From bb1accd44a85929984deaa55f15f66234a14dc11 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 21 Jul 2025 15:10:16 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .eslint_todo/vue-no-unused-properties.mjs     |   4 -
 .rubocop_todo/gitlab/bounded_contexts.yml     |   1 +
 .rubocop_todo/gitlab/namespaced_class.yml     |   1 +
 DUO_WORKFLOW_EXECUTOR_VERSION                 |   2 +-
 Gemfile                                       |   2 +-
 Gemfile.checksum                              |   4 +-
 Gemfile.lock                                  |  10 +-
 Gemfile.next.checksum                         |   4 +-
 Gemfile.next.lock                             |  10 +-
 .../javascripts/emoji/components/picker.vue   |  12 -
 .../groups/settings/init_access_dropdown.js   |  36 --
 .../components/widgets/checklist.vue          |   5 -
 .../components/widgets/list.vue               |   8 -
 .../pipeline_wizard/components/wrapper.vue    |   1 +
 .../projects/compare/components/app.vue       |  21 +-
 .../compare/components/repo_dropdown.vue      |  91 ++-
 .../compare/components/revision_card.vue      |  12 +-
 .../compare/components/revision_dropdown.vue  |  13 +-
 .../javascripts/projects/compare/index.js     |   6 +-
 .../dashboard_layout.stories.js               | 126 -----
 .../dashboard_layout.vue                      | 106 ----
 app/controllers/jwks_controller.rb            |  15 +
 .../oauth/authorizations_controller.rb        |  16 +
 .../oauth/dynamic_registrations_controller.rb |  86 +++
 .../protected_resource_metadata_controller.rb |  26 +
 app/controllers/oauth/tokens_controller.rb    |  12 +
 app/graphql/mutations/work_items/reorder.rb   |  50 ++
 app/graphql/types/mutation_type.rb            |   1 +
 app/helpers/application_helper.rb             |  20 +-
 app/helpers/application_settings_helper.rb    |   2 +-
 app/helpers/auth_helper.rb                    |  11 +-
 app/helpers/compare_helper.rb                 |   9 +-
 app/helpers/integrations_helper.rb            |   2 +-
 .../projects/security/configuration_helper.rb |   2 +-
 app/helpers/sidebars_helper.rb                |   2 +-
 .../dev_ops_report/metric_presenter.rb        |   2 +-
 app/services/work_items/reorder_service.rb    |  73 +++
 .../_security_newsletter_callout.html.haml    |   2 +-
 .../_successful_verification_lightweight.haml |   1 +
 .../devise/sessions/restricted.html.haml      |   2 +-
 app/views/devise/shared/_footer.html.haml     |   2 +-
 .../doorkeeper/authorizations/new.html.haml   |   4 +-
 app/views/help/index.html.haml                |   6 +-
 .../header/_super_sidebar_logged_out.haml     |  12 +-
 app/views/layouts/mailer/devise.html.haml     |   2 +-
 app/views/shared/_promo.html.haml             |   2 +-
 .../wip/oauth_dynamic_client_registration.yml |  10 +
 config/locales/doorkeeper.en.yml              |   1 +
 config/routes.rb                              |   3 +
 config/routes/directs.rb                      |   2 +-
 config/routes/directs/about.rb                |   5 -
 config/routes/directs/promo.rb                |  17 +
 ..._organization_id_on_ci_runner_machines.yml |   2 +-
 ..._organization_id_on_ci_runner_machines.yml |   2 +-
 ..._organization_id_on_ci_runner_taggings.yml |   2 +-
 ...backfill_organization_id_on_ci_runners.yml |   2 +-
 db/docs/issue_assignees.yml                   |  12 +-
 ...50501083748_set_api_rate_limits_to_zero.rb |  38 +-
 ...75354_add_dynamic_to_oauth_applications.rb |  13 +
 ..._backfill_organization_id_on_ci_runners.rb |  21 +
 ...l_organization_id_on_ci_runner_machines.rb |  21 +
 ...l_organization_id_on_ci_runner_taggings.rb |  21 +
 ...g_organization_id_on_ci_runner_machines.rb |  21 +
 ...d_issue_assignees_namespace_id_not_null.rb |  14 +
 ..._top_level_ancestor_to_sbom_graph_paths.rb |  17 +
 db/schema_migrations/20250714075354           |   1 +
 db/schema_migrations/20250714085826           |   1 +
 db/schema_migrations/20250714085833           |   1 +
 db/schema_migrations/20250714085841           |   1 +
 db/schema_migrations/20250714085848           |   1 +
 db/schema_migrations/20250715224740           |   1 +
 db/schema_migrations/20250721063158           |   1 +
 db/structure.sql                              |   8 +-
 .../backup_restore/backup_archive_process.md  |   4 +-
 .../backup_restore/backup_gitlab.md           |   6 +-
 .../compliance/compliance_features.md         |   2 +-
 doc/administration/dedicated/architecture.md  |   2 +-
 doc/administration/geo/_index.md              |   6 +-
 .../background_verification.md                |   2 +-
 .../geo/replication/security_review.md        |   2 +-
 .../synchronization_verification.md           |   4 +-
 .../replication/upgrading_the_geo_sites.md    |   9 +-
 doc/administration/gitaly/praefect/_index.md  |  10 +-
 .../gitaly/praefect/recovery.md               |  20 +-
 doc/administration/gitaly/troubleshooting.md  |   2 +-
 doc/administration/housekeeping.md            |   2 +-
 doc/administration/license.md                 |   2 +-
 doc/administration/object_storage.md          |   2 +-
 .../operations/moving_repositories.md         |  32 +-
 .../reference_architectures/_index.md         |   5 +-
 .../repository_storage_paths.md               |   8 +-
 doc/administration/server_hooks.md            |  24 +-
 doc/administration/whats-new.md               |   1 +
 doc/api/deployments.md                        |   2 +-
 .../audit_event_streaming_instances.md        |   2 +-
 doc/api/graphql/reference/_index.md           |  28 +
 doc/api/group_repository_storage_moves.md     |   2 +-
 doc/api/oauth2.md                             |   2 +-
 doc/api/project_repository_storage_moves.md   |   2 +-
 doc/api/projects.md                           |   3 +-
 doc/api/remote_mirrors.md                     |   2 +-
 doc/api/snippet_repository_storage_moves.md   |   2 +-
 doc/ci/steps/_index.md                        |   4 +-
 doc/development/avoiding_required_stops.md    |   2 +-
 .../gitaly_touch_points.md                    |   2 +-
 doc/development/documentation/redirects.md    |   2 +-
 .../fe_guide/dashboard_layout_framework.md    |   8 +-
 doc/development/fe_guide/icons.md             |   2 +-
 .../multi_version_compatibility.md            |   2 +-
 ...unning_tests_that_require_special_setup.md |   2 +-
 doc/development/workhorse/channel.md          |   4 +-
 .../jetbrains_troubleshooting.md              |   2 +-
 doc/install/aws/_index.md                     |   6 +-
 doc/install/requirements.md                   |   2 +-
 doc/integration/sourcegraph.md                |   2 +-
 .../incident_management/manage_incidents.md   |   2 +-
 doc/policy/maintenance.md                     |   1 +
 doc/solutions/cloud/aws/_index.md             |   2 +-
 doc/solutions/cloud/aws/gitaly_sre_for_aws.md |   2 +-
 .../cloud/aws/gitlab_instance_on_aws.md       |   2 +-
 doc/topics/offline/quick_start_guide.md       |   2 +-
 doc/update/_index.md                          | 255 +--------
 doc/update/convert_to_ee/_index.md            |   1 +
 doc/update/package/_index.md                  |   2 +-
 doc/update/plan_your_upgrade.md               |   1 +
 doc/update/upgrade.md                         | 256 +++++++++
 doc/update/upgrading_from_source.md           |   2 +-
 doc/update/with_downtime.md                   |  10 +-
 doc/update/zero_downtime.md                   |   8 +-
 doc/user/compliance/_index.md                 |   2 +-
 doc/user/group/saml_sso/troubleshooting.md    |   2 +-
 .../repository/branches/branch_rules.md       |   2 +-
 .../repository/code_suggestions/_index.md     |   3 +-
 .../repository/monorepos/troubleshooting.md   |   6 +-
 lib/gitlab/application_rate_limiter.rb        |   1 +
 .../unconfirm_notification_email.html.haml    |   2 +-
 .../unconfirm_notification_email.text.erb     |   6 +-
 lib/gitlab/git/finders/refs_finder.rb         |  10 +-
 lib/gitlab/gitaly_client/list_refs_sort.rb    |  40 ++
 lib/gitlab/gitaly_client/ref_service.rb       |   3 +-
 lib/gitlab/gon_helper.rb                      |   2 +-
 lib/gitlab/saas.rb                            |  16 +-
 locale/gitlab.pot                             |   6 +
 package.json                                  |   2 +-
 scripts/migration_schema_validator.rb         |  11 +-
 spec/factories/oauth_applications.rb          |  17 +
 spec/features/admin/admin_settings_spec.rb    |   2 +-
 .../projects/compare/components/app_spec.js   |   8 +-
 .../projects/compare/components/mock_data.js  |   8 +-
 .../compare/components/repo_dropdown_spec.js  | 145 +++--
 .../components/revision_dropdown_spec.js      |   2 +-
 .../dashboard_layout_spec.js                  | 174 ------
 .../mutations/work_items/reorder_spec.rb      |  80 +++
 spec/helpers/application_helper_spec.rb       |  26 +-
 spec/helpers/auth_helper_spec.rb              |  29 +-
 .../security/configuration_helper_spec.rb     |   2 +-
 spec/helpers/sidebars_helper_spec.rb          |   6 +-
 spec/lib/gitlab/database/dictionary_spec.rb   |   5 +-
 .../email/html_to_markdown_parser_spec.rb     |   5 +
 spec/lib/gitlab/email/reply_parser_spec.rb    |   1 +
 .../gitlab/git/finders/refs_finder_spec.rb    |  38 ++
 .../gitaly_client/list_refs_sort_spec.rb      |  25 +
 .../gitlab/gitaly_client/ref_service_spec.rb  |  32 ++
 spec/lib/gitlab/saas_spec.rb                  |   8 +
 ...083748_set_api_rate_limits_to_zero_spec.rb |  50 +-
 .../mutations/work_items/reorder_spec.rb      |  75 +++
 spec/requests/jwks_controller_spec.rb         |   1 +
 .../oauth/authorizations_controller_spec.rb   | 117 ++++
 .../dynamic_registrations_controller_spec.rb  | 522 ++++++++++++++++++
 ...ected_resource_metadata_controller_spec.rb | 119 ++++
 spec/requests/oauth/tokens_controller_spec.rb | 125 +++++
 spec/routing/directs/about_spec.rb            |  13 -
 spec/routing/directs/promo_spec.rb            |  65 +++
 .../work_items/reorder_service_spec.rb        |  54 ++
 spec/support/finder_collection_allowlist.yml  |   1 +
 .../reorder_service_shared_examples.rb        |  65 +++
 .../devise/shared/_footer.html.haml_spec.rb   |   2 +-
 .../internal/ai_assist/duoworkflow/runner.go  |  12 +-
 yarn.lock                                     |  15 +-
 179 files changed, 2602 insertions(+), 1213 deletions(-)
 delete mode 100644 app/assets/javascripts/groups/settings/init_access_dropdown.js
 delete mode 100644 app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.vue
 create mode 100644 app/controllers/oauth/dynamic_registrations_controller.rb
 create mode 100644 app/controllers/oauth/protected_resource_metadata_controller.rb
 create mode 100644 app/graphql/mutations/work_items/reorder.rb
 create mode 100644 app/services/work_items/reorder_service.rb
 create mode 100644 config/feature_flags/wip/oauth_dynamic_client_registration.yml
 delete mode 100644 config/routes/directs/about.rb
 create mode 100644 config/routes/directs/promo.rb
 create mode 100644 db/migrate/20250714075354_add_dynamic_to_oauth_applications.rb
 create mode 100644 db/post_migrate/20250714085826_finalize_backfill_organization_id_on_ci_runners.rb
 create mode 100644 db/post_migrate/20250714085833_finalize_backfill_organization_id_on_ci_runner_machines.rb
 create mode 100644 db/post_migrate/20250714085841_finalize_backfill_organization_id_on_ci_runner_taggings.rb
 create mode 100644 db/post_migrate/20250714085848_finalize_backfill_missing_organization_id_on_ci_runner_machines.rb
 create mode 100644 db/post_migrate/20250715224740_add_issue_assignees_namespace_id_not_null.rb
 create mode 100644 db/post_migrate/20250721063158_add_partial_index_on_top_level_ancestor_to_sbom_graph_paths.rb
 create mode 100644 db/schema_migrations/20250714075354
 create mode 100644 db/schema_migrations/20250714085826
 create mode 100644 db/schema_migrations/20250714085833
 create mode 100644 db/schema_migrations/20250714085841
 create mode 100644 db/schema_migrations/20250714085848
 create mode 100644 db/schema_migrations/20250715224740
 create mode 100644 db/schema_migrations/20250721063158
 create mode 100644 doc/update/upgrade.md
 create mode 100644 lib/gitlab/gitaly_client/list_refs_sort.rb
 delete mode 100644 spec/frontend/vue_shared/components/customizable_dashboard/dashboard_layout_spec.js
 create mode 100644 spec/graphql/mutations/work_items/reorder_spec.rb
 create mode 100644 spec/lib/gitlab/gitaly_client/list_refs_sort_spec.rb
 create mode 100644 spec/requests/api/graphql/mutations/work_items/reorder_spec.rb
 create mode 100644 spec/requests/oauth/dynamic_registrations_controller_spec.rb
 create mode 100644 spec/requests/oauth/protected_resource_metadata_controller_spec.rb
 delete mode 100644 spec/routing/directs/about_spec.rb
 create mode 100644 spec/routing/directs/promo_spec.rb
 create mode 100644 spec/services/work_items/reorder_service_spec.rb
 create mode 100644 spec/support/shared_examples/reorder_service_shared_examples.rb

diff --git a/.eslint_todo/vue-no-unused-properties.mjs b/.eslint_todo/vue-no-unused-properties.mjs
index c23df4e9a68..20529d93c9b 100644
--- a/.eslint_todo/vue-no-unused-properties.mjs
+++ b/.eslint_todo/vue-no-unused-properties.mjs
@@ -74,7 +74,6 @@ export default {
     'app/assets/javascripts/diffs/components/diff_row.vue',
     'app/assets/javascripts/diffs/components/diff_view.vue',
     'app/assets/javascripts/diffs/components/image_diff_overlay.vue',
-    'app/assets/javascripts/emoji/components/picker.vue',
     'app/assets/javascripts/error_tracking/components/error_details.vue',
     'app/assets/javascripts/error_tracking/components/error_tracking_list.vue',
     'app/assets/javascripts/feature_flags/components/empty_state.vue',
@@ -153,9 +152,6 @@ export default {
     'app/assets/javascripts/pages/projects/pipeline_schedules/shared/components/interval_pattern_input.vue',
     'app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue',
     'app/assets/javascripts/performance_bar/components/performance_bar_app.vue',
-    'app/assets/javascripts/pipeline_wizard/components/widgets/checklist.vue',
-    'app/assets/javascripts/pipeline_wizard/components/widgets/list.vue',
-    'app/assets/javascripts/pipeline_wizard/components/wrapper.vue',
     'app/assets/javascripts/popovers/components/popovers.vue',
     'app/assets/javascripts/projects/commit/components/form_modal.vue',
     'app/assets/javascripts/projects/commit/components/projects_dropdown.vue',
diff --git a/.rubocop_todo/gitlab/bounded_contexts.yml b/.rubocop_todo/gitlab/bounded_contexts.yml
index 6f17503d98e..65a02893af4 100644
--- a/.rubocop_todo/gitlab/bounded_contexts.yml
+++ b/.rubocop_todo/gitlab/bounded_contexts.yml
@@ -2136,6 +2136,7 @@ Gitlab/BoundedContexts:
     - 'ee/app/finders/iterations/cadences_finder.rb'
     - 'ee/app/finders/iterations_finder.rb'
     - 'ee/app/finders/licenses_finder.rb'
+    - 'ee/app/finders/push_rule_finder.rb'
     - 'ee/app/finders/llm/extra_resource_finder.rb'
     - 'ee/app/finders/member_roles/roles_finder.rb'
     - 'ee/app/finders/okrs/checkin_reminder_key_result_finder.rb'
diff --git a/.rubocop_todo/gitlab/namespaced_class.yml b/.rubocop_todo/gitlab/namespaced_class.yml
index 3d4a4b73d0c..ff80bd4abe0 100644
--- a/.rubocop_todo/gitlab/namespaced_class.yml
+++ b/.rubocop_todo/gitlab/namespaced_class.yml
@@ -824,6 +824,7 @@ Gitlab/NamespacedClass:
     - 'ee/app/finders/groups_with_templates_finder.rb'
     - 'ee/app/finders/iterations_finder.rb'
     - 'ee/app/finders/licenses_finder.rb'
+    - 'ee/app/finders/push_rule_finder.rb'
     - 'ee/app/finders/productivity_analytics_finder.rb'
     - 'ee/app/finders/scim_finder.rb'
     - 'ee/app/mailers/ci_minutes_usage_mailer.rb'
diff --git a/DUO_WORKFLOW_EXECUTOR_VERSION b/DUO_WORKFLOW_EXECUTOR_VERSION
index 4fe2fe843d9..89a67e8cd24 100644
--- a/DUO_WORKFLOW_EXECUTOR_VERSION
+++ b/DUO_WORKFLOW_EXECUTOR_VERSION
@@ -1 +1 @@
-0.0.40
+0.0.41
diff --git a/Gemfile b/Gemfile
index c6b49bb353c..6a15f36e2bd 100644
--- a/Gemfile
+++ b/Gemfile
@@ -229,7 +229,7 @@ gem 'google-apis-cloudresourcemanager_v1', '~> 0.31.0', feature_category: :share
 gem 'google-apis-iam_v1', '~> 0.36.0', feature_category: :shared
 gem 'google-apis-serviceusage_v1', '~> 0.28.0', feature_category: :shared
 gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0', feature_category: :shared
-gem 'google-apis-androidpublisher_v3', '~> 0.34.0', feature_category: :shared
+gem 'google-apis-androidpublisher_v3', '~> 0.83.0', feature_category: :shared
 
 gem 'googleauth', '~> 1.14', feature_category: :shared
 gem 'google-cloud-artifact_registry-v1', '~> 0.11.0', feature_category: :shared
diff --git a/Gemfile.checksum b/Gemfile.checksum
index b6320280451..d5a50c60b67 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -246,7 +246,7 @@
 {"name":"gitlab_quality-test_tooling","version":"2.10.0","platform":"ruby","checksum":"68e518f71d85981bdc096d8dbd3369c85f54a2fb9d3115a0b90ef9f14c845017"},
 {"name":"globalid","version":"1.1.0","platform":"ruby","checksum":"b337e1746f0c8cb0a6c918234b03a1ddeb4966206ce288fbb57779f59b2d154f"},
 {"name":"gon","version":"6.4.0","platform":"ruby","checksum":"e3a618d659392890f1aa7db420f17c75fd7d35aeb5f8fe003697d02c4b88d2f0"},
-{"name":"google-apis-androidpublisher_v3","version":"0.34.0","platform":"ruby","checksum":"d7e1d7dd92f79c498fe2082222a1740d788e022e660c135564b3fd299cab5425"},
+{"name":"google-apis-androidpublisher_v3","version":"0.83.0","platform":"ruby","checksum":"34bc99b81deb7d9bba665e14255f7b7c7b0392105174a3c7b689d5445014c4f8"},
 {"name":"google-apis-cloudbilling_v1","version":"0.22.0","platform":"ruby","checksum":"db2b72aebdc2664fd5095264a160cf757119ba3a83a036817b78d0d2ad7886fd"},
 {"name":"google-apis-cloudresourcemanager_v1","version":"0.31.0","platform":"ruby","checksum":"f0a472a228c0b9b592741380ce79ead2458ea0066a4b5a78635818b9b62efbbf"},
 {"name":"google-apis-compute_v1","version":"0.57.0","platform":"ruby","checksum":"404514548abc3a44f5e96393d6a6d588d287548ecb6f5a886ad76e1beea78068"},
@@ -320,7 +320,7 @@
 {"name":"health_check","version":"3.1.0","platform":"ruby","checksum":"10146508237dc54ed7e24c292d8ba7fb8f9590cf26c66e325b947438c4103b57"},
 {"name":"heapy","version":"0.2.0","platform":"ruby","checksum":"74141e845d61ffc7c1e8bf8b127c8cf94544ec7a1181aec613288682543585ea"},
 {"name":"html-pipeline","version":"2.14.3","platform":"ruby","checksum":"8a1d4d7128b2141913387cac0f8ba898bb6812557001acc0c2b46910f59413a0"},
-{"name":"html2text","version":"0.2.0","platform":"ruby","checksum":"31c2f0be9ab7aa4fc780b07d5f84882ebc22a9024c29a45f4f5adfe42e92ad4f"},
+{"name":"html2text","version":"0.4.0","platform":"ruby","checksum":"b1becfa0b9150739633f7dc6d8637a49d7e38c3223bcb3afa3cebf59960afdc5"},
 {"name":"htmlbeautifier","version":"1.4.2","platform":"ruby","checksum":"9de0c98480fe80d795ed5734a11f183563cd969686f25a04609c0f5a446fa5f8"},
 {"name":"htmlentities","version":"4.3.4","platform":"ruby","checksum":"125a73c6c9f2d1b62100b7c3c401e3624441b663762afa7fe428476435a673da"},
 {"name":"http","version":"5.1.1","platform":"ruby","checksum":"fcaec14a4f82de6d2f9cb978c07326814c6c2b42b8974f6ec166ff19c645ebaf"},
diff --git a/Gemfile.lock b/Gemfile.lock
index b3ee5efd4ad..2e311436fb3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -830,8 +830,8 @@ GEM
       i18n (>= 0.7)
       multi_json
       request_store (>= 1.0)
-    google-apis-androidpublisher_v3 (0.34.0)
-      google-apis-core (>= 0.9.1, < 2.a)
+    google-apis-androidpublisher_v3 (0.83.0)
+      google-apis-core (>= 0.15.0, < 2.a)
     google-apis-cloudbilling_v1 (0.22.0)
       google-apis-core (>= 0.9.1, < 2.a)
     google-apis-cloudresourcemanager_v1 (0.31.0)
@@ -1006,8 +1006,8 @@ GEM
     html-pipeline (2.14.3)
       activesupport (>= 2)
       nokogiri (>= 1.4)
-    html2text (0.2.0)
-      nokogiri (~> 1.6)
+    html2text (0.4.0)
+      nokogiri (>= 1.0, < 2.0)
     htmlbeautifier (1.4.2)
     htmlentities (4.3.4)
     http (5.1.1)
@@ -2179,7 +2179,7 @@ DEPENDENCIES
   gitlab_omniauth-ldap (~> 2.2.0)
   gitlab_quality-test_tooling (~> 2.10.0)
   gon (~> 6.4.0)
-  google-apis-androidpublisher_v3 (~> 0.34.0)
+  google-apis-androidpublisher_v3 (~> 0.83.0)
   google-apis-cloudbilling_v1 (~> 0.22.0)
   google-apis-cloudresourcemanager_v1 (~> 0.31.0)
   google-apis-compute_v1 (~> 0.57.0)
diff --git a/Gemfile.next.checksum b/Gemfile.next.checksum
index 4f8d60a14c3..1be46884817 100644
--- a/Gemfile.next.checksum
+++ b/Gemfile.next.checksum
@@ -246,7 +246,7 @@
 {"name":"gitlab_quality-test_tooling","version":"2.10.0","platform":"ruby","checksum":"68e518f71d85981bdc096d8dbd3369c85f54a2fb9d3115a0b90ef9f14c845017"},
 {"name":"globalid","version":"1.1.0","platform":"ruby","checksum":"b337e1746f0c8cb0a6c918234b03a1ddeb4966206ce288fbb57779f59b2d154f"},
 {"name":"gon","version":"6.4.0","platform":"ruby","checksum":"e3a618d659392890f1aa7db420f17c75fd7d35aeb5f8fe003697d02c4b88d2f0"},
-{"name":"google-apis-androidpublisher_v3","version":"0.34.0","platform":"ruby","checksum":"d7e1d7dd92f79c498fe2082222a1740d788e022e660c135564b3fd299cab5425"},
+{"name":"google-apis-androidpublisher_v3","version":"0.83.0","platform":"ruby","checksum":"34bc99b81deb7d9bba665e14255f7b7c7b0392105174a3c7b689d5445014c4f8"},
 {"name":"google-apis-cloudbilling_v1","version":"0.22.0","platform":"ruby","checksum":"db2b72aebdc2664fd5095264a160cf757119ba3a83a036817b78d0d2ad7886fd"},
 {"name":"google-apis-cloudresourcemanager_v1","version":"0.31.0","platform":"ruby","checksum":"f0a472a228c0b9b592741380ce79ead2458ea0066a4b5a78635818b9b62efbbf"},
 {"name":"google-apis-compute_v1","version":"0.57.0","platform":"ruby","checksum":"404514548abc3a44f5e96393d6a6d588d287548ecb6f5a886ad76e1beea78068"},
@@ -320,7 +320,7 @@
 {"name":"health_check","version":"3.1.0","platform":"ruby","checksum":"10146508237dc54ed7e24c292d8ba7fb8f9590cf26c66e325b947438c4103b57"},
 {"name":"heapy","version":"0.2.0","platform":"ruby","checksum":"74141e845d61ffc7c1e8bf8b127c8cf94544ec7a1181aec613288682543585ea"},
 {"name":"html-pipeline","version":"2.14.3","platform":"ruby","checksum":"8a1d4d7128b2141913387cac0f8ba898bb6812557001acc0c2b46910f59413a0"},
-{"name":"html2text","version":"0.2.0","platform":"ruby","checksum":"31c2f0be9ab7aa4fc780b07d5f84882ebc22a9024c29a45f4f5adfe42e92ad4f"},
+{"name":"html2text","version":"0.4.0","platform":"ruby","checksum":"b1becfa0b9150739633f7dc6d8637a49d7e38c3223bcb3afa3cebf59960afdc5"},
 {"name":"htmlbeautifier","version":"1.4.2","platform":"ruby","checksum":"9de0c98480fe80d795ed5734a11f183563cd969686f25a04609c0f5a446fa5f8"},
 {"name":"htmlentities","version":"4.3.4","platform":"ruby","checksum":"125a73c6c9f2d1b62100b7c3c401e3624441b663762afa7fe428476435a673da"},
 {"name":"http","version":"5.1.1","platform":"ruby","checksum":"fcaec14a4f82de6d2f9cb978c07326814c6c2b42b8974f6ec166ff19c645ebaf"},
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 3a107f256a9..e1b3b0b6ff0 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -824,8 +824,8 @@ GEM
       i18n (>= 0.7)
       multi_json
       request_store (>= 1.0)
-    google-apis-androidpublisher_v3 (0.34.0)
-      google-apis-core (>= 0.9.1, < 2.a)
+    google-apis-androidpublisher_v3 (0.83.0)
+      google-apis-core (>= 0.15.0, < 2.a)
     google-apis-cloudbilling_v1 (0.22.0)
       google-apis-core (>= 0.9.1, < 2.a)
     google-apis-cloudresourcemanager_v1 (0.31.0)
@@ -1000,8 +1000,8 @@ GEM
     html-pipeline (2.14.3)
       activesupport (>= 2)
       nokogiri (>= 1.4)
-    html2text (0.2.0)
-      nokogiri (~> 1.6)
+    html2text (0.4.0)
+      nokogiri (>= 1.0, < 2.0)
     htmlbeautifier (1.4.2)
     htmlentities (4.3.4)
     http (5.1.1)
@@ -2174,7 +2174,7 @@ DEPENDENCIES
   gitlab_omniauth-ldap (~> 2.2.0)
   gitlab_quality-test_tooling (~> 2.10.0)
   gon (~> 6.4.0)
-  google-apis-androidpublisher_v3 (~> 0.34.0)
+  google-apis-androidpublisher_v3 (~> 0.83.0)
   google-apis-cloudbilling_v1 (~> 0.22.0)
   google-apis-cloudresourcemanager_v1 (~> 0.31.0)
   google-apis-compute_v1 (~> 0.57.0)
diff --git a/app/assets/javascripts/emoji/components/picker.vue b/app/assets/javascripts/emoji/components/picker.vue
index 3e67d38f3d2..7538e867a0b 100644
--- a/app/assets/javascripts/emoji/components/picker.vue
+++ b/app/assets/javascripts/emoji/components/picker.vue
@@ -82,23 +82,11 @@ export default {
     placement() {
       return this.right ? 'bottom-end' : 'bottom-start';
     },
-    newCustomEmoji() {
-      return {
-        text: __('Create new emoji'),
-        href: this.newEmojiPath,
-        extraAttrs: {
-          'data-testid': 'create-new-emoji',
-        },
-      };
-    },
     smileIcon() {
       return this.isHovered || this.isFocused || this.isVisible;
     },
   },
   methods: {
-    categoryAppeared(category) {
-      this.currentCategory = category;
-    },
     async scrollToCategory(categoryName) {
       const categories = await getEmojiCategories();
       const { top } = categories[categoryName];
diff --git a/app/assets/javascripts/groups/settings/init_access_dropdown.js b/app/assets/javascripts/groups/settings/init_access_dropdown.js
deleted file mode 100644
index f18f260097b..00000000000
--- a/app/assets/javascripts/groups/settings/init_access_dropdown.js
+++ /dev/null
@@ -1,36 +0,0 @@
-import Vue from 'vue';
-import * as Sentry from '~/sentry/sentry_browser_wrapper';
-import AccessDropdown from './components/access_dropdown.vue';
-
-export const initAccessDropdown = (el) => {
-  if (!el) {
-    return null;
-  }
-
-  const { label, disabled, preselectedItems } = el.dataset;
-  let preselected = [];
-  try {
-    preselected = JSON.parse(preselectedItems);
-  } catch (e) {
-    Sentry.captureException(e);
-  }
-
-  return new Vue({
-    el,
-    render(createElement) {
-      const vm = this;
-      return createElement(AccessDropdown, {
-        props: {
-          preselectedItems: preselected,
-          label,
-          disabled,
-        },
-        on: {
-          select(selected) {
-            vm.$emit('select', selected);
-          },
-        },
-      });
-    },
-  });
-};
diff --git a/app/assets/javascripts/pipeline_wizard/components/widgets/checklist.vue b/app/assets/javascripts/pipeline_wizard/components/widgets/checklist.vue
index 4ba5c237311..be679e51854 100644
--- a/app/assets/javascripts/pipeline_wizard/components/widgets/checklist.vue
+++ b/app/assets/javascripts/pipeline_wizard/components/widgets/checklist.vue
@@ -27,11 +27,6 @@ export default {
       validator: (v) => v.every(isValidItemDefinition),
       default: () => [],
     },
-    validate: {
-      type: Boolean,
-      required: false,
-      default: false,
-    },
     id: {
       type: String,
       required: false,
diff --git a/app/assets/javascripts/pipeline_wizard/components/widgets/list.vue b/app/assets/javascripts/pipeline_wizard/components/widgets/list.vue
index 941b5fa3c1e..8e39895d484 100644
--- a/app/assets/javascripts/pipeline_wizard/components/widgets/list.vue
+++ b/app/assets/javascripts/pipeline_wizard/components/widgets/list.vue
@@ -51,11 +51,6 @@ export default {
       required: false,
       default: i18n.invalidFeedback,
     },
-    id: {
-      type: String,
-      required: false,
-      default: () => uniqueId('listWidget-'),
-    },
     pattern: {
       type: String,
       required: false,
@@ -88,9 +83,6 @@ export default {
       // Filter out empty steps
       return this.value.filter(({ value }) => Boolean(value)).map(({ value }) => value) || [];
     },
-    hasAnyValue() {
-      return this.value.some(({ value }) => Boolean(value));
-    },
     needsAnyValue() {
       return this.required && !this.value.some(({ value }) => Boolean(value));
     },
diff --git a/app/assets/javascripts/pipeline_wizard/components/wrapper.vue b/app/assets/javascripts/pipeline_wizard/components/wrapper.vue
index db19b1b0cb5..9c1f2eb37ca 100644
--- a/app/assets/javascripts/pipeline_wizard/components/wrapper.vue
+++ b/app/assets/javascripts/pipeline_wizard/components/wrapper.vue
@@ -86,6 +86,7 @@ export default {
         template: this.steps.get(i).get('template', true),
       }));
     },
+    // eslint-disable-next-line vue/no-unused-properties -- used indirectly by tracking mixin or external analytics utility
     tracking() {
       return {
         category: `pipeline_wizard:${this.templateId}`,
diff --git a/app/assets/javascripts/projects/compare/components/app.vue b/app/assets/javascripts/projects/compare/components/app.vue
index d6f4a0ce206..0ab37677019 100644
--- a/app/assets/javascripts/projects/compare/components/app.vue
+++ b/app/assets/javascripts/projects/compare/components/app.vue
@@ -10,7 +10,6 @@ import {
 } from '@gitlab/ui';
 import PageHeading from '~/vue_shared/components/page_heading.vue';
 import csrf from '~/lib/utils/csrf';
-import { joinPaths } from '~/lib/utils/url_utility';
 import {
   I18N,
   COMPARE_OPTIONS,
@@ -73,10 +72,6 @@ export default {
       type: Object,
       required: true,
     },
-    projects: {
-      type: Array,
-      required: true,
-    },
     straight: {
       type: Boolean,
       required: true,
@@ -85,7 +80,6 @@ export default {
   data() {
     return {
       from: {
-        projects: this.projects,
         selectedProject: this.targetProject,
         revision: this.paramsFrom,
         refsProjectPath: this.targetProjectRefsPath,
@@ -99,14 +93,10 @@ export default {
     };
   },
   methods: {
-    onSubmit() {
-      this.$refs.form.submit();
-    },
     onSelectProject({ direction, project }) {
-      const refsPath = joinPaths(gon.relative_url_root || '', `/${project.name}`, '/refs');
       // direction is either 'from' or 'to'
-      this[direction].refsProjectPath = refsPath;
-      this[direction].selectedProject = project;
+      this[direction].refsProjectPath = project.refs_url;
+      this[direction].selectedProject = { ...project };
     },
     onSelectRevision({ direction, revision }) {
       this[direction].revision = revision; // direction is either 'from' or 'to'
@@ -123,7 +113,7 @@ export default {
 </script>
 
