diff --git a/.gitlab/ci/database.gitlab-ci.yml b/.gitlab/ci/database.gitlab-ci.yml
index 63428b6d19a..d9776e70743 100644
--- a/.gitlab/ci/database.gitlab-ci.yml
+++ b/.gitlab/ci/database.gitlab-ci.yml
@@ -1,7 +1,7 @@
 include:
   - local: .gitlab/ci/rails/shared.gitlab-ci.yml
 
-db:setup pg16:
+.db:setup pg16:
   stage: prepare
   needs: []
   extends:
@@ -18,6 +18,16 @@ db:setup pg16:
     paths:
       - pg_dumpall.sql
 
+db:setup pg16:
+  extends:
+    - .db:setup pg16
+
+# Job name is detected in scripts/utils.sh to set up EE-only databases.
+db:setup-ee pg16:
+  extends:
+    - .db:setup pg16
+    - .rails:rules:setup-test-env-ee
+
 db:rollback single-db-ci-connection:
   extends:
     - db:rollback
diff --git a/.gitlab/ci/rails/shared.gitlab-ci.yml b/.gitlab/ci/rails/shared.gitlab-ci.yml
index b36c511c9e3..12c2a27b239 100644
--- a/.gitlab/ci/rails/shared.gitlab-ci.yml
+++ b/.gitlab/ci/rails/shared.gitlab-ci.yml
@@ -297,6 +297,10 @@ include:
     - .use-pg15-es7-ee
 
 .rspec-ee-base-pg16:
+  needs:
+    - !reference [.rspec-base, needs]
+    - job: "db:setup-ee pg16"
+      optional: true
   extends:
     - .rspec-base
     - .use-pg16-es7-ee
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index b889e55eafd..283b5c1d9d7 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -2072,6 +2072,12 @@
     - <<: *if-merge-request-labels-run-all-rspec
     - <<: *if-default-branch-schedule-weekly
 
+.rails:rules:setup-test-env-ee:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - !reference [".rails:rules:setup-test-env", rules]
+
 .rails:rules:setup-test-env-fips:
   rules:
     - <<: *if-default-branch-schedule-weekly
diff --git a/.rubocop_todo/rspec/context_wording.yml b/.rubocop_todo/rspec/context_wording.yml
index 226fbd7e290..46184fe3a43 100644
--- a/.rubocop_todo/rspec/context_wording.yml
+++ b/.rubocop_todo/rspec/context_wording.yml
@@ -1112,7 +1112,6 @@ RSpec/ContextWording:
     - 'spec/features/reportable_note/merge_request_spec.rb'
     - 'spec/features/search/user_searches_for_code_spec.rb'
     - 'spec/features/signed_commits_spec.rb'
-    - 'spec/features/snippets/explore_spec.rb'
     - 'spec/features/tags/developer_creates_tag_spec.rb'
     - 'spec/features/tags/developer_deletes_tag_spec.rb'
     - 'spec/features/tags/maintainer_deletes_protected_tag_spec.rb'
diff --git a/app/assets/javascripts/design_management/components/design_notes/design_note.vue b/app/assets/javascripts/design_management/components/design_notes/design_note.vue
index eace2275080..eccb5bd2152 100644
--- a/app/assets/javascripts/design_management/components/design_notes/design_note.vue
+++ b/app/assets/javascripts/design_management/components/design_notes/design_note.vue
@@ -19,7 +19,6 @@ import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import TimelineEntryItem from '~/vue_shared/components/notes/timeline_entry_item.vue';
 import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 import EmojiPicker from '~/emoji/components/picker.vue';
-import { TYPE_COMMENT } from '~/import/constants';
 import getDesignQuery from '../../graphql/queries/get_design.query.graphql';
 import updateNoteMutation from '../../graphql/mutations/update_note.mutation.graphql';
 import designNoteAwardEmojiToggleMutation from '../../graphql/mutations/design_note_award_emoji_toggle.mutation.graphql';
@@ -264,7 +263,6 @@ export default {
     },
   },
   updateNoteMutation,
-  TYPE_COMMENT,
 };
 </script>
 
@@ -303,7 +301,7 @@ export default {
           >
             <time-ago-tooltip :time="note.createdAt" tooltip-placement="bottom" />
           </gl-link>
-          <imported-badge v-if="isImported" :importable-type="$options.TYPE_COMMENT" />
+          <imported-badge v-if="isImported" />
         </span>
       </div>
       <div class="-gl-mr-2 -gl-mt-2 gl-flex gl-items-start">
diff --git a/app/assets/javascripts/design_management/components/toolbar/index.vue b/app/assets/javascripts/design_management/components/toolbar/index.vue
index 50791d2c08f..adf35deedbd 100644
--- a/app/assets/javascripts/design_management/components/toolbar/index.vue
+++ b/app/assets/javascripts/design_management/components/toolbar/index.vue
@@ -4,7 +4,6 @@ import { GlButton, GlIcon, GlTooltipDirective, GlSkeletonLoader } from '@gitlab/
 import permissionsQuery from 'shared_queries/design_management/design_permissions.query.graphql';
 import { isLoggedIn } from '~/lib/utils/common_utils';
 import { __, s__, sprintf } from '~/locale';
-import { TYPE_DESIGN } from '~/import/constants';
 import timeagoMixin from '~/vue_shared/mixins/timeago';
 import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import { DESIGNS_ROUTE_NAME } from '../../router/constants';
@@ -130,7 +129,6 @@ export default {
     },
   },
   DESIGNS_ROUTE_NAME,
-  TYPE_DESIGN,
 };
 </script>
 
@@ -147,11 +145,7 @@ export default {
           </span>
           <gl-icon name="chevron-right" class="gl-shrink-0" variant="disabled" />
           <span class="gl-truncate gl-font-normal">{{ filename }}</span>
-          <imported-badge
-            v-if="isImported"
-            :importable-type="$options.TYPE_DESIGN"
-            class="gl-ml-2"
-          />
+          <imported-badge v-if="isImported" class="gl-ml-2" />
         </h2>
         <small v-if="updatedAt" class="gl-text-subtle">{{ updatedText }}</small>
       </div>
diff --git a/app/assets/javascripts/import_entities/import_groups/components/import_table.vue b/app/assets/javascripts/import_entities/import_groups/components/import_table.vue
index f24f87c2f7c..08f28fc465a 100644
--- a/app/assets/javascripts/import_entities/import_groups/components/import_table.vue
+++ b/app/assets/javascripts/import_entities/import_groups/components/import_table.vue
@@ -153,7 +153,7 @@ export default {
     },
     {
       key: 'importTarget',
-      label: s__('BulkImport|New group'),
+      label: s__('BulkImport|Path of the new group'),
       thClass: `gl-w-1/2`,
     },
     {
@@ -886,14 +886,7 @@ export default {
             />
           </template>
           <template #head(importTarget)="data">
-            <span data-testid="new-path-col">
-              <span class="gl-mr-2">{{ data.label }}</span
-              ><gl-icon
-                v-gl-tooltip="s__('BulkImport|Path of the new group')"
-                name="information"
-                :size="12"
-              />
-            </span>
+            {{ data.label }}
           </template>
           <template #cell(selected)="{ rowSelected, selectRow, unselectRow, item: group }">
             <gl-form-checkbox
diff --git a/app/assets/javascripts/issuable/components/hidden_badge.vue b/app/assets/javascripts/issuable/components/hidden_badge.vue
index 67070f33251..5ddb868b679 100644
--- a/app/assets/javascripts/issuable/components/hidden_badge.vue
+++ b/app/assets/javascripts/issuable/components/hidden_badge.vue
@@ -1,7 +1,5 @@
 <script>
 import { GlBadge, GlTooltipDirective } from '@gitlab/ui';
-import { issuableTypeText } from '~/issues/constants';
-import { __, sprintf } from '~/locale';
 
 export default {
   components: {
@@ -10,20 +8,6 @@ export default {
   directives: {
     GlTooltip: GlTooltipDirective,
   },
-  props: {
-    issuableType: {
-      type: String,
-      required: false,
-      default: '',
-    },
-  },
-  computed: {
-    title() {
-      return sprintf(__('This %{issuable} is hidden because its author has been banned.'), {
-        issuable: issuableTypeText[this.issuableType],
-      });
-    },
-  },
 };
 </script>
 
@@ -31,7 +15,7 @@ export default {
   <gl-badge
     v-gl-tooltip
     icon="spam"
-    :title="title"
+    :title="s__('WorkItem|This item is hidden because its author has been banned.')"
     :aria-label="__('Hidden')"
     variant="warning"
     class="gl-shrink-0"
diff --git a/app/assets/javascripts/issues/show/components/sticky_header.vue b/app/assets/javascripts/issues/show/components/sticky_header.vue
index 6daa4d4492b..03d4a8b420b 100644
--- a/app/assets/javascripts/issues/show/components/sticky_header.vue
+++ b/app/assets/javascripts/issues/show/components/sticky_header.vue
@@ -139,8 +139,8 @@ export default {
             :workspace-type="$options.WORKSPACE_PROJECT"
           />
           <locked-badge v-if="isLocked" :issuable-type="issuableType" />
-          <hidden-badge v-if="isHidden" :issuable-type="issuableType" />
-          <imported-badge v-if="isImported" :importable-type="issuableType" />
+          <hidden-badge v-if="isHidden" />
+          <imported-badge v-if="isImported" />
 
           <gl-link class="gl-truncate gl-font-bold gl-text-default" href="#top" :title="title">
             {{ title }}
diff --git a/app/assets/javascripts/members/components/avatars/user_avatar.vue b/app/assets/javascripts/members/components/avatars/user_avatar.vue
index 84fa26da63b..b60832908f4 100644
--- a/app/assets/javascripts/members/components/avatars/user_avatar.vue
+++ b/app/assets/javascripts/members/components/avatars/user_avatar.vue
@@ -1,4 +1,5 @@
 <script>
+import { uniqueId } from 'lodash';
 import { GlAvatarLink, GlAvatarLabeled, GlBadge } from '@gitlab/ui';
 import SafeHtml from '~/vue_shared/directives/safe_html';
 import { generateBadges } from 'ee_else_ce/members/utils';
@@ -34,6 +35,11 @@ export default {
       required: true,
     },
   },
+  data() {
+    return {
+      userPopoverId: uniqueId('user-popover-'),
+    };
+  },
   computed: {
     user() {
       return this.member.user;
@@ -66,48 +72,50 @@ export default {
 </script>
 
 <template>
-  <gl-avatar-link
-    v-if="user"
-    class="js-user-link"
-    :href="user.webUrl"
-    :data-user-id="user.id"
-    :data-username="user.username"
-    :data-email="user.email"
-  >
-    <gl-avatar-labeled
-      :label="user.name"
-      :sub-label="`@${user.username}`"
-      :src="userAvatarUrl"
-      :alt="user.name"
-      :size="$options.avatarSize"
-      :entity-name="user.name"
-      :entity-id="user.id"
+  <span :id="userPopoverId">
+    <gl-avatar-link
+      v-if="user"
+      class="js-user-link"
+      :href="user.webUrl"
+      :data-user-id="user.id"
+      :data-username="user.username"
+      :data-email="user.email"
     >
-      <template #meta>
-        <div v-if="isUserBusy" class="gl-p-1">
-          <span class="gl-text-sm gl-font-normal gl-text-subtle">({{ $options.i18n.busy }})</span>
-        </div>
-        <div v-if="statusEmoji" class="gl-p-1">
-          <span
-            v-safe-html:[$options.safeHtmlConfig]="glEmojiTag(statusEmoji)"
-            class="user-status-emoji gl-mr-0"
-          ></span>
-        </div>
-        <div v-for="badge in badges" :key="badge.text" class="gl-p-1">
-          <gl-badge :variant="badge.variant">
-            {{ badge.text }}
-          </gl-badge>
-        </div>
-      </template>
-    </gl-avatar-labeled>
-  </gl-avatar-link>
+      <gl-avatar-labeled
+        :label="user.name"
+        :sub-label="`@${user.username}`"
+        :src="userAvatarUrl"
+        :alt="user.name"
+        :size="$options.avatarSize"
+        :entity-name="user.name"
+        :entity-id="user.id"
+      >
+        <template #meta>
+          <div v-if="isUserBusy" class="gl-p-1">
+            <span class="gl-text-sm gl-font-normal gl-text-subtle">({{ $options.i18n.busy }})</span>
+          </div>
+          <div v-if="statusEmoji" class="gl-p-1">
+            <span
+              v-safe-html:[$options.safeHtmlConfig]="glEmojiTag(statusEmoji)"
+              class="user-status-emoji gl-mr-0"
+            ></span>
+          </div>
+          <div v-for="badge in badges" :key="badge.text" class="gl-p-1">
+            <gl-badge :variant="badge.variant">
+              {{ badge.text }}
+            </gl-badge>
+          </div>
+        </template>
+      </gl-avatar-labeled>
+    </gl-avatar-link>
 
-  <gl-avatar-labeled
-    v-else
-    :label="$options.orphanedUserLabel"
-    :alt="$options.orphanedUserLabel"
-    :size="$options.avatarSize"
-    :entity-name="$options.orphanedUserLabel"
-    :entity-id="member.id"
-  />
+    <gl-avatar-labeled
+      v-else
+      :label="$options.orphanedUserLabel"
+      :alt="$options.orphanedUserLabel"
+      :size="$options.avatarSize"
+      :entity-name="$options.orphanedUserLabel"
+      :entity-id="member.id"
+    />
+  </span>
 </template>
diff --git a/app/assets/javascripts/merge_requests/components/merge_request_header.vue b/app/assets/javascripts/merge_requests/components/merge_request_header.vue
index 1fd7305c061..c46cf4061e0 100644
--- a/app/assets/javascripts/merge_requests/components/merge_request_header.vue
+++ b/app/assets/javascripts/merge_requests/components/merge_request_header.vue
@@ -106,15 +106,7 @@ export default {
       class="gl-mr-2 gl-self-center"
       :issuable-type="$options.TYPE_MERGE_REQUEST"
     />
-    <hidden-badge
-      v-if="hidden"
-      class="gl-mr-2 gl-self-center"
-      :issuable-type="$options.TYPE_MERGE_REQUEST"
-    />
-    <imported-badge
-      v-if="isImported"
-      class="gl-mr-2 gl-self-center"
-      :importable-type="$options.TYPE_MERGE_REQUEST"
-    />
+    <hidden-badge v-if="hidden" class="gl-mr-2 gl-self-center" />
+    <imported-badge v-if="isImported" class="gl-mr-2 gl-self-center" />
   </span>
 </template>
diff --git a/app/assets/javascripts/merge_requests/components/sticky_header.vue b/app/assets/javascripts/merge_requests/components/sticky_header.vue
index f987006a5ca..5b0574c9159 100644
--- a/app/assets/javascripts/merge_requests/components/sticky_header.vue
+++ b/app/assets/javascripts/merge_requests/components/sticky_header.vue
@@ -178,7 +178,7 @@ export default {
       >
         <div class="gl-flex gl-w-full gl-items-center gl-gap-2">
           <status-badge :issuable-type="$options.TYPE_MERGE_REQUEST" :state="badgeState.state" />
-          <imported-badge v-if="isImported" :importable-type="$options.TYPE_MERGE_REQUEST" />
+          <imported-badge v-if="isImported" />
           <a
             v-safe-html:[$options.safeHtmlConfig]="titleHtml"
             href="#top"
diff --git a/app/assets/javascripts/notes/components/note_header.vue b/app/assets/javascripts/notes/components/note_header.vue
index 82adccb03a8..9e277fbc8bd 100644
--- a/app/assets/javascripts/notes/components/note_header.vue
+++ b/app/assets/javascripts/notes/components/note_header.vue
@@ -216,7 +216,7 @@ export default {
 
       <template v-if="isImported">
         <span v-if="isSystemNote">&middot;</span>
-        <imported-badge :text-only="isSystemNote" :importable-type="importableType" />
+        <imported-badge :text-only="isSystemNote" />
       </template>
 
       <gl-badge
diff --git a/app/assets/javascripts/snippets/components/snippet_header.vue b/app/assets/javascripts/snippets/components/snippet_header.vue
index bffa0f2a411..0dbf10cdd53 100644
--- a/app/assets/javascripts/snippets/components/snippet_header.vue
+++ b/app/assets/javascripts/snippets/components/snippet_header.vue
@@ -21,7 +21,6 @@ import CloneCodeDropdown from '~/vue_shared/components/code_dropdown/clone_code_
 import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 import { createAlert, VARIANT_DANGER, VARIANT_SUCCESS } from '~/alert';
 import { VISIBILITY_LEVEL_PUBLIC_STRING } from '~/visibility_level/constants';
-import { TYPE_SNIPPET } from '~/import/constants';
 import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import DeleteSnippetMutation from '../mutations/delete_snippet.mutation.graphql';
 
