {
+      // We're manually calling `move` function here as VueDraggable doesn't expose it as an event
+      // even when Sortable.js has already defined it https://github.com/SortableJS/Sortable?tab=readme-ov-file#options
+      findDraggableWorkItemsList().vm.move({
+        from: mockFrom,
+        to: mockTo,
+        dragged: document.createElement('ul'),
+      });
+    });
+
+    it('always inserts to the top of the target list', () => {
+      expect(mockTo.prepend).toHaveBeenCalledWith(expect.any(HTMLElement));
+    });
+
+    it('prevents insertion if relationship type did not change', () => {
+      expect(
+        findDraggableWorkItemsList().vm.move({
+          from: mockFrom,
+          to: mockFrom,
+          dragged: findDraggableWorkItemsList().vm.element,
+        }),
+      ).toBe(true);
+    });
+  });
+
+  describe('drag end', () => {
+    const mockItem = {
+      dataset: {
+        workItemId: mockLinkedItems[0].workItem.id,
+      },
+    };
+
+    const emitDragEnd = async (from, to) => {
+      await findDraggableWorkItemsList().vm.$emit('end', {
+        from,
+        to,
+        item: mockItem,
+      });
+    };
+
+    beforeEach(() => {
+      mutationSpy = jest
+        .fn()
+        .mockResolvedValueOnce({
+          data: {
+            workItemRemoveLinkedItems: {
+              errors: [],
+            },
+          },
+        })
+        .mockResolvedValueOnce({
+          data: {
+            workItemAddLinkedItems: {
+              errors: [],
+            },
+          },
+        });
+
+      createComponent({ linkedItems: mockLinkedItems });
+    });
+
+    it('removes class `is-dragging` from document body', async () => {
+      document.body.classList.add('is-dragging');
+
+      await emitDragEnd(mockFrom, mockTo);
+
+      expect(document.body.classList.contains('is-dragging')).toBe(false);
+    });
+
+    it('detaches keyup listener on document which was added for Esc key support', async () => {
+      jest.spyOn(document, 'removeEventListener');
+      await emitDragEnd(mockFrom, mockTo);
+
+      expect(document.removeEventListener).toHaveBeenCalledWith('keyup', expect.any(Function));
+    });
+
+    it('does not emit updateLinkedItem event when relationship type did not change', async () => {
+      await emitDragEnd(mockFrom, mockFrom);
+
+      expect(wrapper.emitted('updateLinkedItem')).toBeUndefined();
+    });
+
+    it('emits updateLinkedItem event when relationship type did change', async () => {
+      await emitDragEnd(mockFrom, mockTo);
+
+      expect(wrapper.emitted('updateLinkedItem')).toEqual([
+        [
+          {
+            linkedItem: mockLinkedItems[0],
+            fromRelationshipType: mockFrom.dataset.relationshipType,
+            toRelationshipType: mockTo.dataset.relationshipType,
+          },
+        ],
+      ]);
+    });
+
+    it('triggers mutation to remove item from source list', async () => {
+      await emitDragEnd(mockFrom, mockTo);
+
+      expect(mutationSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          mutation: removeLinkedItemsMutation,
+          variables: {
+            input: {
+              id: 'gid://gitlab/WorkItem/1',
+              workItemsIds: [mockItem.dataset.workItemId],
+            },
+          },
+        }),
+      );
+    });
+
+    it('triggers mutation to add item to target list', async () => {
+      await emitDragEnd(mockFrom, mockTo);
+
+      await waitForPromises();
+
+      expect(mutationSpy).toHaveBeenCalledTimes(2);
+
+      expect(mutationSpy).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          mutation: addLinkedItemsMutation,
+          variables: {
+            input: {
+              id: 'gid://gitlab/WorkItem/1',
+              linkType: 'BLOCKED_BY',
+              workItemsIds: [mockItem.dataset.workItemId],
+            },
+          },
+        }),
+      );
+    });
+  });
 });
diff --git a/spec/frontend/work_items/components/work_item_relationships/work_item_relationships_spec.js b/spec/frontend/work_items/components/work_item_relationships/work_item_relationships_spec.js
index c10e54207b3..f531307de3b 100644
--- a/spec/frontend/work_items/components/work_item_relationships/work_item_relationships_spec.js
+++ b/spec/frontend/work_items/components/work_item_relationships/work_item_relationships_spec.js
@@ -256,4 +256,24 @@ describe('WorkItemRelationships', () => {
       },
     );
   });
+
+  it('updates linked item relationship type in UI', async () => {
+    await createComponent();
+    const relationshipLists = findAllWorkItemRelationshipListComponents();
+    const blockingList = relationshipLists.at(0);
+    const blockedByList = relationshipLists.at(1);
+
+    expect(blockingList.props('linkedItems')).toHaveLength(1);
+    expect(blockedByList.props('linkedItems')).toHaveLength(1);
+
+    blockingList.vm.$emit('updateLinkedItem', {
+      linkedItem: blockingList.props('linkedItems')[0],
+      fromRelationshipType: 'blocks',
+      toRelationshipType: 'is_blocked_by',
+    });
+
+    await nextTick();
+
+    expect(blockedByList.props('linkedItems')).toHaveLength(2);
+  });
 });
diff --git a/spec/helpers/icons_helper_spec.rb b/spec/helpers/icons_helper_spec.rb
index a9059ea52d9..5b286fc7a40 100644
--- a/spec/helpers/icons_helper_spec.rb
+++ b/spec/helpers/icons_helper_spec.rb
@@ -258,8 +258,7 @@ RSpec.describe IconsHelper do
   describe 'gl_loading_icon' do
     it 'returns the default spinner markup' do
       expect(gl_loading_icon.to_s)
-        .to eq '<div class="gl-spinner-container" role="status"><span aria-hidden class="gl-spinner gl-spinner-sm gl-spinner-dark !gl-align-text-bottom"></span><span class="gl-sr-only !gl-absolute">Loading</span>
-</div>'
+        .to eq '<div class="gl-spinner-container" role="status"><span aria-label="Loading" class="gl-spinner gl-spinner-sm gl-spinner-dark !gl-align-text-bottom"></span></div>'
     end
 