 <template>
-  <form ref="form" class="js-signature-container" method="POST" :action="projectCompareIndexPath">
+  <form class="js-signature-container" method="POST" :action="projectCompareIndexPath">
     <input :value="$options.csrf.token" type="hidden" name="authenticity_token" />
     <page-heading :heading="$options.i18n.title">
       <template #description>
@@ -148,6 +138,7 @@ export default {
         :params-branch="to.revision"
         :projects="to.projects"
         :selected-project="to.selectedProject"
+        disable-repo-dropdown
         @selectProject="onSelectProject"
         @selectRevision="onSelectRevision"
       />
@@ -174,7 +165,6 @@ export default {
         :revision-text="$options.i18n.target"
         params-name="from"
         :params-branch="from.revision"
-        :projects="from.projects"
         :selected-project="from.selectedProject"
         @selectProject="onSelectProject"
         @selectRevision="onSelectRevision"
@@ -193,7 +183,8 @@ export default {
         category="primary"
         variant="confirm"
         data-testid="compare-button"
-        @click="onSubmit"
+        type="submit"
+        class="js-no-auto-disable"
       >
         {{ $options.i18n.compare }}
       </gl-button>
diff --git a/app/assets/javascripts/projects/compare/components/repo_dropdown.vue b/app/assets/javascripts/projects/compare/components/repo_dropdown.vue
index 4c0b5d0b1f6..df2996139a1 100644
--- a/app/assets/javascripts/projects/compare/components/repo_dropdown.vue
+++ b/app/assets/javascripts/projects/compare/components/repo_dropdown.vue
@@ -1,55 +1,89 @@
 <script>
 import { GlCollapsibleListbox } from '@gitlab/ui';
+import { debounce } from 'lodash';
+import { createAlert } from '~/alert';
+import { s__ } from '~/locale';
+import axios from '~/lib/utils/axios_utils';
+import { DEFAULT_DEBOUNCE_AND_THROTTLE_MS } from '~/lib/utils/constants';
 
 export default {
   components: {
     GlCollapsibleListbox,
   },
+  inject: ['targetProjectsPath'],
   props: {
     paramsName: {
       type: String,
       required: true,
     },
-    projects: {
-      type: Array,
-      required: false,
-      default: null,
-    },
     selectedProject: {
       type: Object,
       required: true,
     },
+    disabled: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
   data() {
     return {
-      searchTerm: '',
-      selectedProjectId: this.selectedProject.id,
+      loadingProjects: false,
+      allProjects: [],
     };
   },
   computed: {
-    disableRepoDropdown() {
-      return this.projects === null;
-    },
-    filteredRepos() {
-      if (this.disableRepoDropdown) return [];
-
-      const lowerCaseSearchTerm = this.searchTerm.toLowerCase();
-      return this.projects
-        .filter(({ name }) => name.toLowerCase().includes(lowerCaseSearchTerm))
-        .map((project) => ({ text: project.name, value: project.id }));
-    },
     inputName() {
       return `${this.paramsName}_project_id`;
     },
   },
+  mounted() {
+    this.debouncedSearch = debounce(this.fetchForks, DEFAULT_DEBOUNCE_AND_THROTTLE_MS);
+
+    this.fetchForks();
+  },
+  beforeDestroy() {
+    if (this.debouncedSearch) {
+      this.debouncedSearch.cancel();
+    }
+  },
   methods: {
+    async fetchForks(search = '') {
+      if (this.disabled) return;
+
+      this.loadingProjects = true;
+
+      try {
+        const { data } = await axios.get(this.targetProjectsPath, {
+          params: {
+            search,
+          },
+        });
+
+        this.allProjects = data.map((project) => ({
+          ...project,
+          value: project.id,
+          text: project.full_name,
+        }));
+      } catch (error) {
+        createAlert({
+          message: s__('CompareRevisions|An error occurred while retrieving target projects.'),
+          captureError: true,
+          error,
+        });
+      } finally {
+        this.loadingProjects = false;
+      }
+    },
     emitTargetProject(projectId) {
-      if (this.disableRepoDropdown) return;
-      const project = this.projects.find(({ id }) => id === projectId);
-      this.$emit('selectProject', { direction: this.paramsName, project });
+      const project = this.allProjects.find(({ value }) => value === projectId);
+
+      if (project) {
+        this.$emit('selectProject', { direction: this.paramsName, project });
+      }
     },
     onSearch(searchTerm) {
-      this.searchTerm = searchTerm;
+      this.debouncedSearch(searchTerm);
     },
   },
 };
@@ -57,15 +91,14 @@ export default {
 
 <template>
   <div>
-    <input type="hidden" :name="inputName" :value="selectedProjectId" />
+    <input type="hidden" :name="inputName" :value="selectedProject.value" />
     <gl-collapsible-listbox
-      v-model="selectedProjectId"
-      :toggle-text="selectedProject.name"
+      :selected="selectedProject.value"
+      :toggle-text="selectedProject.text"
       :header-text="s__(`CompareRevisions|Select target project`)"
-      class="gl-font-monospace"
-      toggle-class="gl-min-w-0"
-      :disabled="disableRepoDropdown"
-      :items="filteredRepos"
+      :disabled="disabled"
+      :items="allProjects"
+      :searching="loadingProjects"
       block
       searchable
       @select="emitTargetProject"
diff --git a/app/assets/javascripts/projects/compare/components/revision_card.vue b/app/assets/javascripts/projects/compare/components/revision_card.vue
index 3a203500911..9d93de7de30 100644
--- a/app/assets/javascripts/projects/compare/components/revision_card.vue
+++ b/app/assets/javascripts/projects/compare/components/revision_card.vue
@@ -25,15 +25,15 @@ export default {
       required: false,
       default: null,
     },
-    projects: {
-      type: Array,
-      required: false,
-      default: null,
-    },
     selectedProject: {
       type: Object,
       required: true,
     },
+    disableRepoDropdown: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
 };
 </script>
@@ -47,8 +47,8 @@ export default {
       <repo-dropdown
         class="gl-min-w-0 gl-max-w-full gl-basis-1/2"
         :params-name="paramsName"
-        :projects="projects"
         :selected-project="selectedProject"
+        :disabled="disableRepoDropdown"
         v-on="$listeners"
       />
       <revision-dropdown
diff --git a/app/assets/javascripts/projects/compare/components/revision_dropdown.vue b/app/assets/javascripts/projects/compare/components/revision_dropdown.vue
index dca93e05d06..9fb49514e8f 100644
--- a/app/assets/javascripts/projects/compare/components/revision_dropdown.vue
+++ b/app/assets/javascripts/projects/compare/components/revision_dropdown.vue
@@ -180,8 +180,9 @@ export default {
       ref="collapsibleDropdown"
       block
       searchable
-      class="gl-w-full gl-font-monospace"
-      toggle-class="form-control compare-dropdown-toggle gl-min-w-0"
+      class="gl-w-full"
+      toggle-class="compare-dropdown-toggle gl-font-monospace"
+      :selected="selectedRevision"
       :items="dropdownItems"
       :toggle-text="selectedRevision"
       :header-text="s__('CompareRevisions|Select Git revision')"
@@ -193,6 +194,12 @@ export default {
       @hidden="onHidden"
       @search="searchTerm = $event"
       @select="onClick"
-    />
+    >
+      <template #list-item="{ item }">
+        <span class="gl-break-all gl-font-monospace">
+          {{ item.text }}
+        </span>
+      </template>
+    </gl-collapsible-listbox>
   </div>
 </template>
diff --git a/app/assets/javascripts/projects/compare/index.js b/app/assets/javascripts/projects/compare/index.js
index 284cee6d7f1..aeed2096681 100644
--- a/app/assets/javascripts/projects/compare/index.js
+++ b/app/assets/javascripts/projects/compare/index.js
@@ -16,7 +16,7 @@ export default function init() {
     createMrPath,
     sourceProject,
     targetProject,
-    projectsFrom,
+    targetProjectsPath,
   } = el.dataset;
 
   return new Vue({
@@ -24,6 +24,9 @@ export default function init() {
     components: {
       CompareApp,
     },
+    provide: {
+      targetProjectsPath,
+    },
     render(createElement) {
       return createElement(CompareApp, {
         props: {
@@ -37,7 +40,6 @@ export default function init() {
           createMrPath,
           sourceProject: JSON.parse(sourceProject),
           targetProject: JSON.parse(targetProject),
-          projects: JSON.parse(projectsFrom),
         },
       });
     },
diff --git a/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.stories.js b/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.stories.js
index 3b34db6c21e..e69de29bb2d 100644
--- a/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.stories.js
+++ b/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.stories.js
@@ -1,126 +0,0 @@
-import DashboardLayout from './dashboard_layout.vue';
-import ExtendedDashboardPanel from './extended_dashboard_panel.vue';
-
-export default {
-  component: DashboardLayout,
-  title: 'vue_shared/components/customizable_dashboard/dashboard_layout',
-};
-
-const dashboardConfig = {
-  title: 'Dashboard title',
-  description: 'Dashboards made easy with a snap grid system',
-  panels: [
-    {
-      id: '1',
-      title: 'Dashboard panel',
-      gridAttributes: {
-        width: 6,
-        height: 1,
-        yPos: 0,
-        xPos: 3,
-      },
-    },
-    {
-      id: '2',
-      title: 'Another dashboard panel',
-      gridAttributes: {
-        width: 3,
-        height: 2,
-        yPos: 1,
-        xPos: 1,
-      },
-    },
-    {
-      id: '3',
-      title: 'I can be placed anywhere on the grid',
-      gridAttributes: {
-        width: 4,
-        height: 1,
-        yPos: 2,
-        xPos: 7,
-      },
-    },
-  ],
-};
-
-const Template = (args, { argTypes }) => ({
-  components: { DashboardLayout, ExtendedDashboardPanel },
-  props: Object.keys(argTypes),
-  template: `
-    <dashboard-layout v-bind="$props">
-      <template #panel="{ panel }">
-        <extended-dashboard-panel :title="panel.title" class="gl-h-full">
-          <template #body>
-            <p class="gl-text-tertiary">Your visualization here</p>
-          </template>
-        </extended-dashboard-panel>
-      </template>
-      <template #empty-state>
-        <p>No dashboard panels here 🕵</p>
-      </template>
-    </dashboard-layout>
-  `,
-});
-
-const SlotsTemplate = (args, { argTypes }) => ({
-  components: { DashboardLayout },
-  props: Object.keys(argTypes),
-  template: `
-    <dashboard-layout v-bind="$props">
-      <template #title>
-        <h2>
-          Custom dashboard <code>#title</code> 🚀
-        </h2>
-      </template>
-      <template #description>
-        <div class="gl-text-subtle">
-          This is the <code>#description</code> slot.
-        </div>
-      </template>
-      <template #filters>
-        <div class>
-          Add your dashboard-level filters in the <code>#filters</code> slot.
-        </div>
-      </template>
-      <template #actions>
-        <a href="#" class="gl-display-flex"><code>#actions</code></a>
-      </template>
-      <template #alert>
-        <div class="gl-text-danger">
-          Dashboard alerts go in the <code>#alert</code> slot.
-        </div>
-      </template>
-      <template #panel="{ panel }">
-        <div class="gl-bg-feedback-warning gl-h-full">
-          <p>The <code>#panel</code> slot.</p>
-        </div>
-      </template>
-      <template #empty-state>
-        <p>This dashboard has no panels</p>
-      </template>
-      <template #footer>
-        <div class="gl-text-subtle">
-          This is a custom <code>#footer</code>!
-        </div>
-      </template>
-    </dashboard-layout>
-  `,
-});
-
-export const Default = Template.bind({});
-Default.args = {
-  config: { ...dashboardConfig },
-};
-
-export const EmptyState = Template.bind({});
-EmptyState.args = {
-  config: {
-    ...dashboardConfig,
-    panels: [],
-  },
-};
-
-export const Slots = SlotsTemplate.bind({});
-Slots.args = {
-  config: { ...dashboardConfig },
-};
diff --git a/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.vue b/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.vue
deleted file mode 100644
index 74ff4966448..00000000000
--- a/app/assets/javascripts/vue_shared/components/customizable_dashboard/dashboard_layout.vue
+++ /dev/null
@@ -1,106 +0,0 @@
-<script>
-import GridstackWrapper from './gridstack_wrapper.vue';
-import { dashboardConfigValidator } from './utils';
-
-/**
- * The `DashboardLayout` component provides an easy way to render dashboards using a configuration, aligning with our [Pajamas guidelines](https://design.gitlab.com/patterns/dashboards).
- *
- * Please refer to the [documentation](https://docs.gitlab.com/development/fe_guide/dashboard_layout_framework) for more information.
- *
- */
-export default {
-  name: 'DashboardLayout',
-  components: {
-    GridstackWrapper,
-  },
-  props: {
-    /**
-     * The dashboard configuration object.
-     *
-     * @typedef {Object} Dashboard
-     * @property {string} title - The dashboard title to render. Expected if no #title slot is provided.
-     * @property {string} description - Optional: The dashboard description to render.
-     * @property {Array<Object>} panels - Optional: The dashboard panels. The entire object is passed to the #panel slot.
-     * @property {string} panels[].id - Each panel must have a unique ID.
-     * @property {string} panels[].title - The panel title to render.
-     * @property {Object} panels[].gridAttributes - Layout settings for the panel.
-     * @property {number} panels[].gridAttributes.width - Width of the panel in grid units.
-     * @property {number} panels[].gridAttributes.height - Height of the panel in grid units.
-     * @property {number} panels[].gridAttributes.xPos - X position of the panel in the grid, expressed in grid units, starts from 0.
-     * @property {number} panels[].gridAttributes.yPos - Y position of the panel in the grid, expressed in grid units, starts from 0.
-     *
-     * @type {Dashboard}
-     */
-    config: {
-      type: Object,
-      required: true,
-      validator: dashboardConfigValidator,
-    },
-  },
-  computed: {
-    dashboardHasPanels() {
-      return this.config.panels?.length > 0;
-    },
-    dashboardHasDescription() {
-      return this.$scopedSlots.description || Boolean(this.config.description);
-    },
-  },
-};
-</script>
-<template>
-  <div>
-    <section class="gl-my-4 gl-flex gl-items-center">
-      <div class="gl-flex gl-w-full gl-flex-col">
-        <!-- Dashboard title -->
-        <div class="gl-flex gl-items-center">
-          <!-- @slot Used to render custom dashboard titles. Replaces the default rendering. -->
-          <slot name="title">
-            <h2 data-testid="title" class="gl-my-0">{{ config.title }}</h2>
-          </slot>
-        </div>
-        <!-- Dashboard description -->
-        <div v-if="dashboardHasDescription" class="gl-mt-3 gl-flex">
-          <!-- @slot Used to render custom dashboard descriptions. Replaces the default rendering. -->
-          <slot name="description">
-            <p data-testid="description" class="gl-mb-0">
-              {{ config.description }}
-            </p>
-          </slot>
-        </div>
-      </div>
-      <div v-if="$scopedSlots.actions" data-testid="actions-container">
-        <!-- @slot Place dashboard actions inside this slot. -->
-        <slot name="actions"></slot>
-      </div>
-    </section>
-    <div class="gl-flex">
-      <div class="gl-flex gl-grow gl-flex-col">
-        <!-- @slot For dashboard-level alerts. -->
-        <slot name="alert"></slot>
-
-        <!-- Dashboard filters -->
-        <section
-          v-if="$scopedSlots.filters"
-          class="gl-flex gl-flex-row gl-flex-wrap gl-gap-5 gl-pb-3 gl-pt-4"
-          data-testid="filters-container"
-        >
-          <!-- @slot Place dashboard filters inside this slot. -->
-          <slot name="filters"></slot>
-        </section>
-
-        <!-- Dashboard grid -->
-        <gridstack-wrapper v-if="dashboardHasPanels" :value="config" class="-gl-mx-3">
-          <template #panel="{ panel }">
-            <!-- @slot The contents to render inside each dashboard panel. -->
-            <slot name="panel" v-bind="{ panel }"></slot>
-          </template>
-        </gridstack-wrapper>
-
-        <!-- @slot Shown when a dashboard has no panels. -->
-        <slot v-else name="empty-state"></slot>
-      </div>
-    </div>
-    <!-- @slot Optional: The dashboard footer content. -->
-    <slot name="footer"></slot>
-  </div>
-</template>
diff --git a/app/controllers/jwks_controller.rb b/app/controllers/jwks_controller.rb
index 73e54328b26..2b018b67968 100644
--- a/app/controllers/jwks_controller.rb
+++ b/app/controllers/jwks_controller.rb
@@ -5,12 +5,27 @@ class JwksController < Doorkeeper::OpenidConnect::DiscoveryController
 
   feature_category :system_access
 
+  DYNAMIC_REGISTRATION_PATH = '/oauth/register'
+
   def keys
     expires_in 24.hours, public: true, must_revalidate: true, 'no-transform': true
 
     render json: { keys: payload }
   end
 
+  def provider
+    if request.path == '/.well-known/oauth-authorization-server'
+      expires_in 24.hours, public: true, must_revalidate: true, 'no-transform': true
+      response_hash = provider_response
+      response_hash[:registration_endpoint] = "#{request.base_url}#{DYNAMIC_REGISTRATION_PATH}"
+      render json: response_hash
+
+      return
+    end
+
+    super
+  end
+
   private
 
   def payload
diff --git a/app/controllers/oauth/authorizations_controller.rb b/app/controllers/oauth/authorizations_controller.rb
index 334504780da..a1f6a010a83 100644
--- a/app/controllers/oauth/authorizations_controller.rb
+++ b/app/controllers/oauth/authorizations_controller.rb
@@ -13,6 +13,7 @@ class Oauth::AuthorizationsController < Doorkeeper::AuthorizationsController
   before_action :add_gon_variables
   before_action :verify_confirmed_email!, :verify_admin_allowed!
   # rubocop: disable Rails/LexicallyScopedActionFilter -- :create is defined in Doorkeeper::AuthorizationsController
+  before_action :validate_pkce_for_dynamic_applications, only: [:new, :create]
   after_action :audit_oauth_authorization, only: [:create]
   # rubocop: enable Rails/LexicallyScopedActionFilter
 
@@ -148,6 +149,21 @@ class Oauth::AuthorizationsController < Doorkeeper::AuthorizationsController
     ) && !doorkeeper_application&.trusted?
   end
 
+  def validate_pkce_for_dynamic_applications
+    return unless doorkeeper_application&.dynamic?
+
+    if params[:code_challenge].blank?
+      pre_auth.error = :pkce_required_for_dynamic_applications
+      render "doorkeeper/authorizations/error"
+      return
+    end
+
+    return unless params[:code_challenge_method].present? && params[:code_challenge_method] != 'S256'
+
+    pre_auth.error = :invalid_code_challenge_method
+    render "doorkeeper/authorizations/error"
+  end
+
   # Used by `set_current_organization` in BaseActionController
   def organization_params
     {}
diff --git a/app/controllers/oauth/dynamic_registrations_controller.rb b/app/controllers/oauth/dynamic_registrations_controller.rb
new file mode 100644
index 00000000000..706f004e852
--- /dev/null
+++ b/app/controllers/oauth/dynamic_registrations_controller.rb
@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module Oauth
+  class DynamicRegistrationsController < ApplicationController
+    feature_category :system_access
+
+    skip_before_action :authenticate_user!, only: [:create]
+    skip_before_action :verify_authenticity_token, only: [:create]
+    before_action :check_rate_limit, only: [:create]
+    before_action :check_feature_flag!
+
+    # POST /oauth/register
+    def create
+      client_metadata = Gitlab::Json.parse(request.body.read).symbolize_keys
+
+      allowed_params = [
+        :redirect_uris, :client_name, :scope
+      ]
+
+      client_metadata = client_metadata.slice(*allowed_params)
+
+      # Validations here are specific to this controller, not the model
+      validation_error = validate_dynamic_fields(client_metadata)
+      if validation_error
+        render json: validation_error, status: :bad_request
+        return
+      end
+
+      # TODO: Change this to MCP once the mcp scope has been created.
+      scopes = client_metadata[:scope].presence || "api"
+
+      redirect_uris = client_metadata[:redirect_uris]
+      redirect_uris = [redirect_uris] if redirect_uris.is_a?(String)
+
+      application = ::Doorkeeper::Application.create(
+        name: "[Unverified Dynamic Application] #{client_metadata[:client_name]}",
+        redirect_uri: Array(redirect_uris).join("\n"),
+        scopes: scopes,
+        confidential: false,
+        dynamic: true
+      )
+
+      if application.persisted?
+        render json: {
+          client_id: application.uid,
+          client_id_issued_at: application.created_at.to_i,
+          redirect_uris: application.redirect_uri.split("\n"),
+          token_endpoint_auth_method: "none",
+          grant_types: "authorization_code",
+          require_pkce: true,
+          client_name: application.name,
+          scope: scopes,
+          dynamic: true
+        }, status: :created
+      else
+        error_message = application.errors.full_messages.join(", ")
+
+        render json: {
+          error: "invalid_client_metadata",
+          error_description: error_message
+        }, status: :bad_request
+      end
+    end
+
+    private
+
+    def validate_dynamic_fields(client_metadata)
+      return if client_metadata[:client_name].present? && (client_metadata[:client_name].length < 200)
+
+      {
+        error: "invalid_client_metadata",
+        error_description: "client_name is too long"
+      }
+    end
+
+    def check_feature_flag!
+      render_404 unless Feature.enabled?(:oauth_dynamic_client_registration, :instance)
+    end
+
+    def check_rate_limit
+      return if Rails.env.test?
+
+      check_rate_limit!(:oauth_dynamic_registration, scope: request.ip)
+    end
+  end
+end
diff --git a/app/controllers/oauth/protected_resource_metadata_controller.rb b/app/controllers/oauth/protected_resource_metadata_controller.rb
new file mode 100644
index 00000000000..b3372a0384d
--- /dev/null
+++ b/app/controllers/oauth/protected_resource_metadata_controller.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Oauth
+  class ProtectedResourceMetadataController < ApplicationController
+    include ::Gitlab::EndpointAttributes
+
+    feature_category :system_access
+    skip_before_action :authenticate_user!
+
+    def show
+      expires_in 24.hours, public: true, must_revalidate: true, 'no-transform': true
+      render json: resource_metadata
+    end
+
+    private
+
+    def resource_metadata
+      {
+        resource: "#{request.base_url}/api/v4/mcp",
+        authorization_servers: [
+          request.base_url
+        ]
+      }
+    end
+  end
+end
diff --git a/app/controllers/oauth/tokens_controller.rb b/app/controllers/oauth/tokens_controller.rb
index 41c9a76b331..02595352fb2 100644
--- a/app/controllers/oauth/tokens_controller.rb
+++ b/app/controllers/oauth/tokens_controller.rb
@@ -7,6 +7,8 @@ class Oauth::TokensController < Doorkeeper::TokensController
 
   alias_method :auth_user, :current_user
 
+  before_action :validate_pkce_for_dynamic_applications, only: [:create]
+
   def create
     if authorize_response.status == :ok
       track_internal_event(
@@ -24,6 +26,16 @@ class Oauth::TokensController < Doorkeeper::TokensController
 
   private
 
+  def validate_pkce_for_dynamic_applications
+    return unless server.client&.application&.dynamic?
+    return unless params[:code_verifier].blank? # rubocop:disable Rails/StrongParams -- Only accessing a single named param
+
+    render json: {
+      error: 'invalid_request',
+      error_description: 'PKCE code_verifier is required for dynamic OAuth applications'
+    }, status: :bad_request
+  end
+
   def validate_presence_of_client
     return if Doorkeeper.config.skip_client_authentication_for_password_grant.call
 
diff --git a/app/graphql/mutations/work_items/reorder.rb b/app/graphql/mutations/work_items/reorder.rb
new file mode 100644
index 00000000000..4de05fe70cf
--- /dev/null
+++ b/app/graphql/mutations/work_items/reorder.rb
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Mutations
+  module WorkItems
+    class Reorder < BaseMutation
+      graphql_name 'workItemsReorder'
+      description 'Reorders a project level work item.'
+
+      argument :id,
+        ::Types::GlobalIDType[::WorkItem],
+        required: true,
+        description: 'Global ID of the work item to be reordered.'
+
+      argument :move_before_id,
+        ::Types::GlobalIDType[::WorkItem],
+        required: false,
+        description: 'Global ID of a project’s work item that should be placed before the work item.',
+        prepare: ->(id, _ctx) { GitlabSchema.parse_gid(id)&.model_id }
+
+      argument :move_after_id,
+        ::Types::GlobalIDType[::WorkItem],
+        required: false,
+        description: 'Global ID of a project’s work item that should be placed after the work item.',
+        prepare: ->(id, _ctx) { GitlabSchema.parse_gid(id)&.model_id }
+
+      field :work_item,
+        ::Types::WorkItemType,
+        null: true,
+        description: 'Work item after mutation.'
+
+      authorize :update_work_item
+
+      def ready?(**args)
+        return super if args.slice(:move_after_id, :move_before_id).compact.present?
+
+        raise Gitlab::Graphql::Errors::ArgumentError,
+          'At least one of move_before_id and move_after_id are required'
+      end
+
+      def resolve(**args)
+        work_item = authorized_find!(id: args[:id])
+
+        ::WorkItems::ReorderService.new(
+          current_user: current_user,
+          params: args.slice(:move_before_id, :move_after_id)
+        ).execute(work_item).payload
+      end
+    end
+  end
+end
diff --git a/app/graphql/types/mutation_type.rb b/app/graphql/types/mutation_type.rb
index 35a9b9ff6a0..bc5d314f733 100644
--- a/app/graphql/types/mutation_type.rb
+++ b/app/graphql/types/mutation_type.rb
@@ -251,6 +251,7 @@ module Types
     mount_mutation Mutations::WorkItems::Hierarchy::AddChildrenItems, experiment: { milestone: '18.2' }
     mount_mutation Mutations::WorkItems::BulkUpdate, experiment: { milestone: '17.4' }
     mount_mutation Mutations::WorkItems::BulkMove, experiment: { milestone: '18.2' }
+    mount_mutation Mutations::WorkItems::Reorder, experiment: { milestone: '18.3' }
     mount_mutation Mutations::WorkItems::UserPreference::Update, experiment: { milestone: '17.10' }
     mount_mutation Mutations::Users::SavedReplies::Create
     mount_mutation Mutations::Users::SavedReplies::Update
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 30ac0d9de89..2d4b1c04b09 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -224,16 +224,6 @@ module ApplicationHelper
     end
   end
 
-  # This needs to be used outside of Rails
-  def self.promo_host
-    'about.gitlab.com'
-  end
-
-  # Convenient method for Rails helper
-  def promo_host
-    ApplicationHelper.promo_host
-  end
-
   # This needs to be used outside of Rails
   def self.community_forum
     'https://forum.gitlab.com'
@@ -244,16 +234,8 @@ module ApplicationHelper
     ApplicationHelper.community_forum
   end
 
-  def self.promo_url
-    "https://#{promo_host}"
-  end
-
-  def promo_url
-    ApplicationHelper.promo_url
-  end
-
   def support_url
-    Gitlab::CurrentSettings.current_application_settings.help_page_support_url.presence || "#{promo_url}/get-help/"
+    Gitlab::CurrentSettings.current_application_settings.help_page_support_url.presence || promo_url(path: '/get-help/')
   end
 
   def instance_review_permitted?
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index f178073dd37..46ea63422b5 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -718,7 +718,7 @@ module ApplicationSettingsHelper
       minimum_password_length_min: ApplicationSetting::DEFAULT_MINIMUM_PASSWORD_LENGTH,
       minimum_password_length_max: Devise.password_length.max,
       minimum_password_length_help_link:
-        'https://about.gitlab.com/handbook/security/#gitlab-password-policy-guidelines',
+        promo_url(path: '/handbook/security/', anchor: 'gitlab-password-policy-guidelines'),
       domain_allowlist_raw: @application_setting.domain_allowlist_raw,
       new_user_signups_cap: @application_setting[:new_user_signups_cap].to_s,
       domain_denylist_enabled: @application_setting[:domain_denylist_enabled].to_s,
diff --git a/app/helpers/auth_helper.rb b/app/helpers/auth_helper.rb
index a843cae877b..e51e9f83a05 100644
--- a/app/helpers/auth_helper.rb
+++ b/app/helpers/auth_helper.rb
@@ -220,14 +220,15 @@ module AuthHelper
     current_user.allow_password_authentication_for_web? && !current_user.password_automatically_set?
   end
 
-  def auth_app_owner_text(owner)
-    return _('An administrator added this OAuth application ') unless owner
+  def auth_app_owner_text(application)
+    return _('An anonymous service added this dynamically created OAuth application ') if application.dynamic?
+    return _('An administrator added this OAuth application ') unless application.owner
 
-    if owner.is_a?(Group)
-      group_link = link_to(owner.name, group_path(owner))
+    if application.owner.is_a?(Group)
+      group_link = link_to(application.owner.name, group_path(application.owner))
       safe_format(_("%{group_link} added this OAuth application "), group_link: group_link)
     else
-      user_link = link_to(owner.name, user_path(owner))
+      user_link = link_to(application.owner.name, user_path(application.owner))
       safe_format(_("%{user_link} added this OAuth application "), user_link: user_link)
     end
   end
diff --git a/app/helpers/compare_helper.rb b/app/helpers/compare_helper.rb
index 9ecf780f55b..56c0fc290e5 100644
--- a/app/helpers/compare_helper.rb
+++ b/app/helpers/compare_helper.rb
@@ -37,18 +37,15 @@ module CompareHelper
   def project_compare_selector_data(project, merge_request, params)
     {
       project_compare_index_path: project_compare_index_path(project),
-      source_project: { id: project.id, name: project.full_path }.to_json,
-      target_project: { id: @target_project.id, name: @target_project.full_path }.to_json,
+      source_project: { value: project.id, text: project.full_name }.to_json,
+      target_projects_path: project_new_merge_request_json_target_projects_path(project),
+      target_project: { value: @target_project.id, text: @target_project.full_name }.to_json,
       source_project_refs_path: refs_project_path(project),
       target_project_refs_path: refs_project_path(@target_project),
       params_from: params[:from],
       params_to: params[:to],
       straight: params[:straight]
     }.tap do |data|
-      data[:projects_from] = target_projects(project).map do |target_project|
-        { id: target_project.id, name: target_project.full_path }
-      end.to_json
-
       data[:project_merge_request_path] =
         if merge_request.present?
           project_merge_request_path(project, merge_request)
diff --git a/app/helpers/integrations_helper.rb b/app/helpers/integrations_helper.rb
index 55f4b1d2c4d..9603096e30e 100644
--- a/app/helpers/integrations_helper.rb
+++ b/app/helpers/integrations_helper.rb
@@ -118,7 +118,7 @@ module IntegrationsHelper
       enable_comments: integration.comment_on_event_enabled.to_s,
       comment_detail: integration.comment_detail,
       learn_more_path: integrations_help_page_path,
-      about_pricing_url: Gitlab::Saas.about_pricing_url,
+      about_pricing_url: promo_pricing_url,
       trigger_events: trigger_events_for_integration(integration),
       sections: integration.sections.to_json,
       fields: fields_for_integration(integration),
diff --git a/app/helpers/projects/security/configuration_helper.rb b/app/helpers/projects/security/configuration_helper.rb
index d36494690a4..d366c2e6dfc 100644
--- a/app/helpers/projects/security/configuration_helper.rb
+++ b/app/helpers/projects/security/configuration_helper.rb
@@ -4,7 +4,7 @@ module Projects
   module Security
     module ConfigurationHelper
       def security_upgrade_path
-        "#{ApplicationHelper.promo_url}/pricing/"
+        promo_pricing_url
       end
 
       def vulnerability_training_docs_path
diff --git a/app/helpers/sidebars_helper.rb b/app/helpers/sidebars_helper.rb
index e5fc955f875..a117da5ef33 100644
--- a/app/helpers/sidebars_helper.rb
+++ b/app/helpers/sidebars_helper.rb
@@ -216,7 +216,7 @@ module SidebarsHelper
   end
 
   def compare_plans_url(*)
-    "#{promo_url}/pricing"
+    promo_pricing_url
   end
 
   private
diff --git a/app/presenters/dev_ops_report/metric_presenter.rb b/app/presenters/dev_ops_report/metric_presenter.rb
index 83aa15fc4e8..8932305b071 100644
--- a/app/presenters/dev_ops_report/metric_presenter.rb
+++ b/app/presenters/dev_ops_report/metric_presenter.rb
@@ -59,7 +59,7 @@ module DevOpsReport
           title: 'Environments',
           description: 'created per active user',
           feature: 'environments',
-          blog: 'https://about.gitlab.com/2016/08/26/ci-deployment-and-environments/',
+          blog: promo_url(path: '/2016/08/26/ci-deployment-and-environments/'),
           docs: help_page_path('ci/environments/_index.md')
         ),
         Card.new(
diff --git a/app/services/work_items/reorder_service.rb b/app/services/work_items/reorder_service.rb
new file mode 100644
index 00000000000..0a7d92247aa
--- /dev/null
+++ b/app/services/work_items/reorder_service.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module WorkItems
+  class ReorderService
+    include Gitlab::Utils::StrongMemoize
+
+    def initialize(current_user:, params:)
+      @current_user = current_user
+      @params = params
+    end
+
+    def execute(work_item)
+      return unauthorized_error(work_item) unless current_user.can?(:update_work_item, work_item)
+      return non_project_work_item_error(work_item) if work_item.project.blank?
+      return missing_arguments_error(work_item) unless move_between_ids
+
+      ::WorkItems::UpdateService.new(
+        container: work_item.project,
+        current_user: current_user,
+        params: { move_between_ids: move_between_ids }
+      ).execute(work_item)
+
+      success(work_item)
+    rescue ActiveRecord::RecordNotFound
+      error(work_item, message: "Work item not found")
+    end
+
+    private
+
+    attr_reader :current_user, :params
+
+    def success(work_item)
+      ServiceResponse.success(payload: {
+        work_item: work_item,
+        errors: []
+      })
+    end
+
+    def non_project_work_item_error(work_item)
+      error(
+        work_item,
+        message: 'Only project work items are supported at this moment'
+      )
+    end
+
+    def unauthorized_error(work_item)
+      error(
+        work_item,
+        message: "You don't have permissions to update this work item"
+      )
+    end
+
+    def missing_arguments_error(work_item)
+      error(work_item, message: 'At least one of move_before_id or move_after_id is required')
+    end
+
+    def error(work_item, message: nil)
+      ServiceResponse.new(status: :error, payload: {
+        work_item: work_item,
+        errors: Array.wrap(message)
+      })
+    end
+
+    def move_between_ids
+      params
+        .values_at(:move_before_id, :move_after_id)
+        .map(&:to_i)
+        .map { |id| id > 0 ? id : nil }
+        .then { |ids| ids.any? ? ids : nil }
+    end
+    strong_memoize_attr :move_between_ids
+  end
+end
diff --git a/app/views/admin/dashboard/_security_newsletter_callout.html.haml b/app/views/admin/dashboard/_security_newsletter_callout.html.haml
index 0bdeef9acea..7d470f43520 100644
--- a/app/views/admin/dashboard/_security_newsletter_callout.html.haml
+++ b/app/views/admin/dashboard/_security_newsletter_callout.html.haml
@@ -10,5 +10,5 @@
   - c.with_body do
     = s_('AdminArea|Sign up for the GitLab Security Newsletter to get notified for security updates.')
   - c.with_actions do
-    = render Pajamas::ButtonComponent.new(variant: :confirm, href: 'https://about.gitlab.com/company/preference-center/', target: '_blank', button_options: { class: 'deferred-link gl-alert-action', rel: 'noreferrer noopener' }) do
+    = render Pajamas::ButtonComponent.new(variant: :confirm, href: promo_url(path: '/company/preference-center/'), target: '_blank', button_options: { class: 'deferred-link gl-alert-action', rel: 'noreferrer noopener' }) do
       = s_('AdminArea|Sign up for the GitLab newsletter')
diff --git a/app/views/devise/sessions/_successful_verification_lightweight.haml b/app/views/devise/sessions/_successful_verification_lightweight.haml
index fd870267cab..2eae552b2f5 100644
--- a/app/views/devise/sessions/_successful_verification_lightweight.haml
+++ b/app/views/devise/sessions/_successful_verification_lightweight.haml
@@ -1,4 +1,5 @@
 - @html_class = 'gl-dark'
+- content_for :hide_empty_navbar, true
 = content_for :meta_tags do
   %meta{ 'http-equiv': 'refresh', content: "3; url=#{@redirect_url}" }
 
diff --git a/app/views/devise/sessions/restricted.html.haml b/app/views/devise/sessions/restricted.html.haml
index ca4c812ded2..10f431e7249 100644
--- a/app/views/devise/sessions/restricted.html.haml
+++ b/app/views/devise/sessions/restricted.html.haml
@@ -26,7 +26,7 @@
     = render Pajamas::ButtonComponent.new(variant: :confirm, href: 'https://gitlab.cn/saasmigration/') do
       Take me to JiHu (去极狐)
 