@@ -248,7 +247,6 @@ export default {
     },
   },
   i18n,
-  TYPE_SNIPPET,
 };
 </script>
 <template>
@@ -355,11 +353,7 @@ export default {
           <gl-icon :name="visibilityLevelIcon" :size="14" class="gl-relative gl-top-1" />
         </div>
 
-        <imported-badge
-          v-if="snippet.imported"
-          :importable-type="$options.TYPE_SNIPPET"
-          class="gl-mr-2"
-        />
+        <imported-badge v-if="snippet.imported" class="gl-mr-2" />
 
         <div data-testid="authored-message" class="gl-leading-20">
           <gl-sprintf :message="authoredMessage">
diff --git a/app/assets/javascripts/user_popovers.js b/app/assets/javascripts/user_popovers.js
index ae0a185e335..b9dcb097c84 100644
--- a/app/assets/javascripts/user_popovers.js
+++ b/app/assets/javascripts/user_popovers.js
@@ -73,12 +73,14 @@ function createPopover(el, user) {
     populateUserInfo(user);
   }
   const UserPopoverComponent = Vue.extend(UserPopover);
+
   return new UserPopoverComponent({
     propsData: {
       target: el,
       user,
       show: true,
       placement: el.dataset.placement || 'top',
+      container: el.parentNode?.id || null,
     },
   });
 }
@@ -102,6 +104,13 @@ function launchPopover(el, mountPopover) {
     },
     { once: true },
   );
+  el.addEventListener(
+    'focusout',
+    ({ target }) => {
+      target.removeAttribute('aria-describedby');
+    },
+    { once: true },
+  );
   const popoverInstance = createPopover(el, Vue.observable(emptyUser));
 
   const { userId } = el.dataset;
@@ -138,6 +147,7 @@ export default function addPopovers(mountPopover = (instance) => instance.$mount
   // https://gitlab.com/gitlab-org/gitlab/-/issues/351395#note_1039341458
   if (window.gon?.current_user_id && !hasAddedLazyPopovers) {
     document.addEventListener('mouseover', (event) => lazyLaunchPopover(mountPopover, event));
+    document.addEventListener('focusin', (event) => lazyLaunchPopover(mountPopover, event));
     hasAddedLazyPopovers = true;
   }
 }
diff --git a/app/assets/javascripts/vue_shared/components/imported_badge.vue b/app/assets/javascripts/vue_shared/components/imported_badge.vue
index 308416cc085..98b9ab2fa35 100644
--- a/app/assets/javascripts/vue_shared/components/imported_badge.vue
+++ b/app/assets/javascripts/vue_shared/components/imported_badge.vue
@@ -1,21 +1,9 @@
 <script>
 import { GlBadge, GlTooltipDirective } from '@gitlab/ui';
-import { __, s__, sprintf } from '~/locale';
-
-import { TYPE_EPIC, TYPE_ISSUE, TYPE_MERGE_REQUEST } from '~/issues/constants';
-import { TYPE_ACTIVITY, TYPE_COMMENT, TYPE_DESIGN, TYPE_SNIPPET } from '~/import/constants';
-
-const importableTypeText = {
-  [TYPE_ACTIVITY]: __('activity'),
-  [TYPE_COMMENT]: __('comment'),
-  [TYPE_DESIGN]: __('design'),
-  [TYPE_EPIC]: __('epic'),
-  [TYPE_ISSUE]: __('issue'),
-  [TYPE_MERGE_REQUEST]: __('merge request'),
-  [TYPE_SNIPPET]: __('snippet'),
-};
+import { s__ } from '~/locale';
 
 export default {
+  tooltip: s__('BulkImport|This item was imported from another instance.'),
   components: {
     GlBadge,
   },
@@ -23,32 +11,20 @@ export default {
     GlTooltip: GlTooltipDirective,
   },
   props: {
-    importableType: {
-      type: String,
-      required: false,
-      default: '',
-    },
     textOnly: {
       type: Boolean,
       required: false,
       default: false,
     },
   },
-  computed: {
-    title() {
-      return sprintf(s__('BulkImport|This %{importable} was imported from another instance.'), {
-        importable: importableTypeText[this.importableType],
-      });
-    },
-  },
 };
 </script>
 
 <template>
-  <span v-if="textOnly" v-gl-tooltip="title">
+  <span v-if="textOnly" v-gl-tooltip="$options.tooltip">
     {{ __('Imported') }}
   </span>
-  <gl-badge v-else v-gl-tooltip="title" class="gl-shrink-0">
+  <gl-badge v-else v-gl-tooltip="$options.tooltip" class="gl-shrink-0">
     {{ __('Imported') }}
   </gl-badge>
 </template>
diff --git a/app/assets/javascripts/vue_shared/components/user_popover/user_popover.vue b/app/assets/javascripts/vue_shared/components/user_popover/user_popover.vue
index 19c1515b365..da522633263 100644
--- a/app/assets/javascripts/vue_shared/components/user_popover/user_popover.vue
+++ b/app/assets/javascripts/vue_shared/components/user_popover/user_popover.vue
@@ -71,6 +71,11 @@ export default {
       required: false,
       default: false,
     },
+    container: {
+      type: String,
+      required: false,
+      default: '',
+    },
   },
   data() {
     return {
@@ -202,6 +207,7 @@ export default {
     :target="target"
     :delay="$options.USER_POPOVER_DELAY"
     :placement="placement"
+    :container="container"
     boundary="viewport"
     triggers="hover focus manual"
     data-testid="user-popover"
diff --git a/app/assets/javascripts/vue_shared/issuable/show/components/issuable_header.vue b/app/assets/javascripts/vue_shared/issuable/show/components/issuable_header.vue
index 7af1989fe75..344b196c35f 100644
--- a/app/assets/javascripts/vue_shared/issuable/show/components/issuable_header.vue
+++ b/app/assets/javascripts/vue_shared/issuable/show/components/issuable_header.vue
@@ -168,8 +168,8 @@ export default {
         :workspace-type="workspaceType"
       />
       <locked-badge v-if="blocked" :issuable-type="issuableType" />
-      <hidden-badge v-if="isHidden" :issuable-type="issuableType" />
-      <imported-badge v-if="isImported" :importable-type="issuableType" />
+      <hidden-badge v-if="isHidden" />
+      <imported-badge v-if="isImported" />
 
       <work-item-type-icon
         v-if="shouldShowWorkItemTypeIcon"
diff --git a/app/assets/javascripts/work_items/components/design_management/design_notes/design_note.vue b/app/assets/javascripts/work_items/components/design_management/design_notes/design_note.vue
index b4ce26c6522..fb5893dfa9b 100644
--- a/app/assets/javascripts/work_items/components/design_management/design_notes/design_note.vue
+++ b/app/assets/javascripts/work_items/components/design_management/design_notes/design_note.vue
@@ -19,7 +19,6 @@ import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import EmojiPicker from '~/emoji/components/picker.vue';
 import TimelineEntryItem from '~/vue_shared/components/notes/timeline_entry_item.vue';
 import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
-import { TYPE_COMMENT } from '~/import/constants';
 import { TYPENAME_USER } from '~/graphql_shared/constants';
 import updateNoteMutation from '../graphql/update_note.mutation.graphql';
 import designNoteAwardEmojiToggleMutation from '../graphql/design_note_award_emoji_toggle.mutation.graphql';
@@ -261,7 +260,6 @@ export default {
     },
   },
   updateNoteMutation,
-  TYPE_COMMENT,
 };
 </script>
 
@@ -305,7 +303,7 @@ export default {
           >
             <time-ago-tooltip :time="note.createdAt" tooltip-placement="bottom" />
           </gl-link>
-          <imported-badge v-if="isImported" :importable-type="$options.TYPE_COMMENT" size="sm" />
+          <imported-badge v-if="isImported" size="sm" />
         </span>
       </div>
       <div class="gl-flex gl-items-start">
diff --git a/app/assets/javascripts/work_items/components/design_management/design_preview/design_toolbar.vue b/app/assets/javascripts/work_items/components/design_management/design_preview/design_toolbar.vue
index d3879dc5edc..778f5258981 100644
--- a/app/assets/javascripts/work_items/components/design_management/design_preview/design_toolbar.vue
+++ b/app/assets/javascripts/work_items/components/design_management/design_preview/design_toolbar.vue
@@ -1,7 +1,6 @@
 <script>
 import { GlButton, GlIcon, GlSkeletonLoader, GlTooltipDirective } from '@gitlab/ui';
 import { isLoggedIn } from '~/lib/utils/common_utils';
-import { TYPE_DESIGN } from '~/import/constants';
 import { s__ } from '~/locale';
 import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import TodosToggle from '../../shared/todos_toggle.vue';
@@ -73,7 +72,6 @@ export default {
         : this.$options.i18n.showCommentsButtonLabel;
     },
   },
-  TYPE_DESIGN,
 };
 </script>
 
@@ -90,11 +88,7 @@ export default {
           </span>
           <gl-icon name="chevron-right" class="gl-shrink-0" variant="subtle" />
           <span class="gl-truncate gl-font-normal">{{ design.filename }}</span>
-          <imported-badge
-            v-if="design.imported"
-            :importable-type="$options.TYPE_DESIGN"
-            class="gl-ml-2"
-          />
+          <imported-badge v-if="design.imported" class="gl-ml-2" />
         </h2>
       </div>
       <close-button class="gl-ml-auto md:gl-hidden" />
diff --git a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_assignee.vue b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_assignee.vue
index c7588d77c75..4e039ed28c9 100644
--- a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_assignee.vue
+++ b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_assignee.vue
@@ -46,6 +46,9 @@ export default {
   apollo: {
     currentUser: {
       query: currentUserQuery,
+      skip() {
+        return !this.searchStarted;
+      },
     },
     users: {
       query: usersSearchQuery,
diff --git a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state.vue b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown.vue
similarity index 60%
rename from app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state.vue
rename to app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown.vue
index 9a40d89624c..4e277fe419e 100644
--- a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state.vue
+++ b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown.vue
@@ -1,17 +1,24 @@
 <script>
 import { GlCollapsibleListbox, GlFormGroup } from '@gitlab/ui';
-import { __ } from '~/locale';
 
 export default {
-  listboxItems: [
-    { text: __('Open'), value: 'reopen' },
-    { text: __('Closed'), value: 'close' },
-  ],
   components: {
     GlCollapsibleListbox,
     GlFormGroup,
   },
   props: {
+    headerText: {
+      type: String,
+      required: true,
+    },
+    items: {
+      type: Array,
+      required: true,
+    },
+    label: {
+      type: String,
+      required: true,
+    },
     value: {
       type: String,
       required: false,
@@ -20,27 +27,27 @@ export default {
   },
   computed: {
     toggleText() {
-      const selected = this.$options.listboxItems.find((option) => option.value === this.value);
-      return selected?.text || __('Select state');
+      const selected = this.items.find((option) => option.value === this.value);
+      return selected?.text || this.headerText;
     },
   },
   methods: {
     reset() {
       this.$emit('input', undefined);
-      this.$refs.listbox.close();
+      this.$refs.listbox.close?.();
     },
   },
 };
 </script>
 
 <template>
-  <gl-form-group :label="__('State')">
+  <gl-form-group :label="label">
     <gl-collapsible-listbox
       ref="listbox"
       block
-      :header-text="__('Select state')"
+      :header-text="headerText"
       is-check-centered
-      :items="$options.listboxItems"
+      :items="items"
       :reset-button-label="__('Reset')"
       :selected="value"
       :toggle-text="toggleText"
diff --git a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue
index 14365422f02..a128ab0c727 100644
--- a/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue
+++ b/app/assets/javascripts/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue
@@ -3,21 +3,40 @@ import { GlForm } from '@gitlab/ui';
 import { createAlert } from '~/alert';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import axios from '~/lib/utils/axios_utils';
-import { s__ } from '~/locale';
+import { __, s__ } from '~/locale';
 import { BULK_UPDATE_UNASSIGNED } from '../../constants';
 import workItemBulkUpdateMutation from '../../graphql/list/work_item_bulk_update.mutation.graphql';
 import workItemParent from '../../graphql/list/work_item_parent.query.graphql';
 import WorkItemBulkEditAssignee from './work_item_bulk_edit_assignee.vue';
+import WorkItemBulkEditDropdown from './work_item_bulk_edit_dropdown.vue';
 import WorkItemBulkEditLabels from './work_item_bulk_edit_labels.vue';
-import WorkItemBulkEditState from './work_item_bulk_edit_state.vue';
 
 export default {
+  name: 'WorkItemBulkEditSidebar',
+  confidentialityItems: [
+    { text: __('Confidential'), value: 'true' },
+    { text: __('Not confidential'), value: 'false' },
+  ],
+  healthStatusItems: [
+    { text: __('On track'), value: 'on_track' },
+    { text: __('Needs attention'), value: 'needs_attention' },
+    { text: __('At risk'), value: 'at_risk' },
+  ],
+  stateItems: [
+    { text: __('Open'), value: 'reopen' },
+    { text: __('Closed'), value: 'close' },
+  ],
+  subscriptionItems: [
+    { text: __('Subscribe'), value: 'subscribe' },
+    { text: __('Unsubscribe'), value: 'unsubscribe' },
+  ],
   components: {
     GlForm,
     WorkItemBulkEditAssignee,
+    WorkItemBulkEditDropdown,
     WorkItemBulkEditLabels,
-    WorkItemBulkEditState,
   },
+  inject: ['hasIssuableHealthStatusFeature'],
   props: {
     checkedItems: {
       type: Array,
@@ -42,9 +61,12 @@ export default {
     return {
       addLabelIds: [],
       assigneeId: undefined,
+      confidentiality: undefined,
+      healthStatus: undefined,
       parentId: undefined,
       removeLabelIds: [],
       state: undefined,
+      subscription: undefined,
     };
   },
   apollo: {
@@ -115,9 +137,12 @@ export default {
       const update = {
         add_label_ids: this.addLabelIds.map(getIdFromGraphQLId),
         assignee_ids: assigneeIds,
+        confidential: this.confidentiality,
+        health_status: this.healthStatus,
         issuable_ids: this.checkedItems.map((item) => getIdFromGraphQLId(item.id)).join(','),
         remove_label_ids: this.removeLabelIds.map(getIdFromGraphQLId),
         state_event: this.state,
+        subscription_event: this.subscription,
       };
 
       return axios.post(this.legacyBulkEditEndpoint, { update });
@@ -128,7 +153,14 @@ export default {
 