     context 'when css_class is provided' do
diff --git a/spec/lib/bulk_imports/common/pipelines/members_pipeline_spec.rb b/spec/lib/bulk_imports/common/pipelines/members_pipeline_spec.rb
index 0fb3e8df182..afa19bcf8b4 100644
--- a/spec/lib/bulk_imports/common/pipelines/members_pipeline_spec.rb
+++ b/spec/lib/bulk_imports/common/pipelines/members_pipeline_spec.rb
@@ -98,31 +98,87 @@ RSpec.describe BulkImports::Common::Pipelines::MembersPipeline, feature_category
 
         before do
           allow(context).to receive(:importer_user_mapping_enabled?).and_return(true)
-
-          first_page = extracted_data(id: import_source_user.source_user_identifier, has_next_page: true)
-          second_page = extracted_data(id: reassigned_import_source_user.source_user_identifier, has_next_page: true)
-          last_page = extracted_data(id: 103)
-
           allow_next_instance_of(BulkImports::Common::Extractors::GraphqlExtractor) do |extractor|
-            allow(extractor).to receive(:extract).and_return(first_page, second_page, last_page)
+            allow(extractor).to receive(:extract).and_return(page)
           end
         end
 
-        it 'finds and creates source users and creates membership for the reassigned users' do
-          expect { pipeline.run }.to change { portable.members.count }.by(1).and(
-            change { Import::SourceUser.count }.by(1)
-          )
+        context 'when an import source user with a source_user_identifier equal to the source member user ID exists' do
+          let(:page) { extracted_data(id: import_source_user.source_user_identifier) }
 