-    = render Pajamas::ButtonComponent.new(href: 'https://about.gitlab.com/pricing/faq-jihu/') do
+    = render Pajamas::ButtonComponent.new(href: promo_pricing_url(path: '/faq-jihu/')) do
       Learn more about JiHu (了解更多有关极狐)
 
   .gl-flex.gl-justify-center.gl-items-center.gl-my-6
diff --git a/app/views/devise/shared/_footer.html.haml b/app/views/devise/shared/_footer.html.haml
index 9d68284abb8..a2cd5546fd6 100644
--- a/app/views/devise/shared/_footer.html.haml
+++ b/app/views/devise/shared/_footer.html.haml
@@ -5,7 +5,7 @@
       - unless public_visibility_restricted?
         = link_to _("Explore"), explore_root_path
         = link_to _("Help"), help_path
-      = link_to _("About GitLab"), ApplicationHelper.promo_url
+      = link_to _("About GitLab"), promo_url
       = link_to _("GitLab community forum"), ApplicationHelper.community_forum, target: '_blank', class: 'text-nowrap', rel: 'noopener noreferrer'
     - if one_trust_enabled?
       = render Pajamas::ButtonComponent.new(category: :tertiary, size: :small, button_options: { class: 'ot-sdk-show-settings' }) do
diff --git a/app/views/doorkeeper/authorizations/new.html.haml b/app/views/doorkeeper/authorizations/new.html.haml
index bea64ee9b1a..59807339b9f 100644
--- a/app/views/doorkeeper/authorizations/new.html.haml
+++ b/app/views/doorkeeper/authorizations/new.html.haml
@@ -38,7 +38,7 @@
             = description
   .info-well
     .well-segment
-      - if Gitlab.com? && !@pre_auth.client.application.owner
+      - if Gitlab.com? && !@pre_auth.client.application.owner && !@pre_auth.client.application.dynamic?
         %p.gl-text-success
           = sprite_icon('tanuki-verified', css_class: 'gl-fill-icon-success')
           = _('This application is provided by GitLab.')
@@ -50,7 +50,7 @@
             tag_pair(tag.strong, :strong_start, :strong_end))
       %p
         = safe_format(_('%{owner} %{created_date} ago.'),
-          { owner: auth_app_owner_text(@pre_auth.client.application.owner),
+          { owner: auth_app_owner_text(@pre_auth.client.application),
             created_date: time_ago_in_words(@pre_auth.client.application.created_at.to_date) })
         - domain = URI.parse(@pre_auth.redirect_uri).host.gsub(/^www\./, '')
         - if @pre_auth.redirect_uri.start_with?('http://', 'https://') && domain != 'localhost'
diff --git a/app/views/help/index.html.haml b/app/views/help/index.html.haml
index 4576080e61e..d813229723e 100644
--- a/app/views/help/index.html.haml
+++ b/app/views/help/index.html.haml
@@ -23,7 +23,7 @@
     %br
     = _('Used by more than 100,000 organizations, GitLab is the most popular solution to manage git repositories on-premises.')
     %br
-    - link_to_promo = link_to(promo_host, promo_url, target: '_blank', rel: 'noopener noreferrer')
+    - link_to_promo = link_to(::Gitlab::Saas.promo_host, promo_url, target: '_blank', rel: 'noopener noreferrer')
     = _("Read more about GitLab at %{link_to_promo}.").html_safe % { link_to_promo: link_to_promo }
 
 %p= link_to _('Check the current instance configuration '), help_instance_configuration_url
@@ -46,5 +46,5 @@
           %button.gl-border-none.gl-rounded-none.gl-p-0.btn-link.gl-button.js-trigger-shortcut{ type: 'button', class: "!gl-bg-transparent !gl-outline-none !gl-shadow-none" }
             = _('Use shortcuts')
         - unless Gitlab::CurrentSettings.help_page_hide_commercial_content?
-          %li= link_to _('Get a support subscription'), "#{ApplicationHelper.promo_url}/pricing/", { class: '!gl-text-link' }
-          %li= link_to _('Compare GitLab editions'), "#{ApplicationHelper.promo_url}/features/#compare", { class: '!gl-text-link' }
+          %li= link_to _('Get a support subscription'), promo_pricing_url, { class: '!gl-text-link' }
+          %li= link_to _('Compare GitLab editions'), promo_url(path: '/features/', anchor: 'compare'), { class: '!gl-text-link' }
diff --git a/app/views/layouts/header/_super_sidebar_logged_out.haml b/app/views/layouts/header/_super_sidebar_logged_out.haml
index 553c50a25d7..572601062f4 100644
--- a/app/views/layouts/header/_super_sidebar_logged_out.haml
+++ b/app/views/layouts/header/_super_sidebar_logged_out.haml
@@ -20,24 +20,24 @@
             .dropdown-menu
               %ul
                 %li
-                  = link_to Gitlab::Utils.append_path(promo_url, 'why-gitlab') do
+                  = link_to promo_url(path: '/why-gitlab') do
                     = s_('LoggedOutMarketingHeader|Why GitLab')
                 %li
-                  = link_to Gitlab::Utils.append_path(promo_url, 'pricing') do
+                  = link_to promo_pricing_url do
                     = s_('LoggedOutMarketingHeader|Pricing')
                 %li
-                  = link_to Gitlab::Utils.append_path(promo_url, 'sales') do
+                  = link_to promo_url(path: '/sales') do
                     = s_('LoggedOutMarketingHeader|Contact Sales')
                 %li
                   = link_to _("Explore"), explore_root_path
           %li.header-logged-out-nav-item.gl-hidden.md:gl-inline-block
-            = link_to Gitlab::Utils.append_path(promo_url, 'why-gitlab') do
+            = link_to promo_url(path: '/why-gitlab') do
               = s_('LoggedOutMarketingHeader|Why GitLab')
           %li.header-logged-out-nav-item.gl-hidden.md:gl-inline-block
-            = link_to Gitlab::Utils.append_path(promo_url, 'pricing') do
+            = link_to promo_pricing_url do
               = s_('LoggedOutMarketingHeader|Pricing')
           %li.header-logged-out-nav-item.gl-hidden.gl-inline-block
-            = link_to Gitlab::Utils.append_path(promo_url, 'sales') do
+            = link_to promo_url(path: '/sales') do
               = s_('LoggedOutMarketingHeader|Contact Sales')
         %li.header-logged-out-nav-item{ class: ('gl-hidden md:gl-inline-block' if Gitlab.com?) }
           = link_to _("Explore"), explore_root_path, class: ''
diff --git a/app/views/layouts/mailer/devise.html.haml b/app/views/layouts/mailer/devise.html.haml
index 1912d4267b7..8096a35bd7e 100644
--- a/app/views/layouts/mailer/devise.html.haml
+++ b/app/views/layouts/mailer/devise.html.haml
@@ -5,7 +5,7 @@
         %div
           = _('Everyone can contribute')
         %div
-          = link_to _('Blog'), 'https://about.gitlab.com/blog/', style: "color:#3777b0;text-decoration:none;"
+          = link_to _('Blog'), promo_url(path: '/blog/'), style: "color:#3777b0;text-decoration:none;"
           &middot;
           = link_to _('X (formerly Twitter)'), 'https://twitter.com/gitlab', style: "color:#3777b0;text-decoration:none;"
           &middot;
diff --git a/app/views/shared/_promo.html.haml b/app/views/shared/_promo.html.haml
index 855f6b9c1f4..afe6ae49bf1 100644
--- a/app/views/shared/_promo.html.haml
+++ b/app/views/shared/_promo.html.haml
@@ -1,5 +1,5 @@
 .gitlab-promo
   = link_to _('Homepage'), promo_url
-  = link_to _('Blog'), promo_url + '/blog/'
+  = link_to _('Blog'), promo_url(path: '/blog/')
   = link_to '@gitlab', 'https://twitter.com/gitlab'
   = link_to _('Requests'), 'https://gitlab.com/gitlab-org/gitlab-foss/blob/master/CONTRIBUTING.md#feature-proposals'
diff --git a/config/feature_flags/wip/oauth_dynamic_client_registration.yml b/config/feature_flags/wip/oauth_dynamic_client_registration.yml
new file mode 100644
index 00000000000..6e5355cc3bd
--- /dev/null
+++ b/config/feature_flags/wip/oauth_dynamic_client_registration.yml
@@ -0,0 +1,10 @@
+---
+name: oauth_dynamic_client_registration
+description: Enable dynamic client registration for OAuth 2.0
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/554820
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197644
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/555942
+milestone: '18.3'
+group: group::api
+type: wip
+default_enabled: false
diff --git a/config/locales/doorkeeper.en.yml b/config/locales/doorkeeper.en.yml
index d31a99359ad..9c0af804071 100644
--- a/config/locales/doorkeeper.en.yml
+++ b/config/locales/doorkeeper.en.yml
@@ -36,6 +36,7 @@ en:
         invalid_scope: 'The requested scope is invalid, unknown, or malformed.'
         server_error: 'The authorization server encountered an unexpected condition which prevented it from fulfilling the request.'
         unconfirmed_email: 'Verify the email address in your account profile before you sign in.'
+        pkce_required_for_dynamic_applications: 'PKCE code_challenge is required for dynamic OAuth applications.'
         temporarily_unavailable: 'The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.'
 
         #configuration error messages
diff --git a/config/routes.rb b/config/routes.rb
index 39a441acdb6..f5e255e810c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -31,6 +31,8 @@ InitializerConnections.raise_if_new_database_connection do
         tokens: 'oauth/tokens'
     end
     put '/oauth/applications/:id/renew(.:format)' => 'oauth/applications#renew', as: :renew_oauth_application
+    get '/.well-known/oauth-protected-resource' => 'oauth/protected_resource_metadata#show', as: :oauth_protected_resource_metadata
+    post '/oauth/register(.:format)' => 'oauth/dynamic_registrations#create', as: :oauth_register
 
     draw :oauth
 
@@ -46,6 +48,7 @@ InitializerConnections.raise_if_new_database_connection do
     match '/oauth/userinfo' => 'doorkeeper/openid_connect/userinfo#show', via: :options
     match '/oauth/discovery/keys' => 'jwks#keys', via: :options
     match '/.well-known/openid-configuration' => 'jwks#provider', via: :options
+    match '/.well-known/oauth-protected-resource' => 'oauth_protected_resource_metadata#show', via: :options
     match '/.well-known/webfinger' => 'jwks#webfinger', via: :options
 
     match '/oauth/token' => 'oauth/tokens#create', via: :options
diff --git a/config/routes/directs.rb b/config/routes/directs.rb
index 960ab2a9e69..7f509c1deb3 100644
--- a/config/routes/directs.rb
+++ b/config/routes/directs.rb
@@ -4,4 +4,4 @@
 
 draw 'directs/milestone'
 draw 'directs/subscription_portal'
-draw 'directs/about'
+draw 'directs/promo'
diff --git a/config/routes/directs/about.rb b/config/routes/directs/about.rb
deleted file mode 100644
index 833030defc7..00000000000
--- a/config/routes/directs/about.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-direct :about do
-  'https://about.gitlab.com'
-end
diff --git a/config/routes/directs/promo.rb b/config/routes/directs/promo.rb
new file mode 100644
index 00000000000..ac034f78c17
--- /dev/null
+++ b/config/routes/directs/promo.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+direct :promo do |options = {}|
+  uri = URI.parse("https://#{::Gitlab::Saas.promo_host}")
+
+  uri.query = URI.encode_www_form(options[:query]) if options[:query]
+
+  uri.path = options[:path] if options[:path]
+  uri.fragment = options[:anchor] if options[:anchor]
+
+  uri.to_s
+end
+
+direct :promo_pricing do |options = {}|
+  options[:path] = "/pricing#{options[:path]}"
+  promo_url(**options)
+end
diff --git a/db/docs/batched_background_migrations/backfill_missing_organization_id_on_ci_runner_machines.yml b/db/docs/batched_background_migrations/backfill_missing_organization_id_on_ci_runner_machines.yml
index 27b9dfcc93d..a6bc8abcbc6 100644
--- a/db/docs/batched_background_migrations/backfill_missing_organization_id_on_ci_runner_machines.yml
+++ b/db/docs/batched_background_migrations/backfill_missing_organization_id_on_ci_runner_machines.yml
@@ -8,4 +8,4 @@ feature_category: fleet_visibility
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/195123
 milestone: '18.2'
 queued_migration_version: 20250620094653
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250714085848
diff --git a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_machines.yml b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_machines.yml
index 646e3a48490..9bcde422628 100644
--- a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_machines.yml
+++ b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_machines.yml
@@ -6,4 +6,4 @@ feature_category: fleet_visibility
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193195
 milestone: '18.2'
 queued_migration_version: 20250602183870
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250714085833
diff --git a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_taggings.yml b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_taggings.yml
index 7e8b57f01d2..89f720b3c52 100644
--- a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_taggings.yml
+++ b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runner_taggings.yml
@@ -6,4 +6,4 @@ feature_category: runner
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193195
 milestone: '18.2'
 queued_migration_version: 20250602183875
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250714085841
diff --git a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runners.yml b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runners.yml
index 3dd8d5a048d..deedb95f9f4 100644
--- a/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runners.yml
+++ b/db/docs/batched_background_migrations/backfill_organization_id_on_ci_runners.yml
@@ -6,4 +6,4 @@ feature_category: runner
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193195
 milestone: '18.2'
 queued_migration_version: 20250602183865
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: 20250714085826
diff --git a/db/docs/issue_assignees.yml b/db/docs/issue_assignees.yml
index e7a87b776fa..e935aceb3de 100644
--- a/db/docs/issue_assignees.yml
+++ b/db/docs/issue_assignees.yml
@@ -8,14 +8,6 @@ description: Users assigned to an issue
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/1541
 milestone: '9.2'
 gitlab_schema: gitlab_main_cell
-desired_sharding_key:
-  namespace_id:
-    references: namespaces
-    backfill_via:
-      parent:
-        foreign_key: issue_id
-        table: issues
-        sharding_key: namespace_id
-        belongs_to: issue
+sharding_key:
+  namespace_id: namespaces
 table_size: small
-desired_sharding_key_migration_job_name: BackfillIssueAssigneesNamespaceId
diff --git a/db/migrate/20250501083748_set_api_rate_limits_to_zero.rb b/db/migrate/20250501083748_set_api_rate_limits_to_zero.rb
index 39966ba98db..afefd5048f8 100644
--- a/db/migrate/20250501083748_set_api_rate_limits_to_zero.rb
+++ b/db/migrate/20250501083748_set_api_rate_limits_to_zero.rb
@@ -6,45 +6,11 @@ class SetApiRateLimitsToZero < Gitlab::Database::Migration[2.3]
   milestone '18.0'
 
   def up
-    return if Gitlab.com?
-
-    set_groups_and_projects_api_rate_limits_to_zero
-    set_users_api_rate_limits_to_zero
+    # no-op: As of milestone 18.3, we no longer want to set rate limits to zero for new SM installations
+    # so they receive the proper rate limits instead.
   end
 
   def down
     # no-op
   end
-
-  private
-
-  def set_groups_and_projects_api_rate_limits_to_zero
-    connection.execute(<<~SQL)
-      UPDATE application_settings
-        SET rate_limits = rate_limits
-          || '{"group_api_limit": 0}'::jsonb
-          || '{"group_projects_api_limit": 0}'::jsonb
-          || '{"group_shared_groups_api_limit": 0}'::jsonb
-          || '{"groups_api_limit": 0}'::jsonb
-          || '{"project_api_limit": 0}'::jsonb
-          || '{"projects_api_limit": 0}'::jsonb
-          || '{"user_contributed_projects_api_limit": 0}'::jsonb
-          || '{"user_projects_api_limit": 0}'::jsonb
-          || '{"user_starred_projects_api_limit": 0}'::jsonb;
-    SQL
-  end
-
-  def set_users_api_rate_limits_to_zero
-    connection.execute(<<~SQL)
-      UPDATE application_settings
-        SET rate_limits = rate_limits
-          || '{"users_api_limit_followers": 0}'::jsonb
-          || '{"users_api_limit_following": 0}'::jsonb
-          || '{"users_api_limit_status": 0}'::jsonb
-          || '{"users_api_limit_ssh_keys": 0}'::jsonb
-          || '{"users_api_limit_ssh_key": 0}'::jsonb
-          || '{"users_api_limit_gpg_keys": 0}'::jsonb
-          || '{"users_api_limit_gpg_key": 0}'::jsonb;
-    SQL
-  end
 end
diff --git a/db/migrate/20250714075354_add_dynamic_to_oauth_applications.rb b/db/migrate/20250714075354_add_dynamic_to_oauth_applications.rb
new file mode 100644
index 00000000000..f7886347037
--- /dev/null
+++ b/db/migrate/20250714075354_add_dynamic_to_oauth_applications.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddDynamicToOauthApplications < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+
+  def up
+    add_column :oauth_applications, :dynamic, :boolean, default: false, null: false
+  end
+
+  def down
+    remove_column :oauth_applications, :dynamic
+  end
+end
diff --git a/db/post_migrate/20250714085826_finalize_backfill_organization_id_on_ci_runners.rb b/db/post_migrate/20250714085826_finalize_backfill_organization_id_on_ci_runners.rb
new file mode 100644
index 00000000000..0f71ad8c644
--- /dev/null
+++ b/db/post_migrate/20250714085826_finalize_backfill_organization_id_on_ci_runners.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillOrganizationIdOnCiRunners < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillOrganizationIdOnCiRunners',
+      table_name: :ci_runners,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250714085833_finalize_backfill_organization_id_on_ci_runner_machines.rb b/db/post_migrate/20250714085833_finalize_backfill_organization_id_on_ci_runner_machines.rb
new file mode 100644
index 00000000000..57502b0a5f6
--- /dev/null
+++ b/db/post_migrate/20250714085833_finalize_backfill_organization_id_on_ci_runner_machines.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillOrganizationIdOnCiRunnerMachines < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillOrganizationIdOnCiRunnerMachines',
+      table_name: :ci_runner_machines,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250714085841_finalize_backfill_organization_id_on_ci_runner_taggings.rb b/db/post_migrate/20250714085841_finalize_backfill_organization_id_on_ci_runner_taggings.rb
new file mode 100644
index 00000000000..3e79ab87420
--- /dev/null
+++ b/db/post_migrate/20250714085841_finalize_backfill_organization_id_on_ci_runner_taggings.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillOrganizationIdOnCiRunnerTaggings < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillOrganizationIdOnCiRunnerTaggings',
+      table_name: :ci_runner_taggings,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250714085848_finalize_backfill_missing_organization_id_on_ci_runner_machines.rb b/db/post_migrate/20250714085848_finalize_backfill_missing_organization_id_on_ci_runner_machines.rb
new file mode 100644
index 00000000000..889e569d3e8
--- /dev/null
+++ b/db/post_migrate/20250714085848_finalize_backfill_missing_organization_id_on_ci_runner_machines.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillMissingOrganizationIdOnCiRunnerMachines < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_ci
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillMissingOrganizationIdOnCiRunnerMachines',
+      table_name: :ci_runner_machines,
+      column_name: :id,
+      job_arguments: [],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20250715224740_add_issue_assignees_namespace_id_not_null.rb b/db/post_migrate/20250715224740_add_issue_assignees_namespace_id_not_null.rb
new file mode 100644
index 00000000000..68159235cc0
--- /dev/null
+++ b/db/post_migrate/20250715224740_add_issue_assignees_namespace_id_not_null.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AddIssueAssigneesNamespaceIdNotNull < Gitlab::Database::Migration[2.3]
+  milestone '18.3'
+  disable_ddl_transaction!
+
+  def up
+    add_not_null_constraint :issue_assignees, :namespace_id
+  end
+
+  def down
+    remove_not_null_constraint :issue_assignees, :namespace_id
+  end
+end
diff --git a/db/post_migrate/20250721063158_add_partial_index_on_top_level_ancestor_to_sbom_graph_paths.rb b/db/post_migrate/20250721063158_add_partial_index_on_top_level_ancestor_to_sbom_graph_paths.rb
new file mode 100644
index 00000000000..fb828178e3c
--- /dev/null
+++ b/db/post_migrate/20250721063158_add_partial_index_on_top_level_ancestor_to_sbom_graph_paths.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddPartialIndexOnTopLevelAncestorToSbomGraphPaths < Gitlab::Database::Migration[2.3]
+  disable_ddl_transaction!
+  milestone '18.3'
+
+  INDEX_NAME = "index_sbom_graph_paths_on_descendant_id_created_at_top_level"
+
+  def up
+    add_concurrent_index :sbom_graph_paths, %i[descendant_id created_at], where: "top_level_ancestor = TRUE",
+      name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :sbom_graph_paths, INDEX_NAME
+  end
+end
diff --git a/db/schema_migrations/20250714075354 b/db/schema_migrations/20250714075354
new file mode 100644
index 00000000000..f903b1e674d
--- /dev/null
+++ b/db/schema_migrations/20250714075354
@@ -0,0 +1 @@
+13a8d37a5188cfdc713362a7c28881ed30a2c5ca89d9f1202e2b65527fc071a7
\ No newline at end of file
diff --git a/db/schema_migrations/20250714085826 b/db/schema_migrations/20250714085826
new file mode 100644
index 00000000000..8eca2b7fdde
--- /dev/null
+++ b/db/schema_migrations/20250714085826
@@ -0,0 +1 @@
+7f313e8ae544fbb196fe5b6bf3f72a31844a22282d36dd43db471023fe57b82d
\ No newline at end of file
diff --git a/db/schema_migrations/20250714085833 b/db/schema_migrations/20250714085833
new file mode 100644
index 00000000000..ed54ca1cf13
--- /dev/null
+++ b/db/schema_migrations/20250714085833
@@ -0,0 +1 @@
+a032b93e2e744d7710200240c1353d1aa059205dc72a1769110362ea77e013d8
\ No newline at end of file
diff --git a/db/schema_migrations/20250714085841 b/db/schema_migrations/20250714085841
new file mode 100644
index 00000000000..ba1fdee2f29
--- /dev/null
+++ b/db/schema_migrations/20250714085841
@@ -0,0 +1 @@
+ea8089e6486f6507a4e8fe51fa26d38b8b65c177d93dfa5d7e53e56e8e3eb9ed
\ No newline at end of file
diff --git a/db/schema_migrations/20250714085848 b/db/schema_migrations/20250714085848
new file mode 100644
index 00000000000..4ad863b371f
--- /dev/null
+++ b/db/schema_migrations/20250714085848
@@ -0,0 +1 @@
+df6dd7f78864a076457d3e50d899304736dace8b44da76c652288faf36846bd0
\ No newline at end of file
diff --git a/db/schema_migrations/20250715224740 b/db/schema_migrations/20250715224740
new file mode 100644
index 00000000000..c818910189b
--- /dev/null
+++ b/db/schema_migrations/20250715224740
@@ -0,0 +1 @@
+d2006e39fe229045cae3466dc36828e476c7ed9eb0ff1fda9f0972095c1c5447
\ No newline at end of file
diff --git a/db/schema_migrations/20250721063158 b/db/schema_migrations/20250721063158
new file mode 100644
index 00000000000..5229bc8a1d7
--- /dev/null
+++ b/db/schema_migrations/20250721063158
@@ -0,0 +1 @@
+20fd886d66f34d5efb3fb39391d7befebf9149443aba35c22c0b43ee4e6c88fb
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 474762fb9f6..ad780d7374d 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -16637,7 +16637,8 @@ ALTER SEQUENCE issuable_slas_id_seq OWNED BY issuable_slas.id;
 CREATE TABLE issue_assignees (
     user_id bigint NOT NULL,
     issue_id bigint NOT NULL,
-    namespace_id bigint
+    namespace_id bigint,
+    CONSTRAINT check_d88fe18cfa CHECK ((namespace_id IS NOT NULL))
 );
 
 CREATE TABLE issue_assignment_events (
@@ -18866,7 +18867,8 @@ CREATE TABLE oauth_applications (
     trusted boolean DEFAULT false NOT NULL,
     confidential boolean DEFAULT true NOT NULL,
     expire_access_tokens boolean DEFAULT false NOT NULL,
-    ropc_enabled boolean DEFAULT true NOT NULL
+    ropc_enabled boolean DEFAULT true NOT NULL,
+    dynamic boolean DEFAULT false NOT NULL
 );
 
 CREATE SEQUENCE oauth_applications_id_seq
@@ -38019,6 +38021,8 @@ CREATE INDEX index_sbom_graph_paths_on_ancestor_id ON sbom_graph_paths USING btr
 
 CREATE INDEX index_sbom_graph_paths_on_descendant_id ON sbom_graph_paths USING btree (descendant_id);
 
+CREATE INDEX index_sbom_graph_paths_on_descendant_id_created_at_top_level ON sbom_graph_paths USING btree (descendant_id, created_at) WHERE (top_level_ancestor = true);
+
 CREATE INDEX index_sbom_graph_paths_on_project_id_and_descendant_id ON sbom_graph_paths USING btree (project_id, descendant_id);
 
 CREATE INDEX index_sbom_graph_paths_on_project_id_and_id ON sbom_graph_paths USING btree (project_id, id);
diff --git a/doc/administration/backup_restore/backup_archive_process.md b/doc/administration/backup_restore/backup_archive_process.md
index 609fa403021..c0434b3f003 100644
--- a/doc/administration/backup_restore/backup_archive_process.md
+++ b/doc/administration/backup_restore/backup_archive_process.md
@@ -65,10 +65,10 @@ sequenceDiagram
     gitaly-backup->>-Repositories sub-task: Success/failure
 ```
 
-Gitaly Cluster configured storages are backed up in the same way as standalone Gitaly instances.
+Gitaly Cluster (Praefect) configured storages are backed up in the same way as standalone Gitaly instances.
 
 - When Gitaly Cluster receives the RPC calls from `gitaly-backup`, it rebuilds its own database.
-  - There is no need to backup the Gitaly Cluster database separately.
+  - There is no need to backup the Gitaly Cluster (Praefect) database separately.
 - Each repository is backed up only once, regardless of the replication factor, because backups operate through RPCs.
 
 ### Server-side backups
diff --git a/doc/administration/backup_restore/backup_gitlab.md b/doc/administration/backup_restore/backup_gitlab.md
index 406f310febe..49202cd52e6 100644
--- a/doc/administration/backup_restore/backup_gitlab.md
+++ b/doc/administration/backup_restore/backup_gitlab.md
@@ -106,8 +106,8 @@ Unfortunately, the larger the database, the longer it takes `pg_dump` to execute
 
 ### Git repositories
 
-A GitLab instance can have one or more repository shards. Each shard is a Gitaly instance or Gitaly Cluster that
-is responsible for allowing access and operations on the locally stored Git repositories. Gitaly can run
+A GitLab instance can have one or more repository shards. Each shard is a Gitaly instance or Gitaly Cluster (Praefect)
+that is responsible for allowing access and operations on the locally stored Git repositories. Gitaly can run
 on a machine:
 
 - With a single disk.
@@ -1517,7 +1517,7 @@ In the following cases, consider using file system data transfer or snapshots as
 
 {{< alert type="warning" >}}
 
-Gitaly Cluster [does not support snapshot backups](../gitaly/praefect/_index.md#snapshot-backup-and-recovery).
+Gitaly Cluster (Praefect) [does not support snapshot backups](../gitaly/praefect/_index.md#snapshot-backup-and-recovery).
 
 {{< /alert >}}
 
diff --git a/doc/administration/compliance/compliance_features.md b/doc/administration/compliance/compliance_features.md
index 80fedfed80c..7d6b183fbb4 100644
--- a/doc/administration/compliance/compliance_features.md
+++ b/doc/administration/compliance/compliance_features.md
@@ -45,7 +45,7 @@ These features can help provide visibility into GitLab and audit what is happeni
 |:---------------------------------------------------------|:-------------------------------------|:-------------------------------------|:-------------------------------------|:------------|
 | [Audit events](audit_event_reports.md)                   | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | To maintain the integrity of your code, audit events give administrators the ability to view any modifications made in the GitLab server in an advanced audit events system, so you can control, analyze, and track every change. |
 | [Audit reports](audit_event_reports.md)                  | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Create and access reports based on the audit events that have occurred. Use pre-built GitLab reports or the API to build your own. |
-| [Audit event streaming](audit_event_streaming.md) | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Stream GitLab audit events to a HTTP endpoint or third party service, such as AWS S3 or GCP Logging. |
+| [Audit event streaming](audit_event_streaming.md) | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Stream GitLab audit events to an HTTP endpoint or third party service, such as AWS S3 or GCP Logging. |
 | [Auditor users](../auditor_users.md)                        | {{< icon name="check-circle" >}} Yes | {{< icon name="dotted-circle" >}} No | {{< icon name="dotted-circle" >}} No | Auditor users are users who are given read-only access to all projects, groups, and other resources on the GitLab instance. |
 
 ## Policy management
diff --git a/doc/administration/dedicated/architecture.md b/doc/administration/dedicated/architecture.md
index 5d8cb899497..199a2e1ccf7 100644
--- a/doc/administration/dedicated/architecture.md
+++ b/doc/administration/dedicated/architecture.md
@@ -41,7 +41,7 @@ GitLab team members with edit access can update the [source](https://lucid.app/l
 
 ### Gitaly setup
 
-GitLab Dedicated deploys Gitaly [in a sharded setup](../gitaly/praefect/_index.md#before-deploying-gitaly-cluster-praefect), not a Gitaly Cluster. In this setup:
+GitLab Dedicated deploys Gitaly [in a sharded setup](../gitaly/praefect/_index.md#before-deploying-gitaly-cluster-praefect), not in a Gitaly Cluster (Praefect) configuration.
 
 - Customer repositories are spread across multiple virtual machines.
 - GitLab manages [storage weights](../repository_storage_paths.md#configure-where-new-repositories-are-stored) on behalf of the customer.
diff --git a/doc/administration/geo/_index.md b/doc/administration/geo/_index.md
index 83e4c6aaa9d..d19096136db 100644
--- a/doc/administration/geo/_index.md
+++ b/doc/administration/geo/_index.md
@@ -117,10 +117,10 @@ Geo replicates corruption on the primary site to all secondary sites. To protect
 
 Geo is designed to be an active-passive, high-availability solution. It operates an eventually consistent synchronization model which means that secondary sites are not tightly synchronized with the primary site. Secondary sites follow the primary with a small delay, which can result in a small amount of data loss after a disaster. Failover to a secondary site in the event of a disaster requires human intervention. However, large parts of the process of promoting a secondary site to become a primary is automated by the [GitLab Environment Toolkit (GET)](https://gitlab.com/gitlab-org/gitlab-environment-toolkit), provided you deploy all your sites using GET.
 
-## Gitaly Cluster
+## Gitaly Cluster (Praefect)
 
-Geo should not be confused with [Gitaly Cluster](../gitaly/praefect/_index.md). For more information about
-the difference between Geo and Gitaly Cluster, see [Comparison to Geo](../gitaly/praefect/_index.md#comparison-to-geo).
+Geo should not be confused with [Gitaly Cluster (Praefect)](../gitaly/praefect/_index.md). For more information about
+the difference between Geo and Gitaly Cluster (Praefect), see [Comparison to Geo](../gitaly/praefect/_index.md#comparison-to-geo).
 
 ## How Geo works
 
diff --git a/doc/administration/geo/disaster_recovery/background_verification.md b/doc/administration/geo/disaster_recovery/background_verification.md
index 323fa042b64..64046ba5b2a 100644
--- a/doc/administration/geo/disaster_recovery/background_verification.md
+++ b/doc/administration/geo/disaster_recovery/background_verification.md
@@ -96,7 +96,7 @@ If the **primary** and **secondary** sites have a checksum verification mismatch
    1. On the project administration page, get the values in the **Storage name** and **Relative path** fields.
 
 1. On a **Gitaly node on the primary** site and a **Gitaly node on the secondary** site, go to the project's repository
-   directory. If using Gitaly Cluster,
+   directory. If using Gitaly Cluster (Praefect),
    [check that it is in a healthy state](../../gitaly/praefect/troubleshooting.md#check-cluster-health) before
    running these commands.
 
diff --git a/doc/administration/geo/replication/security_review.md b/doc/administration/geo/replication/security_review.md
index e9551a3d78b..45905856791 100644
--- a/doc/administration/geo/replication/security_review.md
+++ b/doc/administration/geo/replication/security_review.md
@@ -60,7 +60,7 @@ from [owasp.org](https://owasp.org/).
 ### How do the end-users interact with the application?
 
 - **Secondary** sites provide all the interfaces a **primary** site does
-  (notably a HTTP/HTTPS web application, and HTTP/HTTPS or SSH Git repository
+  (notably an HTTP/HTTPS web application, and HTTP/HTTPS or SSH Git repository
   access), but is constrained to read-only activities. The principal use case is
   envisioned to be cloning Git repositories from the **secondary** site in favor of the
   **primary** site, but end-users may use the GitLab web interface to view information like projects,
diff --git a/doc/administration/geo/replication/troubleshooting/synchronization_verification.md b/doc/administration/geo/replication/troubleshooting/synchronization_verification.md
index 12b6c4e9c24..c86f3a31990 100644
--- a/doc/administration/geo/replication/troubleshooting/synchronization_verification.md
+++ b/doc/administration/geo/replication/troubleshooting/synchronization_verification.md
@@ -904,7 +904,7 @@ to start again from scratch, there are a few steps that can help you:
    gitlab-ctl tail sidekiq
    ```
 
-1. Clear Gitaly/Gitaly Cluster data.
+1. Clear Gitaly and Gitaly Cluster (Praefect) data.
 
    {{< tabs >}}
 
@@ -917,7 +917,7 @@ to start again from scratch, there are a few steps that can help you:
 
    {{< /tab >}}
 
-   {{< tab title="Gitaly Cluster" >}}
+   {{< tab title="Gitaly Cluster (Praefect)" >}}
 
    1. Optional. Disable the Praefect internal load balancer.
    1. Stop Praefect on each Praefect server:
diff --git a/doc/administration/geo/replication/upgrading_the_geo_sites.md b/doc/administration/geo/replication/upgrading_the_geo_sites.md
index 53dbfba779f..74d25e2f250 100644
--- a/doc/administration/geo/replication/upgrading_the_geo_sites.md
+++ b/doc/administration/geo/replication/upgrading_the_geo_sites.md
@@ -26,9 +26,10 @@ This may result in a larger than expected downtime.
 Upgrading Geo sites involves performing:
 
 1. Version-specific upgrade steps, depending on the version being upgraded to or from:
-   - [GitLab 17 changes](../../../update/versions/gitlab_17_changes.md)
-   - [GitLab 16 changes](../../../update/versions/gitlab_16_changes.md)
-   - [GitLab 15 changes](../../../update/versions/gitlab_15_changes.md)
+   - [GitLab 18 upgrade notes](../../../update/versions/gitlab_18_changes.md)
+   - [GitLab 17 upgrade notes](../../../update/versions/gitlab_17_changes.md)
+   - [GitLab 16 upgrade notes](../../../update/versions/gitlab_16_changes.md)
+   - [GitLab 15 upgrade notes](../../../update/versions/gitlab_15_changes.md)
 1. [General upgrade steps](#general-upgrade-steps), for all upgrades.
 
 ## General upgrade steps
@@ -48,7 +49,7 @@ and all **secondary** sites:
 1. SSH into each node of the **primary** site.
 1. [Upgrade GitLab on the **primary** site](../../../update/package/_index.md#by-using-the-official-repositories-recommended).
 1. Perform testing on the **primary** site, particularly if you paused replication in step 1 to protect DR.
-   [There are some suggestions for post-upgrade testing](../../../update/_index.md#pre-upgrade-and-post-upgrade-checks) in the upgrade documentation.
+   For more information about post-upgrade testing, see [pre-upgrade and post-upgrade checks](../../../update/upgrade.md#pre-upgrade-and-post-upgrade-checks).
 1. Ensure that the secrets in the `/etc/gitlab/gitlab-secrets.json` file of both the primary site and the secondary site are the same. The file must be the same on all of a site's nodes.
 1. SSH into each node of **secondary** sites.
 1. [Upgrade GitLab on each **secondary** site](../../../update/package/_index.md#by-using-the-official-repositories-recommended).
diff --git a/doc/administration/gitaly/praefect/_index.md b/doc/administration/gitaly/praefect/_index.md
index 85b5f29687b..458292df0fd 100644
--- a/doc/administration/gitaly/praefect/_index.md
+++ b/doc/administration/gitaly/praefect/_index.md
@@ -162,7 +162,7 @@ These atomicity issues have caused multiple problems in the past with:
 - Backup restoration.
 - Repository moves between repository storages.
 
-Gitaly Cluster provides atomicity for these operations by storing repositories on the disk in a special layout that prevents
+Gitaly Cluster (Praefect) provides atomicity for these operations by storing repositories on the disk in a special layout that prevents
 conflicts that could occur due to partially applied operations.
 
 ### Client-generated replica paths
@@ -332,8 +332,8 @@ Strong consistency is the primary replication method. A subset of operations sti
 (eventual consistency) instead of strong consistency. Refer to the
 [strong consistency epic](https://gitlab.com/groups/gitlab-org/-/epics/1189) for more information.
 
-If strong consistency is unavailable, Gitaly Cluster (Praefect) guarantees eventual consistency. In this case. Gitaly Cluster
-(Praefect) replicates all writes to secondary Gitaly nodes after the write to the primary Gitaly node has occurred.
+If strong consistency is unavailable, Gitaly Cluster (Praefect) guarantees eventual consistency. In this case,
+Gitaly Cluster (Praefect) replicates all writes to secondary Gitaly nodes after the write to the primary Gitaly node has occurred.
 
 For more information on monitoring strong consistency, see
 [Monitoring Gitaly Cluster (Praefect)](monitoring.md).
@@ -353,7 +353,7 @@ For configuration information, see [Configure replication factor](configure.md#c
 
 ## Upgrade Gitaly Cluster (Praefect)
 
-To upgrade a Gitaly Cluster, follow the documentation for
+To upgrade a Gitaly Cluster (Praefect), follow the documentation for
 [zero-downtime upgrades](../../../update/zero_downtime.md).
 
 ## Downgrade Gitaly Cluster (Praefect) to a previous version
@@ -449,7 +449,7 @@ Contact your Customer Success Manager or customer support if you have any questi
 
 ### Known issues
 
-The following table outlines current known issues impacting the use of Gitaly Cluster. For
+The following table outlines current known issues impacting the use of Gitaly Cluster (Praefect). For
 the current status of these issues, refer to the referenced issues and epics.
 
 | Issue                                                                                                 | Summary                                                                                                                                                                                                                                    | How to avoid                                                                                                                                                                                                                                                                                                                                                                                                               |
diff --git a/doc/administration/gitaly/praefect/recovery.md b/doc/administration/gitaly/praefect/recovery.md
index 1c4d8d98794..dd9ec5b28b9 100644
--- a/doc/administration/gitaly/praefect/recovery.md
+++ b/doc/administration/gitaly/praefect/recovery.md
@@ -51,13 +51,11 @@ To use the same name for the replacement node, use [repository verifier](configu
 
 #### With a node with a different name
 
-The steps use a different name for the replacement node for a Gitaly Cluster depend on if a [replication factor](configure.md#configure-replication-factor)
-is set.
+The steps to replace a node with a node with a different name for Gitaly Cluster (Praefect) depend on if a
+[replication factor](configure.md#configure-replication-factor) is set.
 
-##### Replication factor set
-
-If a custom replication factor is set, use [`praefect set-replication-factor`](configure.md#configure-replication-factor) to set the replication factor per repository again to get
-new storage assigned.
+If a custom replication factor is set, use [`praefect set-replication-factor`](configure.md#configure-replication-factor)
+to set the replication factor per repository again to get new storage assigned.
 
 For example, if two nodes in the virtual storage have a replication factor of 2 and a new node (`gitaly-3`) is added, you should increase the replication
 factor to 3:
@@ -70,8 +68,8 @@ current assignments: gitaly-1, gitaly-2, gitaly-3
 
 This ensures that the repository is replicated to the new node and the `repository_assignments` table gets updated with the name of new Gitaly node.
 
-If the [default replication factor](configure.md#configure-replication-factor) is set, new nodes are not automatically included in replication.
-You must follow the steps described previously.
+If the [default replication factor](configure.md#configure-replication-factor) is set, new nodes are not
+automatically included in replication. You must follow the steps described previously.
 
 After you [verify](#check-for-data-loss) that repository is successfully replicated to the new node:
 
@@ -104,8 +102,8 @@ This would trigger appropriate replication jobs to bring the system back into th
 
 ## Primary node failure
 
-Gitaly Cluster recovers from a failing primary Gitaly node by promoting a healthy secondary as the new primary. Gitaly
-Cluster:
+Gitaly Cluster (Praefect) recovers from a failing primary Gitaly node by promoting a healthy secondary as the new primary.
+Gitaly Cluster (Praefect):
 
 - Elects a healthy secondary with a fully up to date copy of the repository as the new primary.
 - If no fully up to date secondary is available, elects the secondary with the least unreplicated writes from the primary as the new primary.
@@ -473,7 +471,7 @@ sudo -u git -- /opt/gitlab/embedded/bin/praefect -config /var/opt/gitlab/praefec
   @hashed/f5/ca/f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b.git
   ```
 