 <template>
   <gl-form id="work-item-list-bulk-edit" class="gl-p-5" @submit.prevent="handleFormSubmitted">
-    <work-item-bulk-edit-state v-if="!isEpicsList" v-model="state" />
+    <work-item-bulk-edit-dropdown
+      v-if="!isEpicsList"
+      v-model="state"
+      :header-text="__('Select state')"
+      :items="$options.stateItems"
+      :label="__('State')"
+      data-testid="bulk-edit-state"
+    />
     <work-item-bulk-edit-assignee
       v-if="!isEpicsList"
       v-model="assigneeId"
@@ -150,5 +182,29 @@ export default {
       :selected-labels-ids="removeLabelIds"
       @select="removeLabelIds = $event"
     />
+    <work-item-bulk-edit-dropdown
+      v-if="!isEpicsList && hasIssuableHealthStatusFeature"
+      v-model="healthStatus"
+      :header-text="__('Select health status')"
+      :items="$options.healthStatusItems"
+      :label="__('Health status')"
+      data-testid="bulk-edit-health-status"
+    />
+    <work-item-bulk-edit-dropdown
+      v-if="!isEpicsList"
+      v-model="subscription"
+      :header-text="__('Select subscription')"
+      :items="$options.subscriptionItems"
+      :label="__('Subscription')"
+      data-testid="bulk-edit-subscription"
+    />
+    <work-item-bulk-edit-dropdown
+      v-if="!isEpicsList"
+      v-model="confidentiality"
+      :header-text="__('Select confidentiality')"
+      :items="$options.confidentialityItems"
+      :label="__('Confidentiality')"
+      data-testid="bulk-edit-confidentiality"
+    />
   </gl-form>
 </template>
diff --git a/app/assets/javascripts/work_items/components/work_item_created_updated.vue b/app/assets/javascripts/work_items/components/work_item_created_updated.vue
index 6114f59d265..bb8c4c6ee33 100644
--- a/app/assets/javascripts/work_items/components/work_item_created_updated.vue
+++ b/app/assets/javascripts/work_items/components/work_item_created_updated.vue
@@ -1,10 +1,12 @@
 <script>
 import { GlAvatarLink, GlSprintf, GlLoadingIcon } from '@gitlab/ui';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
+import HiddenBadge from '~/issuable/components/hidden_badge.vue';
 import LockedBadge from '~/issuable/components/locked_badge.vue';
 import { WORKSPACE_PROJECT } from '~/issues/constants';
-import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
+import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
+import TimeAgoTooltip from '~/vue_shared/components/time_ago_tooltip.vue';
 import workItemByIidQuery from '../graphql/work_item_by_iid.query.graphql';
 import { findNotesWidget } from '../utils';
 import WorkItemStateBadge from './work_item_state_badge.vue';
@@ -12,6 +14,8 @@ import WorkItemTypeIcon from './work_item_type_icon.vue';
 
 export default {
   components: {
+    HiddenBadge,
+    ImportedBadge,
     LockedBadge,
     GlAvatarLink,
     GlSprintf,
@@ -32,6 +36,11 @@ export default {
       default: null,
     },
   },
+  data() {
+    return {
+      workItem: {},
+    };
+  },
   computed: {
     createdAt() {
       return this.workItem?.createdAt || '';
@@ -68,7 +77,6 @@ export default {
     },
   },
   apollo: {
-    // eslint-disable-next-line @gitlab/vue-no-undef-apollo-properties
     workItem: {
       query: workItemByIidQuery,
       variables() {
@@ -109,6 +117,8 @@ export default {
       hide-text-in-small-screens
     />
     <locked-badge v-if="isDiscussionLocked" class="gl-align-middle" :issuable-type="workItemType" />
+    <hidden-badge v-if="workItem.hidden" class="gl-align-middle" />
+    <imported-badge v-if="workItem.imported" class="gl-align-middle" />
     <work-item-type-icon
       v-if="workItemType"
       class="gl-align-middle"
diff --git a/app/assets/javascripts/work_items/components/work_item_sticky_header.vue b/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
index 04f17bcf7de..ecacf82d4c0 100644
--- a/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
+++ b/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
@@ -1,8 +1,10 @@
 <script>
 import { GlIntersectionObserver, GlButton, GlLink } from '@gitlab/ui';
+import HiddenBadge from '~/issuable/components/hidden_badge.vue';
 import LockedBadge from '~/issuable/components/locked_badge.vue';
 import { WORKSPACE_PROJECT } from '~/issues/constants';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
+import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { findNotesWidget } from '../utils';
 import TodosToggle from './shared/todos_toggle.vue';
@@ -11,6 +13,8 @@ import WorkItemNotificationsWidget from './work_item_notifications_widget.vue';
 
 export default {
   components: {
+    HiddenBadge,
+    ImportedBadge,
     LockedBadge,
     GlIntersectionObserver,
     TodosToggle,
@@ -78,7 +82,7 @@ export default {
         data-testid="work-item-sticky-header"
       >
         <div
-          class="work-item-sticky-header-text gl-mx-auto gl-flex gl-items-center gl-gap-3 gl-px-5 xl:gl-px-6"
+          class="work-item-sticky-header-text gl-mx-auto gl-flex gl-items-center gl-gap-2 gl-px-5 xl:gl-px-6"
         >
           <work-item-state-badge
             v-if="workItemState"
@@ -94,6 +98,8 @@ export default {
             hide-text-in-small-screens
           />
           <locked-badge v-if="isDiscussionLocked" :issuable-type="workItemType" />
+          <hidden-badge v-if="workItem.hidden" />
+          <imported-badge v-if="workItem.imported" />
           <gl-link
             class="gl-mr-auto gl-block gl-truncate gl-pr-3 gl-font-bold gl-text-strong"
             href="#top"
diff --git a/app/assets/javascripts/work_items/graphql/cache_utils.js b/app/assets/javascripts/work_items/graphql/cache_utils.js
index a1ffe5c33d1..29b7d189c54 100644
--- a/app/assets/javascripts/work_items/graphql/cache_utils.js
+++ b/app/assets/javascripts/work_items/graphql/cache_utils.js
@@ -891,6 +891,8 @@ export const setNewWorkItemCache = async ({
           id: newWorkItemId(workItemType),
           iid: NEW_WORK_ITEM_IID,
           archived: false,
+          hidden: false,
+          imported: false,
           title: isValidWorkItemTitle ? workItemTitle : draftTitle,
           titleHtml: null,
           state: 'OPEN',
diff --git a/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql b/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
index 47a78dded45..1db350f55b1 100644
--- a/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
@@ -6,6 +6,8 @@ fragment WorkItem on WorkItem {
   id
   iid
   archived
+  hidden
+  imported
   title
   titleHtml
   state
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 2106242855e..c2d8fc46f6d 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -148,14 +148,18 @@ module ApplicationSettingsHelper
   end
 
   def import_sources_checkboxes(form)
-    Gitlab::ImportSources.options.map do |name, source|
-      checked = @application_setting.import_sources.include?(source)
+    import_sources_without_templates = Gitlab::ImportSources.import_table.reject do |importer|
+      Gitlab::ImportSources.template?(importer.name)
+    end
+
+    import_sources_without_templates.map do |source|
+      checked = @application_setting.import_sources.include?(source.name)
 
       form.gitlab_ui_checkbox_component(
         :import_sources,
-        name,
+        source.title,
         checkbox_options: { checked: checked, multiple: true, autocomplete: 'off' },
-        checked_value: source,
+        checked_value: source.name,
         unchecked_value: nil
       )
     end
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 9f3d738b66e..4b98c347143 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -454,7 +454,11 @@ class ApplicationSetting < ApplicationRecord
 
   validates_each :import_sources, on: :update do |record, attr, value|
     value&.each do |source|
-      unless Gitlab::ImportSources.options.value?(source)
+      # Temporary allow "gitlab_custom_project_template" to avoid validation errors
+      # "gitlab_custom_project_template" can be excluded after incorrect values are removed from the database
+      allowed_import_sources = Gitlab::ImportSources.values
+
+      unless allowed_import_sources.include?(source)
         record.errors.add(attr, format(_("'%{source}' is not a import source"), source: source))
       end
     end
diff --git a/app/services/packages/create_event_service.rb b/app/services/packages/create_event_service.rb
index 8eba8187d20..c797bfe34db 100644
--- a/app/services/packages/create_event_service.rb
+++ b/app/services/packages/create_event_service.rb
@@ -29,8 +29,9 @@ module Packages
         namespace: params[:namespace],
         additional_properties: {
           label: event_scope.to_s,
-          property: originator_type.to_s
-        }
+          property: originator_type.to_s,
+          deploy_token_id: deploy_token_id
+        }.compact
       )
     end
 
@@ -58,5 +59,11 @@ module Packages
     def event_name
       params[:event_name]
     end
+
+    def deploy_token_id
+      return unless current_user.is_a?(DeployToken)
+
+      Gitlab::CryptoHelper.sha256(current_user.id)
+    end
   end
 end
diff --git a/app/services/projects/create_service.rb b/app/services/projects/create_service.rb
index 42565dbb493..39b5956ffa1 100644
--- a/app/services/projects/create_service.rb
+++ b/app/services/projects/create_service.rb
@@ -5,7 +5,6 @@ module Projects
     include ValidatesClassificationLabel
 
     ImportSourceDisabledError = Class.new(StandardError)
-    INTERNAL_IMPORT_SOURCES = %w[gitlab_custom_project_template gitlab_project_migration].freeze
     README_FILE = 'README.md'
 
     def initialize(user, params)
@@ -115,6 +114,11 @@ module Projects
     def validate_import_permissions
       return unless @project.import?
       return if @project.gitlab_project_import?
+
+      # Skip for project template importers, as their permission model is different from other importers
+      # See: https://gitlab.com/gitlab-org/gitlab/-/issues/414046#note_1945586449.
+      return if Gitlab::ImportSources.template?(@project.import_type)
+
       return if current_user.can?(:import_projects, parent_namespace)
 
       @project.errors.add(:user, 'is not allowed to import projects')
@@ -324,7 +328,12 @@ module Projects
 
       import_type = @params[:import_type].to_s
 
-      return if INTERNAL_IMPORT_SOURCES.include?(import_type)
+      # Skip for projects created through the Direct Transfer importer.
+      return if import_type == BulkImports::Projects::Transformers::ProjectAttributesTransformer::PROJECT_IMPORT_TYPE
+
+      # Skip for project template importers, as their feature availability is not
+      # controlled by the `import_sources` application setting.
+      return if Gitlab::ImportSources.template?(import_type)
 
       # Skip validation when creating project from a built in template
       return if @import_export_upload.present? && import_type == 'gitlab_project'
diff --git a/app/services/search/global_service.rb b/app/services/search/global_service.rb
index 40c643edb35..71e92d38d2b 100644
--- a/app/services/search/global_service.rb
+++ b/app/services/search/global_service.rb
@@ -21,7 +21,9 @@ module Search
         projects,
         order_by: params[:order_by],
         sort: params[:sort],
-        filters: filters)
+        filters: filters,
+        source: params[:source]
+      )
     end
 
     # rubocop: disable CodeReuse/ActiveRecord
diff --git a/app/services/search/group_service.rb b/app/services/search/group_service.rb
index fa80a6ecf58..24f757ddd54 100644
--- a/app/services/search/group_service.rb
+++ b/app/services/search/group_service.rb
@@ -18,7 +18,8 @@ module Search
         group: group,
         order_by: params[:order_by],
         sort: params[:sort],
-        filters: filters
+        filters: filters,
+        source: params[:source]
       )
     end
 
diff --git a/app/services/search/project_service.rb b/app/services/search/project_service.rb
index c2e789790af..40f7850e2b0 100644
--- a/app/services/search/project_service.rb
+++ b/app/services/search/project_service.rb
@@ -22,7 +22,8 @@ module Search
         repository_ref: params[:repository_ref],
         order_by: params[:order_by],
         sort: params[:sort],
-        filters: filters
+        filters: filters,
+        source: params[:source]
       )
     end
 
diff --git a/app/services/search/snippet_service.rb b/app/services/search/snippet_service.rb
index b629fd305d7..d81a5e71ced 100644
--- a/app/services/search/snippet_service.rb
+++ b/app/services/search/snippet_service.rb
@@ -3,7 +3,7 @@
 module Search
   class SnippetService < Search::GlobalService
     def execute
-      Gitlab::SnippetSearchResults.new(current_user, params[:search])
+      Gitlab::SnippetSearchResults.new(current_user, params[:search], source: params[:source])
     end
 
     def scope
diff --git a/config/events/delete_package_from_registry.yml b/config/events/delete_package_from_registry.yml
index f0880e38102..88f863e34f1 100644
--- a/config/events/delete_package_from_registry.yml
+++ b/config/events/delete_package_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '17.3'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153159
diff --git a/config/events/delete_package_reference_from_registry.yml b/config/events/delete_package_reference_from_registry.yml
index 1588efccb50..914a3b8b855 100644
--- a/config/events/delete_package_reference_from_registry.yml
+++ b/config/events/delete_package_reference_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '18.1'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/191910
diff --git a/config/events/delete_package_revision_from_registry.yml b/config/events/delete_package_revision_from_registry.yml
index 772cae5c3e1..b808ee64d10 100644
--- a/config/events/delete_package_revision_from_registry.yml
+++ b/config/events/delete_package_revision_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '18.1'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/191910
diff --git a/config/events/delete_recipe_revision_from_registry.yml b/config/events/delete_recipe_revision_from_registry.yml
index 5659ee00ee8..bd8ea04ecba 100644
--- a/config/events/delete_recipe_revision_from_registry.yml
+++ b/config/events/delete_recipe_revision_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '18.1'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/186073
diff --git a/config/events/pull_package_from_registry.yml b/config/events/pull_package_from_registry.yml
index 903303f43c6..5f869410c3c 100644
--- a/config/events/pull_package_from_registry.yml
+++ b/config/events/pull_package_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '17.1'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151919
diff --git a/config/events/pull_symbol_package_from_registry.yml b/config/events/pull_symbol_package_from_registry.yml
index 46bf6dffd27..c3830a8d505 100644
--- a/config/events/pull_symbol_package_from_registry.yml
+++ b/config/events/pull_symbol_package_from_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '17.3'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/161620
diff --git a/config/events/push_package_to_registry.yml b/config/events/push_package_to_registry.yml
index 80caa4be016..68c1f5e6fb5 100644
--- a/config/events/push_package_to_registry.yml
+++ b/config/events/push_package_to_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '17.3'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/161199
diff --git a/config/events/push_symbol_package_to_registry.yml b/config/events/push_symbol_package_to_registry.yml
index 6e35ce51f10..760227693ac 100644
--- a/config/events/push_symbol_package_to_registry.yml
+++ b/config/events/push_symbol_package_to_registry.yml
@@ -11,6 +11,8 @@ additional_properties:
     description: The name of the package type
   property:
     description: The auth type. Either 'guest', 'user' or 'deploy_token'
+  deploy_token_id:
+    description: The hashed deploy token id
 product_group: package_registry
 milestone: '17.3'
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/161620
diff --git a/config/feature_flags/gitlab_com_derisk/concurrency_limit_current_limit_from_redis.yml b/config/feature_flags/gitlab_com_derisk/concurrency_limit_current_limit_from_redis.yml
new file mode 100644
index 00000000000..9b16cb5d6e2
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/concurrency_limit_current_limit_from_redis.yml
@@ -0,0 +1,10 @@
+---
+name: concurrency_limit_current_limit_from_redis
+description: Track current limit in Redis instead of using the statically defined concurrency_limit
+feature_issue_url: https://gitlab.com/gitlab-com/gl-infra/data-access/durability/team/-/issues/146
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194627
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/549836
+milestone: '18.2'
+group: group::durability
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/doc/administration/dedicated/configure_instance/users_notifications.md b/doc/administration/dedicated/configure_instance/users_notifications.md
index b4d7daede1d..618e7d90669 100644
--- a/doc/administration/dedicated/configure_instance/users_notifications.md
+++ b/doc/administration/dedicated/configure_instance/users_notifications.md
@@ -32,20 +32,37 @@ An invitation to use Switchboard is sent to the user.
 
 There is no direct link between the users in Switchboard and the users in the GitLab Dedicated instance.
 
+## Email notifications
+
+Switchboard sends email notifications about instance incidents, maintenance, performance issues, and security updates.
+
+Notifications are sent to:
+
+- Switchboard users: Receive notifications based on their notification settings.
+- Operational email addresses: Receive notifications for important instance events and service updates,
+  regardless of their notification settings.
+
+Operational email addresses receive customer notifications, even if recipients:
+
+- Are not Switchboard users.
+- Have not signed in to Switchboard.
+- Turn off email notifications.
+
+To stop receiving operational email notifications, [submit a support ticket](https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=4414917877650).
+
 ### Manage notification preferences
 
-You can specify whether you want to receive email notifications from Switchboard. You will only receive notifications after you:
+To receive email notifications, you must first:
 
-- Receive an email invitation and first sign in to Switchboard.
-- Set up a password and two-factor authentication (2FA) for your user account.
+- Receive an email invitation and sign in to Switchboard.
+- Set up a password and two-factor authentication (2FA).
 
-To manage your own email notification preferences:
+To turn your personal notifications on or off:
 
-1. From any page, open the dropdown next to your user name.
-1. To stop receiving email notifications, select **Toggle email notifications off**.
-1. To resume receiving email notifications, select **Toggle email notifications on**.
+1. Select the dropdown list next to your user name.
+1. Select **Toggle email notifications off** or **Toggle email notifications on**.
 
-You will see an alert confirming that your notification preferences have been updated.
+An alert confirms that your notification preferences have been updated.
 