-          expect(Import::SourceUser.last).to have_attributes(
-            source_user_identifier: '103',
-            namespace: context.portable.root_ancestor,
-            source_hostname: bulk_import.configuration.source_hostname,
-            import_type: Import::SOURCE_DIRECT_TRANSFER.to_s
-          )
+          it 'does not create an import source user and creates a placeholder membership' do
+            expect { pipeline.run }.to change { Import::Placeholders::Membership.count }.by(1)
+              .and not_change { Import::SourceUser.count }
+              .and not_change { portable.members.count }
 
-          expect(members).to contain_exactly(
-            { user_id: reassigned_import_source_user.reassign_to_user.id, access_level: 30 }
-          )
+            expect(Import::Placeholders::Membership.last).to have_attributes(
+              source_user_id: import_source_user.id,
+              access_level: 30,
+              expires_at: nil,
+              project_id: portable.is_a?(Project) ? portable.id : nil,
+              group_id: portable.is_a?(Group) ? portable.id : nil
+            )
+          end
+        end
+
+        context 'when an import source user with a source_user_identifier equal to the source member user ID does not ' \
+          'exist' do
+          let(:page) { extracted_data(id: 103) }
+
+          it 'creates an import source user and creates a placeholder membership' do
+            expect { pipeline.run }.to change { Import::Placeholders::Membership.count }.by(1)
+              .and change { Import::SourceUser.count }.by(1)
+              .and not_change { portable.members.count }
+
+            import_source_user = Import::SourceUser.last
+
+            expect(import_source_user).to have_attributes(
+              source_user_identifier: '103',
+              namespace: context.portable.root_ancestor,
+              source_hostname: bulk_import.configuration.source_hostname,
+              import_type: Import::SOURCE_DIRECT_TRANSFER.to_s
+            )
+
+            expect(Import::Placeholders::Membership.last).to have_attributes(
+              source_user_id: import_source_user.id,
+              access_level: 30,
+              expires_at: nil,
+              project_id: portable.is_a?(Project) ? portable.id : nil,
+              group_id: portable.is_a?(Group) ? portable.id : nil
+            )
+          end
+        end
+
+        context 'when placeholder membership fails to be created' do
+          let(:page) { extracted_data(id: import_source_user.source_user_identifier) }
+
+          before do
+            allow_next_instance_of(Import::PlaceholderMemberships::CreateService) do |service|
+              allow(service).to receive(:execute).and_return(ServiceResponse.error(message: 'Error!'))
+            end
+          end
+
+          it 'does not create a placeholder membership and logs the import failure' do
+            expect { pipeline.run }.to not_change { Import::Placeholders::Membership.count }
+              .and change { BulkImports::Failure.count }.by(1)
+
+            expect(BulkImports::Failure.last).to have_attributes(
+              exception_message: 'Error!'
+            )
+          end
+        end
+
+        context 'when import source user is mapped to a user' do
+          let(:page) { extracted_data(id: reassigned_import_source_user.source_user_identifier) }
+
+          it 'creates membership for the reassigned user' do
+            expect { pipeline.run }.to change { portable.members.count }.by(1)
+              .and not_change { Import::Placeholders::Membership.count }
+
+            expect(members).to contain_exactly(
+              { user_id: reassigned_import_source_user.reassign_to_user.id, access_level: 30 }
+            )
+          end
         end
       end
     end
@@ -202,6 +258,32 @@ RSpec.describe BulkImports::Common::Pipelines::MembersPipeline, feature_category
           end
         end
       end
+
+      context 'when source_user key is present' do
+        let(:source_user) { build(:import_source_user) }
+        let(:data) do
+          {
+            source_user: source_user,
+            access_level: 30,
+            expires_at: '2020-01-01T00:00:00Z',
+            group: portable.is_a?(Group) ? portable : nil,
+            project: portable.is_a?(Project) ? portable : nil
+          }
+        end
+
+        it 'creates a placeholder user membership' do
+          expect_next_instance_of(Import::PlaceholderMemberships::CreateService,
+            source_user: source_user,
+            access_level: 30,
+            expires_at: '2020-01-01T00:00:00Z',
+            group: portable.is_a?(Group) ? portable : nil,
+            project: portable.is_a?(Project) ? portable : nil) do |service|
+              expect(service).to receive(:execute).and_return(ServiceResponse.success)
+            end
+
+          pipeline.load(context, data)
+        end
+      end
     end
   end
 