-- `-replica-path` is the relative path on physical storage. Can start with [`@cluster` or match `relative_path`](../../repository_storage_paths.md#gitaly-cluster-storage).
+- `-replica-path` is the relative path on physical storage. Can start with [`@cluster` or match `relative_path`](../../repository_storage_paths.md#gitaly-cluster-praefect-storage).
 - `-authoritative-storage` is the storage we want Praefect to treat as the primary. Required if
   [per-repository replication](configure.md#configure-replication-factor) is set as the replication strategy.
 - `-replicate-immediately` causes the command to replicate the repository to its secondaries immediately.
diff --git a/doc/administration/gitaly/troubleshooting.md b/doc/administration/gitaly/troubleshooting.md
index c90c412193a..8745016ae5f 100644
--- a/doc/administration/gitaly/troubleshooting.md
+++ b/doc/administration/gitaly/troubleshooting.md
@@ -261,7 +261,7 @@ When attempting `git push`, you can see:
 This combination of errors occurs when the GitLab server has been upgraded to GitLab 15.5 or later but Gitaly has not yet been upgraded.
 
 From GitLab 15.5, GitLab [authenticates with GitLab Shell using a JWT token instead of a shared secret](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/86148).
-You should follow the [recommendations on upgrading external Gitaly](../../update/_index.md#external-gitaly) and upgrade Gitaly before the GitLab
+You should follow the [recommendations on upgrading external Gitaly](../../update/upgrade.md#external-gitaly) and upgrade Gitaly before the GitLab
 server.
 
 ## Repository pushes fail with a `deny updating a hidden ref` error
diff --git a/doc/administration/housekeeping.md b/doc/administration/housekeeping.md
index 1bf04af7cec..86f62f37c28 100644
--- a/doc/administration/housekeeping.md
+++ b/doc/administration/housekeeping.md
@@ -194,7 +194,7 @@ duration of 10 minutes.
 
 You can change this default in Gitaly configuration.
 
-For environments with Gitaly Cluster, the scheduled housekeeping start time can be
+For environments with Gitaly Cluster (Praefect), the scheduled housekeeping start time can be
 staggered across Gitaly nodes so the scheduled housekeeping is not running
 simultaneously on multiple nodes.
 
diff --git a/doc/administration/license.md b/doc/administration/license.md
index c49bdee890d..f1ec0d11f21 100644
--- a/doc/administration/license.md
+++ b/doc/administration/license.md
@@ -82,7 +82,7 @@ To verify the edition, sign in to GitLab and select
 at the top of the page.
 
 If you are running GitLab Community Edition (CE), you can upgrade your installation to GitLab
-EE. For more details, see [Upgrading between editions](../update/_index.md#upgrading-between-editions).
+EE. For more information, see [upgrading between editions](../update/upgrade.md#upgrading-between-editions).
 
 If you have questions or need assistance,
 [contact GitLab Support](https://about.gitlab.com/support/#contact-support).
diff --git a/doc/administration/object_storage.md b/doc/administration/object_storage.md
index 424abe094f2..a290c407e9c 100644
--- a/doc/administration/object_storage.md
+++ b/doc/administration/object_storage.md
@@ -802,7 +802,7 @@ gitlab_rails['object_store']['connection'] = {
 }
 ```
 
-The signature version must be `2`. Using v4 results in a HTTP 411 Length Required error.
+The signature version must be `2`. Using v4 results in an HTTP 411 Length Required error.
 For more information, see [issue #4419](https://gitlab.com/gitlab-org/gitlab/-/issues/4419).
 
 ### Hitachi Vantara HCP
diff --git a/doc/administration/operations/moving_repositories.md b/doc/administration/operations/moving_repositories.md
index ce28527a9a1..e25cff0d833 100644
--- a/doc/administration/operations/moving_repositories.md
+++ b/doc/administration/operations/moving_repositories.md
@@ -20,7 +20,7 @@ The GitLab API is the recommended way to move Git repositories:
 
 - Between servers.
 - Between different storages.
-- From single-node Gitaly to Gitaly Cluster.
+- From single-node Gitaly to Gitaly Cluster (Praefect).
 
 For more information, see:
 
@@ -32,7 +32,7 @@ For more information, see:
   querying and scheduling snippet repository moves.
 - [The API documentation](../../api/group_repository_storage_moves.md) details the endpoints for
   querying and scheduling group repository moves.
-- [Migrate to Gitaly Cluster](../gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect).
+- [Migrate to Gitaly Cluster (Praefect)](../gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect).
 
 ### Moving Repositories
 
@@ -190,7 +190,7 @@ Each of the approaches we list can or does overwrite data in the target director
 
 ### Recommended approach in all cases
 
-For either Gitaly or Gitaly Cluster targets, the GitLab [backup and restore capability](../backup_restore/_index.md)
+For either Gitaly or Gitaly Cluster (Praefect) targets, the GitLab [backup and restore capability](../backup_restore/_index.md)
 should be used. Git repositories are accessed, managed, and stored on GitLab servers by Gitaly as a database. Data loss
 can result from directly accessing and copying Gitaly files using tools like `rsync`.
 
@@ -199,13 +199,13 @@ can result from directly accessing and copying Gitaly files using tools like `rs
 - Backups can be created of just the repositories using the
   [skip feature](../backup_restore/backup_gitlab.md#excluding-specific-data-from-the-backup).
 
-No other method works for Gitaly Cluster targets.
+No other method works for Gitaly Cluster (Praefect) targets.
 
 ### Target directory is empty: use a `tar` pipe
 
-For Gitaly targets (use [recommended approach](#recommended-approach-in-all-cases) for Gitaly Cluster targets), if the
-target directory `/mnt/gitlab/repositories` is empty the simplest thing to do is to use a `tar` pipe. This method has
-low overhead and `tar` is almost always already installed on your system.
+For Gitaly targets, if the target directory `/mnt/gitlab/repositories` is empty, use a `tar` pipe. This method has low overhead and `tar` is usually pre-installed on your system.
+
+For Gitaly Cluster (Praefect) targets, use the [recommended approach](#recommended-approach-in-all-cases) instead.
 
 However, it is not possible to resume an interrupted `tar` pipe; if that happens then all data must be copied again.
 
@@ -218,9 +218,9 @@ If you want to see progress, replace `-xf` with `-xvf`.
 
 #### `tar` pipe to another server
 
-For Gitaly targets (use [recommended approach](#recommended-approach-in-all-cases) for Gitaly Cluster targets), you can
-also use a `tar` pipe to copy data to another server. If your `git` user has SSH access to the new server as
-`git@newserver`, you can pipe the data through SSH.
+For Gitaly targets, you can use a `tar` pipe to copy data to another server. If your `git` user has SSH access to the new server as `git@newserver`, you can pipe the data through SSH.
+
+For Gitaly Cluster (Praefect) targets, use the [recommended approach](#recommended-approach-in-all-cases).
 
 ```shell
 sudo -u git sh -c 'tar -C /var/opt/gitlab/git-data/repositories -cf - -- . |\
@@ -239,9 +239,9 @@ Using `rsync` to migrate Git data can cause data loss and repository corruption.
 
 {{< /alert >}}
 
-If the target directory already contains a partial or outdated copy of the repositories it may be wasteful to copy all
-the data again with `tar`. In this scenario it is better to use `rsync` for Gitaly targets (use
-[recommended approach](#recommended-approach-in-all-cases) for Gitaly Cluster targets).
+If the target directory already contains a partial or outdated copy of the repositories, copying all the data again with `tar` is inefficient. For Gitaly targets, use `rsync` instead.
+
+For Gitaly Cluster (Praefect) targets, use the [recommended approach](#recommended-approach-in-all-cases).
 
 This utility is either already installed on your system, or installable using `apt` or `yum`.
 
@@ -263,9 +263,9 @@ Using `rsync` to migrate Git data can cause data loss and repository corruption.
 
 {{< /alert >}}
 
-For Gitaly targets (use [recommended approach](#recommended-approach-in-all-cases) for Gitaly Cluster targets), if the
-`git` user on your source system has SSH access to the target server you can send the repositories over the network with
-`rsync`.
+For Gitaly targets, you can send the repositories over the network with `rsync` if the `git` user on your source system has SSH access to the target server.
+
+For Gitaly Cluster (Praefect) targets, use the [recommended approach](#recommended-approach-in-all-cases).
 
 ```shell
 sudo -u git sh -c 'rsync -a --delete /var/opt/gitlab/git-data/repositories/. \
diff --git a/doc/administration/reference_architectures/_index.md b/doc/administration/reference_architectures/_index.md
index 572294e742f..61754e427ea 100644
--- a/doc/administration/reference_architectures/_index.md
+++ b/doc/administration/reference_architectures/_index.md
@@ -743,9 +743,8 @@ For more information, see the following documentation:
 
 ### Upgrades
 
-Upgrading a reference architecture environment is same as any other GitLab environment.
-The main [Upgrade GitLab](../../update/_index.md) section has detailed steps on how to approach this.
-[Zero-downtime upgrades](#zero-downtime-upgrades) are also available.
+Upgrading a reference architecture environment is the same as any other GitLab environment. For more information, see
+[upgrade GitLab](../../update/_index.md). [Zero-downtime upgrades](#zero-downtime-upgrades) are also available.
 
 {{< alert type="note" >}}
 
diff --git a/doc/administration/repository_storage_paths.md b/doc/administration/repository_storage_paths.md
index 3149141a580..a74b4ca4e9e 100644
--- a/doc/administration/repository_storage_paths.md
+++ b/doc/administration/repository_storage_paths.md
@@ -17,7 +17,7 @@ GitLab stores [repositories](../user/project/repository/_index.md) on repository
 storage is either:
 
 - Physical storage configured with a `gitaly_address` that points to a [Gitaly node](gitaly/_index.md).
-- [Virtual storage](gitaly/praefect/_index.md#virtual-storage) that stores repositories on a Gitaly Cluster.
+- [Virtual storage](gitaly/praefect/_index.md#virtual-storage) that stores repositories on a Gitaly Cluster (Praefect).
 
 {{< alert type="warning" >}}
 
@@ -30,7 +30,7 @@ access repositories through a physical or virtual storage.
 For more information on:
 
 - Configuring Gitaly, see [Configure Gitaly](gitaly/configure_gitaly.md).
-- Configuring Gitaly Cluster, see [Configure Gitaly Cluster](gitaly/praefect/_index.md).
+- Configuring Gitaly Cluster (Praefect), see [Configure Gitaly Cluster (Praefect)](gitaly/praefect/configure.md).
 
 ## Hashed storage
 
@@ -178,7 +178,7 @@ For example:
 "@groups/#{hash[0..1]}/#{hash[2..3]}/#{hash}.wiki.git"
 ```
 
-### Gitaly Cluster storage
+### Gitaly Cluster (Praefect) storage
 
 If Gitaly Cluster is used, Praefect manages storage locations. The internal path used by Praefect for the repository
 differs from the hashed path. For more information, see
@@ -325,4 +325,4 @@ See [the tracking issue](https://gitlab.com/gitlab-org/gitlab/-/issues/36175) fo
 ## Move repositories
 
 To move a repository to a different repository storage (for example, from `default` to `storage2`), use the
-same process as [migrating to Gitaly Cluster](gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect).
+same process as [migrating to Gitaly Cluster (Praefect)](gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect).
diff --git a/doc/administration/server_hooks.md b/doc/administration/server_hooks.md
index 1ac8badde8f..431d16d2d78 100644
--- a/doc/administration/server_hooks.md
+++ b/doc/administration/server_hooks.md
@@ -82,7 +82,7 @@ To set server hooks for a repository:
    - A path to a valid Gitaly configuration for the node is required to connect to the node and provided to the `--config` flag.
    - Custom hooks tarball must be passed via `stdin`. For example, `cat custom_hooks.tar | sudo -u git -- /opt/gitlab/embedded/bin/gitaly hooks set --storage <storage> --repository <relative path> --config <config path>`.
 1. If you are using Gitaly Cluster, you must run `hooks set` subcommand on all Gitaly nodes. For more information, see
-   [Server hooks on a Gitaly Cluster](#server-hooks-on-a-gitaly-cluster).
+   [Server hooks on a Gitaly Cluster (Praefect)](#server-hooks-on-a-gitaly-cluster-praefect).
 
 If you implemented the server hook code correctly, it should execute when the Git hook is next triggered.
 
@@ -114,8 +114,8 @@ To create server hooks for a repository:
    example, if the script is in Ruby the shebang is probably `#!/usr/bin/env ruby`.
 1. Ensure the hook file does not match the backup file
    pattern (`*~`).
-1. If you are using Gitaly Cluster, you must repeat this process on all Gitaly nodes. For more information, see
-   [Server hooks on a Gitaly Cluster](#server-hooks-on-a-gitaly-cluster).
+1. If you are using Gitaly Cluster (Praefect), you must repeat this process on all Gitaly nodes. For more information, see
+   [Server hooks on a Gitaly Cluster (Praefect)](#server-hooks-on-a-gitaly-cluster-praefect).
 
 If the server hook code is properly implemented, it should execute when the Git hook is next triggered.
 
@@ -123,21 +123,17 @@ If the server hook code is properly implemented, it should execute when the Git
 
 {{< /tabs >}}
 
-### Server hooks on a Gitaly Cluster
+### Server hooks on a Gitaly Cluster (Praefect)
 
-If you use [Gitaly Cluster](gitaly/_index.md), an individual repository may be replicated to multiple Gitaly storages in Praefect.
+If you use [Gitaly Cluster (Praefect)](gitaly/praefect/_index.md), an individual repository may be replicated to multiple Gitaly storages in Praefect.
 Consequentially, the hook scripts must be copied to every Gitaly node that has a replica of the repository.
 To accomplish this, follow the same steps for setting custom repository hooks for the applicable version and repeat for each storage.
 
-The location to copy the scripts to depends on where repositories are stored:
-
-- In GitLab 15.2 and earlier, Gitaly Cluster uses the [hashed storage path](repository_storage_paths.md#hashed-storage)
-  reported by the GitLab application.
-- In GitLab 15.3 and later, new repositories are created using
-  [Praefect-generated replica paths](gitaly/praefect/_index.md#praefect-generated-replica-paths),
-  which are not the hashed storage path. The replica path can be identified by
-  [querying the Praefect repository metadata](gitaly/praefect/troubleshooting.md#view-repository-metadata)
-  using `-relative-path` to specify the expected GitLab hashed storage path.
+The location to copy the scripts to depends on where repositories are stored. New repositories are created using
+[Praefect-generated replica paths](gitaly/praefect/_index.md#praefect-generated-replica-paths),
+which are not the hashed storage path. The replica path can be identified by
+[querying the Praefect repository metadata](gitaly/praefect/troubleshooting.md#view-repository-metadata)
+using `-relative-path` to specify the expected GitLab hashed storage path.
 
 ## Create global server hooks for all repositories
 
diff --git a/doc/administration/whats-new.md b/doc/administration/whats-new.md
index dea3e99c340..1d45d92acb1 100644
--- a/doc/administration/whats-new.md
+++ b/doc/administration/whats-new.md
@@ -3,6 +3,7 @@ stage: none
 group: unassigned
 info: For assistance with this What's new page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments-to-other-projects-and-subjects.
 title: What's new
+description: See highlights from previous GitLab releases.
 ---
 
 {{< details >}}
diff --git a/doc/api/deployments.md b/doc/api/deployments.md
index d4865ef73fa..190521d89c1 100644
--- a/doc/api/deployments.md
+++ b/doc/api/deployments.md
@@ -18,7 +18,7 @@ title: Deployments API
 
 {{< /history >}}
 
-Use this API to interact with [code deployments](../ci/environments/deployments.md) to GitLab enviroments.
+Use this API to interact with [code deployments](../ci/environments/deployments.md) to GitLab environments.
 
 ## List project deployments
 
diff --git a/doc/api/graphql/audit_event_streaming_instances.md b/doc/api/graphql/audit_event_streaming_instances.md
index 38a2f852c20..9a41479374d 100644
--- a/doc/api/graphql/audit_event_streaming_instances.md
+++ b/doc/api/graphql/audit_event_streaming_instances.md
@@ -140,7 +140,7 @@ You need the ID values returned by this query for the update and delete mutation
 
 ### Update streaming destinations
 
-Update a HTTP streaming destination for an instance.
+Update an HTTP streaming destination for an instance.
 
 Prerequisites:
 
diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md
index 08662934c45..bc32cc0a80f 100644
--- a/doc/api/graphql/reference/_index.md
+++ b/doc/api/graphql/reference/_index.md
@@ -13781,6 +13781,34 @@ Input type: `workItemsHierarchyReorderInput`
 | <a id="mutationworkitemshierarchyreorderparentworkitem"></a>`parentWorkItem` | [`WorkItem`](#workitem) | Work item's parent after mutation. |
 | <a id="mutationworkitemshierarchyreorderworkitem"></a>`workItem` | [`WorkItem`](#workitem) | Work item after mutation. |
 
+### `Mutation.workItemsReorder`
+
+{{< details >}}
+**Introduced** in GitLab 18.3.
+**Status**: Experiment.
+{{< /details >}}
+
+Reorders a project level work item.
+
+Input type: `workItemsReorderInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationworkitemsreorderclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationworkitemsreorderid"></a>`id` | [`WorkItemID!`](#workitemid) | Global ID of the work item to be reordered. |
+| <a id="mutationworkitemsreordermoveafterid"></a>`moveAfterId` | [`WorkItemID`](#workitemid) | Global ID of a project’s work item that should be placed after the work item. |
+| <a id="mutationworkitemsreordermovebeforeid"></a>`moveBeforeId` | [`WorkItemID`](#workitemid) | Global ID of a project’s work item that should be placed before the work item. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationworkitemsreorderclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationworkitemsreordererrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during the mutation. |
+| <a id="mutationworkitemsreorderworkitem"></a>`workItem` | [`WorkItem`](#workitem) | Work item after mutation. |
+
 ### `Mutation.workspaceCreate`
 
 Input type: `WorkspaceCreateInput`
diff --git a/doc/api/group_repository_storage_moves.md b/doc/api/group_repository_storage_moves.md
index d3f974233de..80d4cceb857 100644
--- a/doc/api/group_repository_storage_moves.md
+++ b/doc/api/group_repository_storage_moves.md
@@ -14,7 +14,7 @@ title: Group repository storage moves API
 {{< /details >}}
 
 Group wiki repositories can be moved between storages. This API can help you, for example,
-[migrate to Gitaly Cluster](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect)
+[migrate to Gitaly Cluster (Praefect)](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect)
 or migrate a [group wiki](../user/project/wiki/group.md). This API does not manage
 project repositories in a group. To schedule project moves, use the
 [project repository storage moves API](project_repository_storage_moves.md).
diff --git a/doc/api/oauth2.md b/doc/api/oauth2.md
index 86517649a8f..7f76f29a813 100644
--- a/doc/api/oauth2.md
+++ b/doc/api/oauth2.md
@@ -114,7 +114,7 @@ Before starting the flow, generate the `STATE`, the `CODE_VERIFIER` and the `COD
   state between the request and callback. It should also be used as a CSRF token.
 - The `CODE_VERIFIER` is a random string, between 43 and 128 characters in length,
   which use the characters `A-Z`, `a-z`, `0-9`, `-`, `.`, `_`, and `~`.
-- The `CODE_CHALLENGE` is an URL-safe base64-encoded string of the SHA256 hash of the
+- The `CODE_CHALLENGE` is a URL-safe base64-encoded string of the SHA256 hash of the
   `CODE_VERIFIER`:
   - The SHA256 hash must be in binary format before encoding.
   - In Ruby, you can set that up with `Base64.urlsafe_encode64(Digest::SHA256.digest(CODE_VERIFIER), padding: false)`.
diff --git a/doc/api/project_repository_storage_moves.md b/doc/api/project_repository_storage_moves.md
index 1a2cce10f80..37946512b1e 100644
--- a/doc/api/project_repository_storage_moves.md
+++ b/doc/api/project_repository_storage_moves.md
@@ -13,7 +13,7 @@ title: Project repository storage moves API
 {{< /details >}}
 
 Project repositories including wiki and design repositories can be moved between storages. This API can help you when
-[migrating to Gitaly Cluster](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect), for example.
+[migrating to Gitaly Cluster (Praefect)](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect), for example.
 
 As project repository storage moves are processed, they transition through different states. Values
 of `state` are:
diff --git a/doc/api/projects.md b/doc/api/projects.md
index 94d84f1460b..fbb9c4ad751 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -2613,8 +2613,7 @@ Supported attributes:
 
 ## Get the path to repository storage
 
-Get the path to repository storage for specified project if Gitaly Cluster is not being used. If Gitaly Cluster is being used, see
-[Praefect-generated replica paths](../administration/gitaly/praefect/_index.md#praefect-generated-replica-paths).
+Get the path to repository storage for the specified project. If you're using Gitaly Cluster (Praefect), see [Praefect-generated replica paths](../administration/gitaly/praefect/_index.md#praefect-generated-replica-paths) instead.
 
 Available for administrators only.
 
diff --git a/doc/api/remote_mirrors.md b/doc/api/remote_mirrors.md
index 2f56b8f2fb1..e4a776fc3eb 100644
--- a/doc/api/remote_mirrors.md
+++ b/doc/api/remote_mirrors.md
@@ -279,7 +279,7 @@ curl --request POST \
 
 Example response:
 
-An empty response with a HTTP response code 204.
+An empty response with an HTTP response code 204.
 
 ## Delete a remote mirror
 
diff --git a/doc/api/snippet_repository_storage_moves.md b/doc/api/snippet_repository_storage_moves.md
index 358793edfee..b9ba4e0b75d 100644
--- a/doc/api/snippet_repository_storage_moves.md
+++ b/doc/api/snippet_repository_storage_moves.md
@@ -13,7 +13,7 @@ title: Snippet repository storage moves API
 {{< /details >}}
 
 Snippet repositories can be moved between storages. This API can help you when
-[migrating to Gitaly Cluster](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect), for
+[migrating to Gitaly Cluster (Praefect)](../administration/gitaly/praefect/_index.md#migrate-to-gitaly-cluster-praefect), for
 example.
 
 As snippet repository storage moves are processed, they transition through different states. Values
diff --git a/doc/ci/steps/_index.md b/doc/ci/steps/_index.md
index 969a9e70239..4a6cc7616f4 100644
--- a/doc/ci/steps/_index.md
+++ b/doc/ci/steps/_index.md
@@ -27,7 +27,7 @@ for full details on any breaking changes.
 
 {{< alert type="note" >}}
 
-In GitLab Runner 17.11 and later, when you use the Docker executor, GitLab Runner injects the 
+In GitLab Runner 17.11 and later, when you use the Docker executor, GitLab Runner injects the
 step-runner binary into the build container. For all other executors, ensure that the step-runner
 binary is in the execution environment. Support for the legacy Docker image
 `registry.gitlab.com/gitlab-org/step-runner:v0`, maintained by the step runner team,
@@ -629,7 +629,7 @@ In this example, the CI/CD component hides the complexity of the steps from the
 
 ## Troubleshooting
 
-### Fetching steps from a HTTPS URL
+### Fetching steps from an HTTPS URL
 
 An error message such as `tls: failed to verify certificate: x509: certificate signed by unknown authority` indicates
 that the operating system does not recognize or trust the server hosting the step.
diff --git a/doc/development/avoiding_required_stops.md b/doc/development/avoiding_required_stops.md
index 43d64fa944c..cf70fdeffea 100644
--- a/doc/development/avoiding_required_stops.md
+++ b/doc/development/avoiding_required_stops.md
@@ -202,7 +202,7 @@ it might affect one of the following projects:
 ## Further reading
 
 - [Documentation: Database required stops](database/required_stops.md)
-- [Documentation: Upgrading GitLab](../update/_index.md)
+- [Documentation: Upgrade GitLab](../update/_index.md)
   - [Package (Omnibus) upgrade](../update/package/_index.md)
   - [Docker upgrade](../install/docker/upgrade.md)
   - [GitLab chart](https://docs.gitlab.com/charts/installation/upgrade.html)
diff --git a/doc/development/backend/create_source_code_be/gitaly_touch_points.md b/doc/development/backend/create_source_code_be/gitaly_touch_points.md
index 0fe4170e4df..6d0b643b0d5 100644
--- a/doc/development/backend/create_source_code_be/gitaly_touch_points.md
+++ b/doc/development/backend/create_source_code_be/gitaly_touch_points.md
@@ -7,7 +7,7 @@ title: Source Code - Gitaly Touch Points
 
 ## RPCs
 
-Gitaly is a wrapper around the `git` binary, running in a [Gitaly Cluster](../../../administration/gitaly/_index.md). It provides managed access to the file system housing the `git` repositories, using Go Remote Procedure Calls (RPCs). Other functions are access optimization, caching, and a form of pagination against the file system.
+Gitaly is a wrapper around the `git` binary. It provides managed access to the file system housing the `git` repositories, using Go Remote Procedure Calls (RPCs). Other functions are access optimization, caching, and a form of pagination against the file system.
 
 The [Beginner's guide to Gitaly contributions](https://gitlab.com/gitlab-org/gitaly/-/blob/master/doc/beginners_guide.md) is focused on making updates to Gitaly, and offers many insights into how to understand the Gitaly code.
 
diff --git a/doc/development/documentation/redirects.md b/doc/development/documentation/redirects.md
index 152b98fb513..fee2ab9a7d2 100644
--- a/doc/development/documentation/redirects.md
+++ b/doc/development/documentation/redirects.md
@@ -44,7 +44,7 @@ There are two types of redirects:
   contributors and expire after nine months. Redirects pointing to external sites
   are not added to the GitLab Pages redirects.
 
-Expired redirect files are removed from the documentation projects as part of the Technical Writing team's [monthly tasks](https://gitlab.com/gitlab-org/technical-writing/-/blob/main/.gitlab/issue_templates/tw-monthly-tasks.md).
+Expired redirect files are removed from the documentation projects as part of the Technical Writing team's [monthly tasks](https://gitlab.com/gitlab-org/technical-writing/team-tasks/-/blob/main/.gitlab/issue_templates/tw-monthly-tasks.md).
 
 ## Redirect to a page that already exists
 
diff --git a/doc/development/fe_guide/dashboard_layout_framework.md b/doc/development/fe_guide/dashboard_layout_framework.md
index 494660aea05..cef3ef2f583 100644
--- a/doc/development/fe_guide/dashboard_layout_framework.md
+++ b/doc/development/fe_guide/dashboard_layout_framework.md
@@ -29,8 +29,6 @@ To render dashboard layouts it's recommended to use the [GlDashboardLayout](http
 component. It provides an easy way to render dashboards using
 a configuration which aligns with our [Pajamas guidelines](https://design.gitlab.com/patterns/dashboards/).
 
-Note that GlDashboardLayout supplants the deprecated `dashboard_layout.vue` component in the vue shared directory.
-
 ### Panel guidelines
 
 You are free to
@@ -51,7 +49,7 @@ and can keep existing visualizations. A typical migration path could look like t
 1. Create a new dashboard using GlDashboardLayout and `extended_dashboard_panel.vue`.
 1. Create a dashboard config object that mimics your old dashboard layout.
 1. Optionally, use GlDashboardLayout's slots to render your dashboard's
-filters, actions, or custom title or description.
+   filters, actions, or custom title or description.
 1. Ensure your new dashboard, panels, and visualizations render correctly.
 1. Remove the feature flag and your old dashboard.
 