 ## Reset a Switchboard user password
 
diff --git a/doc/api/groups.md b/doc/api/groups.md
index 5d4441b4b46..2648ec42bf5 100644
--- a/doc/api/groups.md
+++ b/doc/api/groups.md
@@ -1659,9 +1659,17 @@ Parameters:
 - `unique_project_download_limit`, `unique_project_download_limit_interval_in_seconds`, and `unique_project_download_limit_allowlist` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/92970) in GitLab 15.3 [with a flag](../administration/feature_flags/_index.md) named `limit_unique_project_downloads_per_namespace_user`. Disabled by default.
 - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/issues/365724) in GitLab 15.6.
 - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/183101) in GitLab 18.0. Feature flag `limit_unique_project_downloads_per_namespace_user` removed.
-
+- `web_based_commit_signing_enabled` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/193928) in GitLab 18.2 [with a flag](../administration/feature_flags/_index.md) named `use_web_based_commit_signing_enabled`. Disabled by default.
 {{< /history >}}
 
+{{< alert type="flag" >}}
+
+The availability of the  `web_based_commit_signing_enabled` attribute is controlled by a feature flag.
+For more information, see the history.
+This feature is available for testing, but not ready for production use.
+
+{{< /alert >}}
+
 Updates the project group. Only available to group owners and administrators.
 
 ```plaintext
@@ -1713,6 +1721,7 @@ PUT /groups/:id
 | `duo_features_enabled`                               | boolean           | no       | Indicates whether GitLab Duo features are enabled for this group. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
 | `lock_duo_features_enabled`                          | boolean           | no       | Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144931) in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only. |
 | `max_artifacts_size`                                 | integer           | No       | The maximum file size in megabytes for individual job artifacts. |
+| `web_based_commit_signing_enabled`                  | boolean           | No       | Enables web-based commit signing for commits created from the GitLab UI. Available only for top-level groups on GitLab SaaS. When enabled for a group, applies to all projects in the group. |
 
 {{< alert type="note" >}}
 
diff --git a/doc/api/projects.md b/doc/api/projects.md
index 636a5c46064..3fec92fffb5 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -356,9 +356,18 @@ List projects.
 {{< history >}}
 
 - The `_links.cluster_agents` attribute in the response was [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/347047) in GitLab 15.0.
+- `web_based_commit_signing_enabled` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194650) in GitLab 18.2 [with a flag](../administration/feature_flags/_index.md) named `use_web_based_commit_signing_enabled`. Disabled by default.
 
 {{< /history >}}
 
+{{< alert type="flag" >}}
+
+The availability of the  `web_based_commit_signing_enabled` attribute is controlled by a feature flag.
+For more information, see the history.
+This feature is available for testing, but not ready for production use.
+
+{{< /alert >}}
+
 Get a list of all visible projects across GitLab for the authenticated user.
 When accessed without authentication, only public projects with simple fields
 are returned.
@@ -1753,6 +1762,7 @@ Supported general project attributes:
 | `visibility`                                       | string            | No       | See [project visibility level](#project-visibility-level). |
 | `warn_about_potentially_unwanted_characters`       | boolean           | No       | Enable warnings about usage of potentially unwanted characters in this project. |
 | `wiki_enabled`                                     | boolean           | No       | _(Deprecated)_ Enable wiki for this project. Use `wiki_access_level` instead. |
+| `web_based_commit_signing_enabled`                 | boolean           | No       | Enables web-based commit signing for commits created from the GitLab UI. Available only on GitLab SaaS. |
 
 For example, to toggle the setting for [instance runners on a GitLab.com project](../ci/runners/_index.md):
 
diff --git a/doc/development/database/clickhouse/_index.md b/doc/development/database/clickhouse/_index.md
index 07351dd34b2..cf3a2641b75 100644
--- a/doc/development/database/clickhouse/_index.md
+++ b/doc/development/database/clickhouse/_index.md
@@ -10,7 +10,7 @@ title: Introduction to ClickHouse use and table design
 The [intro](https://clickhouse.com/docs/en/intro) page is quite good to give an overview of ClickHouse.
 
 ClickHouse has a lot of differences from traditional OLTP (online transaction processing) databases like PostgreSQL. The underlying architecture is a bit different, and the processing is a lot more CPU-bound than in traditional databases.
-ClickHouse is a log-centric database where immutability is a key component. The advantages of such approaches are well documented [[1]](https://www.odbms.org/2015/10/the-rise-of-immutable-data-stores/) however it also makes updates much harder. See ClickHouse [documentation](https://clickhouse.com/docs/en/guides/developer/mutations) for operations that provide UPDATE/DELETE support. It is noticeable that these operations are supposed to be non-frequent.
+ClickHouse is a log-centric database where immutability is a key component. The advantages of such approaches are well documented; for more information, see [The rise of immutable data stores](https://www.odbms.org/2015/10/the-rise-of-immutable-data-stores/). However, this also makes updates much harder. See ClickHouse [documentation](https://clickhouse.com/docs/en/guides/developer/mutations) for operations that provide UPDATE/DELETE support. It is noticeable that these operations are supposed to be non-frequent.
 
 This distinction is important while designing tables. Either:
 
diff --git a/doc/user/application_security/policies/scheduled_pipeline_execution_policies.md b/doc/user/application_security/policies/scheduled_pipeline_execution_policies.md
index 5c875a411b1..5e39e13ab4f 100644
--- a/doc/user/application_security/policies/scheduled_pipeline_execution_policies.md
+++ b/doc/user/application_security/policies/scheduled_pipeline_execution_policies.md
@@ -92,6 +92,7 @@ The `schedules` section supports the following options:
 | `time_window.value` | Duration in seconds (minimum: 600, maximum: 2629746) |
 | `time_window.distribution` | Distribution method (currently, only `random` is supported) |
 | `timezone` | IANA timezone identifier (defaults to UTC if not specified) |
+| `branches` | Optional array with names of the branches to schedule pipelines on. If `branches` is specified, pipelines run only on the specified branches and only if they exist in the project. If not specified, pipelines run only on the default branch. You can provide a maximum of five unique branch names per schedule. |
 | `days` | Use with weekly schedules only: Array of days when the schedule runs (for example, `["Monday", "Friday"]`) |
 | `days_of_month` | Use with monthly schedules only: Array of dates when the schedule runs (for example, `[1, 15]`, can include values from 1 to 31) |
 | `snooze` | Optional configuration to temporarily pause the schedule |
@@ -112,6 +113,10 @@ schedules:
       value: 3600  # 1 hour window
       distribution: random
     timezone: "America/New_York"
+    branches:
+      - main
+      - develop
+      - staging
 ```
 
 #### Weekly schedule example
@@ -207,6 +212,45 @@ For example, `2025-06-26T16:27:00+00:00` represents June 26, 2025, at 4:27 PM UT
 
 To remove a snooze before its expiration time, remove the `snooze` section from the policy configuration or set a date in the past for the `until` value.
 
+## Schedule pipelines for specific branches
+
+By default, schedules run on the default branch only. Scheduled pipeline execution policies support branch filtering, which allows you to schedule pipelines for additional branches. Use the `branches` property to perform regular scans or checks on other important branches in your project.
+
+When you configure the `branches` property in your schedule:
+
+- If you don't specify any branches, the scheduled pipeline runs only on the default branch.
+- If you specify branches, the policy schedules pipelines for each specified branch that actually exists in the project.
+- You can specify a maximum of five unique branch names per schedule.
+- You must specify each branch name in full. Wildcard matching is not supported.
+
+### Branch filtering example
+
+```yaml
+pipeline_execution_schedule_policy:
+- name: Scan Multiple Branches
+  description: 'Run security scans on main, staging and develop branches'
+  enabled: true
+  content:
+    include:
+    - project: your-group/your-project
+      file: security-scan.yml
+  schedules:
+  - type: weekly
+    days:
+      - Monday
+    start_time: '02:00'
+    time_window:
+      value: 3600
+      distribution: random
+    branches:
+      - main
+      - staging
+      - develop
+      - feature/new-authentication
+```
+
+In this example, if all of the specified branches exist in the project, the policy creates four separate pipelines (one for each branch).
+
 ## Requirements
 
 To use scheduled pipeline execution policies:
@@ -219,7 +263,8 @@ The security policy bot is a system account that GitLab automatically creates to
 
 Note these limitations:
 
-- Scheduled pipeline execution policies can only run on default branches.
+- If no branches are specified, scheduled pipeline execution policies only run on the default branch.
+- You can specify up to five unique branch names in the `branches` array.
 - Time windows must be at least 10 minutes (600 seconds) to ensure proper distribution of pipelines.
 - The maximum number of scheduled pipeline execution policies per security policy project is limited to 1 policy with 1 schedule.
 - This feature is experimental and may change in future releases.
@@ -240,6 +285,7 @@ If your scheduled pipelines are not running as expected, follow these troublesho
 1. **Verify policy configuration**:
    - Ensure the policy is enabled (`enabled: true`).
    - Verify that the schedule configuration has the correct format and valid values.
+   - If you've specified branches, verify that the branches exist in the project.
    - Verify that the time zone setting is correct (if specified).
 1. **Review logs and activity**:
    - Check the security policy project's CI/CD pipeline logs for any errors.
diff --git a/doc/user/packages/container_registry/protected_container_tags.md b/doc/user/packages/container_registry/protected_container_tags.md
index f46cfdd601d..4c820e28ba4 100644
--- a/doc/user/packages/container_registry/protected_container_tags.md
+++ b/doc/user/packages/container_registry/protected_container_tags.md
@@ -9,7 +9,6 @@ title: Protected container tags
 
 - Tier: Free, Premium, Ultimate
 - Offering: GitLab.com, GitLab Self-Managed
-- Status: Experiment
 
 {{< /details >}}
 
@@ -21,14 +20,6 @@ title: Protected container tags
 
 {{< /history >}}
 
-{{< alert type="flag" >}}
-
-The availability of this feature is controlled by a feature flag.
-For more information, see the history.
-This feature is available for testing, but not ready for production use.
-
-{{< /alert >}}
-
 Control who can push and delete container tags in your project.
 
 By default, users with the Developer role or higher can push and delete image tags in all project container repositories.
diff --git a/keeps/prompts/remove_feature_flags.rb b/keeps/prompts/remove_feature_flags.rb
index a92ac1dbe0b..72b5a98dd76 100644
--- a/keeps/prompts/remove_feature_flags.rb
+++ b/keeps/prompts/remove_feature_flags.rb
@@ -282,6 +282,7 @@ module Keeps
           - NEVER change the syntax of remaining feature flags from `this.glFeatures.otherFlag` to anything else
           - NEVER replace `this.glFeatures.` with `$options.features.` or any other syntax
           - NEVER modify feature flags other than `#{camel_case_flag}`
+          - NEVER add optional chaining to feature flag mixin `this.glFeatures?.flagName` or `glFeatures?.flagName`.
           - If in doubt, keep the mixin - it's safer to leave it than to break other feature flags
 
           If there are no changes needed to the file, return it unchanged.
diff --git a/lib/gitlab/file_detector.rb b/lib/gitlab/file_detector.rb
index 6bab14ca767..95e39944270 100644
--- a/lib/gitlab/file_detector.rb
+++ b/lib/gitlab/file_detector.rb
@@ -22,7 +22,7 @@ module Gitlab
       # Configuration files
       gitignore: '.gitignore',
       gitlab_ci: ::Ci::Pipeline::DEFAULT_CONFIG_PATH,
-      jenkinsfile: 'jenkinsfile',
+      jenkinsfile: %r{\A([^/]*\.)?Jenkinsfile(\.[^/]*)?\z}i,
       route_map: '.gitlab/route-map.yml',
 
       # Dependency files
diff --git a/lib/gitlab/group_search_results.rb b/lib/gitlab/group_search_results.rb
index b112740c4ad..506d3c17776 100644
--- a/lib/gitlab/group_search_results.rb
+++ b/lib/gitlab/group_search_results.rb
@@ -4,10 +4,18 @@ module Gitlab
   class GroupSearchResults < SearchResults
     attr_reader :group
 
-    def initialize(current_user, query, limit_projects = nil, group:, default_project_filter: false, order_by: nil, sort: nil, filters: {})
+    def initialize(current_user, query, limit_projects = nil, group:, **opts)
       @group = group
-
-      super(current_user, query, limit_projects, default_project_filter: default_project_filter, order_by: order_by, sort: sort, filters: filters)
+      super(
+        current_user,
+        query,
+        limit_projects,
+        default_project_filter: opts.fetch(:default_project_filter, false),
+        order_by: opts.fetch(:order_by, nil),
+        sort: opts.fetch(:sort, nil),
+        filters: opts.fetch(:filters, {}),
+        source: opts.fetch(:source, nil)
+      )
     end
 
     # rubocop:disable CodeReuse/ActiveRecord
diff --git a/lib/gitlab/import_sources.rb b/lib/gitlab/import_sources.rb
index 20e61d6793e..a340a4deae2 100644
--- a/lib/gitlab/import_sources.rb
+++ b/lib/gitlab/import_sources.rb
@@ -22,29 +22,37 @@ module Gitlab
     class << self
       prepend_mod_with('Gitlab::ImportSources') # rubocop: disable Cop/InjectEnterpriseEditionModule
 
-      def options
-        import_table.to_h { |importer| [importer.title, importer.name] }
-      end
-
       def values
         import_table.map(&:name)
       end
 
+      def import_source(name)
+        import_table.find { |import_source| import_source.name == name }
+      end
+
       def has_importer?(name)
-        import_table.select(&:importer).map(&:name).include?(name)
+        importer(name).present?
+      end
+
+      def template?(name)
+        project_template_importers.include?(name)
       end
 
       def importer(name)
-        import_table.find { |import_source| import_source.name == name }.importer
+        import_source(name)&.importer
       end
 
       def title(name)
-        options.key(name)
+        import_source(name)&.title
       end
 
       def import_table
         IMPORT_TABLE
       end
+
+      def project_template_importers
+        []
+      end
     end
   end
 end
diff --git a/lib/gitlab/project_search_results.rb b/lib/gitlab/project_search_results.rb
index 24c7d9d78cf..1fcc94bc1ac 100644
--- a/lib/gitlab/project_search_results.rb
+++ b/lib/gitlab/project_search_results.rb
@@ -4,12 +4,12 @@ module Gitlab
   class ProjectSearchResults < SearchResults
     attr_reader :project, :repository_ref
 
-    def initialize(current_user, query, project:, repository_ref: nil, order_by: nil, sort: nil, filters: {})
+    def initialize(current_user, query, project:, repository_ref: nil, order_by: nil, sort: nil, filters: {}, source: nil)
       @project = project
       @repository_ref = repository_ref.presence
 
       # use the default filter for project searches since we are already limiting by a single project
-      super(current_user, query, [project], order_by: order_by, sort: sort, filters: filters, default_project_filter: true)
+      super(current_user, query, [project], order_by: order_by, sort: sort, filters: filters, default_project_filter: true, source: source)
     end
 
     def objects(scope, page: nil, per_page: DEFAULT_PER_PAGE, preload_method: nil)
diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index 3993d547bc5..4c99e9ba914 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -7,7 +7,7 @@ module Gitlab
     DEFAULT_PAGE = 1
     DEFAULT_PER_PAGE = 20
 
-    attr_reader :current_user, :query, :order_by, :sort, :filters
+    attr_reader :current_user, :query, :order_by, :sort, :filters, :source
 
     # Limit search results by passed projects
     # It allows us to search only for projects user has access to
@@ -26,7 +26,9 @@ module Gitlab
       order_by: nil,
       sort: nil,
       default_project_filter: false,
-      filters: {})
+      filters: {},
+      source: nil
+    )
       @current_user = current_user
       @query = query
       @limit_projects = limit_projects || Project.all
@@ -34,6 +36,7 @@ module Gitlab
       @order_by = order_by
       @sort = sort
       @filters = filters
+      @source = source
     end
 
     def objects(scope, page: nil, per_page: DEFAULT_PER_PAGE, without_count: true, preload_method: nil)
diff --git a/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service.rb b/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service.rb
index a7abe5e8769..22a409c4c97 100644
--- a/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service.rb
+++ b/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service.rb
@@ -12,10 +12,13 @@ module Gitlab
         delegate :track_execution_start, :track_execution_end, :cleanup_stale_trackers,
           :concurrent_worker_count, to: :@worker_execution_tracker
 
+        delegate :current_limit, :set_current_limit!, to: :@limit_manager
+
         def initialize(worker_name)
           @worker_name = worker_name
           @queue_manager = QueueManager.new(worker_name: worker_name, prefix: REDIS_KEY_PREFIX)
           @worker_execution_tracker = WorkerExecutionTracker.new(worker_name: worker_name, prefix: REDIS_KEY_PREFIX)
+          @limit_manager = LimitManager.new(worker_name: worker_name, prefix: REDIS_KEY_PREFIX)
         end
 
         class << self
@@ -54,6 +57,23 @@ module Gitlab
           def concurrent_worker_count(worker_name)
             new(worker_name).concurrent_worker_count
           end
+
+          def current_limit(worker_name)
+            new(worker_name).current_limit
+          end
+
+          def set_current_limit!(worker_name, limit:)
+            new(worker_name).set_current_limit!(limit)
+          end
+
+          def over_the_limit?(worker_name)
+            service = new(worker_name)
+            limit = service.current_limit
+
+            return false if limit == 0
+
+            service.concurrent_worker_count >= limit
+          end
         end
       end
     end
diff --git a/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager.rb b/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager.rb
new file mode 100644
index 00000000000..9f4aaef0aa4
--- /dev/null
+++ b/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqMiddleware
+    module ConcurrencyLimit
+      class LimitManager
+        include Gitlab::Utils::StrongMemoize
+
+        TTL = 30.minutes
+        attr_reader :worker_name
+
+        def initialize(worker_name:, prefix:)
+          @worker_name = worker_name
+          @prefix = prefix
+        end
+
+        # Reads the current limit value in Redis.
+        # Falls back on the max limit value set in WorkersMap if no limit is set in Redis.
+        # @return [Integer] The current limit value, or 0 if no limit is set
+        def current_limit
+          return 0 if worker_klass.nil?
+
+          value = with_redis do |r|
+            value = r.get(current_limit_key)
+            value.to_i if value
+          end
+
+          return value unless value.nil?
+
+          limit_from_workers_map
+        end
+
+        # Updates the current limit value in Redis
+        # @param value [Integer] The new limit value to set
+        def set_current_limit!(value)
+          with_redis do |r|
+            r.set(current_limit_key, value.to_i, ex: TTL)
+          end
+        end
+
+        private
+
+        def worker_klass
+          worker_name.safe_constantize
+        end
+        strong_memoize_attr(:worker_klass)
+
+        def limit_from_workers_map
+          WorkersMap.limit_for(worker: worker_klass)
+        end
+
+        def with_redis(&block)
+          Gitlab::Redis::QueuesMetadata.with(&block) # rubocop:disable CodeReuse/ActiveRecord -- Not active record
+        end
+
+        def current_limit_key
+          "#{@prefix}:{#{@worker_name.underscore}}:current_limit"
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/sidekiq_middleware/concurrency_limit/middleware.rb b/lib/gitlab/sidekiq_middleware/concurrency_limit/middleware.rb
index d6be27343bb..06b45e3dc88 100644
--- a/lib/gitlab/sidekiq_middleware/concurrency_limit/middleware.rb
+++ b/lib/gitlab/sidekiq_middleware/concurrency_limit/middleware.rb
@@ -9,7 +9,7 @@ module Gitlab
           @job = job
 
           worker_class = worker.is_a?(Class) ? worker : worker.class
-          @worker_class = worker_class.name
+          @worker_name = worker_class.name
         end
 
         # This will continue the middleware chain if the job should be scheduled
@@ -41,7 +41,7 @@ module Gitlab
 
         private
 
-        attr_reader :job, :worker, :worker_class
+        attr_reader :job, :worker, :worker_name
 
         def should_defer_schedule?
           return false if Feature.disabled?(:sidekiq_concurrency_limit_middleware, Feature.current_request, type: :ops)
@@ -58,7 +58,11 @@ module Gitlab
           return false if resumed?
           return true if has_jobs_in_queue?
 