diff --git a/spec/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer_spec.rb b/spec/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer_spec.rb
index 48392b8f5a8..31c30f3d9d6 100644
--- a/spec/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer_spec.rb
+++ b/spec/lib/import/bulk_imports/common/transformers/source_user_member_attributes_transformer_spec.rb
@@ -91,8 +91,14 @@ RSpec.describe Import::BulkImports::Common::Transformers::SourceUserMemberAttrib
         )
       end
 
-      it 'retuns nil' do
-        expect(subject.transform(context, data)).to eq(nil)
+      it 'returns placeholder membership hash' do
+        expect(subject.transform(context, data)).to eq(
+          source_user: Import::SourceUser.last,
+          access_level: 30,
+          expires_at: nil,
+          group: entity.group,
+          project: entity.project
+        )
       end
 
       context 'when importer_user_mapping is disabled' do
@@ -115,8 +121,14 @@ RSpec.describe Import::BulkImports::Common::Transformers::SourceUserMemberAttrib
         expect { subject.transform(context, data) }.not_to change { Import::SourceUser.count }
       end
 
-      it 'retuns nil' do
-        expect(subject.transform(context, data)).to eq(nil)
+      it 'returns placeholder membership hash' do
+        expect(subject.transform(context, data)).to eq(
+          source_user: import_source_user,
+          access_level: 30,
+          expires_at: nil,
+          group: entity.group,
+          project: entity.project
+        )
       end
     end
 
diff --git a/spec/models/projects/triggered_hooks_spec.rb b/spec/models/projects/triggered_hooks_spec.rb
index 64f670397d7..51cf211beb0 100644
--- a/spec/models/projects/triggered_hooks_spec.rb
+++ b/spec/models/projects/triggered_hooks_spec.rb
@@ -59,18 +59,6 @@ RSpec.describe Projects::TriggeredHooks, feature_category: :webhooks do
 
       run_hooks(:emoji_hooks, data)
     end
-
-    context 'when emoji_webhooks feature flag is disabled' do
-      before do
-        stub_feature_flags(emoji_webhooks: false)
-      end
-
-      it 'does not execute the hook' do
-        expect(WebHookService).not_to receive(:new)
-
-        run_hooks(:emoji_hooks, data)
-      end
-    end
   end
 
   def expect_hook_execution(hook, data, scope)
diff --git a/spec/requests/api/graphql/mutations/projects/blobs_remove_spec.rb b/spec/requests/api/graphql/mutations/projects/blobs_remove_spec.rb
index 08801a1e55f..5a5b4aa2153 100644
--- a/spec/requests/api/graphql/mutations/projects/blobs_remove_spec.rb
+++ b/spec/requests/api/graphql/mutations/projects/blobs_remove_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe "projectBlobsRemove", feature_category: :source_code_management d
   let_it_be(:current_user) { create(:user, owner_of: project) }
   let_it_be(:repo) { project.repository }
 
+  let(:async_rewrite_history) { false }
   let(:project_path) { project.full_path }
   let(:mutation_params) { { project_path: project_path, blob_oids: blob_oids } }
   let(:mutation) { graphql_mutation(:project_blobs_remove, mutation_params) }
@@ -16,6 +17,10 @@ RSpec.describe "projectBlobsRemove", feature_category: :source_code_management d
 
   subject(:post_mutation) { post_graphql_mutation(mutation, current_user: current_user) }
 