@@ -62,4 +60,6 @@ for an example on how to render existing visualization components using the dash
 
 Real world implementations and migrations using the GlDashboardLayout component:
 
-- New security dashboard added in MR [!191974](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/191974)
+- New group security dashboard added in MR [!191974](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/191974)
+- New project security dashboard added in MR [!197626](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197626)
+- New compliance center added in MR [!195759](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/195759)
diff --git a/doc/development/fe_guide/icons.md b/doc/development/fe_guide/icons.md
index 7009faec665..539a1c60362 100644
--- a/doc/development/fe_guide/icons.md
+++ b/doc/development/fe_guide/icons.md
@@ -174,7 +174,7 @@ Component:
 ```html
 <script>
 import { GlEmptyState } from '@gitlab/ui';
-// The ?url query string ensures the SVG is imported as an URL instead of an inilne SVG
+// The ?url query string ensures the SVG is imported as a URL instead of an inline SVG
 // This is useful for bundle size and optimized loading
 import mergeTrainsSvgPath from '@gitlab/svgs/dist/illustrations/train-sm.svg?url';
 
diff --git a/doc/development/multi_version_compatibility.md b/doc/development/multi_version_compatibility.md
index b1fa4bc7ae9..02531b1bdbd 100644
--- a/doc/development/multi_version_compatibility.md
+++ b/doc/development/multi_version_compatibility.md
@@ -51,7 +51,7 @@ Is it ok that some nodes have the new Rails version, but some nodes have the old
 Backward compatibility problems during updates are often very subtle. This is why it is worth
 familiarizing yourself with:
 
-- [Update instructions](../update/_index.md)
+- [Upgrade instructions](../update/_index.md)
 - [Reference architectures](../administration/reference_architectures/_index.md)
 - [GitLab.com's architecture](https://handbook.gitlab.com/handbook/engineering/infrastructure/production/architecture/)
 - [GitLab.com's upgrade pipeline](https://gitlab.com/gitlab-org/release/docs/blob/master/general/deploy/gitlab-com-deployer.md#upgrade-pipeline-default)
diff --git a/doc/development/testing_guide/end_to_end/running_tests/running_tests_that_require_special_setup.md b/doc/development/testing_guide/end_to_end/running_tests/running_tests_that_require_special_setup.md
index aca0adc4138..4dcfb39d365 100644
--- a/doc/development/testing_guide/end_to_end/running_tests/running_tests_that_require_special_setup.md
+++ b/doc/development/testing_guide/end_to_end/running_tests/running_tests_that_require_special_setup.md
@@ -54,7 +54,7 @@ If you need to run Jenkins manually outside of the tests, refer to the README fo
 If Jenkins Docker container exits without providing any information in the logs, try increasing the memory used by
 the Docker Engine.
 
-## Gitaly Cluster tests
+## Gitaly Cluster (Praefect) tests
 
 The tests tagged `:gitaly_ha` are orchestrated tests that can only be run against a set of Docker containers as configured and started by [the `Test::Integration::GitalyCluster` GitLab QA scenario](https://gitlab.com/gitlab-org/gitlab-qa/-/blob/master/docs/what_tests_can_be_run.md#testintegrationgitalycluster-ceeefull-image-address).
 
diff --git a/doc/development/workhorse/channel.md b/doc/development/workhorse/channel.md
index aa0489487e7..a2588b1cd02 100644
--- a/doc/development/workhorse/channel.md
+++ b/doc/development/workhorse/channel.md
@@ -39,7 +39,7 @@ At this point, the connection is still HTTP, so this is a request.
 The server can send a standard HTTP response, such as `404 Not Found` or
 `500 Internal Server Error`.
 
-If the server decides to permit the upgrade, it sends a HTTP
+If the server decides to permit the upgrade, it sends an HTTP
 `101 Switching Protocols` response. From this point, the connection is no longer
 HTTP. It is now a WebSocket and frames, not HTTP requests, flow over it. The connection
 persists until the client or server closes the connection.
@@ -142,7 +142,7 @@ remote end.
 
 Before upgrading the browser's connection to a websocket, Workhorse:
 
-1. Opens a HTTP client connection, according to the details given to it by Workhorse.
+1. Opens an HTTP client connection, according to the details given to it by Workhorse.
 1. Attempts to upgrade that connection to a websocket.
    - If it fails, an error response is sent to the browser.
    - If it succeeds, the browser is also upgraded.
diff --git a/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md b/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
index 8516e55c825..0ea7e6e0d2a 100644
--- a/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
+++ b/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
@@ -25,7 +25,7 @@ To enable debug logs in JetBrains:
 1. Select **OK** or **Save**.
 
 If you experience [certificate errors](#certificate-errors) or other connection errors, and
-use a HTTP proxy to connect to your GitLab instance, you must
+use an HTTP proxy to connect to your GitLab instance, you must
 [configure the Language Server to use a proxy](../language_server/_index.md#configure-the-language-server-to-use-a-proxy)
 for the GitLab Language Server.
 
diff --git a/doc/install/aws/_index.md b/doc/install/aws/_index.md
index d893bd66d7a..f8c96762745 100644
--- a/doc/install/aws/_index.md
+++ b/doc/install/aws/_index.md
@@ -30,13 +30,13 @@ It's highly recommended to use the [GitLab Environment Toolkit (GET)](https://gi
 
 {{< /alert >}}
 
-Following this guide exactly results in a proof of concept instance that roughly equates to a **scaled down** version of a **two availability zone implementation** of the **Non-HA** [40 RPS or 2,000 User Reference Architecture](../../administration/reference_architectures/2k_users.md). The 2K reference architecture is not HA because it is primarily intended to provide some scaling while keeping costs and complexity low. The [60 RPS or 3,000 User Reference Architecture](../../administration/reference_architectures/3k_users.md) is the smallest size that is GitLab HA. It has additional service roles to achieve HA, most notably it uses Gitaly Cluster to achieve HA for Git repository storage and specifies triple redundancy.
+Following this guide exactly results in a proof of concept instance that roughly equates to a **scaled down** version of a **two availability zone implementation** of the **Non-HA** [40 RPS or 2,000 User Reference Architecture](../../administration/reference_architectures/2k_users.md). The 2K reference architecture is not HA because it is primarily intended to provide some scaling while keeping costs and complexity low. The [60 RPS or 3,000 User Reference Architecture](../../administration/reference_architectures/3k_users.md) is the smallest size that is GitLab HA. It has additional service roles to achieve HA, most notably it uses Gitaly Cluster (Praefect) to achieve HA for Git repository storage and specifies triple redundancy.
 
 GitLab maintains and tests two main types of Reference Architectures. The **Linux package architectures** are implemented on instance compute while **Cloud Native Hybrid architectures** maximize the use of a Kubernetes cluster. Cloud Native Hybrid reference architecture specifications are addendum sections to the Reference Architecture size pages that start by describing the Linux package architecture. For example, the 60 RPS or 3,000 User Cloud Native Reference Architecture is in the subsection titled [Cloud Native Hybrid reference architecture with Helm Charts (alternative)](../../administration/reference_architectures/3k_users.md#cloud-native-hybrid-reference-architecture-with-helm-charts-alternative) in the 60 RPS or 3,000 User Reference Architecture page.
 
 ### Getting started for production-grade Linux package installations
 
-The Infrastructure as Code tooling [GitLab Environment Tool (GET)](https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/tree/main) is the best place to start for building using the Linux package on AWS and most especially if you are targeting an HA setup. While it does not automate everything, it does complete complex setups like Gitaly Cluster for you. GET is open source so anyone can build on top of it and contribute improvements to it.
+The Infrastructure as Code tooling [GitLab Environment Tool (GET)](https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/tree/main) is the best place to start for building using the Linux package on AWS and most especially if you are targeting an HA setup. While it does not automate everything, it does complete complex setups like Gitaly Cluster (Praefect) for you. GET is open source so anyone can build on top of it and contribute improvements to it.
 
 ### Getting started for production-grade Cloud Native Hybrid GitLab
 
@@ -640,7 +640,7 @@ gitlab=# \q
 {{< alert type="warning" >}}
 
 In this architecture, having a single Gitaly server creates a single point of failure. Use
-[Gitaly Cluster](../../administration/gitaly/praefect/_index.md) to remove this limitation.
+[Gitaly Cluster (Praefect)](../../administration/gitaly/praefect/_index.md) to remove this limitation.
 
 {{< /alert >}}
 
diff --git a/doc/install/requirements.md b/doc/install/requirements.md
index 89bdc7e2a16..6f1f4fedc0c 100644
--- a/doc/install/requirements.md
+++ b/doc/install/requirements.md
@@ -107,7 +107,7 @@ For more information, see [upgrading operating systems for PostgreSQL](../admini
 ### GitLab schemas
 
 You should create or use databases exclusively for GitLab, [Geo](../administration/geo/_index.md),
-[Gitaly Cluster](../administration/gitaly/praefect/_index.md), or other components.
+[Gitaly Cluster (Praefect)](../administration/gitaly/praefect/_index.md), or other components.
 Do not create or modify databases, schemas, users, or other properties except when you follow:
 
 - Procedures in the GitLab documentation
diff --git a/doc/integration/sourcegraph.md b/doc/integration/sourcegraph.md
index 3f4711365ea..ba618cffd99 100644
--- a/doc/integration/sourcegraph.md
+++ b/doc/integration/sourcegraph.md
@@ -51,7 +51,7 @@ Prerequisites:
 
 - You must have a Sourcegraph instance [configured and running](https://sourcegraph.com/docs/admin)
   with your GitLab instance as an external service.
-- If your Sourcegraph instance uses a HTTPS connection to GitLab, you must
+- If your Sourcegraph instance uses an HTTPS connection to GitLab, you must
   [configure HTTPS](https://sourcegraph.com/docs/admin/http_https_configuration)
   for your Sourcegraph instance.
 
diff --git a/doc/operations/incident_management/manage_incidents.md b/doc/operations/incident_management/manage_incidents.md
index c9ffcbac283..faae13d87e3 100644
--- a/doc/operations/incident_management/manage_incidents.md
+++ b/doc/operations/incident_management/manage_incidents.md
@@ -271,7 +271,7 @@ You are then credited with the alert's status change.
 ### Automatically close incidents via recovery alerts
 
 Turn on closing an incident automatically when GitLab receives a recovery alert
-from a HTTP or Prometheus webhook.
+from an HTTP or Prometheus webhook.
 
 Prerequisites:
 
diff --git a/doc/policy/maintenance.md b/doc/policy/maintenance.md
index 22818dc8b6a..7a30ba5fa04 100644
--- a/doc/policy/maintenance.md
+++ b/doc/policy/maintenance.md
@@ -3,6 +3,7 @@ stage: GitLab Delivery
 group: Self Managed
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: GitLab release and maintenance policy
+description: Version support, release cadence, and backporting polices.
 ---
 
 The Delivery Group are the owners of the maintenance policy and must approve any requested updates. This follows our DRI model and is in place to ensure predictability for customers.
diff --git a/doc/solutions/cloud/aws/_index.md b/doc/solutions/cloud/aws/_index.md
index a9403af6763..7c4179972e1 100644
--- a/doc/solutions/cloud/aws/_index.md
+++ b/doc/solutions/cloud/aws/_index.md
@@ -20,7 +20,7 @@ Testing-backed architectural qualification is a fundamental concept behind Cloud
 - Cloud solution implementations maintain GitLab Reference Architecture compliance and provide [GitLab Performance Tool](https://gitlab.com/gitlab-org/quality/performance) (GPT) reports to demonstrate adherence to them.
 - Cloud solution implementations may be qualified by and/or contributed to by the technology vendor. For instance, an implementation pattern for AWS may be officially reviewed by AWS.
 - Cloud solution implementations may specify and test Cloud Platform PaaS services for suitability for GitLab. This testing can be coordinated and help qualify these technologies for Reference Architectures. For instance, qualifying compatibility with and availability of runtime versions of top level PaaS such as those for PostgreSQL and Redis.
-- Cloud solution implementations can provided qualified testing for platform limitations, for example, ensuring Gitaly Cluster can work correctly on specific Cloud Platform availability zone latency and throughput characteristics or qualifying what levels of available platform partner local disk performance is workable for Gitaly server to operate with integrity.
+- Cloud solution implementations can provided qualified testing for platform limitations, for example, ensuring Gitaly Cluster (Praefect) can work correctly on specific Cloud Platform availability zone latency and throughput characteristics or qualifying what levels of available platform partner local disk performance is workable for Gitaly server to operate with integrity.
 
 ## AWS known issues list
 
diff --git a/doc/solutions/cloud/aws/gitaly_sre_for_aws.md b/doc/solutions/cloud/aws/gitaly_sre_for_aws.md
index aecce7e9c74..3afbe2ea10e 100644
--- a/doc/solutions/cloud/aws/gitaly_sre_for_aws.md
+++ b/doc/solutions/cloud/aws/gitaly_sre_for_aws.md
@@ -15,7 +15,7 @@ title: SRE Considerations for Gitaly on AWS
 
 ## Gitaly SRE considerations
 
-Gitaly is an embedded service for Git Repository Storage. Gitaly and Gitaly Cluster have been engineered by GitLab to overcome fundamental challenges with horizontal scaling of the open source Git binaries that must be used on the service side of GitLab. Here is in-depth technical reading on the topic:
+Gitaly is an embedded service for Git Repository Storage. Gitaly and Gitaly Cluster (Praefect) have been engineered by GitLab to overcome fundamental challenges with horizontal scaling of the open source Git binaries that must be used on the service side of GitLab. Here is in-depth technical reading on the topic:
 
 ### Why Gitaly was built
 
diff --git a/doc/solutions/cloud/aws/gitlab_instance_on_aws.md b/doc/solutions/cloud/aws/gitlab_instance_on_aws.md
index 33817f5824a..551a2cc9fcf 100644
--- a/doc/solutions/cloud/aws/gitlab_instance_on_aws.md
+++ b/doc/solutions/cloud/aws/gitlab_instance_on_aws.md
@@ -15,7 +15,7 @@ You can use the GitLab Environment Toolkit to deploy a Cloud Native Hybrid envir
 
 While GitLab Reference Architectures generally encourage three zone redundancy, the AWS Well Architected framework consider two zone redundancy as AWS Well Architected. Individual implementations should weigh the costs of two and three zone configurations against their own high availability requirements for a final configuration.
 
-Gitaly Cluster uses a consistency voting system to implement strong consistency between synchronized nodes. Regardless of the number of availability zones implemented, there will always need to be a minimum of three Gitaly and three Praefect nodes in the cluster to avoid voting stalemates cause by an even number of nodes.
+Gitaly Cluster (Praefect) uses a consistency voting system to implement strong consistency between synchronized nodes. Regardless of the number of availability zones implemented, there will always need to be a minimum of three Gitaly and three Praefect nodes in the cluster to avoid voting stalemates cause by an even number of nodes.
 
 ## AWS PaaS qualified for all GitLab implementations
 
diff --git a/doc/topics/offline/quick_start_guide.md b/doc/topics/offline/quick_start_guide.md
index 42b6b4ff94b..10df1f257b1 100644
--- a/doc/topics/offline/quick_start_guide.md
+++ b/doc/topics/offline/quick_start_guide.md
@@ -225,7 +225,7 @@ for offline environments.
 
 ### Configure NTP
 
-Gitaly Cluster assumes `pool.ntp.org` is accessible. If `pool.ntp.org` is not accessible, [customize the time server setting](../../administration/gitaly/praefect/configure.md#customize-time-server-setting) on the Gitaly
+Gitaly Cluster (Praefect) assumes `pool.ntp.org` is accessible. If `pool.ntp.org` is not accessible, [customize the time server setting](../../administration/gitaly/praefect/configure.md#customize-time-server-setting) on the Gitaly
 and Praefect servers so they can use an accessible NTP server.
 
 On offline instances, the [GitLab Geo check Rake task](../../administration/geo/replication/troubleshooting/common.md#can-geo-detect-the-current-site-correctly)
diff --git a/doc/update/_index.md b/doc/update/_index.md
index 863cd39e97f..63e4d554aef 100644
--- a/doc/update/_index.md
+++ b/doc/update/_index.md
@@ -2,255 +2,18 @@
 stage: GitLab Delivery
 group: Self Managed
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+title: Upgrade GitLab
 description: Latest version instructions.
-title: Upgrading GitLab
 ---
 
-{{< details >}}
+Upgrade a GitLab installation to a later version.
 
-- Tier: Free, Premium, Ultimate
-- Offering: GitLab Self-Managed
+{{< cards >}}
 
-{{< /details >}}
+- [Before you upgrade](plan_your_upgrade.md)
+- [Upgrade a GitLab installation](upgrade.md)
+- [Releases and maintenance](../policy/maintenance.md)
+- [What's new](../administration/whats-new.md)
+- [Other upgrade paths](convert_to_ee/_index.md)
 
-Upgrading GitLab is a relatively straightforward process, but the complexity can increase based on:
-
-- The installation method you have used.
-- How old your GitLab version is.
-- If you're upgrading to a major version.
-
-If possible, you should test out the upgrade in a test environment before updating your production instance. Your test
-environment should mimic your production environment as closely as possible.
-
-Make sure to read the whole page as it contains information related to every upgrade method.
-
-## Upgrade GitLab
-
-To upgrade GitLab:
-
-1. Create an [upgrade plan](plan_your_upgrade.md) to document your upgrade steps.
-1. Familiarize yourself with the [maintenance policy documentation](../policy/maintenance.md) and the [currently maintained versions](../policy/maintenance.md#maintained-versions).
-1. Read the [release posts](https://about.gitlab.com/releases/categories/releases/) for versions you're passing over.
-   In particular, deprecations, removals, and important notes on upgrading.
-1. Using the [upgrade path tool](upgrade_paths.md#upgrade-path-tool), determine what [upgrade path](upgrade_paths.md) you should take.
-   If your upgrade path includes required upgrade stops, you might have to perform multiple
-   upgrades to move from your current version to your target version. If
-   relevant, check [OS compatibility with the target GitLab version](../administration/package_information/supported_os.md).
-1. Check for [background migrations](background_migrations.md). All migrations must finish running before each upgrade.
-   You must spread out upgrades between major and minor releases to allow time for background migrations to finish.
-1. Test your upgrade in a test environment first, and have a [rollback plan](plan_your_upgrade.md#rollback-plan)
-   to reduce the risk of unplanned outages and extended downtime.
-1. If available in your starting version, consider [turning on maintenance mode](../administration/maintenance_mode/_index.md)
-   during the upgrade.
-1. Consult changes for different versions of GitLab to ensure compatibility before upgrading:
-   - [GitLab 18 changes](versions/gitlab_18_changes.md)
-   - [GitLab 17 changes](versions/gitlab_17_changes.md)
-   - [GitLab 16 changes](versions/gitlab_16_changes.md)
-   - [GitLab 15 changes](versions/gitlab_15_changes.md)
-1. Perform [pre-upgrade checks](#pre-upgrade-and-post-upgrade-checks).
-1. Pause [running CI/CD pipelines and jobs](#cicd-pipelines-and-jobs-during-upgrades).
-1. If relevant, follow [upgrade steps for additional features](#upgrade-steps-for-additional-features):
-   - [Advanced search (Elasticsearch)](#elasticsearch).
-   - [Geo](#geo).
-   - [Gitaly running on its own server](#external-gitaly).
-   - [GitLab agent for Kubernetes](#gitlab-agent-for-kubernetes).
-1. Follow the [upgrade steps based on your installation method](#upgrade-based-on-installation-method).
-1. If your GitLab instance has any runners associated with it, upgrade them to match the current GitLab version.
-   This step ensures [compatibility with GitLab versions](https://docs.gitlab.com/runner/#gitlab-runner-versions).
-1. If you encounter problems with the upgrade, [get support](#getting-support).
-1. [Disable maintenance mode](../administration/maintenance_mode/_index.md#disable-maintenance-mode) if you had enabled
-   it.
-1. Unpause [running CI/CD pipelines and jobs](#cicd-pipelines-and-jobs-during-upgrades).
-1. Perform [post-upgrade checks](#pre-upgrade-and-post-upgrade-checks).
-
-## Upgrade based on installation method
-
-Depending on the installation method and your GitLab version, there are multiple
-official ways to upgrade GitLab:
-
-{{< tabs >}}
-
-{{< tab title="Linux packages (Omnibus)" >}}
-
-As part of a GitLab upgrade, the [Linux package upgrade guide](package/_index.md) contains the specific steps to follow
-to upgrade a Linux package instance.
-
-{{< /tab >}}
-
-{{< tab title="Helm chart (Kubernetes)" >}}
-
-GitLab can be deployed into a Kubernetes cluster using Helm. For production deployments,
-the setup follows the [Cloud Native Hybrid](../administration/reference_architectures/_index.md#cloud-native-hybrid)
-guidance where stateless components of cloud-native GitLab run in Kubernetes with
-the GitLab Helm chart, and stateful components are deployed in compute VMs with the
-Linux package.
-
-Use the [version mapping](https://docs.gitlab.com/charts/installation/version_mappings.html)
-from the chart version to GitLab version to determine the [upgrade path](upgrade_paths.md).
-
-Follow [Multi-node upgrades with downtime](with_downtime.md) to perform the upgrade in a Cloud Native Hybrid setup.
-
-A full cloud-native deployment is [not supported](../administration/reference_architectures/_index.md#stateful-components-in-kubernetes)
-for production. However, instructions on how to upgrade such an environment are in
-[a separate document](https://docs.gitlab.com/charts/installation/upgrade.html).
-
-{{< /tab >}}
-
-{{< tab title="Docker" >}}
-
-GitLab provides official Docker images for both Community and Enterprise
-editions, and they are based on the Linux package. See how to
-[install GitLab using Docker](../install/docker/_index.md).
-
-{{< /tab >}}
-
-{{< tab title="Self-compiled (source)" >}}
-
-- [Upgrading Community Edition and Enterprise Edition from source](upgrading_from_source.md):
-  The guidelines for upgrading Community Edition and Enterprise Edition from source.
-- [Patch versions](patch_versions.md) guide includes the steps needed for a
-  patch version, such as 15.2.0 to 15.2.1, and apply to both Community and Enterprise
-  Editions.
-
-In the past we used separate documents for the upgrading instructions, but we
-have switched to using a single document. The old upgrading guidelines
-can still be found in the Git repository:
-
-- [Old upgrading guidelines for Community Edition](https://gitlab.com/gitlab-org/gitlab-foss/tree/11-8-stable/doc/update)
-- [Old upgrading guidelines for Enterprise Edition](https://gitlab.com/gitlab-org/gitlab/-/tree/11-8-stable-ee/doc/update)
-
-{{< /tab >}}
-
-{{< /tabs >}}
-
-## Pre-upgrade and post-upgrade checks
-
-Immediately before and after the upgrade, perform the pre-upgrade and post-upgrade checks
-to ensure the major components of GitLab are working:
-
-1. [Check the general configuration](../administration/raketasks/maintenance.md#check-gitlab-configuration):
-
-   ```shell
-   sudo gitlab-rake gitlab:check
-   ```
-
-1. [Check the status of all background database migrations](background_migrations.md#check-for-pending-migrations).
-
-1. Confirm that encrypted database values [can be decrypted](../administration/raketasks/check.md#verify-database-values-can-be-decrypted-using-the-current-secrets):
-
-   ```shell
-   sudo gitlab-rake gitlab:doctor:secrets
-   ```
-
-1. In GitLab UI, check that:
-   - Users can sign in.
-   - The project list is visible.
-   - Project issues and merge requests are accessible.
-   - Users can clone repositories from GitLab.
-   - Users can push commits to GitLab.
-
-1. For GitLab CI/CD, check that:
-   - Runners pick up jobs.
-   - Docker images can be pushed and pulled from the registry.
-
-1. If using Geo, run the relevant checks on the primary and each secondary:
-
-   ```shell
-   sudo gitlab-rake gitlab:geo:check
-   ```
-
-1. If using Elasticsearch, verify that searches are successful.
-
-If something goes wrong, [get support](#getting-support).
-
-## CI/CD pipelines and jobs during upgrades
-
-If you upgrade your GitLab instance while the GitLab Runner is processing jobs, the trace updates fail. When GitLab is back online, the trace updates should self-heal. However, depending on the error, the GitLab Runner either retries, or eventually terminates, job handling.
-
-As for the artifacts, the GitLab Runner attempts to upload them three times, after which the job eventually fails.
-
-To address the two previous scenarios, it is advised to do the following prior to upgrading:
-
-1. Plan your maintenance.
-1. Pause your runners, or block new jobs from starting by adding the following to your `/etc/gitlab/gitlab.rb`:
-
-   ```ruby
-   nginx['custom_gitlab_server_config'] = "location = /api/v4/jobs/request {\n deny all;\n return 503;\n}\n"
-   ```
-
-   And reconfigure GitLab with:
-
-   ```shell
-   sudo gitlab-ctl reconfigure
-   ```
-
-1. Wait until all jobs are finished.
-1. Upgrade GitLab.
-1. [Upgrade GitLab Runner](https://docs.gitlab.com/runner/install/) to the same version
-   as your GitLab version. Both versions [should be the same](https://docs.gitlab.com/runner/#gitlab-runner-versions).
-1. Unpause your runners and unblock new jobs from starting by reverting the previous `/etc/gitlab/gitlab.rb` change.
-
-## Upgrading between editions
-
-GitLab comes in two flavors: [Community Edition](https://about.gitlab.com/features/#community) which is MIT licensed,
-and [Enterprise Edition](https://about.gitlab.com/features/#enterprise) which builds on top of the Community Edition and
-includes extra features mainly aimed at organizations with more than 100 users.
-
-In the following section you can find some guides to help you change GitLab editions.
-
-## Upgrade steps for additional features
-
-Some GitLab features have additional steps.
-
-### External Gitaly
-
-Upgrade Gitaly servers to the newer version before upgrading the application server. This prevents the gRPC client
-on the application server from sending RPCs that the old Gitaly version does not support.
-
-### Geo
-
-If you're using Geo:
-
-- Review [Geo upgrade documentation](../administration/geo/replication/upgrading_the_geo_sites.md).
-- Read about the Geo version-specific update instructions:
-  - [GitLab 18](versions/gitlab_18_changes.md)
-  - [GitLab 17](versions/gitlab_17_changes.md)
-  - [GitLab 16](versions/gitlab_16_changes.md)
-  - [GitLab 15](versions/gitlab_15_changes.md)
-- Review Geo-specific steps when [upgrading the database](https://docs.gitlab.com/omnibus/settings/database.html#upgrading-a-geo-instance).
-- Create an upgrade and rollback plan for each Geo site (primary and each secondary).
-
-### GitLab agent for Kubernetes
-
-If you have Kubernetes clusters connected with GitLab, [upgrade your GitLab agents for Kubernetes](../user/clusters/agent/install/_index.md#update-the-agent-version) to match your new GitLab version.
-
-### Elasticsearch
-
-Before updating GitLab, confirm advanced search migrations are complete by
-[checking for pending migrations](background_migrations.md#check-for-pending-migrations).
-
-After updating GitLab, you may have to upgrade
-[Elasticsearch if the new version breaks compatibility](../integration/advanced_search/elasticsearch.md#version-requirements).
-Updating Elasticsearch is **out of scope for GitLab Support**.
-
-## Getting support
-
-If something goes wrong:
-
-- Copy any errors and gather any logs to later analyze, and then [roll back to the last working version](plan_your_upgrade.md#rollback-plan).
-  You can use the following tools to help you gather data:
-  - [`gitlabsos`](https://gitlab.com/gitlab-com/support/toolbox/gitlabsos) if
-    you installed GitLab using the Linux package or Docker.
-  - [`kubesos`](https://gitlab.com/gitlab-com/support/toolbox/kubesos/) if
-    you installed GitLab using the Helm Charts.
-
-For support:
-
-- [Contact GitLab Support](https://support.gitlab.com/hc/en-us) and, if you have one, your Customer Success Manager.
-- If [the situation qualifies](https://about.gitlab.com/support/#definitions-of-support-impact) and
-  [your plan includes emergency support](https://about.gitlab.com/support/#priority-support),
-  create an emergency ticket.
-
-## Related topics
-
-- [Managing PostgreSQL extensions](../install/postgresql_extensions.md)
+{{< /cards >}}
diff --git a/doc/update/convert_to_ee/_index.md b/doc/update/convert_to_ee/_index.md
index e071a455e73..5a5228b7952 100644
--- a/doc/update/convert_to_ee/_index.md
+++ b/doc/update/convert_to_ee/_index.md
@@ -3,6 +3,7 @@ stage: GitLab Delivery
 group: Self Managed
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Other upgrade paths
+description: Move between different editions or installation methods.
 ---
 
 Not all upgrades are from one version of GitLab to another.
diff --git a/doc/update/package/_index.md b/doc/update/package/_index.md
index 969495c26e1..4caae63f39d 100644
--- a/doc/update/package/_index.md
+++ b/doc/update/package/_index.md
@@ -62,7 +62,7 @@ Nevertheless, you should maintain a full up-to-date
 
 To upgrade a Linux package instance:
 
-1. [Complete the initial steps](../_index.md#upgrade-gitlab) in the main GitLab upgrade documentation.
+1. [Complete the initial steps](../upgrade.md#upgrade-gitlab) in the main GitLab upgrade documentation.
 1. If you are upgrading from a non-package installation to a GitLab package installation, follow the steps in
    [Upgrading from a non-package installation to a GitLab package installation](https://docs.gitlab.com/omnibus/update/convert_to_omnibus.html).
 1. Continue the upgrade by following the next sections.
diff --git a/doc/update/plan_your_upgrade.md b/doc/update/plan_your_upgrade.md
index faba6fb8917..db2dc117da8 100644
--- a/doc/update/plan_your_upgrade.md
+++ b/doc/update/plan_your_upgrade.md
@@ -3,6 +3,7 @@ stage: GitLab Delivery
 group: Self Managed
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 title: Create an upgrade plan
+description: Steps to take before you upgrade.
 ---
 
 {{< details >}}
diff --git a/doc/update/upgrade.md b/doc/update/upgrade.md
new file mode 100644
index 00000000000..7521e2265a6
--- /dev/null
+++ b/doc/update/upgrade.md
@@ -0,0 +1,256 @@
+---
+stage: GitLab Delivery
+group: Self Managed
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+title: Upgrade a GitLab installation
+description: Upgrade steps for all installation methods.
+---
+
+{{< details >}}
+
+- Tier: Free, Premium, Ultimate
+- Offering: GitLab Self-Managed
+
+{{< /details >}}
+
+Upgrading GitLab is a relatively straightforward process, but the complexity can increase based on:
+
+- The installation method you have used.
+- How old your GitLab version is.
+- If you're upgrading to a major version.
+
+If possible, you should test out the upgrade in a test environment before updating your production instance. Your test
+environment should mimic your production environment as closely as possible.
+
+Make sure to read the whole page as it contains information related to every upgrade method.
+
+## Upgrade GitLab
+
+To upgrade GitLab:
+
+1. Create an [upgrade plan](plan_your_upgrade.md) to document your upgrade steps.
+1. Familiarize yourself with the [maintenance policy documentation](../policy/maintenance.md) and the [currently maintained versions](../policy/maintenance.md#maintained-versions).
+1. Read the [release posts](https://about.gitlab.com/releases/categories/releases/) for versions you're passing over.
+   In particular, deprecations, removals, and important notes on upgrading.
+1. Using the [upgrade path tool](upgrade_paths.md#upgrade-path-tool), determine what [upgrade path](upgrade_paths.md) you should take.
+   If your upgrade path includes required upgrade stops, you might have to perform multiple
+   upgrades to move from your current version to your target version. If
+   relevant, check [OS compatibility with the target GitLab version](../administration/package_information/supported_os.md).
+1. Check for [background migrations](background_migrations.md). All migrations must finish running before each upgrade.
+   You must spread out upgrades between major and minor releases to allow time for background migrations to finish.
+1. Test your upgrade in a test environment first, and have a [rollback plan](plan_your_upgrade.md#rollback-plan)
+   to reduce the risk of unplanned outages and extended downtime.
+1. If available in your starting version, consider [turning on maintenance mode](../administration/maintenance_mode/_index.md)
+   during the upgrade.
+1. Consult changes for different versions of GitLab to ensure compatibility before upgrading:
+   - [GitLab 18 changes](versions/gitlab_18_changes.md)
+   - [GitLab 17 changes](versions/gitlab_17_changes.md)
+   - [GitLab 16 changes](versions/gitlab_16_changes.md)
+   - [GitLab 15 changes](versions/gitlab_15_changes.md)
+1. Perform [pre-upgrade checks](#pre-upgrade-and-post-upgrade-checks).
+1. Pause [running CI/CD pipelines and jobs](#cicd-pipelines-and-jobs-during-upgrades).
+1. If relevant, follow [upgrade steps for additional features](#upgrade-steps-for-additional-features):
+   - [Advanced search (Elasticsearch)](#elasticsearch).
+   - [Geo](#geo).
+   - [Gitaly running on its own server](#external-gitaly).
+   - [GitLab agent for Kubernetes](#gitlab-agent-for-kubernetes).
+1. Follow the [upgrade steps based on your installation method](#upgrade-based-on-installation-method).
+1. If your GitLab instance has any runners associated with it, upgrade them to match the current GitLab version.
+   This step ensures [compatibility with GitLab versions](https://docs.gitlab.com/runner/#gitlab-runner-versions).
+1. If you encounter problems with the upgrade, [get support](#getting-support).
+1. [Disable maintenance mode](../administration/maintenance_mode/_index.md#disable-maintenance-mode) if you had enabled
+   it.
+1. Unpause [running CI/CD pipelines and jobs](#cicd-pipelines-and-jobs-during-upgrades).
+1. Perform [post-upgrade checks](#pre-upgrade-and-post-upgrade-checks).
+
+## Upgrade based on installation method
+
+Depending on the installation method and your GitLab version, there are multiple
+official ways to upgrade GitLab:
+
+{{< tabs >}}
+
+{{< tab title="Linux packages (Omnibus)" >}}
+
+As part of a GitLab upgrade, the [Linux package upgrade guide](package/_index.md) contains the specific steps to follow
+to upgrade a Linux package instance.
+
+{{< /tab >}}
+
+{{< tab title="Helm chart (Kubernetes)" >}}
+
+GitLab can be deployed into a Kubernetes cluster using Helm. For production deployments,
+the setup follows the [Cloud Native Hybrid](../administration/reference_architectures/_index.md#cloud-native-hybrid)
+guidance where stateless components of cloud-native GitLab run in Kubernetes with
+the GitLab Helm chart, and stateful components are deployed in compute VMs with the
+Linux package.
+
+Use the [version mapping](https://docs.gitlab.com/charts/installation/version_mappings.html)
+from the chart version to GitLab version to determine the [upgrade path](upgrade_paths.md).
+
+Follow [Multi-node upgrades with downtime](with_downtime.md) to perform the upgrade in a Cloud Native Hybrid setup.
+
+A full cloud-native deployment is [not supported](../administration/reference_architectures/_index.md#stateful-components-in-kubernetes)