-          ::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap.over_the_limit?(worker: worker)
+          if Feature.enabled?(:concurrency_limit_current_limit_from_redis, Feature.current_request)
+            concurrency_service.over_the_limit?(worker_name)
+          else
+            ::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap.over_the_limit?(worker: worker)
+          end
         end
 
         def concurrency_service
@@ -68,13 +72,13 @@ module Gitlab
         def track_execution_start
           return if Feature.disabled?(:sidekiq_concurrency_limit_middleware, Feature.current_request, type: :ops)
 
-          concurrency_service.track_execution_start(worker_class)
+          concurrency_service.track_execution_start(worker_name)
         end
 
         def track_execution_end
           return if Feature.disabled?(:sidekiq_concurrency_limit_middleware, Feature.current_request, type: :ops)
 
-          concurrency_service.track_execution_end(worker_class)
+          concurrency_service.track_execution_end(worker_name)
         end
 
         def worker_limit
@@ -86,7 +90,7 @@ module Gitlab
         end
 
         def has_jobs_in_queue?
-          concurrency_service.has_jobs_in_queue?(worker_class)
+          concurrency_service.has_jobs_in_queue?(worker_name)
         end
 
         def defer_job!
diff --git a/lib/sidebars/groups/menus/settings_menu.rb b/lib/sidebars/groups/menus/settings_menu.rb
index 43468942a12..eab7aa26830 100644
--- a/lib/sidebars/groups/menus/settings_menu.rb
+++ b/lib/sidebars/groups/menus/settings_menu.rb
@@ -104,7 +104,7 @@ module Sidebars
           ::Sidebars::MenuItem.new(
             title: s_('UsageQuota|Usage Quotas'),
             link: group_usage_quotas_path(context.group),
-            active_routes: { path: 'usage_quotas#index' },
+            active_routes: { path: 'usage_quotas#root' },
             item_id: :usage_quotas
           )
         end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 1390a5bebc1..3039ef7cac7 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -11539,9 +11539,6 @@ msgstr ""
 msgid "BulkImport|More than six imports were attempted in one minute. Try again after a minute."
 msgstr ""
 
-msgid "BulkImport|New group"
-msgstr ""
-
 msgid "BulkImport|No additional information provided"
 msgstr ""
 
@@ -11617,6 +11614,9 @@ msgstr ""
 msgid "BulkImport|This %{importable} was imported from another instance."
 msgstr ""
 
+msgid "BulkImport|This item was imported from another instance."
+msgstr ""
+
 msgid "BulkImport|This name already exists."
 msgstr ""
 
@@ -70878,6 +70878,9 @@ msgstr ""
 msgid "WorkItem|This group has no active custom fields. Create a custom field to track data that matters to your team."
 msgstr ""
 
+msgid "WorkItem|This item is hidden because its author has been banned."
+msgstr ""
+
 msgid "WorkItem|This work item is not available. It either doesn't exist or you don't have permission to view it."
 msgstr ""
 
diff --git a/package.json b/package.json
index 3500eea6cdf..e84a6ac7409 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/query-language-rust": "0.9.0",
     "@gitlab/svgs": "3.134.0",
-    "@gitlab/ui": "114.0.1",
+    "@gitlab/ui": "114.7.1",
     "@gitlab/vue-router-vue3": "npm:vue-router@4.5.1",
     "@gitlab/vuex-vue3": "npm:vuex@4.1.0",
     "@gitlab/web-ide": "^0.0.1-dev-20250618150607",
@@ -262,9 +262,9 @@
     "@testing-library/dom": "^7.16.2",
     "@types/jest": "^29.5.12",
     "@types/lodash": "^4.14.197",
-    "@vue/compat": "^3.5.13",
-    "@vue/compiler-sfc": "^3.5.13",
-    "@vue/server-renderer": "^3.5.13",
+    "@vue/compat": "^3.5.17",
+    "@vue/compiler-sfc": "^3.5.17",
+    "@vue/server-renderer": "^3.5.17",
     "@vue/test-utils": "1.3.6",
     "@vue/test-utils-vue3": "npm:@vue/test-utils@^2.4.6",
     "@vue/vue2-jest": "^28.1.0",
diff --git a/patches/@vue+compat+3.5.13.patch b/patches/@vue+compat+3.5.13.patch
deleted file mode 100644
index bc279e20ab5..00000000000
--- a/patches/@vue+compat+3.5.13.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/node_modules/@vue/compat/dist/vue.cjs.js b/node_modules/@vue/compat/dist/vue.cjs.js
-index 5b4b617..1baafa5 100644
---- a/node_modules/@vue/compat/dist/vue.cjs.js
-+++ b/node_modules/@vue/compat/dist/vue.cjs.js
-@@ -10208,8 +10208,20 @@ function emit(instance, event, ...rawArgs) {
-     }
-   }
-   let args = rawArgs;
--  const isModelListener = event.startsWith("update:");
--  const modifiers = isModelListener && getModelModifiers(props, event.slice(7));
-+
-+  // This applies https://github.com/vuejs/core/pull/12654. Once that has been
-+  // merged and we've upgraded to the version of @vue/compat that includes it,
-+  // this patch can be removed.
-+  let isModelListener;
-+  let modifiers;
-+  if (
-+    (isModelListener = compatModelEventPrefix + event in props)
-+  ) {
-+    modifiers = props.modelModifiers
-+  } else if ((isModelListener = event.startsWith('update:'))) {
-+    modifiers = getModelModifiers(props, event.slice(7));
-+  }
-+
-   if (modifiers) {
-     if (modifiers.trim) {
-       args = rawArgs.map((a) => isString(a) ? a.trim() : a);
diff --git a/patches/@vue+compiler-sfc+3.5.13.patch b/patches/@vue+compiler-sfc+3.5.17.patch
similarity index 89%
rename from patches/@vue+compiler-sfc+3.5.13.patch
rename to patches/@vue+compiler-sfc+3.5.17.patch
index cc8cc85b7e5..ca9383a7c00 100644
--- a/patches/@vue+compiler-sfc+3.5.13.patch
+++ b/patches/@vue+compiler-sfc+3.5.17.patch
@@ -1,5 +1,5 @@
 diff --git a/node_modules/@vue/compiler-sfc/dist/compiler-sfc.cjs.js b/node_modules/@vue/compiler-sfc/dist/compiler-sfc.cjs.js
-index dc6a170..a47e397 100644
+index 652af73..a715166 100644
 --- a/node_modules/@vue/compiler-sfc/dist/compiler-sfc.cjs.js
 +++ b/node_modules/@vue/compiler-sfc/dist/compiler-sfc.cjs.js
 @@ -1817,7 +1817,8 @@ function parse$1(source, options = {}) {
@@ -13,15 +13,16 @@ index dc6a170..a47e397 100644
                `<template functional> is no longer supported in Vue 3, since functional components no longer have significant performance difference from stateful ones. Just use a normal <template> instead.`
              );
 diff --git a/node_modules/@vue/compiler-sfc/dist/compiler-sfc.esm-browser.js b/node_modules/@vue/compiler-sfc/dist/compiler-sfc.esm-browser.js
-index a7cf8b0..0969009 100644
+index d3bb28f..80c9c7d 100644
 --- a/node_modules/@vue/compiler-sfc/dist/compiler-sfc.esm-browser.js
 +++ b/node_modules/@vue/compiler-sfc/dist/compiler-sfc.esm-browser.js
-@@ -26519,7 +26519,8 @@ function parse$2(source, options = {}) {
+@@ -27061,7 +27061,9 @@ function parse$2(source, options = {}) {
            if (!templateBlock.attrs.src) {
              templateBlock.ast = createRoot(node.children, source);
            }
 -          if (templateBlock.attrs.functional) {
 +          // disabled by patch-package in gitlab as temporary migration
++          // See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/114730
 +          if (false && templateBlock.attrs.functional) {
              const err = new SyntaxError(
                `<template functional> is no longer supported in Vue 3, since functional components no longer have significant performance difference from stateful ones. Just use a normal <template> instead.`
diff --git a/scripts/frontend/quarantined_vue3_specs.txt b/scripts/frontend/quarantined_vue3_specs.txt
index c85745bd975..cb0456ca268 100644
--- a/scripts/frontend/quarantined_vue3_specs.txt
+++ b/scripts/frontend/quarantined_vue3_specs.txt
@@ -1,6 +1,5 @@
 # Lines beginning with a hash are ignored, like this one.
 # Do not add new specs to this file.
-ee/spec/frontend/admin/signup_restrictions/components/signup_form_spec.js
 ee/spec/frontend/admin/subscriptions/show/components/subscription_breakdown_spec.js
 ee/spec/frontend/analytics/analytics_dashboards/components/analytics_dashboards_breadcrumbs_spec.js
 ee/spec/frontend/analytics/analytics_dashboards/components/analytics_data_explorer_spec.js
@@ -23,7 +22,6 @@ ee/spec/frontend/dependencies/components/direct_descendant_viewer_spec.js
 ee/spec/frontend/dependencies/components/filtered_search/tokens/component_token_spec.js
 ee/spec/frontend/geo_sites/index_spec.js
 ee/spec/frontend/groups/settings/components/comma_separated_list_token_selector_spec.js
-ee/spec/frontend/integrations/edit/components/jira_issue_creation_vulnerabilities_spec.js
 ee/spec/frontend/issues_analytics/components/issues_analytics_table_spec.js
 ee/spec/frontend/iterations/components/iteration_form_spec.js
 ee/spec/frontend/iterations/components/iteration_report_issues_spec.js
@@ -47,7 +45,6 @@ ee/spec/frontend/users/identity_verification/components/international_phone_inpu
 ee/spec/frontend/users/identity_verification/components/verify_phone_verification_code_spec.js
 spec/frontend/__helpers__/vue_test_utils_helper_spec.js
 spec/frontend/access_tokens/index_spec.js
-spec/frontend/admin/abuse_reports/components/abuse_reports_filtered_search_bar_spec.js
 spec/frontend/admin/broadcast_messages/components/base_spec.js
 spec/frontend/alert_management/components/alert_management_table_spec.js
 spec/frontend/boards/board_list_spec.js
@@ -88,8 +85,6 @@ spec/frontend/glql/components/presenters/table_spec.js
 spec/frontend/glql/core/presenter_spec.js
 spec/frontend/groups/components/transfer_group_form_spec.js
 spec/frontend/helpers/init_simple_app_helper_spec.js
-spec/frontend/integrations/edit/components/trigger_field_spec.js
-spec/frontend/integrations/edit/components/trigger_fields_spec.js
 spec/frontend/issuable/related_issues/components/related_issues_root_spec.js
 spec/frontend/issues/list/components/issues_list_app_spec.js
 spec/frontend/issues/service_desk/components/service_desk_list_app_spec.js
diff --git a/scripts/utils.sh b/scripts/utils.sh
index 3da24d2fa3e..77bf94842f9 100644
--- a/scripts/utils.sh
+++ b/scripts/utils.sh
@@ -165,7 +165,7 @@ function setup_database_yml() {
 
   # Set up Geo database if the job name matches `rspec-ee` or `geo`.
   # Since Geo is an EE feature, we shouldn't set it up for non-EE tests.
-  if [[ "${CI_JOB_NAME}" =~ "rspec-ee" ]] || [[ "${CI_JOB_NAME}" =~ "geo" ]]; then
+  if [[ "${CI_JOB_NAME}" =~ "rspec-ee" ]] || [[ "${CI_JOB_NAME}" =~ "geo" ]] || [[ "${CI_JOB_NAME}" =~ "db:setup-ee" ]]; then
     echoinfo "Geo DB will be set up."
   else
     echoinfo "Geo DB won't be set up."
@@ -174,7 +174,7 @@ function setup_database_yml() {
 
   # Set up Embedding database if the job name matches `rspec-ee`
   # Since Embedding is an EE feature, we shouldn't set it up for non-EE tests.
-  if [[ "${CI_JOB_NAME}" =~ "rspec-ee" ]]; then
+  if [[ "${CI_JOB_NAME}" =~ "rspec-ee" ]] || [[ "${CI_JOB_NAME}" =~ "db:setup-ee" ]]; then
     echoinfo "Embedding DB will be set up."
   else
     echoinfo "Embedding DB won't be set up."
diff --git a/spec/features/issuables/sorting_list_spec.rb b/spec/features/issuables/sorting_list_spec.rb
index c53094a5abb..77a067801f8 100644
--- a/spec/features/issuables/sorting_list_spec.rb
+++ b/spec/features/issuables/sorting_list_spec.rb
@@ -55,7 +55,7 @@ RSpec.describe 'Sort Issuable List', feature_category: :team_planning do
         it 'is "created date"' do
           visit_merge_requests_with_state(project, 'opened')
 
-          expect(selected_sort_order).to eq('created date')
+          expect(page).to have_button 'Created date'
           expect(first_merge_request).to include(last_created_issuable.title)
           expect(last_merge_request).to include(first_created_issuable.title)
         end
@@ -216,10 +216,6 @@ RSpec.describe 'Sort Issuable List', feature_category: :team_planning do
     end
   end
 
-  def selected_sort_order
-    find('.sort-dropdown-container').text.downcase
-  end
-
   def visit_merge_requests_with_state(project, state)
     visit_merge_requests project, state: state
   end
diff --git a/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb b/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
index f399e6a24ca..214bf767337 100644
--- a/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
+++ b/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
@@ -19,8 +19,7 @@ RSpec.describe 'Admin views hidden merge request', feature_category: :insider_th
 
       find('svg[data-testid="spam-icon"]').hover
 
-      expect(page).to have_text format(_('This %{issuable} is hidden because its author has been banned.'),
-        issuable: _('merge request'))
+      expect(page).to have_text 'This item is hidden because its author has been banned.'
     end
   end
 end
diff --git a/spec/features/snippets/explore_spec.rb b/spec/features/snippets/explore_spec.rb
index 2e06125963e..139866b5b0b 100644
--- a/spec/features/snippets/explore_spec.rb
+++ b/spec/features/snippets/explore_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe 'Explore Snippets', feature_category: :source_code_management do
   let!(:internal_snippet) { create(:personal_snippet, :internal) }
   let!(:private_snippet) { create(:personal_snippet, :private) }
 
-  context 'User' do
+  context 'when user is authenticated' do
     let(:user) { create(:user) }
 
     before do
@@ -27,7 +27,7 @@ RSpec.describe 'Explore Snippets', feature_category: :source_code_management do
     end
   end
 
-  context 'External user' do
+  context 'when external user is authenticated' do
     let(:user) { create(:user, :external) }
 
     before do
@@ -58,7 +58,7 @@ RSpec.describe 'Explore Snippets', feature_category: :source_code_management do
     end
   end
 