+  before do
+    stub_feature_flags(async_rewrite_history: async_rewrite_history)
+  end
+
   describe 'Removing blobs:' do
     before do
       ::Gitlab::GitalyClient.clear_stubs!
@@ -44,6 +49,20 @@ RSpec.describe "projectBlobsRemove", feature_category: :source_code_management d
 
       expect { post_mutation }.not_to change { AuditEvent.count }
     end
+
+    context 'when async_rewrite_history is enabled' do
+      let(:async_rewrite_history) { true }
+
+      it 'processes text redaction asynchoronously' do
+        expect(Repositories::RewriteHistoryWorker).to receive(:perform_async).with(
+          project_id: project.id, user_id: current_user.id, blob_oids: blob_oids, redactions: []
+        )
+
+        post_mutation
+
+        expect(graphql_mutation_response(:project_blobs_remove)['errors']).not_to be_present
+      end
+    end
   end
 
   describe 'Invalid requests:' do
diff --git a/spec/requests/api/graphql/mutations/projects/text_replace_spec.rb b/spec/requests/api/graphql/mutations/projects/text_replace_spec.rb
index 87d3d6a3cd0..54431d85d4b 100644
--- a/spec/requests/api/graphql/mutations/projects/text_replace_spec.rb
+++ b/spec/requests/api/graphql/mutations/projects/text_replace_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe "projectTextReplace", feature_category: :source_code_management d
   let_it_be(:current_user) { create(:user, owner_of: project) }
   let_it_be(:repo) { project.repository }
 
+  let(:async_rewrite_history) { false }
   let(:project_path) { project.full_path }
   let(:mutation_params) { { project_path: project_path, replacements: replacements } }
   let(:mutation) { graphql_mutation(:project_text_replace, mutation_params) }
@@ -30,6 +31,10 @@ RSpec.describe "projectTextReplace", feature_category: :source_code_management d
 
   subject(:post_mutation) { post_graphql_mutation(mutation, current_user: current_user) }
 
+  before do
+    stub_feature_flags(async_rewrite_history: async_rewrite_history)
+  end
+
   describe 'Replacing text' do
     before do
       ::Gitlab::GitalyClient.clear_stubs!
@@ -58,6 +63,20 @@ RSpec.describe "projectTextReplace", feature_category: :source_code_management d
 
       expect { post_mutation }.not_to change { AuditEvent.count }
     end
+
+    context 'when async_rewrite_history is enabled' do
+      let(:async_rewrite_history) { true }
+
+      it 'processes text redaction asynchoronously' do
+        expect(Repositories::RewriteHistoryWorker).to receive(:perform_async).with(
+          project_id: project.id, user_id: current_user.id, redactions: literal_replacements, blob_oids: []
+        )
+
+        post_mutation
+
+        expect(graphql_mutation_response(:project_text_replace)['errors']).not_to be_present
+      end
+    end
   end
 
   describe 'Invalid requests:' do
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 80636b3250e..2cb70a2866b 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -2037,7 +2037,6 @@ RSpec.describe API::MergeRequests, :aggregate_failures, feature_category: :sourc
       end
 
       context 'with oauth token that has ai_workflows scope' do
-        let(:user) { create(:user) }
         let(:token) { create(:oauth_access_token, user: user, scopes: [:ai_workflows]) }
 
         it "allows access" do
@@ -3012,6 +3011,19 @@ RSpec.describe API::MergeRequests, :aggregate_failures, feature_category: :sourc
     let(:merge_request) { create(:merge_request, :simple, author: user, source_project: project, source_branch: 'markdown', title: 'Test') }
     let(:pipeline) { create(:ci_pipeline, project: project) }
 