+for production. However, instructions on how to upgrade such an environment are in
+[a separate document](https://docs.gitlab.com/charts/installation/upgrade.html).
+
+{{< /tab >}}
+
+{{< tab title="Docker" >}}
+
+GitLab provides official Docker images for both Community and Enterprise
+editions, and they are based on the Linux package. See how to
+[install GitLab using Docker](../install/docker/_index.md).
+
+{{< /tab >}}
+
+{{< tab title="Self-compiled (source)" >}}
+
+- [Upgrading Community Edition and Enterprise Edition from source](upgrading_from_source.md):
+  The guidelines for upgrading Community Edition and Enterprise Edition from source.
+- [Patch versions](patch_versions.md) guide includes the steps needed for a
+  patch version, such as 15.2.0 to 15.2.1, and apply to both Community and Enterprise
+  Editions.
+
+In the past we used separate documents for the upgrading instructions, but we
+have switched to using a single document. The old upgrading guidelines
+can still be found in the Git repository:
+
+- [Old upgrading guidelines for Community Edition](https://gitlab.com/gitlab-org/gitlab-foss/tree/11-8-stable/doc/update)
+- [Old upgrading guidelines for Enterprise Edition](https://gitlab.com/gitlab-org/gitlab/-/tree/11-8-stable-ee/doc/update)
+
+{{< /tab >}}
+
+{{< /tabs >}}
+
+## Pre-upgrade and post-upgrade checks
+
+Immediately before and after the upgrade, perform the pre-upgrade and post-upgrade checks
+to ensure the major components of GitLab are working:
+
+1. [Check the general configuration](../administration/raketasks/maintenance.md#check-gitlab-configuration):
+
+   ```shell
+   sudo gitlab-rake gitlab:check
+   ```
+
+1. [Check the status of all background database migrations](background_migrations.md#check-for-pending-migrations).
+
+1. Confirm that encrypted database values [can be decrypted](../administration/raketasks/check.md#verify-database-values-can-be-decrypted-using-the-current-secrets):
+
+   ```shell
+   sudo gitlab-rake gitlab:doctor:secrets
+   ```
+
+1. In GitLab UI, check that:
+   - Users can sign in.
+   - The project list is visible.
+   - Project issues and merge requests are accessible.
+   - Users can clone repositories from GitLab.
+   - Users can push commits to GitLab.
+
+1. For GitLab CI/CD, check that:
+   - Runners pick up jobs.
+   - Docker images can be pushed and pulled from the registry.
+
+1. If using Geo, run the relevant checks on the primary and each secondary:
+
+   ```shell
+   sudo gitlab-rake gitlab:geo:check
+   ```
+
+1. If using Elasticsearch, verify that searches are successful.
+
+If something goes wrong, [get support](#getting-support).
+
+## CI/CD pipelines and jobs during upgrades
+
+If you upgrade your GitLab instance while the GitLab Runner is processing jobs, the trace updates fail. When GitLab is back online, the trace updates should self-heal. However, depending on the error, the GitLab Runner either retries, or eventually terminates, job handling.
+
+As for the artifacts, the GitLab Runner attempts to upload them three times, after which the job eventually fails.
+
+To address the two previous scenarios, it is advised to do the following prior to upgrading:
+
+1. Plan your maintenance.
+1. Pause your runners, or block new jobs from starting by adding the following to your `/etc/gitlab/gitlab.rb`:
+
+   ```ruby
+   nginx['custom_gitlab_server_config'] = "location = /api/v4/jobs/request {\n deny all;\n return 503;\n}\n"
+   ```
+
+   And reconfigure GitLab with:
+
+   ```shell
+   sudo gitlab-ctl reconfigure
+   ```
+
+1. Wait until all jobs are finished.
+1. Upgrade GitLab.
+1. [Upgrade GitLab Runner](https://docs.gitlab.com/runner/install/) to the same version
+   as your GitLab version. Both versions [should be the same](https://docs.gitlab.com/runner/#gitlab-runner-versions).
+1. Unpause your runners and unblock new jobs from starting by reverting the previous `/etc/gitlab/gitlab.rb` change.
+
+## Upgrading between editions
+
+GitLab comes in two flavors: [Community Edition](https://about.gitlab.com/features/#community) which is MIT licensed,
+and [Enterprise Edition](https://about.gitlab.com/features/#enterprise) which builds on top of the Community Edition and
+includes extra features mainly aimed at organizations with more than 100 users.
+
+In the following section you can find some guides to help you change GitLab editions.
+
+## Upgrade steps for additional features
+
+Some GitLab features have additional steps.
+
+### External Gitaly
+
+Upgrade Gitaly servers to the newer version before upgrading the application server. This prevents the gRPC client
+on the application server from sending RPCs that the old Gitaly version does not support.
+
+### Geo
+
+If you're using Geo:
+
+- Review [Geo upgrade documentation](../administration/geo/replication/upgrading_the_geo_sites.md).
+- Read about the Geo version-specific update instructions:
+  - [GitLab 18](versions/gitlab_18_changes.md)
+  - [GitLab 17](versions/gitlab_17_changes.md)
+  - [GitLab 16](versions/gitlab_16_changes.md)
+  - [GitLab 15](versions/gitlab_15_changes.md)
+- Review Geo-specific steps when [upgrading the database](https://docs.gitlab.com/omnibus/settings/database.html#upgrading-a-geo-instance).
+- Create an upgrade and rollback plan for each Geo site (primary and each secondary).
+
+### GitLab agent for Kubernetes
+
+If you have Kubernetes clusters connected with GitLab, [upgrade your GitLab agents for Kubernetes](../user/clusters/agent/install/_index.md#update-the-agent-version) to match your new GitLab version.
+
+### Elasticsearch
+
+Before updating GitLab, confirm advanced search migrations are complete by
+[checking for pending migrations](background_migrations.md#check-for-pending-migrations).
+
+After updating GitLab, you may have to upgrade
+[Elasticsearch if the new version breaks compatibility](../integration/advanced_search/elasticsearch.md#version-requirements).
+Updating Elasticsearch is **out of scope for GitLab Support**.
+
+## Getting support
+
+If something goes wrong:
+
+- Copy any errors and gather any logs to later analyze, and then [roll back to the last working version](plan_your_upgrade.md#rollback-plan).
+  You can use the following tools to help you gather data:
+  - [`gitlabsos`](https://gitlab.com/gitlab-com/support/toolbox/gitlabsos) if
+    you installed GitLab using the Linux package or Docker.
+  - [`kubesos`](https://gitlab.com/gitlab-com/support/toolbox/kubesos/) if
+    you installed GitLab using the Helm Charts.
+
+For support:
+
+- [Contact GitLab Support](https://support.gitlab.com/hc/en-us) and, if you have one, your Customer Success Manager.
+- If [the situation qualifies](https://about.gitlab.com/support/#definitions-of-support-impact) and
+  [your plan includes emergency support](https://about.gitlab.com/support/#priority-support),
+  create an emergency ticket.
+
+## Related topics
+
+- [Managing PostgreSQL extensions](../install/postgresql_extensions.md)
diff --git a/doc/update/upgrading_from_source.md b/doc/update/upgrading_from_source.md
index 8e104be93d9..dee4f5c110e 100644
--- a/doc/update/upgrading_from_source.md
+++ b/doc/update/upgrading_from_source.md
@@ -382,7 +382,7 @@ sudo -u git -H bundle exec rake "gitlab:workhorse:install[/home/git/gitlab-workh
 Upgrade Gitaly servers to the newer version before upgrading the application server. This prevents the gRPC client
 on the application server from sending RPCs that the old Gitaly version does not support.
 
-If Gitaly is located on its own server, or you use Gitaly Cluster, see [Zero-downtime upgrades](zero_downtime.md).
+If Gitaly is located on its own server, or you use Gitaly Cluster (Praefect), see [Zero-downtime upgrades](zero_downtime.md).
 
 During the build process, Gitaly [compiles and embeds Git binaries](https://gitlab.com/gitlab-org/gitaly/-/issues/6089),
 which requires additional dependencies.
diff --git a/doc/update/with_downtime.md b/doc/update/with_downtime.md
index d4666764aba..676e4bb5d7b 100644
--- a/doc/update/with_downtime.md
+++ b/doc/update/with_downtime.md
@@ -100,10 +100,10 @@ following principles when upgrading those servers:
 - Do not restart services more than one server at a time.
 - Check the Consul cluster is healthy before upgrading or restarting services.
 
-## Upgrade the Gitaly nodes (Praefect / Gitaly Cluster)
+## Upgrade the Gitaly nodes (Gitaly Cluster (Praefect))
 
-If you're running Gitaly cluster, follow the [zero-downtime process](zero_downtime.md)
-for Gitaly cluster.
+If you're running Gitaly Cluster (Praefect), follow the [zero-downtime process](zero_downtime.md)
+for Gitaly Cluster (Praefect).
 
 If you are using Amazon Machine Images (AMIs) on AWS, you can either upgrade the Gitaly nodes
 through the AMI process, or upgrade the package itself:
@@ -113,9 +113,9 @@ through the AMI process, or upgrade the package itself:
   you can upgrade through the AMI process. With ENI, you can keep the private DNS names
   through AMI instance changes, something that is crucial for Gitaly to work.
 - If you're **not** using ENI, you must upgrade Gitaly using the GitLab package.
-  This is because Gitaly Cluster tracks replicas of Git repositories by the server hostname,
+  This is because Gitaly Cluster (Praefect) tracks replicas of Git repositories by the server hostname,
   and a redeployment using AMIs issues the nodes with new hostnames. Even though
-  the storage is the same, Gitaly Cluster does not work when the hostnames change.
+  the storage is the same, Gitaly Cluster (Praefect) does not work when the hostnames change.
 
 The Praefect nodes, however, can be upgraded by using an AMI redeployment process:
 
diff --git a/doc/update/zero_downtime.md b/doc/update/zero_downtime.md
index d5420a6b1d1..462a8628916 100644
--- a/doc/update/zero_downtime.md
+++ b/doc/update/zero_downtime.md
@@ -43,7 +43,7 @@ The zero-downtime upgrade process has the following requirements:
   - Internal Load Balancer configured for any PgBouncer and Praefect components with TCP health checks enabled.
   - HA mechanisms configured for the Consul, Postgres, Redis components if present.
     - Any of these components that are not deployed in a HA fashion need to be upgraded separately with downtime.
-    - For databases, the [Linux package only supports HA for the main GitLab database](https://gitlab.com/groups/gitlab-org/-/epics/7814). For any other databases, such as the [Praefect database](#praefect-gitaly-cluster), a third party database solution is required to achieve HA and subsequently to avoid downtime.
+    - For databases, the [Linux package only supports HA for the main GitLab database](https://gitlab.com/groups/gitlab-org/-/epics/7814). For any other databases, such as the [Praefect database](#gitaly-cluster-praefect), a third party database solution is required to achieve HA and subsequently to avoid downtime.
 - **You can only upgrade one minor release at a time**. So from `16.1` to `16.2`, not to `16.3`. If you skip releases, database modifications may be run in the wrong sequence [and leave the database schema in a broken state](https://gitlab.com/gitlab-org/gitlab/-/issues/321542).
 - You have to use post-deployment migrations.
 - [Zero-downtime upgrades are not available with the GitLab Charts](https://docs.gitlab.com/charts/installation/upgrade.html). Support is available with the [GitLab Operator](https://docs.gitlab.com/operator/gitlab_upgrades.html) but there are [known limitations](https://docs.gitlab.com/operator/#known-issues) with this deployment method and as such it's not covered in this guide at this time.
@@ -60,7 +60,7 @@ In addition to the previous, be aware of the following considerations:
   - Certain major or minor releases may require a set of background migrations to be finished. While this doesn't require downtime (if the previous conditions are met), it's required that you [wait for background migrations to complete](background_migrations.md) between each major or minor release upgrade.
   - The time necessary to complete these migrations can be reduced by increasing the number of Sidekiq workers that can process jobs in the
     `background_migration` queue. To see the size of this queue, [check for background migrations before upgrading](background_migrations.md).
-- Zero downtime upgrades can be performed for [Gitaly](#gitaly) when it's set up in its Cluster or Sharded setups due to a graceful reload mechanism. For the [Praefect (Gitaly Cluster)](#praefect-gitaly-cluster) component it can also be directly upgraded without downtime, however the GitLab Linux package does not offer HA and subsequently Zero Downtime support for it's database - A third party database solution is required to avoid downtime.
+- Zero downtime upgrades can be performed for [Gitaly](#gitaly) when it's set up in its Cluster or Sharded setups due to a graceful reload mechanism. For the [Gitaly Cluster (Praefect)](#gitaly-cluster-praefect) component it can also be directly upgraded without downtime, however the GitLab Linux package does not offer HA and subsequently Zero Downtime support for it's database - A third party database solution is required to avoid downtime.
 - [PostgreSQL major version upgrades](../administration/postgresql/replication_and_failover.md#near-zero-downtime-upgrade-of-postgresql-in-a-patroni-cluster) are a separate process and not covered by zero-downtime upgrades (smaller upgrades are covered).
 - Zero-downtime upgrades are supported for the noted GitLab components you've deployed with the GitLab Linux package. If you've deployed select components through a supported third party service, such as PostgreSQL in AWS RDS or Redis in GCP Memorystore, upgrades for those services need to be performed separately as per their standard processes.
 - As a general guideline, the larger amount of data you have, the more time is needed for the upgrade to complete. In testing, any database smaller than 10 GB shouldn't generally take longer than an hour, but your mileage may vary.
@@ -177,9 +177,9 @@ This process applies to both Gitaly Sharded and Cluster setups. Run through the
    sudo gitlab-ctl restart consul node-exporter logrotate
    ```
 
-#### Praefect (Gitaly Cluster)
+#### Gitaly Cluster (Praefect)
 
-For Gitaly Cluster setups, you must deploy and upgrade Praefect in a similar way by using a graceful reload.
+For Gitaly Cluster (Praefect) setups, you must deploy and upgrade Praefect in a similar way by using a graceful reload.
 
 {{< alert type="note" >}}
 
diff --git a/doc/user/compliance/_index.md b/doc/user/compliance/_index.md
index e184eb7ea82..c125d69ecea 100644
--- a/doc/user/compliance/_index.md
+++ b/doc/user/compliance/_index.md
@@ -46,7 +46,7 @@ These features can help provide visibility into GitLab and audit what is happeni
 |:--------------------------------------------------|:-------------------------------------|:-------------------------------------|:-------------------------------------|:------------|
 | [Audit events](audit_events.md)                   | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | To maintain the integrity of your code, audit events give administrators the ability to view any modifications made in the GitLab server in an advanced audit events system, so you can control, analyze, and track every change. |
 | [Audit reports](audit_events.md)                  | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Create and access reports based on the audit events that have occurred. Use pre-built GitLab reports or the API to build your own. |
-| [Audit event streaming](audit_event_streaming.md) | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Stream GitLab audit events to a HTTP endpoint or third party service, such as AWS S3 or GCP Logging. |
+| [Audit event streaming](audit_event_streaming.md) | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Stream GitLab audit events to an HTTP endpoint or third party service, such as AWS S3 or GCP Logging. |
 | [Compliance center](compliance_center/_index.md)  | {{< icon name="dotted-circle" >}} No | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | Quickly get visibility into the compliance posture of your organization through compliance standards adherence reporting and violations reports. Manage your groups compliance frameworks centrally. |
 
 ## Policy management
diff --git a/doc/user/group/saml_sso/troubleshooting.md b/doc/user/group/saml_sso/troubleshooting.md
index 01e581df3b5..c15e4501ece 100644
--- a/doc/user/group/saml_sso/troubleshooting.md
+++ b/doc/user/group/saml_sso/troubleshooting.md
@@ -455,7 +455,7 @@ If all users are receiving a `404` after signing in to the identity provider (Id
 
 - Verify the clocks on the IdP server and GitLab are synced to the same time.
 
-If a subset of users recieve a `404` error after they sign in to the IdP, first verify what audit events are returned if the user is added to the group and then immediately removed. Alternatively, if the user can successfully sign in, but they do not show as [a member of the top-level group](../_index.md#search-a-group):
+If a subset of users receive a `404` error after they sign in to the IdP, first verify what audit events are returned if the user is added to the group and then immediately removed. Alternatively, if the user can successfully sign in, but they do not show as [a member of the top-level group](../_index.md#search-a-group):
 
 - Ensure the user has been [added to the SAML identity provider](_index.md#user-access-and-management), and [SCIM](scim_setup.md) if configured.
 - Ensure the user's SCIM identity's `active` attribute is `true` using the [SCIM API](../../../api/scim.md).
diff --git a/doc/user/project/repository/branches/branch_rules.md b/doc/user/project/repository/branches/branch_rules.md
index 2154e0530fb..d7472ad46e8 100644
--- a/doc/user/project/repository/branches/branch_rules.md
+++ b/doc/user/project/repository/branches/branch_rules.md
@@ -223,7 +223,7 @@ To add a status check service:
 1. Enter the **Service name**.
 1. In the **API to check** field, enter the URL.
 
-   You should use a HTTPS URL to protect your merge request data in transit.
+   You should use an HTTPS URL to protect your merge request data in transit.
 
 ![Branch rules status checks](img/branch_rule_status_check_v17_4.png)
 
diff --git a/doc/user/project/repository/code_suggestions/_index.md b/doc/user/project/repository/code_suggestions/_index.md
index bec179759b2..6f3a947efd7 100644
--- a/doc/user/project/repository/code_suggestions/_index.md
+++ b/doc/user/project/repository/code_suggestions/_index.md
@@ -52,7 +52,8 @@ To use Code Suggestions, you need:
 
 {{< alert type="note" >}}
 
-GitLab Duo requires GitLab 17.2 or later. For GitLab Duo Core access, and for the best user experience and results, [upgrade to GitLab 18.0 or later](../../../../update/_index.md#upgrade-gitlab). Earlier versions might continue to work, however the experience might be degraded.
+GitLab Duo requires GitLab 17.2 or later. For GitLab Duo Core access, and for the best user experience and results,
+[upgrade to GitLab 18.0 or later](../../../../update/_index.md). Earlier versions might continue to work, however the experience might be degraded.
 
 {{< /alert >}}
 
diff --git a/doc/user/project/repository/monorepos/troubleshooting.md b/doc/user/project/repository/monorepos/troubleshooting.md
index af2f39ba309..769a6094caa 100644
--- a/doc/user/project/repository/monorepos/troubleshooting.md
+++ b/doc/user/project/repository/monorepos/troubleshooting.md
@@ -27,7 +27,7 @@ High CPU utilization is a common cause of slow performance.
 The following non-mutually exclusive causes are possible:
 
 - [Too many clones for Gitaly to handle](#cause-too-many-large-clones).
-- [Poor read distribution on Gitaly Cluster](#cause-poor-read-distribution).
+- [Poor read distribution on Gitaly Cluster (Praefect)](#cause-poor-read-distribution).
 
 #### Cause: too many large clones
 
@@ -54,7 +54,7 @@ The other option is to increase CPU capacity on Gitaly servers.
 
 #### Cause: poor read distribution
 
-You might have poor read distribution on Gitaly Cluster.
+You might have poor read distribution on Gitaly Cluster (Praefect).
 
 To observe if most read traffic is going to the primary Gitaly node instead of
 getting distributed across the cluster, use the
@@ -67,7 +67,7 @@ a monorepo.
 Monorepos are often both large and busy. This leads to two effects. Firstly,
 monorepos are pushed to often and have lots of CI jobs running. There can be
 times when write operations such as deleting a branch fails a proxy call to the
-secondary nodes. This triggers a replication job in Gitaly Cluster so that
+secondary nodes. This triggers a replication job in Gitaly Cluster (Praefect) so that
 the secondary node will catch up eventually.
 
 The replication job is essentially a `git fetch` from the secondary node to the
diff --git a/lib/gitlab/application_rate_limiter.rb b/lib/gitlab/application_rate_limiter.rb
index c1da8cdbcb6..f285ffba167 100644
--- a/lib/gitlab/application_rate_limiter.rb
+++ b/lib/gitlab/application_rate_limiter.rb
@@ -56,6 +56,7 @@ module Gitlab
           namespace_exists: { threshold: 20, interval: 1.minute },
           notes_create: { threshold: -> { application_settings.notes_create_limit }, interval: 1.minute },
           notification_emails: { threshold: 1000, interval: 1.day },
+          oauth_dynamic_registration: { threshold: 5, interval: 1.hour },
           permanent_email_failure: { threshold: 5, interval: 1.day },
           phone_verification_send_code: { threshold: 5, interval: 1.day },
           phone_verification_verify_code: { threshold: 5, interval: 1.day },
diff --git a/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.html.haml b/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.html.haml
index 9ceaef468bf..00663bbb40e 100644
--- a/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.html.haml
+++ b/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.html.haml
@@ -3,7 +3,7 @@
   Dear GitLab user,
 
 %p
-  As part of our commitment to keeping GitLab secure, we have identified and addressed a vulnerability in GitLab that allowed some users to bypass the email verification process in a #{link_to('recent patch release', 'https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released', target: '_blank')}.
+  As part of our commitment to keeping GitLab secure, we have identified and addressed a vulnerability in GitLab that allowed some users to bypass the email verification process in a #{link_to('recent patch release', promo_url(path: '/releases/2020/05/27/security-release-13-0-1-released'), target: '_blank')}.
 
 %p
   As a precautionary measure, you will need to re-verify some of your account's email addresses before continuing to use GitLab. Sorry for the inconvenience!
diff --git a/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.text.erb b/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.text.erb
index ba1055a6cad..b15d251e9d3 100644
--- a/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.text.erb
+++ b/lib/gitlab/background_migration/mailers/views/unconfirm_mailer/unconfirm_notification_email.text.erb
@@ -1,12 +1,12 @@
 Dear GitLab user,
 
-As part of our commitment to keeping GitLab secure, we have identified and addressed a vulnerability in GitLab that allowed some users to bypass the email verification process in a recent patch release. 
+As part of our commitment to keeping GitLab secure, we have identified and addressed a vulnerability in GitLab that allowed some users to bypass the email verification process in a recent patch release.
 
-Patch release: https://about.gitlab.com/releases/2020/05/27/security-release-13-0-1-released
+Patch release: <%= promo_url(path: '/releases/2020/05/27/security-release-13-0-1-released') %>
 
 As a precautionary measure, you will need to re-verify some of your account's email addresses before continuing to use GitLab. Sorry for the inconvenience!
 
-We have already sent the re-verification email with a subject line of "Confirmation instructions" from <%= @verification_from_mail %>. 
+We have already sent the re-verification email with a subject line of "Confirmation instructions" from <%= @verification_from_mail %>.
 Please feel free to contribute any questions or comments to this issue: https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/7942
 
 If you are not "<%= @user.username %>", please report abuse from the user's profile page: <%= user_url(@user.id) %>.
diff --git a/lib/gitlab/git/finders/refs_finder.rb b/lib/gitlab/git/finders/refs_finder.rb
index a0117bc0fa9..be76e76257e 100644
--- a/lib/gitlab/git/finders/refs_finder.rb
+++ b/lib/gitlab/git/finders/refs_finder.rb
@@ -4,26 +4,28 @@ module Gitlab
   module Git
     module Finders
       class RefsFinder
-        attr_reader :repository, :search, :ref_type
-
         UnknownRefTypeError = Class.new(StandardError)
 
-        def initialize(repository, search:, ref_type:)
+        def initialize(repository, ref_type:, search: nil, sort_by: nil)
           @repository = repository
           @search = search
           @ref_type = ref_type
+          @sort_by = sort_by
         end
 
         def execute
           pattern = [prefix, search, "*"].compact.join
 
           repository.list_refs(
-            [pattern]
+            [pattern],
+            sort_by: sort_by
           )
         end
 
         private
 
+        attr_reader :repository, :search, :ref_type, :sort_by
+
         def prefix
           case ref_type
           when :branches
diff --git a/lib/gitlab/gitaly_client/list_refs_sort.rb b/lib/gitlab/gitaly_client/list_refs_sort.rb
new file mode 100644
index 00000000000..e4ac94a82b6
--- /dev/null
+++ b/lib/gitlab/gitaly_client/list_refs_sort.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module GitalyClient
+    class ListRefsSort
+      def initialize(sort_by)
+        @sort_by = sort_by
+      end
+
+      def gitaly_sort_by
+        Gitaly::ListRefsRequest::SortBy.new(
+          key: key,
+          direction: direction
+        )
+      end
+
+      private
+
+      attr_reader :sort_by
+
+      def key
+        return Gitaly::ListRefsRequest::SortBy::Key::CREATORDATE if match?('updated')
+
+        Gitaly::ListRefsRequest::SortBy::Key::REFNAME
+      end
+
+      def direction
+        return Gitaly::SortDirection::DESCENDING if match?('desc')
+
+        Gitaly::SortDirection::ASCENDING
+      end
+
+      def match?(key)
+        return false if sort_by.blank?
+
+        sort_by.downcase.split('_').include?(key)
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/gitaly_client/ref_service.rb b/lib/gitlab/gitaly_client/ref_service.rb
index e7b3bbc8903..3dd10c6b49e 100644
--- a/lib/gitlab/gitaly_client/ref_service.rb
+++ b/lib/gitlab/gitaly_client/ref_service.rb
@@ -237,13 +237,14 @@ module Gitlab
       end
 
       # peel_tags slows down the request by a factor of 3-4
-      def list_refs(patterns = [Gitlab::Git::BRANCH_REF_PREFIX], pointing_at_oids: [], peel_tags: false, dynamic_timeout: nil)
+      def list_refs(patterns = [Gitlab::Git::BRANCH_REF_PREFIX], pointing_at_oids: [], peel_tags: false, dynamic_timeout: nil, sort_by: nil)
         request = Gitaly::ListRefsRequest.new(
           repository: @gitaly_repo,
           patterns: patterns,
           pointing_at_oids: pointing_at_oids,
           peel_tags: peel_tags
         )
+        request.sort_by = Gitlab::GitalyClient::ListRefsSort.new(sort_by).gitaly_sort_by if sort_by
 
         timeout = dynamic_timeout || GitalyClient.fast_timeout
 
diff --git a/lib/gitlab/gon_helper.rb b/lib/gitlab/gon_helper.rb
index 4ea14ef2eac..57d82f182d0 100644
--- a/lib/gitlab/gon_helper.rb
+++ b/lib/gitlab/gon_helper.rb
@@ -34,7 +34,7 @@ module Gitlab
       gon.recaptcha_api_server_url = ::Recaptcha.configuration.api_server_url
       gon.recaptcha_sitekey      = Gitlab::CurrentSettings.recaptcha_site_key
       gon.gitlab_url             = Gitlab.config.gitlab.url
-      gon.promo_url              = ApplicationHelper.promo_url
+      gon.promo_url              = Gitlab::Routing.url_helpers.promo_url
       gon.forum_url              = Gitlab::Saas.community_forum_url
       gon.docs_url               = Gitlab::Saas.doc_url
       gon.revision               = Gitlab.revision
diff --git a/lib/gitlab/saas.rb b/lib/gitlab/saas.rb
index 847ac5c36de..5ead4aa8e39 100644
--- a/lib/gitlab/saas.rb
+++ b/lib/gitlab/saas.rb
@@ -9,6 +9,10 @@ module Gitlab
       'gitlab.com'
     end
 
+    def self.promo_host
+      'about.gitlab.com'
+    end
+
     def self.com_url
       'https://gitlab.com'
     end
@@ -45,18 +49,6 @@ module Gitlab
       'https://status.gitlab.com'
     end
 
-    def self.about_pricing_url
-      "https://about.gitlab.com/pricing/"
-    end
-
-    def self.about_pricing_faq_url
-      "https://about.gitlab.com/pricing#faq"
-    end
-
-    def self.about_feature_comparison_url
-      "https://about.gitlab.com/pricing/gitlab-com/feature-comparison"
-    end
-
     def self.doc_url
       'https://docs.gitlab.com'
     end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index aac829a9005..452d5560bf1 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -7207,6 +7207,9 @@ msgstr ""
 msgid "An alert has been triggered in %{project_path}."
 msgstr ""
 
+msgid "An anonymous service added this dynamically created OAuth application "
+msgstr ""
+
 msgid "An email notification was recently sent from the admin panel. Please wait %{wait_time_in_words} before attempting to send another message."
 msgstr ""
 
@@ -15527,6 +15530,9 @@ msgstr ""
 msgid "CompareRevisions|%{source_branch} and %{target_branch} are the same."
 msgstr ""
 
+msgid "CompareRevisions|An error occurred while retrieving target projects."
+msgstr ""
+
 msgid "CompareRevisions|Branches"
 msgstr ""
 
diff --git a/package.json b/package.json
index 1b7536f4b75..27874772d98 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,7 @@
     "@gitlab/favicon-overlay": "2.0.0",
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/query-language-rust": "0.13.1",
-    "@gitlab/svgs": "3.141.0",
+    "@gitlab/svgs": "3.142.0",
     "@gitlab/ui": "115.6.1",
     "@gitlab/vue-router-vue3": "npm:vue-router@4.5.1",
     "@gitlab/vuex-vue3": "npm:vuex@4.1.0",
diff --git a/scripts/migration_schema_validator.rb b/scripts/migration_schema_validator.rb
index dab83565272..b977e843e85 100644
--- a/scripts/migration_schema_validator.rb
+++ b/scripts/migration_schema_validator.rb
@@ -7,6 +7,7 @@ class MigrationSchemaValidator
   FILENAME = 'db/structure.sql'
 
   MIGRATION_DIRS = %w[db/migrate db/post_migrate].freeze
+  PARTITION_MANAGER_CONFIG = %w[config/initializers/postgres_partitioning.rb].freeze
 
   SCHEMA_VERSION_DIR = 'db/schema_migrations'
 
@@ -38,8 +39,8 @@ class MigrationSchemaValidator
   end
 
   def validate!
-    if committed_migrations.empty?
-      puts "\e[32m No migrations found, skipping schema validation\e[0m"
+    unless committed_migrations.any? || partition_manager_config_changes?
+      puts "\e[32m No new migrations or partition configuration changes found, skipping schema validation\e[0m"
       return
     end
 
@@ -184,6 +185,12 @@ class MigrationSchemaValidator
     end
   end
 
+  def partition_manager_config_changes?
+    git_command = "git diff --name-only #{diff_target} -- #{PARTITION_MANAGER_CONFIG.join(' ')}"
+
+    run(git_command).split("\n").any?
+  end
+
   def diff_target
     @diff_target ||= pipeline_for_merged_results? ? target_branch : merge_base
   end
diff --git a/spec/factories/oauth_applications.rb b/spec/factories/oauth_applications.rb
index aff32805f03..d83ff7ae421 100644
--- a/spec/factories/oauth_applications.rb
+++ b/spec/factories/oauth_applications.rb
@@ -8,4 +8,21 @@ FactoryBot.define do
     owner
     owner_type { 'User' }
   end
+
+  trait :group_owned do
+    owner_type { 'Group' }
+    owner { association(:group) }
+  end
+
+  trait :dynamic do
+    owner { nil }
+    owner_type { nil }
+    dynamic { true }
+  end
+
+  trait :without_owner do
+    owner { nil }
+    owner_type { nil }
+    dynamic { false }
+  end
 end
diff --git a/spec/features/admin/admin_settings_spec.rb b/spec/features/admin/admin_settings_spec.rb
index 51aaefac9ee..35c7d2d9250 100644
--- a/spec/features/admin/admin_settings_spec.rb
+++ b/spec/features/admin/admin_settings_spec.rb
@@ -1376,7 +1376,7 @@ RSpec.describe 'Admin updates settings', feature_category: :shared do
 
     context 'Nav bar', :js do
       it 'shows default help links in nav' do
-        default_support_url = "https://#{ApplicationHelper.promo_host}/get-help/"
+        default_support_url = Gitlab::Routing.url_helpers.promo_url(path: '/get-help/')
 
         visit root_dashboard_path
 
diff --git a/spec/frontend/projects/compare/components/app_spec.js b/spec/frontend/projects/compare/components/app_spec.js
index b093b243ea2..c9299f37580 100644
--- a/spec/frontend/projects/compare/components/app_spec.js
+++ b/spec/frontend/projects/compare/components/app_spec.js
@@ -94,11 +94,6 @@ describe('CompareApp component', () => {
       expect(findCompareButton().exists()).toBe(true);
     });
 
-    it('submits form', () => {
-      findCompareButton().vm.$emit('click');
-      expect(wrapper.find('form').element.submit).toHaveBeenCalled();
-    });
-
     it('has compare text', () => {
       expect(findCompareButton().text()).toBe('Compare');
     });
@@ -108,10 +103,11 @@ describe('CompareApp component', () => {
     const project = {
       name: 'some-to-name',
       id: '1',
+      refs_url: '/',
     };
 
     findTargetRevisionCard().vm.$emit('selectProject', {
-      direction: 'to',
+      direction: 'from',
       project,
     });
 
diff --git a/spec/frontend/projects/compare/components/mock_data.js b/spec/frontend/projects/compare/components/mock_data.js
index f4ebf071d1a..2ad5baac182 100644
--- a/spec/frontend/projects/compare/components/mock_data.js
+++ b/spec/frontend/projects/compare/components/mock_data.js
@@ -3,12 +3,12 @@ const targetProjectRefsPath = 'some/refs/path';
 const paramsName = 'to';
 const paramsBranch = 'main';
 const sourceProject = {
-  name: 'some-to-name',
-  id: '2',
+  text: 'some-to-name',
+  value: '2',
 };
 const targetProject = {
-  name: 'some-to-name',
-  id: '1',
+  text: 'some-to-name',
+  value: '1',
 };
 
 export const appDefaultProps = {
diff --git a/spec/frontend/projects/compare/components/repo_dropdown_spec.js b/spec/frontend/projects/compare/components/repo_dropdown_spec.js
index 44aaac21733..c2d3e08f398 100644
--- a/spec/frontend/projects/compare/components/repo_dropdown_spec.js
+++ b/spec/frontend/projects/compare/components/repo_dropdown_spec.js
@@ -1,22 +1,33 @@
-import { GlCollapsibleListbox, GlListboxItem } from '@gitlab/ui';
+import { GlCollapsibleListbox } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
 import { nextTick } from 'vue';
+import MockAdapter from 'axios-mock-adapter';
+import waitForPromises from 'helpers/wait_for_promises';
+import { createAlert } from '~/alert';
+import axios from '~/lib/utils/axios_utils';
 import RepoDropdown from '~/projects/compare/components/repo_dropdown.vue';
+import { HTTP_STATUS_OK, HTTP_STATUS_INTERNAL_SERVER_ERROR } from '~/lib/utils/http_status';
 import { revisionCardDefaultProps as defaultProps } from './mock_data';
 
+jest.mock('~/alert');
+
 describe('RepoDropdown component', () => {
   let wrapper;
+  let mock;
+
+  const createComponent = (props = {}, status = HTTP_STATUS_OK) => {
+    mock = new MockAdapter(axios);
+
+    mock.onGet('/target_projects').reply(status, props.projects || []);
 
-  const createComponent = (props = {}) => {
     wrapper = shallowMount(RepoDropdown, {
+      provide: {
+        targetProjectsPath: '/target_projects',
+      },
       propsData: {
         ...defaultProps,
         ...props,
       },
-      stubs: {
-        GlCollapsibleListbox,
-        GlListboxItem,
-      },
     });
   };
 
@@ -25,16 +36,20 @@ describe('RepoDropdown component', () => {
 
   describe('Source Revision', () => {
     beforeEach(() => {
-      createComponent();
+      createComponent({ disabled: true });
+    });
+
+    afterEach(() => {
+      mock.restore();
     });
 
     it('set hidden input', () => {
-      expect(findHiddenInput().attributes('value')).toBe(defaultProps.selectedProject.id);
+      expect(findHiddenInput().attributes('value')).toBe(defaultProps.selectedProject.value);
     });
 
     it('displays the project name in the disabled dropdown', () => {