-  context 'Not authenticated user' do
+  context 'when user is not authenticated' do
     before do
       visit explore_snippets_path
     end
diff --git a/spec/frontend/design_management/components/design_notes/design_note_spec.js b/spec/frontend/design_management/components/design_notes/design_note_spec.js
index 98245e96357..9d46e664764 100644
--- a/spec/frontend/design_management/components/design_notes/design_note_spec.js
+++ b/spec/frontend/design_management/components/design_notes/design_note_spec.js
@@ -193,7 +193,7 @@ describe('Design note component', () => {
         },
       });
 
-      expect(findImportedBadge().props('importableType')).toBe('comment');
+      expect(findImportedBadge().exists()).toBe(true);
     });
   });
 
diff --git a/spec/frontend/design_management/components/toolbar/__snapshots__/index_spec.js.snap b/spec/frontend/design_management/components/toolbar/__snapshots__/index_spec.js.snap
index 560a89afe4a..56c6d36cb47 100644
--- a/spec/frontend/design_management/components/toolbar/__snapshots__/index_spec.js.snap
+++ b/spec/frontend/design_management/components/toolbar/__snapshots__/index_spec.js.snap
@@ -31,7 +31,6 @@ exports[`Design management toolbar component renders design and updated data 1`]
         </span>
         <imported-badge-stub
           class="gl-ml-2"
-          importabletype="design"
         />
       </h2>
       <small
diff --git a/spec/frontend/import_entities/import_groups/components/import_table_spec.js b/spec/frontend/import_entities/import_groups/components/import_table_spec.js
index 93b6ca39682..100a74318ee 100644
--- a/spec/frontend/import_entities/import_groups/components/import_table_spec.js
+++ b/spec/frontend/import_entities/import_groups/components/import_table_spec.js
@@ -1,11 +1,11 @@
-import { GlEmptyState, GlIcon, GlLoadingIcon } from '@gitlab/ui';
+import { GlEmptyState, GlLoadingIcon } from '@gitlab/ui';
 import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import MockAdapter from 'axios-mock-adapter';
 import { mountExtended, extendedWrapper } from 'helpers/vue_test_utils_helper';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
-import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
+import { createMockDirective } from 'helpers/vue_mock_directive';
 import { createAlert } from '~/alert';
 import { HTTP_STATUS_OK, HTTP_STATUS_TOO_MANY_REQUESTS } from '~/lib/utils/http_status';
 import axios from '~/lib/utils/axios_utils';
@@ -64,7 +64,6 @@ describe('import table', () => {
     extendedWrapper(rowWrapper).findByTestId('target-namespace-input');
   const findPaginationDropdownText = () => findPaginationDropdown().find('button').text();
   const findSelectionCount = () => wrapper.findByTestId('selection-count');
-  const findNewPathCol = () => wrapper.findByTestId('new-path-col');
   const findHistoryLink = () => wrapper.findByTestId('history-link');
   const findUnavailableFeaturesWarning = () => wrapper.findByTestId('unavailable-features-alert');
   const findImportProjectsWarning = () => wrapper.findByTestId('import-projects-warning');
@@ -850,26 +849,6 @@ describe('import table', () => {
     );
   });
 
-  it('displays info icon with a tooltip', async () => {
-    const NEW_GROUPS = [generateFakeEntry({ id: 1, status: STATUSES.NONE })];
-
-    createComponent({
-      bulkImportSourceGroups: () => ({
-        nodes: NEW_GROUPS,
-        pageInfo: FAKE_PAGE_INFO,
-        versionValidation: FAKE_VERSION_VALIDATION,
-      }),
-    });
-    jest.spyOn(apolloProvider.defaultClient, 'mutate');
-    await waitForPromises();
-
-    const icon = findNewPathCol().findComponent(GlIcon);
-    const tooltip = getBinding(icon.element, 'gl-tooltip');
-
-    expect(tooltip).toBeDefined();
-    expect(tooltip.value).toBe('Path of the new group');
-  });
-
   describe('re-import', () => {
     beforeEach(async () => {
       createComponent({
diff --git a/spec/frontend/issuable/components/hidden_badge_spec.js b/spec/frontend/issuable/components/hidden_badge_spec.js
index 02ffac66f42..61e89f646c5 100644
--- a/spec/frontend/issuable/components/hidden_badge_spec.js
+++ b/spec/frontend/issuable/components/hidden_badge_spec.js
@@ -11,34 +11,33 @@ describe('HiddenBadge component', () => {
       directives: {
         GlTooltip: createMockDirective('gl-tooltip'),
       },
-      propsData: {
-        issuableType: 'issue',
-      },
     });
   };
 
   const findBadge = () => wrapper.findComponent(GlBadge);
 
-  beforeEach(() => {
-    mountComponent();
-  });
+  describe('default', () => {
+    beforeEach(() => {
+      mountComponent();
+    });
 
-  it('renders warning badge', () => {
-    expect(findBadge().attributes('aria-label')).toBe('Hidden');
-    expect(findBadge().props('variant')).toEqual('warning');
-  });
+    it('renders warning badge', () => {
+      expect(findBadge().attributes('aria-label')).toBe('Hidden');
+      expect(findBadge().props('variant')).toEqual('warning');
+    });
 
-  it('renders spam icon', () => {
-    expect(findBadge().props('icon')).toBe('spam');
-  });
+    it('renders spam icon', () => {
+      expect(findBadge().props('icon')).toBe('spam');
+    });
 
-  it('has tooltip', () => {
-    expect(getBinding(wrapper.element, 'gl-tooltip')).not.toBeUndefined();
-  });
+    it('has tooltip', () => {
+      expect(getBinding(wrapper.element, 'gl-tooltip')).not.toBeUndefined();
+    });
 
-  it('has title', () => {
-    expect(findBadge().attributes('title')).toBe(
-      'This issue is hidden because its author has been banned.',
-    );
+    it('has title', () => {
+      expect(findBadge().attributes('title')).toBe(
+        'This item is hidden because its author has been banned.',
+      );
+    });
   });
 });
diff --git a/spec/frontend/members/components/avatars/user_avatar_spec.js b/spec/frontend/members/components/avatars/user_avatar_spec.js
index 6ab945bbbe0..5c6f4eef054 100644
--- a/spec/frontend/members/components/avatars/user_avatar_spec.js
+++ b/spec/frontend/members/components/avatars/user_avatar_spec.js
@@ -5,6 +5,8 @@ import { AVAILABILITY_STATUS } from '~/set_status_modal/constants';
 
 import { member as memberMock, member2faEnabled, orphanedMember } from '../../mock_data';
 
+jest.mock('lodash/uniqueId', () => (x) => `${x}1`);
+
 describe('UserAvatar', () => {
   let wrapper;
 
@@ -74,6 +76,12 @@ describe('UserAvatar', () => {
     expect(wrapper.find('img').exists()).toBe(false);
   });
 
+  it('renders id on parent to make popover accessible via keyboard', () => {
+    createComponent();
+
+    expect(wrapper.find('span').attributes('id')).toBe('user-popover-1');
+  });
+
   describe('when user property does not exist', () => {
     it('displays an orphaned user', () => {
       createComponent({ member: orphanedMember });
diff --git a/spec/frontend/merge_requests/components/merge_request_header_spec.js b/spec/frontend/merge_requests/components/merge_request_header_spec.js
index c53a340281f..2ca2852b54f 100644
--- a/spec/frontend/merge_requests/components/merge_request_header_spec.js
+++ b/spec/frontend/merge_requests/components/merge_request_header_spec.js
@@ -93,7 +93,7 @@ describe('MergeRequestHeader component', () => {
     it('renders when merge request is imported', () => {
       createComponent({ isImported: true });
 
-      expect(findImportedBadge().props('importableType')).toBe('merge_request');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('does not render when merge request is not imported', () => {
diff --git a/spec/frontend/merge_requests/components/sticky_header_spec.js b/spec/frontend/merge_requests/components/sticky_header_spec.js
index 11e2dff4559..2a9f3ad9032 100644
--- a/spec/frontend/merge_requests/components/sticky_header_spec.js
+++ b/spec/frontend/merge_requests/components/sticky_header_spec.js
@@ -78,7 +78,7 @@ describe('Merge requests sticky header component', () => {
         props: { isImported: true },
       });
 
-      expect(findImportedBadge().props('importableType')).toBe('merge_request');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('does not render when merge request is not imported', () => {
diff --git a/spec/frontend/notes/components/note_header_spec.js b/spec/frontend/notes/components/note_header_spec.js
index c487a748aa4..027d8ba5c54 100644
--- a/spec/frontend/notes/components/note_header_spec.js
+++ b/spec/frontend/notes/components/note_header_spec.js
@@ -204,13 +204,13 @@ describe('NoteHeader component', () => {
     it('renders with "comment" when note is imported', () => {
       createComponent({ isImported: true });
 
-      expect(findImportedBadge().props('importableType')).toBe('comment');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('renders with "activity" when note is imported and is system note', () => {
       createComponent({ isImported: true, isSystemNote: true });
 
-      expect(findImportedBadge().props('importableType')).toBe('activity');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('does not render when note is not imported', () => {
diff --git a/spec/frontend/snippets/components/snippet_header_spec.js b/spec/frontend/snippets/components/snippet_header_spec.js
index 7a57b47008c..b2e6621f50c 100644
--- a/spec/frontend/snippets/components/snippet_header_spec.js
+++ b/spec/frontend/snippets/components/snippet_header_spec.js
@@ -217,7 +217,7 @@ describe('Snippet header component', () => {
         snippetProps: { imported: true },
       });
 
-      expect(findImportedBadge().props('importableType')).toBe('snippet');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('does not render when snippet is not imported', () => {
diff --git a/spec/frontend/user_popovers_spec.js b/spec/frontend/user_popovers_spec.js
index d5b2d59bea9..7b469c3147d 100644
--- a/spec/frontend/user_popovers_spec.js
+++ b/spec/frontend/user_popovers_spec.js
@@ -83,12 +83,13 @@ describe('User Popovers', () => {
       resetHTMLFixture();
     });
 
-    describe('shows a placeholder popover on hover', () => {
+    describe.each(['mouseover', 'focusin'])('shows a placeholder popover on %s', (eventType) => {
       let linksWithUsers;
+
       beforeEach(() => {
         linksWithUsers = findFixtureLinks();
         linksWithUsers.forEach((el) => {
-          triggerEvent('mouseover', el);
+          triggerEvent(eventType, el);
         });
       });
 
@@ -105,7 +106,7 @@ describe('User Popovers', () => {
         jest.runOnlyPendingTimers();
 
         addedLinks.forEach((link) => {
-          triggerEvent('mouseover', link);
+          triggerEvent(eventType, link);
         });
 
         expect(findPopovers().length).toBe(linksWithUsers.length + addedLinks.length);
@@ -121,7 +122,7 @@ describe('User Popovers', () => {
 
         expect(findPopovers().length).toBe(linksWithUsers.length);
 
-        triggerEvent('mouseover', div);
+        triggerEvent(eventType, div);
 
         expect(findPopovers().length).toBe(linksWithUsers.length + 1);
       });
@@ -149,48 +150,55 @@ describe('User Popovers', () => {
 
     it('does not initialize the user popovers twice for the same element', () => {
       const [firstUserLink] = findFixtureLinks();
-      triggerEvent('mouseover', firstUserLink);
-      jest.runOnlyPendingTimers();
-      triggerEvent('mouseleave', firstUserLink);
-      jest.runOnlyPendingTimers();
-      triggerEvent('mouseover', firstUserLink);
-      jest.runOnlyPendingTimers();
+
+      const events = ['mouseover', 'mouseleave', 'mouseover', 'focusin', 'focusout'];
+
+      events.forEach((event) => {
+        triggerEvent(event, firstUserLink);
+        jest.runOnlyPendingTimers();
+      });
 
       expect(findPopovers().length).toBe(1);
     });
 
-    describe('when user link emits mouseenter event with empty user cache', () => {
-      let userLink;
+    describe.each(['focusin', 'mouseover'])(
+      'when user link emits %s event with empty user cache',
+      (eventType) => {
+        let userLink;
 
-      beforeEach(() => {
-        UsersCache.retrieveById.mockReset();
+        beforeEach(() => {
+          UsersCache.retrieveById.mockReset();
 
-        [userLink] = findFixtureLinks();
+          [userLink] = findFixtureLinks();
 
-        triggerEvent('mouseover', userLink);
-      });
+          triggerEvent(eventType, userLink);
+        });
 
-      it('populates popover with preloaded user data', () => {
-        const { name, userId, username, email } = userLink.dataset;
+        it('populates popover with preloaded user data', () => {
+          const { name, userId, username, email } = userLink.dataset;
 
-        expect(userLink.user).toEqual(
-          expect.objectContaining({
-            name,
-            userId,
-            username,
-            email,
-          }),
-        );
-      });
-    });
+          expect(userLink.user).toEqual(
+            expect.objectContaining({
+              name,
+              userId,
+              username,
+              email,
+            }),
+          );
+        });
+      },
+    );
 
-    describe('when user link emits mouseenter event', () => {
+    describe.each([
+      { eventType: 'mouseover', leaveEvent: 'mouseleave' },
+      { eventType: 'focusin', leaveEvent: 'focusout' },
+    ])('when user link emits $eventType event', ({ eventType, leaveEvent }) => {
       let userLink;
 
       beforeEach(() => {
         [userLink] = findFixtureLinks();
 
-        triggerEvent('mouseover', userLink);
+        triggerEvent(eventType, userLink);
       });
 
       it('removes title attribute from user links', () => {
@@ -205,9 +213,9 @@ describe('User Popovers', () => {
         expect(UsersCache.retrieveStatusById).toHaveBeenCalledWith(userId);
       });
 
-      it('removes aria-describedby attribute from the user link on mouseleave', () => {
+      it(`removes aria-describedby attribute from the user link on ${leaveEvent}`, () => {
         userLink.setAttribute('aria-describedby', 'popover');
-        triggerEvent('mouseleave', userLink);
+        triggerEvent(leaveEvent, userLink);
 
         expect(userLink.getAttribute('aria-describedby')).toBe(null);
       });
diff --git a/spec/frontend/vue_shared/components/imported_badge_spec.js b/spec/frontend/vue_shared/components/imported_badge_spec.js
index bea4eac1738..80bc306a753 100644
--- a/spec/frontend/vue_shared/components/imported_badge_spec.js
+++ b/spec/frontend/vue_shared/components/imported_badge_spec.js
@@ -1,22 +1,14 @@
 import { GlBadge } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
 import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
-
-import { TYPE_EPIC, TYPE_ISSUE, TYPE_MERGE_REQUEST } from '~/issues/constants';
-import { TYPE_ACTIVITY, TYPE_COMMENT, TYPE_DESIGN, TYPE_SNIPPET } from '~/import/constants';
-
 import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 
 describe('ImportedBadge', () => {
   let wrapper;
-  const defaultProps = {
-    importableType: TYPE_ISSUE,
-  };
 
   const createComponent = ({ props = {} } = {}) => {
     wrapper = shallowMount(ImportedBadge, {
       propsData: {
-        ...defaultProps,
         ...props,
       },
       directives: {
@@ -37,32 +29,15 @@ describe('ImportedBadge', () => {
   });
 
   it('renders span instead of badge when text-only', () => {
-    createComponent({
-      props: {
-        textOnly: true,
-      },
-    });
+    createComponent({ props: { textOnly: true } });
 
     expect(findBadge().exists()).toBe(false);
     expect(findSpan().text()).toBe('Imported');
   });
 
-  it.each`
-    importableType        | tooltipText
-    ${TYPE_ACTIVITY}      | ${'This activity was imported from another instance.'}
-    ${TYPE_COMMENT}       | ${'This comment was imported from another instance.'}
-    ${TYPE_DESIGN}        | ${'This design was imported from another instance.'}
-    ${TYPE_EPIC}          | ${'This epic was imported from another instance.'}
-    ${TYPE_ISSUE}         | ${'This issue was imported from another instance.'}
-    ${TYPE_MERGE_REQUEST} | ${'This merge request was imported from another instance.'}
-    ${TYPE_SNIPPET}       | ${'This snippet was imported from another instance.'}
-  `('renders tooltip for $importableType', ({ importableType, tooltipText }) => {
-    createComponent({
-      props: {
-        importableType,
-      },
-    });
+  it('renders tooltip', () => {
+    createComponent();
 
-    expect(findBadgeTooltip().value).toBe(tooltipText);
+    expect(findBadgeTooltip().value).toBe('This item was imported from another instance.');
   });
 });
diff --git a/spec/frontend/vue_shared/issuable/show/components/issuable_header_spec.js b/spec/frontend/vue_shared/issuable/show/components/issuable_header_spec.js
index e2d68f11228..3a030b25e91 100644
--- a/spec/frontend/vue_shared/issuable/show/components/issuable_header_spec.js
+++ b/spec/frontend/vue_shared/issuable/show/components/issuable_header_spec.js
@@ -132,7 +132,7 @@ describe('IssuableHeader component', () => {
     it('renders when issuable is hidden', () => {
       createComponent({ isHidden: true });
 