+    context 'with oauth token that has ai_workflows scope' do
+      let(:token) { create(:oauth_access_token, user: user, scopes: [:ai_workflows]) }
+
+      it "allows access" do
+        put api(
+          "/projects/#{project.id}/merge_requests/#{merge_request.iid}?title=new_title",
+          oauth_access_token: token
+        )
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
     it "returns merge_request in case of success" do
       expect { put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/merge", user) }
         .to change { merge_request.reload.merged? }
diff --git a/spec/requests/api/project_attributes.yml b/spec/requests/api/project_attributes.yml
index ff8ef24ed21..a14cc5882be 100644
--- a/spec/requests/api/project_attributes.yml
+++ b/spec/requests/api/project_attributes.yml
@@ -190,6 +190,7 @@ project_setting:
     - require_reauthentication_to_approve
     - observability_alerts_enabled
     - spp_repository_pipeline_access
+    - max_number_of_vulnerabilities
 
 build_service_desk_setting: # service_desk_setting
   unexposed_attributes:
diff --git a/spec/services/repositories/rewrite_history_service_spec.rb b/spec/services/repositories/rewrite_history_service_spec.rb
index 0dac28b24ed..801dcfa5324 100644
--- a/spec/services/repositories/rewrite_history_service_spec.rb
+++ b/spec/services/repositories/rewrite_history_service_spec.rb
@@ -132,4 +132,38 @@ RSpec.describe Repositories::RewriteHistoryService, feature_category: :source_co
       end
     end
   end
+
+  describe '#async_execute', :aggregate_failures do
+    subject(:async_execute) { service.async_execute(blob_oids: blob_oids, redactions: redactions) }
+
+    let(:blob_oids) { ['53855584db773c3df5b5f61f72974cb298822fbb'] }
+    let(:redactions) { ['p455w0rd'] }
+
+    it 'triggers a RewriteHistoryWorker job' do
+      expect(Repositories::RewriteHistoryWorker).to receive(:perform_async).with(
+        project_id: project.id, user_id: user.id, blob_oids: blob_oids, redactions: redactions
+      )
+
+      is_expected.to be_success
+    end
+
+    context 'when user does not have permissions' do
+      let(:user) { create(:user, maintainer_of: project) }
+
+      it 'returns an error' do
+        is_expected.to be_error
+        expect(async_execute.message).to eq('Access Denied')
+      end
+    end
+
+    context 'when none of arguments are set' do
+      let(:blob_oids) { [] }
+      let(:redactions) { [] }
+
+      it 'returns an error' do
+        is_expected.to be_error
+        expect(async_execute.message).to eq('not enough arguments')
+      end
+    end
+  end
 end
diff --git a/spec/workers/repositories/rewrite_history_worker_spec.rb b/spec/workers/repositories/rewrite_history_worker_spec.rb
new file mode 100644
index 00000000000..4d74286c2a2
--- /dev/null
+++ b/spec/workers/repositories/rewrite_history_worker_spec.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Repositories::RewriteHistoryWorker, feature_category: :source_code_management do
+  describe "#perform" do
+    subject(:perform) { described_class.new.perform(params) }
+
+    let_it_be(:project) { create(:project, :public, :repository) }
+    let_it_be(:user) { create(:user) }
+
+    let(:params) { { project_id: project_id, user_id: user_id, blob_oids: blob_oids } }
+    let(:project_id) { project.id }
+    let(:user_id) { user.id }
+    let(:blob_oids) { ['blob_oid'] }
+
+    let(:job_args) { params }
+
+    it_behaves_like 'an idempotent worker' do
+      it 'removes the blob' do
+        perform_multiple(job_args)
+      end
+    end
+
+    it 'executes RewriteHistoryService service' do
+      allow_next_instance_of(Repositories::RewriteHistoryService) do |instance|
+        expect(instance).to receive(:execute).with(blob_oids: blob_oids, redactions: [])
+      end
+
+      perform
+    end
+
+    context 'when project id is not valid' do
+      let(:project_id) { non_existing_record_id }
+
+      it 'skips the execution' do
+        expect(Repositories::RewriteHistoryService).not_to receive(:new)
+        perform
+      end
+    end
+
+    context 'when user id is not valid' do
+      let(:user_id) { non_existing_record_id }
+
+      it 'skips the execution' do
+        expect(Repositories::RewriteHistoryService).not_to receive(:new)
+        perform
+      end
+    end
+  end
+end