       expect(findGlCollapsibleListbox().props('toggleText')).toBe(
-        defaultProps.selectedProject.name,
+        defaultProps.selectedProject.text,
       );
       expect(findGlCollapsibleListbox().props('disabled')).toBe(true);
     });
@@ -47,42 +62,88 @@ describe('RepoDropdown component', () => {
   });
 
   describe('Target Revision', () => {
-    beforeEach(() => {
-      const projects = [
-        {
-          name: 'some-to-name',
-          id: '1',
-        },
-      ];
+    describe('when target projects request succeeds', () => {
+      beforeEach(async () => {
+        const projects = [
+          {
+            full_name: 'some-to-name',
+            id: '1',
+          },
+        ];
 
-      createComponent({ paramsName: 'from', projects });
+        createComponent({ paramsName: 'from', projects });
+
+        await waitForPromises();
+      });
+
+      it('set hidden input of the selected project', () => {
+        expect(findHiddenInput().attributes('value')).toBe(defaultProps.selectedProject.value);
+      });
+
+      it('displays matching project name of the source revision initially in the dropdown', () => {
+        expect(findGlCollapsibleListbox().props('toggleText')).toBe(
+          defaultProps.selectedProject.text,
+        );
+      });
+
+      it('updates the hidden input value when dropdown item is selected', () => {
+        const repoId = '1';
+        findGlCollapsibleListbox().vm.$emit('select', repoId);
+        expect(findHiddenInput().attributes('value')).toBe(repoId);
+      });
+
+      it('emits `selectProject` event when another target project is selected', async () => {
+        findGlCollapsibleListbox().vm.$emit('select', '1');
+
+        await nextTick();
+
+        expect(wrapper.emitted().selectProject).toEqual([
+          [
+            {
+              direction: 'from',
+              project: { full_name: 'some-to-name', id: '1', text: 'some-to-name', value: '1' },
+            },
+          ],
+        ]);
+      });
+
+      it('sets items on drodpown to projects from API', () => {
+        expect(findGlCollapsibleListbox().props('items')).toEqual([
+          {
+            full_name: 'some-to-name',
+            id: '1',
+            value: '1',
+            text: 'some-to-name',
+          },
+        ]);
+      });
+
+      it('searches projects from search event', async () => {
+        findGlCollapsibleListbox().vm.$emit('search', 'Test project');
+
+        await waitForPromises();
+
+        expect(mock.history.get.at(-1)).toEqual(
+          expect.objectContaining({
+            params: { search: 'Test project' },
+          }),
+        );
+      });
+    });
+  });
+
+  describe('when target projects request fails', () => {
+    beforeEach(async () => {
+      createComponent({ paramsName: 'from' }, HTTP_STATUS_INTERNAL_SERVER_ERROR);
+
+      await waitForPromises();
     });
 
-    it('set hidden input of the selected project', () => {
-      expect(findHiddenInput().attributes('value')).toBe(defaultProps.selectedProject.id);
-    });
-
-    it('displays matching project name of the source revision initially in the dropdown', () => {
-      expect(findGlCollapsibleListbox().props('toggleText')).toBe(
-        defaultProps.selectedProject.name,
-      );
-    });
-
-    it('updates the hidden input value when dropdown item is selected', () => {
-      const repoId = '1';
-      findGlCollapsibleListbox().vm.$emit('select', repoId);
-      expect(findHiddenInput().attributes('value')).toBe(repoId);
-    });
-
-    it('emits `selectProject` event when another target project is selected', async () => {
-      const repoId = '1';
-      findGlCollapsibleListbox().vm.$emit('select', repoId);
-
-      await nextTick();
-
-      expect(wrapper.emitted('selectProject')[0][0]).toEqual({
-        direction: 'from',
-        project: { id: '1', name: 'some-to-name' },
+    it('calls createAlert', () => {
+      expect(createAlert).toHaveBeenCalledWith({
+        captureError: true,
+        error: expect.anything(),
+        message: 'An error occurred while retrieving target projects.',
       });
     });
   });
diff --git a/spec/frontend/projects/compare/components/revision_dropdown_spec.js b/spec/frontend/projects/compare/components/revision_dropdown_spec.js
index f27860c5d05..7acfd47fee2 100644
--- a/spec/frontend/projects/compare/components/revision_dropdown_spec.js
+++ b/spec/frontend/projects/compare/components/revision_dropdown_spec.js
@@ -176,7 +176,7 @@ describe('RevisionDropdown component', () => {
         searchPlaceholder: 'Filter by Git revision',
         searchable: true,
         searching: false,
-        toggleClass: 'form-control compare-dropdown-toggle gl-min-w-0',
+        toggleClass: 'compare-dropdown-toggle gl-font-monospace',
         toggleText: 'Select branch/tag',
       });
     });
diff --git a/spec/frontend/vue_shared/components/customizable_dashboard/dashboard_layout_spec.js b/spec/frontend/vue_shared/components/customizable_dashboard/dashboard_layout_spec.js
deleted file mode 100644
index de5640210a1..00000000000
--- a/spec/frontend/vue_shared/components/customizable_dashboard/dashboard_layout_spec.js
+++ /dev/null
@@ -1,174 +0,0 @@
-import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
-import DashboardLayout from '~/vue_shared/components/customizable_dashboard/dashboard_layout.vue';
-import GridstackWrapper from '~/vue_shared/components/customizable_dashboard/gridstack_wrapper.vue';
-
-const dashboardConfig = {
-  title: 'Dashboard title',
-  description: 'This is my dashboard description',
-  panels: [
-    {
-      id: '1',
-      title: 'A dashboard panel',
-      gridAttributes: {
-        width: 6,
-        height: 1,
-        yPos: 0,
-        xPos: 3,
-      },
-    },
-  ],
-};
-
-describe('CustomizableDashboard', () => {
-  /** @type {import('helpers/vue_test_utils_helper').ExtendedWrapper} */
-  let wrapper;
-
-  const findTitle = () => wrapper.findByTestId('title');
-  const findDescription = () => wrapper.findByTestId('description');
-  const findActionsContainer = () => wrapper.findByTestId('actions-container');
-  const findFiltersContainer = () => wrapper.findByTestId('filters-container');
-  const findGrid = () => wrapper.findComponent(GridstackWrapper);
-
-  const panelSlotSpy = jest.fn();
-  const emptyStateSlotSpy = jest.fn();
-
-  const createWrapper = (props = {}, scopedSlots = {}) => {
-    wrapper = shallowMountExtended(DashboardLayout, {
-      propsData: {
-        config: dashboardConfig,
-        ...props,
-      },
-      scopedSlots: {
-        panel: panelSlotSpy,
-        'empty-state': emptyStateSlotSpy,
-        ...scopedSlots,
-      },
-    });
-  };
-
-  afterEach(() => {
-    panelSlotSpy.mockRestore();
-    emptyStateSlotSpy.mockRestore();
-  });
-
-  describe('default behaviour', () => {
-    beforeEach(() => {
-      createWrapper();
-    });
-
-    it('renders the dashboard title', () => {
-      expect(findTitle().text()).toContain('Dashboard title');
-    });
-
-    it('renders the dashboard description', () => {
-      expect(findDescription().text()).toContain('This is my dashboard description');
-    });
-
-    it('renders the dashboard grid with the config', () => {
-      expect(findGrid().props('value')).toMatchObject(dashboardConfig);
-    });
-
-    it('renders the panel slot for each panel', () => {
-      expect(panelSlotSpy).toHaveBeenCalledTimes(dashboardConfig.panels.length);
-    });
-
-    it('does not render the empty state', () => {
-      expect(emptyStateSlotSpy).not.toHaveBeenCalled();
-    });
-
-    it('does not render the filter or actions containers', () => {
-      expect(findFiltersContainer().exists()).toBe(false);
-      expect(findActionsContainer().exists()).toBe(false);
-    });
-  });
-
-  describe('when a dashboard has no panels', () => {
-    beforeEach(() => {
-      createWrapper({
-        config: {
-          ...dashboardConfig,
-          panels: undefined,
-        },
-      });
-    });
-
-    it('does not render the dashboard grid', () => {
-      expect(findGrid().exists()).toBe(false);
-    });
-
-    it('renders the empty state', () => {
-      expect(emptyStateSlotSpy).toHaveBeenCalled();
-    });
-  });
-
-  describe('when a dashboard has no description', () => {
-    beforeEach(() => {
-      createWrapper({
-        config: {
-          ...dashboardConfig,
-          description: undefined,
-        },
-      });
-    });
-
-    it('does not render the dashboard description', () => {
-      expect(findDescription().exists()).toBe(false);
-    });
-  });
-
-  describe('when a dashboard has title and description slots', () => {
-    const titleSlotSpy = jest.fn();
-    const descriptionSlotSpy = jest.fn();
-
-    beforeEach(() => {
-      createWrapper(
-        {},
-        {
-          title() {
-            titleSlotSpy();
-            return this.$createElement('div');
-          },
-          description() {
-            descriptionSlotSpy();
-            return this.$createElement('div');
-          },
-        },
-      );
-    });
-
-    afterEach(() => {
-      titleSlotSpy.mockRestore();
-      descriptionSlotSpy.mockRestore();
-    });
-
-    it('renders the title slot and not the config title', () => {
-      expect(titleSlotSpy).toHaveBeenCalled();
-      expect(findTitle().exists()).toBe(false);
-    });
-
-    it('renders the description slot and not the config description', () => {
-      expect(descriptionSlotSpy).toHaveBeenCalled();
-      expect(findDescription().exists()).toBe(false);
-    });
-  });
-
-  describe('when a dashboard has actions slot content', () => {
-    beforeEach(() => {
-      createWrapper({}, { actions: '<div>actions</div>' });
-    });
-
-    it('renders the action slots', () => {
-      expect(findActionsContainer().exists()).toBe(true);
-    });
-  });
-
-  describe('when a dashboard has filters slot content', () => {
-    beforeEach(() => {
-      createWrapper({}, { filters: '<div>filters</div>' });
-    });
-
-    it('renders the filters container', () => {
-      expect(findFiltersContainer().exists()).toBe(true);
-    });
-  });
-});
diff --git a/spec/graphql/mutations/work_items/reorder_spec.rb b/spec/graphql/mutations/work_items/reorder_spec.rb
new file mode 100644
index 00000000000..88b3055a627
--- /dev/null
+++ b/spec/graphql/mutations/work_items/reorder_spec.rb
@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Mutations::WorkItems::Reorder, feature_category: :team_planning do
+  include GraphqlHelpers
+  using RSpec::Parameterized::TableSyntax
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user, developer_of: project) }
+  let_it_be(:item1, reload: true) { create(:work_item, :issue, project: project, relative_position: 10) }
+  let_it_be(:item2, reload: true) { create(:work_item, :issue, project: project, relative_position: 20) }
+
+  subject(:mutation) { described_class.new(object: nil, context: query_context, field: nil) }
+
+  describe '#ready?' do
+    context 'with invalid arguments' do
+      it 'raises an error' do
+        expect { mutation.ready? }
+          .to raise_error('At least one of move_before_id and move_after_id are required')
+      end
+    end
+
+    context 'with valid arguments' do
+      where(:move_before, :move_after, :expected_result) do
+        nil | ref(:item2) | true
+        ref(:item2) | nil | true
+      end
+
+      with_them do
+        specify do
+          ready_result = mutation.ready?(
+            move_before_id: move_before&.id,
+            move_after_id: move_after&.id
+          )
+
+          expect(ready_result).to be(expected_result)
+        end
+      end
+    end
+  end
+
+  describe '#resolve' do
+    context 'when it fails to move' do
+      specify do
+        result = mutation.resolve(
+          id: item2.to_gid,
+          move_before_id: non_existing_record_id
+        )
+
+        expect(result[:errors]).to eq(["Work item not found"])
+        expect(result[:work_item]&.relative_position).to be(item2.relative_position)
+      end
+    end
+
+    context 'when moving it before other item' do
+      specify do
+        result = mutation.resolve(
+          id: item1.to_gid,
+          move_before_id: item2.id
+        )
+
+        expect(result[:errors]).to be_empty
+        expect(result[:work_item].relative_position).to be > item2.relative_position
+      end
+    end
+
+    context 'when moving it after other item' do
+      specify do
+        result = mutation.resolve(
+          id: item2.to_gid,
+          move_after_id: item1.id
+        )
+
+        expect(result[:errors]).to be_empty
+        expect(result[:work_item].relative_position).to be < item1.relative_position
+      end
+    end
+  end
+end
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 1cfb65bfa0d..00759193eaf 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -303,30 +303,6 @@ RSpec.describe ApplicationHelper do
     end
   end
 
-  unless Gitlab.jh?
-    describe '#promo_host' do
-      subject { helper.promo_host }
-
-      it 'returns the url' do
-        is_expected.to eq('about.gitlab.com')
-      end
-    end
-  end
-
-  describe '#promo_url' do
-    subject { helper.promo_url }
-
-    it 'returns the url' do
-      is_expected.to eq("https://#{helper.promo_host}")
-    end
-
-    it 'changes if promo_host changes' do
-      allow(described_class).to receive(:promo_host).and_return('foobar.baz')
-
-      is_expected.to eq('https://foobar.baz')
-    end
-  end
-
   describe '#community_forum' do
     subject { helper.community_forum }
 
@@ -348,7 +324,7 @@ RSpec.describe ApplicationHelper do
 
     context 'when alternate support url is not specified' do
       it 'builds the support url from the promo_url' do
-        expect(helper.support_url).to eq(helper.promo_url + '/get-help/')
+        expect(helper.support_url).to eq(promo_url(path: '/get-help/'))
       end
     end
   end
diff --git a/spec/helpers/auth_helper_spec.rb b/spec/helpers/auth_helper_spec.rb
index 05abd1af713..6b668992f5e 100644
--- a/spec/helpers/auth_helper_spec.rb
+++ b/spec/helpers/auth_helper_spec.rb
@@ -320,32 +320,45 @@ RSpec.describe AuthHelper, feature_category: :system_access do
   describe '#auth_app_owner_text' do
     shared_examples 'generates text with the correct info' do
       it 'includes the name of the application owner' do
-        auth_app_owner_text = helper.auth_app_owner_text(owner)
+        auth_app_owner_text = helper.auth_app_owner_text(application)
 
-        expect(auth_app_owner_text).to include(owner.name)
+        expect(auth_app_owner_text).to include(application.owner.name)
         expect(auth_app_owner_text).to include(path_to_owner)
       end
     end
 
     context 'when owner is a user' do
-      let_it_be(:owner) { create(:user) }
+      let_it_be(:application) { create(:oauth_application) }
 
-      let(:path_to_owner) { user_path(owner) }
+      let(:path_to_owner) { user_path(application.owner) }
 
       it_behaves_like 'generates text with the correct info'
     end
 
     context 'when owner is a group' do
-      let_it_be(:owner) { create(:group) }
+      let_it_be(:application) { create(:oauth_application, :group_owned) }
 
-      let(:path_to_owner) { user_path(owner) }
+      let(:path_to_owner) { user_path(application.owner) }
 
       it_behaves_like 'generates text with the correct info'
     end
 
     context 'when the user is missing' do
-      it 'returns nil' do
-        expect(helper.auth_app_owner_text(nil)).to be('An administrator added this OAuth application ')
+      let_it_be(:application) { create(:oauth_application, :without_owner) }
+
+      context 'when the application is dynamically created' do
+        let_it_be(:application) { create(:oauth_application, :dynamic) }
+
+        it 'returns a warning' do
+          expect(helper.auth_app_owner_text(application))
+            .to be('An anonymous service added this dynamically created OAuth application ')
+        end
+      end
+
+      context 'when the application is not dynamically generated' do
+        it 'returns nil' do
+          expect(helper.auth_app_owner_text(application)).to be('An administrator added this OAuth application ')
+        end
       end
     end
   end
diff --git a/spec/helpers/projects/security/configuration_helper_spec.rb b/spec/helpers/projects/security/configuration_helper_spec.rb
index 1ffe8f16d90..7e9012c4a50 100644
--- a/spec/helpers/projects/security/configuration_helper_spec.rb
+++ b/spec/helpers/projects/security/configuration_helper_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe Projects::Security::ConfigurationHelper do
   describe 'security_upgrade_path' do
     subject { security_upgrade_path }
 
-    it { is_expected.to eq("#{ApplicationHelper.promo_url}/pricing/") }
+    it { is_expected.to eq(promo_pricing_url) }
   end
 
   describe 'vulnerability_training_docs_path' do
diff --git a/spec/helpers/sidebars_helper_spec.rb b/spec/helpers/sidebars_helper_spec.rb
index 404b24e0cef..6885766deb9 100644
--- a/spec/helpers/sidebars_helper_spec.rb
+++ b/spec/helpers/sidebars_helper_spec.rb
@@ -821,12 +821,8 @@ RSpec.describe SidebarsHelper, feature_category: :navigation do
   end
 
   describe '#compare_plans_url' do
-    before do
-      allow(helper).to receive(:promo_url).and_return('https://about.gitlab.com')
-    end
-
     it 'always returns the pricing page URL' do
-      expect(helper.compare_plans_url(user: nil, group: nil, project: nil)).to eq('https://about.gitlab.com/pricing')
+      expect(helper.compare_plans_url(user: nil, group: nil, project: nil)).to eq(promo_pricing_url)
     end
   end
 
diff --git a/spec/lib/gitlab/database/dictionary_spec.rb b/spec/lib/gitlab/database/dictionary_spec.rb
index 90eb4d0cc9d..ae1fc3b1125 100644
--- a/spec/lib/gitlab/database/dictionary_spec.rb
+++ b/spec/lib/gitlab/database/dictionary_spec.rb
@@ -182,11 +182,12 @@ RSpec.describe Gitlab::Database::Dictionary, feature_category: :database do
       end
 
       describe '#desired_sharding_key_migration_job_name' do
-        let(:file_path) { 'db/docs/issue_assignees.yml' }
+        let(:file_path) { 'db/docs/bulk_import_trackers.yml' }
 
         it 'returns the name of the migration that backfills the desired sharding key' do
           expect(database_dictionary.desired_sharding_key_migration_job_name)
-            .to eq('BackfillIssueAssigneesNamespaceId')
+            .to eq(%w[BackfillBulkImportTrackersProjectId BackfillBulkImportTrackersNamespaceId
+              BackfillBulkImportTrackersOrganizationId])
         end
       end
 
diff --git a/spec/lib/gitlab/email/html_to_markdown_parser_spec.rb b/spec/lib/gitlab/email/html_to_markdown_parser_spec.rb
index 59c488739dc..49693636fce 100644
--- a/spec/lib/gitlab/email/html_to_markdown_parser_spec.rb
+++ b/spec/lib/gitlab/email/html_to_markdown_parser_spec.rb
@@ -17,8 +17,11 @@ RSpec.describe Gitlab::Email::HtmlToMarkdownParser, feature_category: :service_d
       expect(subject).to eq(
         <<~BODY.chomp
           Hello, World!
+
           This is some e-mail content. Even though it has whitespace and newlines, the e-mail converter will handle it correctly.
+
           *Even* mismatched tags.
+
           A div
           Another div
           A div
@@ -26,7 +29,9 @@ RSpec.describe Gitlab::Email::HtmlToMarkdownParser, feature_category: :service_d
 
           Another line
           Yet another line
+
           [A link](http://foo.com)
+
           <details>
           <summary>
           One</summary>
diff --git a/spec/lib/gitlab/email/reply_parser_spec.rb b/spec/lib/gitlab/email/reply_parser_spec.rb
index 05c8559e30f..1766b040646 100644
--- a/spec/lib/gitlab/email/reply_parser_spec.rb
+++ b/spec/lib/gitlab/email/reply_parser_spec.rb
@@ -70,6 +70,7 @@ RSpec.describe Gitlab::Email::ReplyParser, feature_category: :team_planning do
             Company	Contact	Country
             Alfreds Futterkiste	Maria Anders	Germany
             Centro comercial Moctezuma	Francisco Chang	Mexico
+
             Words can be like X-rays, if you use them properly—they’ll go through anything. You read and you’re pierced.
           BODY
         )
diff --git a/spec/lib/gitlab/git/finders/refs_finder_spec.rb b/spec/lib/gitlab/git/finders/refs_finder_spec.rb
index 63d794d1e59..dd9450dfbde 100644
--- a/spec/lib/gitlab/git/finders/refs_finder_spec.rb
+++ b/spec/lib/gitlab/git/finders/refs_finder_spec.rb
@@ -58,5 +58,43 @@ RSpec.describe Gitlab::Git::Finders::RefsFinder, feature_category: :source_code_
         expect { subject }.to raise_error(described_class::UnknownRefTypeError)
       end
     end
+
+    describe 'Sort' do
+      context 'without sort' do
+        let(:params) do
+          { ref_type: :tags }
+        end
+
+        it "returns refs sorted by name in ascending order" do
+          refs = subject
+
+          expect(refs.map(&:name)).to eq(['refs/tags/v1.0.0', 'refs/tags/v1.1.0', 'refs/tags/v1.1.1'])
+        end
+      end
+
+      context 'with sort by name in descending order' do
+        let(:params) do
+          { ref_type: :tags, sort_by: 'name_desc' }
+        end
+
+        it "returns refs sorted by name in descending order" do
+          refs = subject
+
+          expect(refs.map(&:name)).to eq(['refs/tags/v1.1.1', 'refs/tags/v1.1.0', 'refs/tags/v1.0.0'])
+        end
+      end
+
+      context 'with sort by updated in descending order' do
+        let(:params) do
+          { ref_type: :tags, sort_by: 'updated_desc' }
+        end
+
+        it "returns refs sorted by created timestamp in descending order" do
+          refs = subject
+
+          expect(refs.map(&:name)).to eq(['refs/tags/v1.1.1', 'refs/tags/v1.1.0', 'refs/tags/v1.0.0'])
+        end
+      end
+    end
   end
 end
diff --git a/spec/lib/gitlab/gitaly_client/list_refs_sort_spec.rb b/spec/lib/gitlab/gitaly_client/list_refs_sort_spec.rb
new file mode 100644
index 00000000000..26bae78f043
--- /dev/null
+++ b/spec/lib/gitlab/gitaly_client/list_refs_sort_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'fast_spec_helper'
+
+RSpec.describe Gitlab::GitalyClient::ListRefsSort, feature_category: :source_code_management do
+  using RSpec::Parameterized::TableSyntax
+
+  subject(:sort) { described_class.new(sort_by) }
+
+  where(:sort_by, :key, :direction) do
+    nil | Gitaly::ListRefsRequest::SortBy::Key::REFNAME | Gitaly::SortDirection::ASCENDING
+    'name_asc' | Gitaly::ListRefsRequest::SortBy::Key::REFNAME | Gitaly::SortDirection::ASCENDING
+    'name_desc' | Gitaly::ListRefsRequest::SortBy::Key::REFNAME | Gitaly::SortDirection::DESCENDING
+    'updated_asc' | Gitaly::ListRefsRequest::SortBy::Key::CREATORDATE | Gitaly::SortDirection::ASCENDING
+    'updated_desc' | Gitaly::ListRefsRequest::SortBy::Key::CREATORDATE | Gitaly::SortDirection::DESCENDING
+    'UPDATED_DESC' | Gitaly::ListRefsRequest::SortBy::Key::CREATORDATE | Gitaly::SortDirection::DESCENDING
+    'unknown' | Gitaly::ListRefsRequest::SortBy::Key::REFNAME | Gitaly::SortDirection::ASCENDING
+  end
+
+  with_them do
+    it 'is correct' do
+      expect(sort.gitaly_sort_by).to eq(Gitaly::ListRefsRequest::SortBy.new(key: key, direction: direction))
+    end
+  end
+end
diff --git a/spec/lib/gitlab/gitaly_client/ref_service_spec.rb b/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
index 8ed4d71cbc3..941277e0c08 100644
--- a/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
+++ b/spec/lib/gitlab/gitaly_client/ref_service_spec.rb
@@ -520,6 +520,38 @@ RSpec.describe Gitlab::GitalyClient::RefService, feature_category: :gitaly do
 
       client.list_refs(peel_tags: true)
     end
+
+    context 'with sorting option' do
+      it 'sends a correct list_refs message' do
+        expected_sort_by = Gitaly::ListRefsRequest::SortBy.new(
+          key: :REFNAME,
+          direction: :DESCENDING
+        )
+
+        expect_any_instance_of(Gitaly::RefService::Stub)
+          .to receive(:list_refs)
+          .with(gitaly_request_with_params(sort_by: expected_sort_by), kind_of(Hash))
+          .and_return([])
+
+        client.list_refs(sort_by: 'name_desc')
+      end
+
+      context 'when sorting option is invalid' do
+        it 'uses default sort by name' do
+          expected_sort_by = Gitaly::ListRefsRequest::SortBy.new(
+            key: :REFNAME,
+            direction: :ASCENDING
+          )
+
+          expect_any_instance_of(Gitaly::RefService::Stub)
+            .to receive(:list_refs)
+                  .with(gitaly_request_with_params(sort_by: expected_sort_by), kind_of(Hash))
+                  .and_return([])
+
+          client.list_refs(sort_by: 'invalid')
+        end
+      end
+    end
   end
 
   describe '#find_refs_by_oid' do
diff --git a/spec/lib/gitlab/saas_spec.rb b/spec/lib/gitlab/saas_spec.rb
index e9132b7a229..baa801d1578 100644
--- a/spec/lib/gitlab/saas_spec.rb
+++ b/spec/lib/gitlab/saas_spec.rb
@@ -17,4 +17,12 @@ RSpec.describe Gitlab::Saas, feature_category: :shared do
 
     it { is_expected.to eq(get_next_url) }
   end
+
+  describe '.promo_host' do
+    subject { described_class.promo_host }
+
+    it 'returns the url' do
+      is_expected.to eq('about.gitlab.com')
+    end
+  end
 end
diff --git a/spec/migrations/20250501083748_set_api_rate_limits_to_zero_spec.rb b/spec/migrations/20250501083748_set_api_rate_limits_to_zero_spec.rb
index 80792f10171..f31ba348a1c 100644
--- a/spec/migrations/20250501083748_set_api_rate_limits_to_zero_spec.rb
+++ b/spec/migrations/20250501083748_set_api_rate_limits_to_zero_spec.rb
@@ -14,54 +14,8 @@ RSpec.describe SetApiRateLimitsToZero, feature_category: :groups_and_projects do
   end
 
   describe '#up' do
-    context 'when running on GitLab.com' do
-      before do
-        allow(Gitlab).to receive(:com?).and_return(true)
-      end
-
-      it 'does not modify any rate limits' do
-        expect { migration.up }.not_to change { application_settings.first.rate_limits }
-      end
-    end
-
-    context 'when not running on GitLab.com' do
-      before do
-        allow(Gitlab).to receive(:com?).and_return(false)
-      end
-
-      it 'sets all API rate limits to zero' do
-        migration.up
-
-        settings = application_settings.first
-        expect(settings.rate_limits).to include(
-          # Groups and projects API limits
-          'group_api_limit' => 0,
-          'group_projects_api_limit' => 0,
-          'group_shared_groups_api_limit' => 0,
-          'groups_api_limit' => 0,
-          'project_api_limit' => 0,
-          'projects_api_limit' => 0,
-          'user_contributed_projects_api_limit' => 0,
-          'user_projects_api_limit' => 0,
-          'user_starred_projects_api_limit' => 0,
-
-          # Users API limits
-          'users_api_limit_followers' => 0,
-          'users_api_limit_following' => 0,
-          'users_api_limit_status' => 0,
-          'users_api_limit_ssh_keys' => 0,
-          'users_api_limit_ssh_key' => 0,
-          'users_api_limit_gpg_keys' => 0,
-          'users_api_limit_gpg_key' => 0
-        )
-      end
-
-      it 'does not change other rate limits' do
-        migration.up
-
-        settings = application_settings.first
-        expect(settings.rate_limits).to include('create_organization_api_limit' => create_organization_api_limit)
-      end
+    it 'does not modify any rate limits (no-op migration)' do
+      expect { migration.up }.not_to change { application_settings.first.rate_limits }
     end
   end
 
diff --git a/spec/requests/api/graphql/mutations/work_items/reorder_spec.rb b/spec/requests/api/graphql/mutations/work_items/reorder_spec.rb
new file mode 100644
index 00000000000..3b510d7b0ea
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/work_items/reorder_spec.rb
@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Reorder work items', feature_category: :team_planning do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user, developer_of: project) }
+  let_it_be(:item1, reload: true) { create(:work_item, :issue, project: project, relative_position: 10) }
+  let_it_be(:item2, reload: true) { create(:work_item, :issue, project: project, relative_position: 20) }
+  let_it_be(:item3, reload: true) { create(:work_item, :issue, project: project, relative_position: 20) }
+
+  let(:input) do
+    {
+      id: item1.to_gid.to_s
+    }
+  end
+
+  let(:mutation) { graphql_mutation(:work_items_reorder, input) }
+  let(:mutation_response) { graphql_mutation_response(:work_items_reorder) }
+
+  context 'when missing arguments' do
+    let(:input) do
+      {
+        id: item1.to_gid.to_s
+      }
+    end
+
+    it 'returns an error' do
+      expect { post_graphql_mutation(mutation, current_user: current_user) }
+        .not_to change { item1.relative_position }
+
+      expect_graphql_errors_to_include(
+        'At least one of move_before_id and move_after_id are required'
+      )
+    end
+  end
+
+  context 'when all arguments are given' do
+    context 'when moving it before other item' do
+      let(:input) do
+        {
+          id: item1.to_gid.to_s,
+          move_before_id: item2.to_gid.to_s
+        }
+      end
+
+      specify do
+        expect { post_graphql_mutation(mutation, current_user: current_user) }
+          .to change { item1.reload.relative_position }.to be > item2.relative_position
+
+        expect(graphql_errors).to be_blank
+        expect(mutation_response['errors']).to be_blank
+      end
+    end
+
+    context 'when moving it after other item' do
+      let(:input) do
+        {
+          id: item2.to_gid.to_s,
+          move_after_id: item1.to_gid.to_s
+        }
+      end
+
+      specify do
+        expect { post_graphql_mutation(mutation, current_user: current_user) }
+          .to change { item2.reload.relative_position }.to be < item1.relative_position
+
+        expect(graphql_errors).to be_blank
+        expect(mutation_response['errors']).to be_blank
+      end
+    end
+  end
+end
diff --git a/spec/requests/jwks_controller_spec.rb b/spec/requests/jwks_controller_spec.rb
index cd84a19f39f..869da2904aa 100644
--- a/spec/requests/jwks_controller_spec.rb
+++ b/spec/requests/jwks_controller_spec.rb
@@ -8,6 +8,7 @@ RSpec.describe JwksController, feature_category: :system_access do
       [
         "/oauth/discovery/keys",
         "/.well-known/openid-configuration",
+        "/.well-known/oauth-authorization-server",
         "/.well-known/webfinger?resource=#{create(:user).email}"
       ].each do |endpoint|
         get endpoint
diff --git a/spec/requests/oauth/authorizations_controller_spec.rb b/spec/requests/oauth/authorizations_controller_spec.rb
index 9dfab850487..e425e890a7f 100644
--- a/spec/requests/oauth/authorizations_controller_spec.rb
+++ b/spec/requests/oauth/authorizations_controller_spec.rb
@@ -22,6 +22,43 @@ RSpec.describe Oauth::AuthorizationsController, :with_current_organization, feat
     sign_in(user)
   end
 
+  describe 'POST #create' do
+    context 'with dynamic OAuth application' do
+      let_it_be(:application) { create(:oauth_application, :dynamic, redirect_uri: 'http://example.com') }
+
+      context 'when code_challenge is missing' do
+        it 'returns 200 and renders error view with PKCE error' do
+          post oauth_authorization_path, params: params
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to render_template('doorkeeper/authorizations/error')
+          expect(response.body).to include('PKCE code_challenge is required for dynamic OAuth applications')
+        end
+      end
+
+      context 'when code_challenge is present' do
+        it 'allows the request to proceed past PKCE validation' do
+          post oauth_authorization_path,
+            params: params.merge(code_challenge: 'valid_code_challenge', code_challenge_method: 'S256')
+
+          expect(response.body).not_to include('PKCE code_challenge is required')
+        end
+      end
+    end
+
+    context 'with non-dynamic OAuth application' do
+      let_it_be(:application) { create(:oauth_application, redirect_uri: 'http://example.com') }
+
+      context 'when code_challenge is missing' do
+        it 'does not enforce PKCE validation' do
+          post oauth_authorization_path, params: params
+
+          expect(response.body).not_to include('PKCE')
+        end
+      end
+    end
+  end
+
   describe 'GET #new' do
     it_behaves_like 'Base action controller' do
       subject(:request) { get oauth_authorization_path }
@@ -97,5 +134,85 @@ RSpec.describe Oauth::AuthorizationsController, :with_current_organization, feat
         expect(response).to redirect_to(new_user_session_path)
       end
     end
+
+    describe 'PKCE validation for dynamic applications' do
+      context 'with non-dynamic OAuth applications' do
+        context 'when an owner is defined' do
+          let_it_be(:application) { create(:oauth_application, redirect_uri: 'http://example.com') }
+
+          context 'when code_challenge is missing' do
+            it 'does not enforce PKCE validation' do
+              get oauth_authorization_path, params: params
+
+              expect(response).to have_gitlab_http_status(:ok)
+              expect(response).to render_template('doorkeeper/authorizations/new')
+              expect(response.body).not_to include('PKCE')
+            end
+          end
+        end
+
+        context 'with application that is explicitly not dynamic' do
+          let_it_be(:application) do
+            create(:oauth_application, :without_owner, redirect_uri: 'http://example.com')
+          end
+
+          context 'when code_challenge is missing' do
+            it 'does not enforce PKCE validation' do
+              get oauth_authorization_path, params: params
+
+              expect(response).to have_gitlab_http_status(:ok)
+              expect(response).to render_template('doorkeeper/authorizations/new')
+              expect(response.body).not_to include('PKCE')
+            end
+          end
+        end
+      end
+
+      context 'with dynamic OAuth application' do
+        let_it_be(:application) { create(:oauth_application, :dynamic, redirect_uri: 'http://example.com') }
+
+        context 'when code_challenge is missing' do
+          it 'returns 200 and renders error view with PKCE error' do
+            get oauth_authorization_path, params: params
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to render_template('doorkeeper/authorizations/error')
+            expect(response.body).to include('PKCE code_challenge is required for dynamic OAuth applications')
+          end
+        end
+
+        context 'when code_challenge is blank' do
+          it 'returns 200 and renders error view with PKCE error' do
+            get oauth_authorization_path, params: params.merge(code_challenge: '')
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to render_template('doorkeeper/authorizations/error')
+            expect(response.body).to include('PKCE code_challenge is required for dynamic OAuth applications')
+          end
+        end
+
+        context 'when SHA-256 code_challenge is present' do
+          it 'allows the request to proceed past PKCE validation' do
+            get oauth_authorization_path,
+              params: params.merge(code_challenge: 'valid_code_challenge', code_challenge_method: 'S256')
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to render_template('doorkeeper/authorizations/new')
+            expect(response.body).not_to include('PKCE code_challenge is required')
+          end
+        end
+
+        context 'when plain code_challenge is present' do
+          it 'returns 200 and renders error view with PKCE error' do
+            get oauth_authorization_path,
+              params: params.merge(code_challenge: 'valid_code_challenge', code_challenge_method: 'plain')
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to render_template('doorkeeper/authorizations/error')
+            expect(response.body).to include('there are no accepted code_challenge_method values')
+          end
+        end
+      end
+    end
   end
 end
diff --git a/spec/requests/oauth/dynamic_registrations_controller_spec.rb b/spec/requests/oauth/dynamic_registrations_controller_spec.rb
new file mode 100644
index 00000000000..8891e261308
--- /dev/null
+++ b/spec/requests/oauth/dynamic_registrations_controller_spec.rb
@@ -0,0 +1,522 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Oauth::DynamicRegistrationsController, feature_category: :system_access do
+  let(:oauth_registration_path) { Gitlab::Routing.url_helpers.oauth_register_path }