-      expect(findHiddenBadge().props('issuableType')).toBe('issue');
+      expect(findHiddenBadge().exists()).toBe(true);
     });
 
     it('does not render when issuable is not hidden', () => {
@@ -146,7 +146,7 @@ describe('IssuableHeader component', () => {
     it('renders when issuable is imported', () => {
       createComponent({ isImported: true });
 
-      expect(findImportedBadge().props('importableType')).toBe('issue');
+      expect(findImportedBadge().exists()).toBe(true);
     });
 
     it('does not render when issuable is not imported', () => {
diff --git a/spec/frontend/work_items/components/design_management/design_notes/design_note_spec.js b/spec/frontend/work_items/components/design_management/design_notes/design_note_spec.js
index b9463863f32..c18e13793f1 100644
--- a/spec/frontend/work_items/components/design_management/design_notes/design_note_spec.js
+++ b/spec/frontend/work_items/components/design_management/design_notes/design_note_spec.js
@@ -197,7 +197,7 @@ describe('Design note component', () => {
         },
       });
 
-      expect(findImportedBadge().props('importableType')).toBe('comment');
+      expect(findImportedBadge().exists()).toBe(true);
     });
   });
 
diff --git a/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state_spec.js b/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown_spec.js
similarity index 70%
rename from spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state_spec.js
rename to spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown_spec.js
index 8bea5828884..0d5e8534c9d 100644
--- a/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state_spec.js
+++ b/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown_spec.js
@@ -1,13 +1,19 @@
 import { GlCollapsibleListbox, GlFormGroup } from '@gitlab/ui';
-import { mount } from '@vue/test-utils';
-import WorkItemBulkEditState from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state.vue';
+import { shallowMount } from '@vue/test-utils';
+import WorkItemBulkEditDropdown from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_dropdown.vue';
 
-describe('WorkItemBulkEditState component', () => {
+describe('WorkItemBulkEditDropdown component', () => {
   let wrapper;
 
   const createComponent = (props = {}) => {
-    wrapper = mount(WorkItemBulkEditState, {
+    wrapper = shallowMount(WorkItemBulkEditDropdown, {
       propsData: {
+        headerText: 'Select state',
+        items: [
+          { text: 'Open', value: 'reopen' },
+          { text: 'Closed', value: 'close' },
+        ],
+        label: 'State',
         ...props,
       },
       stubs: {
@@ -43,7 +49,7 @@ describe('WorkItemBulkEditState component', () => {
   });
 
   describe('listbox items', () => {
-    it('renders all states', () => {
+    it('renders all items', () => {
       createComponent();
 
       expect(findListbox().props('items')).toEqual([
@@ -54,7 +60,7 @@ describe('WorkItemBulkEditState component', () => {
   });
 
   describe('listbox text', () => {
-    describe('with no selected state', () => {
+    describe('with no selected value', () => {
       it('renders "Select state"', () => {
         createComponent();
 
@@ -62,12 +68,12 @@ describe('WorkItemBulkEditState component', () => {
       });
     });
 
-    describe('with selected state', () => {
+    describe('with selected value', () => {
       it.each`
         value       | text
         ${'reopen'} | ${'Open'}
         ${'close'}  | ${'Closed'}
-      `('renders $text when state=$state', ({ value, text }) => {
+      `('renders $text when value=$state', ({ value, text }) => {
         createComponent({ value });
 
         expect(findListbox().props('toggleText')).toBe(text);
diff --git a/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar_spec.js b/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar_spec.js
index 16adeb4025a..c30c18a71c5 100644
--- a/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar_spec.js
+++ b/spec/frontend/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar_spec.js
@@ -1,9 +1,9 @@
 import { GlForm } from '@gitlab/ui';
-import { shallowMount } from '@vue/test-utils';
 import MockAdapter from 'axios-mock-adapter';
 import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import createMockApollo from 'helpers/mock_apollo_helper';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import { createAlert } from '~/alert';
 import axios from '~/lib/utils/axios_utils';
@@ -11,7 +11,6 @@ import { HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_OK } from '~/lib/utils/http_status
 import WorkItemBulkEditAssignee from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_assignee.vue';
 import WorkItemBulkEditLabels from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_labels.vue';
 import WorkItemBulkEditSidebar from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue';
-import WorkItemBulkEditState from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_state.vue';
 import workItemBulkUpdateMutation from '~/work_items/graphql/list/work_item_bulk_update.mutation.graphql';
 import workItemParentQuery from '~/work_items/graphql/list//work_item_parent.query.graphql';
 import { workItemParentQueryResponse } from '../../mock_data';
@@ -34,12 +33,20 @@ describe('WorkItemBulkEditSidebar component', () => {
     .fn()
     .mockResolvedValue({ data: { workItemBulkUpdate: { updatedWorkItemCount: 1 } } });
 
-  const createComponent = ({ props = {}, mutationHandler = workItemBulkUpdateHandler } = {}) => {
-    wrapper = shallowMount(WorkItemBulkEditSidebar, {
+  const createComponent = ({
+    provide = {},
+    props = {},
+    mutationHandler = workItemBulkUpdateHandler,
+  } = {}) => {
+    wrapper = shallowMountExtended(WorkItemBulkEditSidebar, {
       apolloProvider: createMockApollo([
         [workItemParentQuery, workItemParentQueryHandler],
         [workItemBulkUpdateMutation, mutationHandler],
       ]),
+      provide: {
+        hasIssuableHealthStatusFeature: false,
+        ...provide,
+      },
       propsData: {
         checkedItems,
         fullPath: 'group/project',
@@ -50,10 +57,14 @@ describe('WorkItemBulkEditSidebar component', () => {
   };
 
   const findForm = () => wrapper.findComponent(GlForm);
-  const findStateComponent = () => wrapper.findComponent(WorkItemBulkEditState);
+  const findStateComponent = () => wrapper.findComponentByTestId('bulk-edit-state');
   const findAssigneeComponent = () => wrapper.findComponent(WorkItemBulkEditAssignee);
   const findAddLabelsComponent = () => wrapper.findAllComponents(WorkItemBulkEditLabels).at(0);
   const findRemoveLabelsComponent = () => wrapper.findAllComponents(WorkItemBulkEditLabels).at(1);
+  const findHealthStatusComponent = () => wrapper.findComponentByTestId('bulk-edit-health-status');
+  const findSubscriptionComponent = () => wrapper.findComponentByTestId('bulk-edit-subscription');
+  const findConfidentialityComponent = () =>
+    wrapper.findComponentByTestId('bulk-edit-confidentiality');
 
   beforeEach(() => {
     axiosMock = new MockAdapter(axios);
@@ -117,10 +128,16 @@ describe('WorkItemBulkEditSidebar component', () => {
         const issuable_ids = '11,22'; // eslint-disable-line camelcase
         const add_label_ids = [1, 2, 3]; // eslint-disable-line camelcase
         const assignee_ids = [5]; // eslint-disable-line camelcase
+        const confidential = 'true';
+        const health_status = 'on_track'; // eslint-disable-line camelcase
         const remove_label_ids = [4, 5, 6]; // eslint-disable-line camelcase
         const state_event = 'reopen'; // eslint-disable-line camelcase
+        const subscription_event = 'subscribe'; // eslint-disable-line camelcase
         axiosMock.onPost().replyOnce(HTTP_STATUS_OK);
-        createComponent({ props: { isEpicsList: false } });
+        createComponent({
+          provide: { hasIssuableHealthStatusFeature: true },
+          props: { isEpicsList: false },
+        });
 
         findStateComponent().vm.$emit('input', state_event);
         findAssigneeComponent().vm.$emit('input', 'gid://gitlab/User/5');
@@ -134,6 +151,9 @@ describe('WorkItemBulkEditSidebar component', () => {
           'gid://gitlab/Label/5',
           'gid://gitlab/Label/6',
         ]);
+        findHealthStatusComponent().vm.$emit('input', health_status);
+        findSubscriptionComponent().vm.$emit('input', subscription_event);
+        findConfidentialityComponent().vm.$emit('input', confidential);
         findForm().vm.$emit('submit', { preventDefault: () => {} });
         await waitForPromises();
 
@@ -143,9 +163,12 @@ describe('WorkItemBulkEditSidebar component', () => {
             update: {
               add_label_ids,
               assignee_ids,
+              confidential,
+              health_status,
               issuable_ids,
               remove_label_ids,
               state_event,
+              subscription_event,
             },
           }),
         );
@@ -252,4 +275,64 @@ describe('WorkItemBulkEditSidebar component', () => {
       expect(findRemoveLabelsComponent().props('selectedLabelsIds')).toEqual(labelIds);
     });
   });
+
+  describe('"Health status" component', () => {
+    it.each`
+      isEpicsList | hasIssuableHealthStatusFeature | expected
+      ${false}    | ${false}                       | ${false}
+      ${false}    | ${true}                        | ${true}
+      ${true}     | ${false}                       | ${false}
+      ${true}     | ${true}                        | ${false}
+    `(
+      'renders only when isEpicsList=false and hasIssuableHealthStatusFeature=true',
+      ({ isEpicsList, hasIssuableHealthStatusFeature, expected }) => {
+        createComponent({ provide: { hasIssuableHealthStatusFeature }, props: { isEpicsList } });
+
+        expect(findHealthStatusComponent().exists()).toBe(expected);
+      },
+    );
+
+    it('updates health status when "Health status" component emits "input" event', async () => {
+      createComponent({ provide: { hasIssuableHealthStatusFeature: true } });
+
+      findHealthStatusComponent().vm.$emit('input', 'needs_attention');
+      await nextTick();
+
+      expect(findHealthStatusComponent().props('value')).toBe('needs_attention');
+    });
+  });
+
+  describe('"Subscription" component', () => {
+    it.each([true, false])('renders depending on isEpicsList prop', (isEpicsList) => {
+      createComponent({ props: { isEpicsList } });
+
+      expect(findSubscriptionComponent().exists()).toBe(!isEpicsList);
+    });
+
+    it('updates subscription when "Subscription" component emits "input" event', async () => {
+      createComponent();
+
+      findSubscriptionComponent().vm.$emit('input', 'unsubscribe');
+      await nextTick();
+
+      expect(findSubscriptionComponent().props('value')).toBe('unsubscribe');
+    });
+  });
+
+  describe('"Confidentiality" component', () => {
+    it.each([true, false])('renders depending on isEpicsList prop', (isEpicsList) => {
+      createComponent({ props: { isEpicsList } });
+
+      expect(findConfidentialityComponent().exists()).toBe(!isEpicsList);
+    });
+
+    it('updates confidentiality when "Confidentiality" component emits "input" event', async () => {
+      createComponent();
+
+      findConfidentialityComponent().vm.$emit('input', 'false');
+      await nextTick();
+
+      expect(findConfidentialityComponent().props('value')).toBe('false');
+    });
+  });
 });
diff --git a/spec/frontend/work_items/components/work_item_created_updated_spec.js b/spec/frontend/work_items/components/work_item_created_updated_spec.js
index b67df28c3c0..133037790ee 100644
--- a/spec/frontend/work_items/components/work_item_created_updated_spec.js
+++ b/spec/frontend/work_items/components/work_item_created_updated_spec.js
@@ -4,9 +4,11 @@ import Vue from 'vue';
 import VueApollo from 'vue-apollo';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
+import HiddenBadge from '~/issuable/components/hidden_badge.vue';
 import LockedBadge from '~/issuable/components/locked_badge.vue';
 import WorkItemCreatedUpdated from '~/work_items/components/work_item_created_updated.vue';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
+import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import WorkItemTypeIcon from '~/work_items/components/work_item_type_icon.vue';
 import WorkItemStateBadge from '~/work_items/components/work_item_state_badge.vue';
 import workItemByIidQuery from '~/work_items/graphql/work_item_by_iid.query.graphql';
@@ -23,6 +25,8 @@ describe('WorkItemCreatedUpdated component', () => {
   const findCreatedAtText = () => findCreatedAt().text().replace(/\s+/g, ' ');
   const findWorkItemTypeIcon = () => wrapper.findComponent(WorkItemTypeIcon);
   const findConfidentialityBadge = () => wrapper.findComponent(ConfidentialityBadge);
+  const findHiddenBadge = () => wrapper.findComponent(HiddenBadge);
+  const findImportedBadge = () => wrapper.findComponent(ImportedBadge);
   const findLockedBadge = () => wrapper.findComponent(LockedBadge);
   const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findWorkItemStateBadge = () => wrapper.findComponent(WorkItemStateBadge);
@@ -30,6 +34,8 @@ describe('WorkItemCreatedUpdated component', () => {
   const createComponent = async ({
     workItemIid = '1',
     author = null,
+    hidden = false,
+    imported = false,
     updatedAt,
     confidential = false,
     discussionLocked = false,
@@ -39,6 +45,8 @@ describe('WorkItemCreatedUpdated component', () => {
   } = {}) => {
     const workItemQueryResponse = workItemByIidResponseFactory({
       author,
+      hidden,
+      imported,
       updatedAt,
       confidential,
       discussionLocked,
@@ -159,4 +167,32 @@ describe('WorkItemCreatedUpdated component', () => {
       expect(findLockedBadge().exists()).toBe(false);
     });
   });
+
+  describe('hidden badge', () => {
+    it('renders when the work item is hidden', async () => {
+      await createComponent({ hidden: true });
+
+      expect(findHiddenBadge().exists()).toBe(true);
+    });
+
+    it('does not render when the work item is not hidden', async () => {
+      await createComponent({ hidden: false });
+
+      expect(findHiddenBadge().exists()).toBe(false);
+    });
+  });
+
+  describe('imported badge', () => {
+    it('renders when the work item is imported', async () => {
+      await createComponent({ imported: true });
+
+      expect(findImportedBadge().exists()).toBe(true);
+    });
+
+    it('does not render when the work item is not imported', async () => {
+      await createComponent({ imported: false });
+
+      expect(findImportedBadge().exists()).toBe(false);
+    });
+  });
 });
diff --git a/spec/frontend/work_items/components/work_item_sticky_header_spec.js b/spec/frontend/work_items/components/work_item_sticky_header_spec.js
index 7648b45df1b..a5e48534e1b 100644
--- a/spec/frontend/work_items/components/work_item_sticky_header_spec.js
+++ b/spec/frontend/work_items/components/work_item_sticky_header_spec.js
@@ -3,9 +3,11 @@ import { nextTick } from 'vue';
 import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import { STATE_OPEN } from '~/work_items/constants';
 import { workItemResponseFactory } from 'ee_else_ce_jest/work_items/mock_data';
+import HiddenBadge from '~/issuable/components/hidden_badge.vue';
 import LockedBadge from '~/issuable/components/locked_badge.vue';
 import WorkItemStickyHeader from '~/work_items/components/work_item_sticky_header.vue';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
+import ImportedBadge from '~/vue_shared/components/imported_badge.vue';
 import TodosToggle from '~/work_items/components/shared/todos_toggle.vue';
 import WorkItemStateBadge from '~/work_items/components/work_item_state_badge.vue';
 import WorkItemNotificationsWidget from '~/work_items/components/work_item_notifications_widget.vue';
@@ -15,6 +17,8 @@ describe('WorkItemStickyHeader', () => {
 
   const createComponent = ({
     confidential = false,
+    hidden = false,
+    imported = false,
     discussionLocked = false,
     canUpdate = true,
     features = {},
@@ -29,6 +33,8 @@ describe('WorkItemStickyHeader', () => {
           canUpdate,
           confidential,
           discussionLocked,
+          hidden,
+          imported,
           movedToWorkItemUrl,
           duplicatedToWorkItemUrl,
           promotedToEpicUrl,
@@ -51,6 +57,8 @@ describe('WorkItemStickyHeader', () => {
 