+
+  let(:valid_request_body) do
+    {
+      client_name: 'Test Application',
+      redirect_uris: ['http://example.com/callback'],
+      scope: 'api read_user'
+    }
+  end
+
+  let(:headers) { { 'Content-Type' => 'application/json' } }
+
+  RSpec.shared_examples 'creates application successfully' do
+    before do
+      create_registration
+    end
+
+    it 'returns created status' do
+      expect(response).to have_gitlab_http_status(:created)
+    end
+  end
+
+  RSpec.shared_examples 'rejects request with bad_request' do
+    let(:initial_count) { Doorkeeper::Application.count }
+
+    before do
+      initial_count
+    end
+
+    it 'returns bad request status' do
+      create_registration
+      expect(response).to have_gitlab_http_status(:bad_request)
+    end
+
+    it 'does not create application' do
+      expect { create_registration }.not_to change { Doorkeeper::Application.count }
+    end
+  end
+
+  describe 'POST /oauth/register' do
+    subject(:create_registration) do
+      post oauth_registration_path, params: request_body.to_json, headers: headers
+    end
+
+    context 'when feature flag is enabled' do
+      context 'with valid parameters' do
+        let(:request_body) { valid_request_body }
+
+        it 'creates a new OAuth application' do
+          expect { create_registration }.to change { Doorkeeper::Application.count }.by(1)
+        end
+
+        it_behaves_like 'creates application successfully'
+
+        it 'returns correct JSON response structure' do
+          create_registration
+
+          application = Doorkeeper::Application.last.reload
+          expect(response.parsed_body).to include(
+            'client_id' => application.uid,
+            'client_id_issued_at' => application.created_at.to_i,
+            'redirect_uris' => ['http://example.com/callback'],
+            'grant_types' => 'authorization_code',
+            'client_name' => '[Unverified Dynamic Application] Test Application',
+            'scope' => 'api read_user',
+            'dynamic' => true
+          )
+        end
+
+        it 'creates application with correct attributes' do
+          create_registration
+
+          application = Doorkeeper::Application.last
+          expect(application).to have_attributes(
+            name: '[Unverified Dynamic Application] Test Application',
+            redirect_uri: 'http://example.com/callback',
+            confidential: false,
+            dynamic: true
+          )
+          expect(application.scopes.to_s).to eq('api read_user')
+        end
+
+        it 'sets content type to JSON' do
+          create_registration
+          expect(response.content_type).to include('application/json')
+        end
+
+        context 'when validating application attributes' do
+          before do
+            create_registration
+          end
+
+          let(:created_application) { Doorkeeper::Application.last }
+
+          it 'generates unique client_id and client_secret' do
+            expect(created_application.uid).to be_present
+            expect(created_application.uid).to be_a(String)
+          end
+        end
+
+        it 'sets client_id_issued_at to current time' do
+          freeze_time do
+            create_registration
+
+            expect(response.parsed_body['client_id_issued_at']).to eq(Time.current.to_i)
+          end
+        end
+      end
+
+      context 'with redirect URI variations' do
+        context 'with multiple redirect URIs as array' do
+          let(:request_body) do
+            valid_request_body.merge(
+              redirect_uris: %w[http://example.com/callback http://example.com/callback2]
+            )
+          end
+
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'creates application with multiple redirect URIs' do
+            expect(created_application.redirect_uri).to eq("http://example.com/callback\nhttp://example.com/callback2")
+          end
+
+          it 'returns multiple redirect URIs in response' do
+            expect(response.parsed_body['redirect_uris'])
+              .to eq(%w[http://example.com/callback http://example.com/callback2])
+          end
+        end
+
+        context 'with redirect URI as string' do
+          let(:request_body) do
+            valid_request_body.merge(redirect_uris: 'http://example.com/callback')
+          end
+
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'creates application with single redirect URI' do
+            expect(created_application.redirect_uri).to eq('http://example.com/callback')
+          end
+
+          it 'returns single redirect URI as array in response' do
+            expect(response.parsed_body['redirect_uris']).to eq(['http://example.com/callback'])
+          end
+        end
+
+        context 'with missing redirect_uris' do
+          let(:request_body) { valid_request_body.except(:redirect_uris) }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+
+        context 'with empty redirect_uris array' do
+          let(:request_body) { valid_request_body.merge(redirect_uris: []) }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+
+        context 'with invalid redirect URI' do
+          let(:request_body) { valid_request_body.merge(redirect_uris: ['invalid-uri']) }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+
+        context 'with HTTPS redirect URIs' do
+          let(:request_body) do
+            valid_request_body.merge(redirect_uris: ['https://secure.example.com/callback'])
+          end
+
+          it_behaves_like 'creates application successfully'
+        end
+
+        context 'with localhost redirect URIs' do
+          let(:request_body) do
+            valid_request_body.merge(redirect_uris: ['http://localhost:3000/callback'])
+          end
+
+          it_behaves_like 'creates application successfully'
+        end
+
+        context 'with custom scheme redirect URIs' do
+          let(:request_body) do
+            valid_request_body.merge(redirect_uris: ['myapp://callback'])
+          end
+
+          it_behaves_like 'creates application successfully'
+        end
+      end
+
+      context 'with scope variations' do
+        context 'with no scope provided' do
+          let(:request_body) { valid_request_body.except(:scope) }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses default api scope' do
+            expect(created_application.scopes.to_s).to eq('api')
+          end
+
+          it 'returns default scope in response' do
+            expect(response.parsed_body['scope']).to eq('api')
+          end
+        end
+
+        context 'with empty scope' do
+          let(:request_body) { valid_request_body.merge(scope: '') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses default api scope' do
+            expect(created_application.scopes.to_s).to eq('api')
+          end
+        end
+
+        context 'with nil scope' do
+          let(:request_body) { valid_request_body.merge(scope: nil) }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses default api scope' do
+            expect(created_application.scopes.to_s).to eq('api')
+          end
+        end
+
+        context 'with whitespace-only scope' do
+          let(:request_body) { valid_request_body.merge(scope: '   ') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses default api scope' do
+            expect(created_application.scopes.to_s).to eq('api')
+          end
+        end
+
+        context 'with multiple spaces in scope' do
+          let(:request_body) { valid_request_body.merge(scope: 'api    read_user') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'handles multiple spaces correctly' do
+            expect(response).to have_gitlab_http_status(:created)
+            expect(created_application.scopes.to_s).to eq('api read_user')
+          end
+        end
+
+        context 'with single scope' do
+          let(:request_body) { valid_request_body.merge(scope: 'read_user') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses provided scope' do
+            expect(created_application.scopes.to_s).to eq('read_user')
+          end
+        end
+
+        context 'with multiple scopes' do
+          let(:request_body) { valid_request_body.merge(scope: 'api read_user read_repository') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'uses all provided scopes' do
+            expect(created_application.scopes.to_s).to eq('api read_user read_repository')
+          end
+        end
+      end
+
+      context 'with client_name variations' do
+        context 'with minimal valid parameters' do
+          let(:request_body) do
+            {
+              client_name: 'Minimal App',
+              redirect_uris: ['http://example.com/callback']
+            }
+          end
+
+          it 'creates application successfully' do
+            create_registration
+
+            expect(response).to have_gitlab_http_status(:created)
+
+            application = Doorkeeper::Application.last
+            expect(application.name).to eq('[Unverified Dynamic Application] Minimal App')
+            expect(application.redirect_uri).to eq('http://example.com/callback')
+            expect(application.scopes.to_s).to eq('api')
+          end
+        end
+
+        context 'with very long client name' do
+          let(:request_body) { valid_request_body.merge(client_name: 'A' * 1000) }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+
+        context 'with special characters in client name' do
+          let(:request_body) { valid_request_body.merge(client_name: 'Test App & Co. (v1.0)') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'handles special characters correctly' do
+            expect(created_application.name).to eq('[Unverified Dynamic Application] Test App & Co. (v1.0)')
+          end
+        end
+
+        context 'with Unicode characters in client name' do
+          let(:request_body) { valid_request_body.merge(client_name: 'Test 应用程序 🚀') }
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'handles Unicode characters correctly' do
+            expect(created_application.name).to eq('[Unverified Dynamic Application] Test 应用程序 🚀')
+          end
+        end
+
+        context 'with empty client name' do
+          let(:request_body) { valid_request_body.merge(client_name: '') }
+
+          it_behaves_like 'rejects request with bad_request'
+
+          it 'returns error response' do
+            create_registration
+            expect(response.parsed_body).to include(
+              'error' => 'invalid_client_metadata'
+            )
+            expect(response.parsed_body['error_description']).to be_present
+          end
+        end
+
+        context 'with nil client name' do
+          let(:request_body) { valid_request_body.merge(client_name: nil) }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+      end
+
+      context 'with parameter filtering' do
+        context 'with disallowed parameters' do
+          let(:request_body) do
+            valid_request_body.merge(
+              confidential: false,
+              dynamic: false,
+              uid: 'custom_uid',
+              secret: 'custom_secret',
+              created_at: 1.day.ago.to_i,
+              updated_at: 1.day.ago.to_i
+            )
+          end
+
+          let(:created_application) { Doorkeeper::Application.last }
+
+          before do
+            create_registration
+          end
+
+          it 'filters out disallowed parameters' do
+            expect(created_application.name).to eq('[Unverified Dynamic Application] Test Application')
+            expect(created_application.confidential).to be false # Should always be true
+            expect(created_application.dynamic).to be true # Should always be true
+            expect(created_application.uid).not_to eq('custom_uid')
+            expect(created_application.secret).not_to eq('custom_secret')
+          end
+        end
+      end
+
+      context 'with extra unknown parameters' do
+        let(:request_body) do
+          valid_request_body.merge(
+            unknown_param: 'value',
+            another_param: 'another_value'
+          )
+        end
+
+        let(:created_application) { Doorkeeper::Application.last }
+
+        before do
+          create_registration
+        end
+
+        it 'ignores unknown parameters' do
+          expect(response).to have_gitlab_http_status(:created)
+          expect(created_application.name).to eq('[Unverified Dynamic Application] Test Application')
+        end
+      end
+
+      context 'with request body format issues' do
+        context 'with invalid JSON' do
+          let(:request_body) { '{ invalid json' }
+
+          it 'returns bad request status' do
+            post oauth_registration_path, params: request_body, headers: headers
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
+
+          it 'does not create application' do
+            expect do
+              post oauth_registration_path, params: request_body, headers: headers
+            end.not_to change { Doorkeeper::Application.count }
+          end
+        end
+
+        context 'with empty request body' do
+          let(:request_body) { {} }
+
+          it_behaves_like 'rejects request with bad_request'
+        end
+      end
+
+      context 'with database validation failures' do
+        context 'with duplicate application name' do
+          let(:request_body) { valid_request_body.merge(client_name: 'Duplicate App') }
+
+          before do
+            create(:application, name: 'Duplicate App')
+          end
+
+          it 'creates application successfully' do
+            create_registration
+            expect(response).to have_gitlab_http_status(:created)
+          end
+
+          it 'allows duplicate names' do
+            expect { create_registration }.to change { Doorkeeper::Application.count }.by(1)
+          end
+        end
+
+        context 'with extremely long redirect URI' do
+          let(:request_body) do
+            valid_request_body.merge(redirect_uris: ["http://example.com/callback#{'a' * 10000}"])
+          end
+
+          it 'handles long redirect URIs appropriately' do
+            create_registration
+
+            expect(response).to have_gitlab_http_status(:created).or have_gitlab_http_status(:bad_request)
+          end
+        end
+      end
+
+      context 'with application creation edge cases' do
+        context 'when application fails to save' do
+          let(:request_body) { valid_request_body }
+
+          before do
+            allow_next_instance_of(Doorkeeper::Application) do |application|
+              errors = ActiveModel::Errors.new(application)
+              allow(errors).to receive(:full_messages).and_return(['Name is invalid'])
+              allow(application).to receive_messages(persisted?: false, errors: errors)
+            end
+          end
+
+          it 'returns bad request status' do
+            create_registration
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
+
+          it 'returns error response with validation messages' do
+            create_registration
+            expect(response.parsed_body).to include(
+              'error' => 'invalid_client_metadata',
+              'error_description' => 'Name is invalid'
+            )
+          end
+        end
+      end
+    end
+
+    context 'when feature flag is disabled' do
+      let(:request_body) { valid_request_body }
+
+      before do
+        stub_feature_flags(oauth_dynamic_client_registration: false)
+      end
+
+      it 'returns 404' do
+        create_registration
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'does not create application' do
+        expect { create_registration }.not_to change { Doorkeeper::Application.count }
+      end
+    end
+  end
+end
diff --git a/spec/requests/oauth/protected_resource_metadata_controller_spec.rb b/spec/requests/oauth/protected_resource_metadata_controller_spec.rb
new file mode 100644
index 00000000000..22c7a3ce835
--- /dev/null
+++ b/spec/requests/oauth/protected_resource_metadata_controller_spec.rb
@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Oauth::ProtectedResourceMetadataController, feature_category: :system_access do
+  describe 'GET /.well-known/oauth-protected-resource' do
+    let(:protected_resource_path) { Gitlab::Routing.url_helpers.oauth_protected_resource_metadata_path }
+    let(:expected_response) do
+      {
+        'resource' => "http://www.example.com/api/v4/mcp",
+        'authorization_servers' => [
+          "http://www.example.com"
+        ]
+      }
+    end
+
+    before do
+      get protected_resource_path
+    end
+
+    it 'returns 200 status' do
+      expect(response).to have_gitlab_http_status(:ok)
+    end
+
+    it 'returns correct content type' do
+      expect(response.content_type).to eq('application/json; charset=utf-8')
+    end
+
+    it 'returns the expected JSON structure' do
+      expect(response.parsed_body).to eq(expected_response)
+    end
+
+    it 'includes correct caching headers' do
+      cache_control = response.headers['Cache-Control']
+      expect(cache_control).to include('max-age=86400')
+      expect(cache_control).to include('public')
+      expect(cache_control).to include('must-revalidate')
+      expect(cache_control).to include('no-transform')
+    end
+
+    context 'when using custom base URL' do
+      let(:custom_host) { 'https://custom-gitlab.example.com' }
+
+      before do
+        allow_next_instance_of(ActionDispatch::Request) do |instance|
+          allow(instance).to receive(:base_url).and_return(custom_host)
+        end
+
+        get protected_resource_path
+      end
+
+      it 'returns metadata with custom base URL' do
+        expected_custom_response = {
+          'resource' => "#{custom_host}/api/v4/mcp",
+          'authorization_servers' => [
+            custom_host
+          ]
+        }
+
+        expect(response.parsed_body).to eq(expected_custom_response)
+      end
+    end
+
+    context 'without authentication' do
+      it 'does not require authentication' do
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    context 'with authenticated user' do
+      let_it_be(:user) { create(:user) }
+
+      before do
+        sign_in(user)
+
+        get protected_resource_path
+      end
+
+      it 'returns the same response as unauthenticated request' do
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.parsed_body).to eq(expected_response)
+      end
+    end
+
+    context 'when validating response' do
+      it 'contains required fields' do
+        response_body = response.parsed_body
+
+        expect(response_body).to have_key('resource')
+        expect(response_body).to have_key('authorization_servers')
+      end
+
+      it 'has correct resource format' do
+        resource_url = response.parsed_body['resource']
+
+        expect(resource_url).to be_a(String)
+        expect(resource_url).to end_with('/api/v4/mcp')
+        expect(resource_url).to match(%r{\Ahttps?://})
+      end
+
+      it 'has correct authorization_servers format' do
+        auth_servers = response.parsed_body['authorization_servers']
+
+        expect(auth_servers).to be_a(Array)
+        expect(auth_servers.length).to eq(1)
+        expect(auth_servers.first).to be_a(String)
+        expect(auth_servers.first).to match(%r{\Ahttps?://})
+      end
+
+      it 'authorization_servers contains the same base URL as resource' do
+        response_body = response.parsed_body
+        resource_base = response_body['resource'].gsub('/api/v4/mcp', '')
+        auth_server = response_body['authorization_servers'].first
+
+        expect(auth_server).to eq(resource_base)
+      end
+    end
+  end
+end
diff --git a/spec/requests/oauth/tokens_controller_spec.rb b/spec/requests/oauth/tokens_controller_spec.rb
index f5fe983c853..fef104e1135 100644
--- a/spec/requests/oauth/tokens_controller_spec.rb
+++ b/spec/requests/oauth/tokens_controller_spec.rb
@@ -132,6 +132,131 @@ RSpec.describe Oauth::TokensController, feature_category: :system_access do
         end
       end
     end
+
+    describe 'PKCE validation for dynamic applications' do
+      let_it_be(:user) { create(:user) }
+
+      context 'with dynamic OAuth application' do
+        let_it_be(:oauth_application) { create(:oauth_application, :dynamic) }
+        let_it_be(:oauth_access_grant) do
+          create(:oauth_access_grant,
+            application: oauth_application,
+            redirect_uri: oauth_application.redirect_uri,
+            resource_owner_id: user.id)
+        end
+
+        let(:base_params) do
+          {
+            grant_type: 'authorization_code',
+            client_id: oauth_application.uid,
+            client_secret: oauth_application.secret,
+            redirect_uri: oauth_application.redirect_uri,
+            code: oauth_access_grant.token
+          }
+        end
+
+        context 'when code_verifier is missing' do
+          it 'returns bad request with PKCE error' do
+            post('/oauth/token', params: base_params)
+
+            expect(response).to have_gitlab_http_status(:bad_request)
+            expect(response.parsed_body).to eq({
+              'error' => 'invalid_request',
+              'error_description' => 'PKCE code_verifier is required for dynamic OAuth applications'
+            })
+          end
+        end
+
+        context 'when code_verifier is blank' do
+          it 'returns bad request with PKCE error' do
+            post('/oauth/token', params: base_params.merge(code_verifier: ''))
+
+            expect(response).to have_gitlab_http_status(:bad_request)
+            expect(response.parsed_body).to eq({
+              'error' => 'invalid_request',
+              'error_description' => 'PKCE code_verifier is required for dynamic OAuth applications'
+            })
+          end
+        end
+
+        context 'when code_verifier is present' do
+          it 'allows the request to proceed past PKCE validation' do
+            post('/oauth/token', params: base_params.merge(code_verifier: 'valid_code_verifier'))
+
+            expect(response.parsed_body['error']).not_to eq('invalid_request')
+            expect(response.parsed_body['error_description']).not_to include('PKCE code_verifier is required')
+          end
+        end
+      end
+
+      context 'with non-dynamic OAuth application' do
+        let_it_be(:oauth_application) { create(:oauth_application) }
+        let_it_be(:oauth_access_grant) do
+          create(:oauth_access_grant,
+            application: oauth_application,
+            redirect_uri: oauth_application.redirect_uri,
+            resource_owner_id: user.id)
+        end
+
+        let(:base_params) do
+          {
+            grant_type: 'authorization_code',
+            client_id: oauth_application.uid,
+            client_secret: oauth_application.secret,
+            redirect_uri: oauth_application.redirect_uri,
+            code: oauth_access_grant.token
+          }
+        end
+
+        context 'when code_verifier is missing' do
+          it 'does not enforce PKCE validation' do
+            post('/oauth/token', params: base_params)
+
+            # Should not be rejected due to missing code_verifier
+            expect(response.parsed_body['error']).not_to eq('invalid_request')
+
+            if response.parsed_body['error_description']
+              expect(
+                response.parsed_body['error_description']
+              ).not_to include('PKCE')
+            end
+          end
+        end
+      end
+
+      context 'with application that is explicitly not dynamic' do
+        let_it_be(:oauth_application) { create(:oauth_application, :without_owner) }
+        let_it_be(:oauth_access_grant) do
+          create(:oauth_access_grant,
+            application: oauth_application,
+            redirect_uri: oauth_application.redirect_uri,
+            resource_owner_id: user.id)
+        end
+
+        let(:base_params) do
+          {
+            grant_type: 'authorization_code',
+            client_id: oauth_application.uid,
+            client_secret: oauth_application.secret,
+            redirect_uri: oauth_application.redirect_uri,
+            code: oauth_access_grant.token
+          }
+        end
+
+        context 'when code_verifier is missing' do
+          it 'does not enforce PKCE validation' do
+            post('/oauth/token', params: base_params)
+
+            expect(response.parsed_body['error']).not_to eq('invalid_request')
+
+            if response.parsed_body['error_description']
+              expect(response.parsed_body['error_description'])
+                .not_to include('PKCE')
+            end
+          end
+        end
+      end
+    end
   end
 
   context 'for CORS requests' do
diff --git a/spec/routing/directs/about_spec.rb b/spec/routing/directs/about_spec.rb
deleted file mode 100644
index e6615cb1f87..00000000000
--- a/spec/routing/directs/about_spec.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe 'About site URLs', 'about', feature_category: :shared do
-  describe 'about_url' do
-    subject { about_url }
-
-    context 'when STAGING_CUSTOMER_PORTAL_URL is unset' do
-      it { is_expected.to eq('https://about.gitlab.com') }
-    end
-  end
-end
diff --git a/spec/routing/directs/promo_spec.rb b/spec/routing/directs/promo_spec.rb
new file mode 100644
index 00000000000..57296eb8d16
--- /dev/null
+++ b/spec/routing/directs/promo_spec.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Promo site URLs', 'about', feature_category: :shared do
+  describe 'promo_url' do
+    subject { promo_url }
+
+    it { is_expected.to eq('https://about.gitlab.com') }
+
+    context 'with query parameters' do
+      subject { promo_url(query: { utm_source: 'gitlab', utm_medium: 'web' }) }
+
+      it { is_expected.to eq('https://about.gitlab.com?utm_source=gitlab&utm_medium=web') }
+    end
+
+    context 'with path' do
+      subject { promo_url(path: '/features') }
+
+      it { is_expected.to eq('https://about.gitlab.com/features') }
+    end
+
+    context 'with anchor' do
+      subject { promo_url(anchor: 'section1') }
+
+      it { is_expected.to eq('https://about.gitlab.com#section1') }
+    end
+
+    context 'with all options' do
+      subject { promo_url(path: '/solutions', query: { ref: 'navbar' }, anchor: 'devops') }
+
+      it { is_expected.to eq('https://about.gitlab.com/solutions?ref=navbar#devops') }
+    end
+  end
+
+  describe 'promo_pricing_url' do
+    subject { promo_pricing_url }
+
+    it { is_expected.to eq('https://about.gitlab.com/pricing') }
+
+    context 'with additional path' do
+      subject { promo_pricing_url(path: '/saas') }
+
+      it { is_expected.to eq('https://about.gitlab.com/pricing/saas') }
+    end
+
+    context 'with query parameters' do
+      subject { promo_pricing_url(query: { plan: 'premium' }) }
+
+      it { is_expected.to eq('https://about.gitlab.com/pricing?plan=premium') }
+    end
+
+    context 'with anchor' do
+      subject { promo_pricing_url(anchor: 'features') }
+
+      it { is_expected.to eq('https://about.gitlab.com/pricing#features') }
+    end
+
+    context 'with all options' do
+      subject { promo_pricing_url(path: '/enterprise', query: { trial: 'true' }, anchor: 'contact') }
+
+      it { is_expected.to eq('https://about.gitlab.com/pricing/enterprise?trial=true#contact') }
+    end
+  end
+end
diff --git a/spec/services/work_items/reorder_service_spec.rb b/spec/services/work_items/reorder_service_spec.rb
new file mode 100644
index 00000000000..6fdcae3eba6
--- /dev/null
+++ b/spec/services/work_items/reorder_service_spec.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe WorkItems::ReorderService, feature_category: :team_planning do
+  let_it_be(:user)    { create_default(:user) }
+  let_it_be(:group)   { create(:group) }
+  let_it_be(:project, reload: true) { create(:project, namespace: group) }
+
+  describe '#execute' do
+    let_it_be(:item1, reload: true) { create(:work_item, :issue, project: project, relative_position: 10) }
+    let_it_be(:item2, reload: true) { create(:work_item, :issue, project: project, relative_position: 20) }
+    let_it_be(:item3, reload: true) { create(:work_item, :issue, project: project, relative_position: 30) }
+
+    let(:work_item) { item1 }
+    let(:params) { {} }
+
+    subject(:service_result) do
+      described_class
+        .new(current_user: user, params: params)
+        .execute(work_item)
+    end
+
+    context 'when ordering work items in a project' do
+      before do
+        project.add_developer(user)
+      end
+
+      it_behaves_like 'reorder service'
+    end
+
+    context 'when ordering work items in a group' do
+      before_all do
+        group.add_developer(user)
+      end
+
+      it_behaves_like 'reorder service'
+
+      context 'when ordering work items from other namespaces' do
+        let_it_be(:project2) { create(:project) }
+        let(:work_item) { create(:work_item, :issue, project: project2) }
+        let(:params) { { move_after_id: item2.id, move_before_id: item3.id } }
+
+        it 'does not reorder' do
+          expect { service_result }
+            .not_to change { work_item.relative_position }
+
+          expect(service_result[:errors])
+            .to eq(["You don't have permissions to update this work item"])
+        end
+      end
+    end
+  end
+end
diff --git a/spec/support/finder_collection_allowlist.yml b/spec/support/finder_collection_allowlist.yml
index f67bc5dd271..682938441ba 100644
--- a/spec/support/finder_collection_allowlist.yml
+++ b/spec/support/finder_collection_allowlist.yml
@@ -63,6 +63,7 @@
 - Packages::Pypi::PackageFinder
 - Projects::Integrations::Jira::ByIdsFinder
 - Projects::Integrations::Jira::IssuesFinder
+- PushRuleFinder
 - Releases::EvidencePipelineFinder
 - Repositories::BranchNamesFinder
 - Repositories::ChangelogTagFinder
diff --git a/spec/support/shared_examples/reorder_service_shared_examples.rb b/spec/support/shared_examples/reorder_service_shared_examples.rb
new file mode 100644
index 00000000000..e9a15c3af2f
--- /dev/null
+++ b/spec/support/shared_examples/reorder_service_shared_examples.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'reorder service' do
+  context 'when reordering items' do
+    context 'when no params are passed' do
+      let(:params) { {} }
+
+      it 'does not reorder' do
+        expect { service_result }
+          .not_to change { work_item.relative_position }
+
+        expect(service_result[:errors])
+          .to eq(["At least one of move_before_id or move_after_id is required"])
+      end
+    end
+
+    context 'with both invalid params' do
+      let(:params) { { move_after_id: nil, move_before_id: non_existing_record_id } }
+
+      it 'does not reorder' do
+        expect { service_result }
+          .not_to change { work_item.relative_position }
+
+        expect(service_result[:errors]).to eq(["Work item not found"])
+      end
+    end
+
+    context 'with valid params' do
+      let(:params) { { move_after_id: item2.id, move_before_id: item3.id } }
+
+      it 'sorts items' do
+        expect { service_result }
+          .to change { work_item.relative_position }.to be_between(
+            item2.relative_position,
+            item3.relative_position
+          )
+
+        expect(service_result[:errors]).to be_empty
+      end
+    end
+
+    context 'when only move_before_id is given' do
+      let(:params) { { move_before_id: item3.id } }
+
+      it 'sorts items if only given one neighbour, on the left' do
+        expect { service_result }
+          .to change { work_item.relative_position }.to be > item3.relative_position
+
+        expect(service_result[:errors]).to be_empty
+      end
+    end
+
+    context 'when only move_after_id is given' do
+      let(:work_item) { item3 }
+      let(:params) { { move_after_id: item1.id } }
+
+      it 'sorts items if only given one neighbour, on the right' do
+        expect { service_result }
+          .to change { work_item.relative_position }.to be < item1.relative_position
+
+        expect(service_result[:errors]).to be_empty
+      end
+    end
+  end
+end
diff --git a/spec/views/devise/shared/_footer.html.haml_spec.rb b/spec/views/devise/shared/_footer.html.haml_spec.rb
index c1d0ad8a322..c0651fe5222 100644
--- a/spec/views/devise/shared/_footer.html.haml_spec.rb
+++ b/spec/views/devise/shared/_footer.html.haml_spec.rb
@@ -23,7 +23,7 @@ RSpec.describe 'devise/shared/_footer', feature_category: :system_access do
     it { is_expected.to have_link(_('Help'), href: help_path) }
   end
 
-  it { is_expected.to have_link(_('About GitLab'), href: ApplicationHelper.promo_url) }
+  it { is_expected.to have_link(_('About GitLab'), href: promo_url) }
   it { is_expected.to have_link(_('GitLab community forum'), href: ApplicationHelper.community_forum) }
 
   context 'when one trust is enabled' do
diff --git a/workhorse/internal/ai_assist/duoworkflow/runner.go b/workhorse/internal/ai_assist/duoworkflow/runner.go
index e3b9b55e081..3657eddfe74 100644
--- a/workhorse/internal/ai_assist/duoworkflow/runner.go
+++ b/workhorse/internal/ai_assist/duoworkflow/runner.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"sync"
 
 	pb "gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb/contract"
 
@@ -39,6 +40,7 @@ type runner struct {
 	originalReq *http.Request
 	conn        websocketConn
 	wf          workflowStream
+	sendMu      sync.Mutex
 }
 
 func (r *runner) Execute(ctx context.Context) error {
@@ -86,7 +88,7 @@ func (r *runner) handleWebSocketMessage() error {
 		return fmt.Errorf("handleWebSocketMessage: failed to unmarshal a WS message: %v", err)
 	}
 
-	if err = r.wf.Send(response); err != nil {
+	if err = r.threadSafeSend(response); err != nil {
 		if err == io.EOF {
 			// ignore EOF to let Recv() fail and return a meaningful message
 			return nil
@@ -113,7 +115,7 @@ func (r *runner) handleAgentAction(ctx context.Context, action *pb.Action) error
 			return fmt.Errorf("handleAgentAction: failed to perform API call: %v", err)
 		}
 
-		if err := r.wf.Send(event); err != nil {
+		if err := r.threadSafeSend(event); err != nil {
 			return fmt.Errorf("handleAgentAction: failed to send gRPC message: %v", err)
 		}
 	default:
@@ -129,3 +131,9 @@ func (r *runner) handleAgentAction(ctx context.Context, action *pb.Action) error
 
 	return nil
 }
+
+func (r *runner) threadSafeSend(event *pb.ClientEvent) error {
+	r.sendMu.Lock()
+	defer r.sendMu.Unlock()
+	return r.wf.Send(event)
+}
diff --git a/yarn.lock b/yarn.lock
index d717c836240..1e16596e7d6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1425,7 +1425,7 @@
   resolved "https://registry.yarnpkg.com/@gitlab/fonts/-/fonts-1.3.0.tgz#df89c1bb6714e4a8a5d3272568aa4de7fb337267"
   integrity sha512-DoMUIN3DqjEn7wvcxBg/b7Ite5fTdF5EmuOZoBRo2j0UBGweDXmNBi+9HrTZs4cBU660dOxcf1hATFcG3npbPg==
 
-"@gitlab/noop@^1.0.1", jackspeak@^3.1.2, "jackspeak@npm:@gitlab/noop@1.0.1":
+"@gitlab/noop@^1.0.1":
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/@gitlab/noop/-/noop-1.0.1.tgz#71a831146ee02732b4a61d2d3c11204564753454"
   integrity sha512-s++4wjMYeDvBp9IO59DBrWjy8SE/gFkjTDO5ck2W0S6Vv7OlqgErwL7pHngAnrSmTJAzyUG8wHGqo0ViS4jn5Q==
@@ -1444,10 +1444,10 @@
     stylelint-declaration-strict-value "1.10.4"
     stylelint-scss "6.0.0"
 
-"@gitlab/svgs@3.141.0":
-  version "3.141.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.141.0.tgz#0be316b5dfdcbac0796c9b71b941740bccb89ec6"
-  integrity sha512-xLrEY14dc1jGknP4tZ5SgrGojDsmkI7S2sii83MBqwdqy9QQ3DWxdreeClQkBDXC/A6wDTbJAN0U4ebGBX7Y7w==
+"@gitlab/svgs@3.142.0":
+  version "3.142.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.142.0.tgz#525092e432d00dc8d6554eba20bb80c6316eec79"
+  integrity sha512-0yZq45G7SvDwY9nfQ5APhtxqaYS1hvcdtRxPEIzLv5g5UZoslIr7fTcg2r45987NS24FegjdDId2XLJXe6F5eQ==
 
 "@gitlab/ui@115.6.1":
   version "115.6.1"
@@ -9495,6 +9495,11 @@ istanbul-reports@^3.1.3:
     html-escaper "^2.0.0"
     istanbul-lib-report "^3.0.0"
 
+jackspeak@^3.1.2, "jackspeak@npm:@gitlab/noop@1.0.1":
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/@gitlab/noop/-/noop-1.0.1.tgz#71a831146ee02732b4a61d2d3c11204564753454"
+  integrity sha512-s++4wjMYeDvBp9IO59DBrWjy8SE/gFkjTDO5ck2W0S6Vv7OlqgErwL7pHngAnrSmTJAzyUG8wHGqo0ViS4jn5Q==
+
 jed@^1.1.1:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/jed/-/jed-1.1.1.tgz#7a549bbd9ffe1585b0cd0a191e203055bee574b4"