   const findStickyHeader = () => wrapper.findByTestId('work-item-sticky-header');
   const findConfidentialityBadge = () => wrapper.findComponent(ConfidentialityBadge);
+  const findHiddenBadge = () => wrapper.findComponent(HiddenBadge);
+  const findImportedBadge = () => wrapper.findComponent(ImportedBadge);
   const findLockedBadge = () => wrapper.findComponent(LockedBadge);
   const findTodosToggle = () => wrapper.findComponent(TodosToggle);
   const findIntersectionObserver = () => wrapper.findComponent(GlIntersectionObserver);
@@ -190,4 +198,32 @@ describe('WorkItemStickyHeader', () => {
       });
     });
   });
+
+  describe('hidden badge', () => {
+    it('renders when the work item is hidden', () => {
+      createComponent({ hidden: true });
+
+      expect(findHiddenBadge().exists()).toBe(true);
+    });
+
+    it('does not render when the work item is not hidden', () => {
+      createComponent({ hidden: false });
+
+      expect(findHiddenBadge().exists()).toBe(false);
+    });
+  });
+
+  describe('imported badge', () => {
+    it('renders when the work item is imported', () => {
+      createComponent({ imported: true });
+
+      expect(findImportedBadge().exists()).toBe(true);
+    });
+
+    it('does not render when the work item is not imported', () => {
+      createComponent({ imported: false });
+
+      expect(findImportedBadge().exists()).toBe(false);
+    });
+  });
 });
diff --git a/spec/frontend/work_items/list/components/work_items_list_app_spec.js b/spec/frontend/work_items/list/components/work_items_list_app_spec.js
index ff6e833fdac..0fa0d39cdef 100644
--- a/spec/frontend/work_items/list/components/work_items_list_app_spec.js
+++ b/spec/frontend/work_items/list/components/work_items_list_app_spec.js
@@ -161,6 +161,9 @@ describeSkipVue3(skipReason, () => {
         rootPageFullPath: 'full/path',
         ...props,
       },
+      stubs: {
+        WorkItemBulkEditSidebar: true,
+      },
     });
   };
 
diff --git a/spec/frontend/work_items/mock_data.js b/spec/frontend/work_items/mock_data.js
index e9d9eca9647..f1a00e72d00 100644
--- a/spec/frontend/work_items/mock_data.js
+++ b/spec/frontend/work_items/mock_data.js
@@ -204,6 +204,8 @@ export const workItemQueryResponse = {
       id: 'gid://gitlab/WorkItem/1',
       iid: '1',
       archived: false,
+      hidden: false,
+      imported: false,
       title: '_Test_',
       titleHtml: '<em>Test</em>',
       movedToWorkItemUrl: null,
@@ -358,6 +360,8 @@ export const workItemWithEpicParentQueryResponse = {
       id: 'gid://gitlab/WorkItem/1',
       iid: '1',
       archived: false,
+      hidden: false,
+      imported: false,
       title: '_Test_',
       titleHtml: '<em>Test</em>',
       movedToWorkItemUrl: null,
@@ -441,6 +445,8 @@ export const updateWorkItemMutationResponse = {
         id: 'gid://gitlab/WorkItem/1',
         iid: '1',
         archived: false,
+        hidden: false,
+        imported: false,
         title: 'Updated _title_',
         titleHtml: 'Updated <em>title</em>',
         movedToWorkItemUrl: null,
@@ -598,6 +604,8 @@ export const convertWorkItemMutationResponse = {
         id: 'gid://gitlab/WorkItem/1',
         iid: '1',
         archived: false,
+        hidden: false,
+        imported: false,
         title: 'Updated _title_',
         titleHtml: 'Updated <em>title</em>',
         movedToWorkItemUrl: null,
@@ -1734,6 +1742,8 @@ export const workItemResponseFactory = ({
   duplicatedToWorkItemUrl = null,
   promotedToEpicUrl = null,
   commentTemplatesPaths = null,
+  hidden = false,
+  imported = false,
 } = {}) => ({
   data: {
     workItem: {
@@ -1741,6 +1751,8 @@ export const workItemResponseFactory = ({
       id,
       iid,
       archived: false,
+      hidden,
+      imported,
       title: 'Updated _title_',
       titleHtml: 'Updated <em>title</em>',
       state,
@@ -2136,6 +2148,8 @@ export const createWorkItemMutationResponse = {
         id: 'gid://gitlab/WorkItem/1',
         iid: '1',
         archived: false,
+        hidden: false,
+        imported: false,
         title: 'Updated _title_',
         titleHtml: 'Updated <em>title</em>',
         state: 'OPEN',
@@ -2232,6 +2246,8 @@ export const workItemHierarchyNoUpdatePermissionResponse = {
       id: 'gid://gitlab/WorkItem/1',
       iid: '1',
       archived: false,
+      hidden: false,
+      imported: false,
       state: 'OPEN',
       movedToWorkItemUrl: null,
       duplicatedToWorkItemUrl: null,
@@ -3456,6 +3472,8 @@ export const changeWorkItemParentMutationResponse = {
         id: 'gid://gitlab/WorkItem/2',
         iid: '2',
         archived: false,
+        hidden: false,
+        imported: false,
         state: 'OPEN',
         movedToWorkItemUrl: null,
         duplicatedToWorkItemUrl: null,
@@ -6243,6 +6261,8 @@ export const createWorkItemQueryResponse = (widgets = []) => ({
       workItem: {
         id: 'gid://gitlab/WorkItem/new-epic',
         iid: NEW_WORK_ITEM_IID,
+        hidden: false,
+        imported: false,
         archived: false,
         title: '',
         titleHtml: null,
diff --git a/spec/lib/gitlab/file_detector_spec.rb b/spec/lib/gitlab/file_detector_spec.rb
index eabc92b794a..13e2acb76e5 100644
--- a/spec/lib/gitlab/file_detector_spec.rb
+++ b/spec/lib/gitlab/file_detector_spec.rb
@@ -119,6 +119,12 @@ RSpec.describe Gitlab::FileDetector, feature_category: :global_search do
 
     it 'returns the type of a Jenkins config file' do
       expect(described_class.type_of('jenkinsfile')).to eq(:jenkinsfile)
+      expect(described_class.type_of('Jenkinsfile')).to eq(:jenkinsfile)
+      expect(described_class.type_of('JenkinsFile')).to eq(:jenkinsfile)
+      expect(described_class.type_of('Jenkinsfile.groovy')).to eq(:jenkinsfile)
+      expect(described_class.type_of('cicd.Jenkinsfile')).to eq(:jenkinsfile)
+      expect(described_class.type_of('app.Jenkinsfile.prod')).to eq(:jenkinsfile)
+      expect(described_class.type_of('ci/Jenkinsfile')).to be_nil
     end
   end
 end
diff --git a/spec/lib/gitlab/import_sources_spec.rb b/spec/lib/gitlab/import_sources_spec.rb
index 3ab9a12fe0f..b0419f6259a 100644
--- a/spec/lib/gitlab/import_sources_spec.rb
+++ b/spec/lib/gitlab/import_sources_spec.rb
@@ -3,24 +3,6 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::ImportSources, feature_category: :importers do
-  describe '.options' do
-    it 'returns a hash' do
-      expected =
-        {
-          'GitHub' => 'github',
-          'Bitbucket Cloud' => 'bitbucket',
-          'Bitbucket Server' => 'bitbucket_server',
-          'FogBugz' => 'fogbugz',
-          'Repository by URL' => 'git',
-          'GitLab export' => 'gitlab_project',
-          'Gitea' => 'gitea',
-          'Manifest file' => 'manifest'
-        }
-
-      expect(described_class.options).to eq(expected)
-    end
-  end
-
   describe '.values' do
     it 'returns an array' do
       expected =
@@ -51,7 +33,7 @@ RSpec.describe Gitlab::ImportSources, feature_category: :importers do
           gitea
         ]
 
-      without_importer = %w[git manifest]
+      without_importer = %w[git manifest doesnotexist]
 
       with_importer.each do |import_source|
         expect(described_class.has_importer?(import_source)).to be(true)
@@ -72,7 +54,9 @@ RSpec.describe Gitlab::ImportSources, feature_category: :importers do
       'git' => nil,
       'gitlab_project' => Gitlab::ImportExport::Importer,
       'gitea' => Gitlab::LegacyGithubImport::Importer,
-      'manifest' => nil
+      'manifest' => nil,
+      'doesnotexist' => nil,
+      nil => nil
     }
 
     import_sources.each do |name, klass|
@@ -91,7 +75,9 @@ RSpec.describe Gitlab::ImportSources, feature_category: :importers do
       'git' => 'Repository by URL',
       'gitlab_project' => 'GitLab export',
       'gitea' => 'Gitea',
-      'manifest' => 'Manifest file'
+      'manifest' => 'Manifest file',
+      'doesnotexist' => nil,
+      nil => nil
     }
 
     import_sources.each do |name, title|
@@ -119,4 +105,48 @@ RSpec.describe Gitlab::ImportSources, feature_category: :importers do
       MSG
     end
   end
+
+  describe '.import_source' do
+    subject { described_class.import_source(source) }
+
+    context 'when import source exists' do
+      let(:source) { 'github' }
+
+      it { is_expected.to have_attributes(name: 'github') }
+    end
+
+    context 'when import source does not exist' do
+      let(:source) { 'doesnotexist' }
+
+      it { is_expected.to be_nil }
+    end
+  end
+
+  describe '.template?' do
+    subject { described_class.template?(template) }
+
+    context 'when importer is not project template importer' do
+      let(:template) { 'github' }
+
+      it { is_expected.to be_falsey }
+    end
+
+    context 'when template is nil' do
+      let(:template) { nil }
+
+      it { is_expected.to be_falsey }
+    end
+
+    context 'when template does not exist' do
+      let(:template) { 'doesnotexist' }
+
+      it { is_expected.to be_falsey }
+    end
+  end
+
+  describe '.project_template_importers' do
+    it 'does not include non-project template importers' do
+      expect(described_class.project_template_importers).not_to include('github')
+    end
+  end
 end
diff --git a/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service_spec.rb b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service_spec.rb
index 1b70f09efa1..8358e17c8d6 100644
--- a/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/concurrency_limit_service_spec.rb
@@ -139,6 +139,52 @@ RSpec.describe Gitlab::SidekiqMiddleware::ConcurrencyLimit::ConcurrencyLimitServ
     end
   end
 
+  describe '.current_limit' do
+    subject(:current_limit) { described_class.current_limit(worker_class_name) }
+
+    it 'calls an instance method' do
+      expect_next_instance_of(described_class) do |instance|
+        expect(instance).to receive(:current_limit)
+      end
+
+      current_limit
+    end
+  end
+
+  describe '.set_current_limit!' do
+    subject(:set_current_limit!) { described_class.set_current_limit!(worker_class_name, limit: 10) }
+
+    it 'calls an instance method' do
+      expect_next_instance_of(described_class) do |instance|
+        expect(instance).to receive(:set_current_limit!)
+      end
+
+      set_current_limit!
+    end
+  end
+
+  describe '.over_the_limit?' do
+    subject(:over_the_limit?) { described_class.over_the_limit?(worker_class_name) }
+
+    it 'returns true if over the limit' do
+      expect_next_instance_of(described_class) do |instance|
+        expect(instance).to receive(:concurrent_worker_count).and_return(10)
+        expect(instance).to receive(:current_limit).and_return(10)
+      end
+
+      expect(over_the_limit?).to be(true)
+    end
+
+    it 'return false if under the limit' do
+      expect_next_instance_of(described_class) do |instance|
+        expect(instance).to receive(:concurrent_worker_count).and_return(9)
+        expect(instance).to receive(:current_limit).and_return(10)
+      end
+
+      expect(over_the_limit?).to be(false)
+    end
+  end
+
   context 'with concurrent changes to different queues' do
     let(:second_worker_class) do
       Class.new do
diff --git a/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager_spec.rb b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager_spec.rb
new file mode 100644
index 00000000000..41f83e3af29
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/limit_manager_spec.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::SidekiqMiddleware::ConcurrencyLimit::LimitManager, :clean_gitlab_redis_queues_metadata,
+  feature_category: :scalability do
+  let(:worker_class) do
+    Class.new do
+      def self.name
+        'DummyWorker'
+      end
+
+      include ApplicationWorker
+    end
+  end
+
+  let(:worker_name) { worker_class.name }
+  let(:redis_key_prefix) { 'random_prefix' }
+  let(:key) { "#{redis_key_prefix}:{#{worker_name.underscore}}:current_limit" }
+
+  subject(:service) { described_class.new(worker_name: worker_name, prefix: redis_key_prefix) }
+
+  describe '#current_limit' do
+    before do
+      stub_const(worker_name, worker_class)
+      allow(::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap).to receive(:limit_for)
+                                                                            .with(worker: worker_name.safe_constantize)
+                                                                            .and_return(10)
+    end
+
+    context 'when no value has been set before' do
+      it 'returns the max limit value set in WorkersMap' do
+        expect(service.current_limit).to eq(10)
+      end
+    end
+
+    context 'when a value has been set before' do
+      before do
+        with_redis do |r|
+          r.set(key, 5, ex: described_class::TTL)
+        end
+      end
+
+      it 'returns the value set in Redis' do
+        expect(service.current_limit).to eq(5)
+      end
+    end
+
+    context 'with undefined worker' do
+      before do
+        hide_const(worker_name)
+      end
+
+      it 'returns 0' do
+        expect(service.current_limit).to eq(0)
+      end
+    end
+  end
+
+  describe '#set_current_limit!' do
+    it 'sets the limit in Redis' do
+      with_redis do |r|
+        expect(r).to receive(:set).with(key, 15, ex: described_class::TTL)
+      end
+
+      service.set_current_limit!(15)
+    end
+  end
+
+  def with_redis(&block)
+    Gitlab::Redis::QueuesMetadata.with(&block)
+  end
+end
diff --git a/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/server_spec.rb b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/server_spec.rb
index ef501940277..c7b0cde3b7b 100644
--- a/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/server_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/concurrency_limit/server_spec.rb
@@ -150,8 +150,8 @@ RSpec.describe Gitlab::SidekiqMiddleware::ConcurrencyLimit::Server, feature_cate
 
     context 'when sidekiq_workers are stubbed' do
       before do
-        allow(::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap).to receive(:over_the_limit?)
-          .and_return(over_the_limit)
+        allow(::Gitlab::SidekiqMiddleware::ConcurrencyLimit::ConcurrencyLimitService).to receive(:over_the_limit?)
+                                                                                           .and_return(over_the_limit)
       end
 
       context 'when under the limit' do
@@ -195,6 +195,56 @@ RSpec.describe Gitlab::SidekiqMiddleware::ConcurrencyLimit::Server, feature_cate
           TestConcurrencyLimitWorker.perform_async('foo')
         end
       end
+
+      context 'when concurrency_limit_current_limit_from_redis FF is disabled' do
+        before do
+          stub_feature_flags(concurrency_limit_current_limit_from_redis: false)
+          allow(::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap).to receive(:over_the_limit?)
+                                                                                             .and_return(over_the_limit)
+        end
+
+        context 'when under the limit' do
+          let(:over_the_limit) { false }
+
+          it 'executes the job' do
+            expect(TestConcurrencyLimitWorker).to receive(:work)
+            expect(Gitlab::SidekiqLogging::ConcurrencyLimitLogger.instance).not_to receive(:deferred_log)
+            expect(Gitlab::SidekiqMiddleware::ConcurrencyLimit::ConcurrencyLimitService).not_to receive(:add_to_queue!)
+
+            TestConcurrencyLimitWorker.perform_async('foo')
+          end
+
+          it_behaves_like 'track execution'
+
+          context 'when limit is set to zero' do
+            before do
+              allow(::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap).to receive(:limit_for).and_return(0)
+            end
+
+            it_behaves_like 'track execution'
+          end
+
+          context 'when limit is not defined' do
+            before do
+              ::Gitlab::SidekiqMiddleware::ConcurrencyLimit::WorkersMap.remove_instance_variable(:@data)
+            end
+
+            it_behaves_like 'track execution'
+          end
+        end
+
+        context 'when over the limit' do
+          let(:over_the_limit) { true }
+
+          it 'defers the job' do
+            expect(TestConcurrencyLimitWorker).not_to receive(:work)
+            expect(Gitlab::SidekiqLogging::ConcurrencyLimitLogger.instance).to receive(:deferred_log).and_call_original
+            expect(Gitlab::SidekiqMiddleware::ConcurrencyLimit::ConcurrencyLimitService).to receive(:add_to_queue!)
+
+            TestConcurrencyLimitWorker.perform_async('foo')
+          end
+        end
+      end
     end
 
     context 'with worker class without concurrency limit' do
diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb
index 4f32286997f..401ef948275 100644
--- a/spec/models/application_setting_spec.rb
+++ b/spec/models/application_setting_spec.rb
@@ -924,6 +924,12 @@ RSpec.describe ApplicationSetting, feature_category: :shared, type: :model do
       end
     end
 
+    describe 'import_sources' do
+      let(:valid_import_sources) { Gitlab::ImportSources.values }
+
+      it { is_expected.to allow_value(valid_import_sources).for(:import_sources) }
+    end
+
     describe 'default_artifacts_expire_in' do
       it 'sets an error if it cannot parse' do
         expect do
diff --git a/spec/models/ci/runner_spec.rb b/spec/models/ci/runner_spec.rb
index 3299ccab905..427459a6db0 100644
--- a/spec/models/ci/runner_spec.rb
+++ b/spec/models/ci/runner_spec.rb
@@ -83,7 +83,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     let(:tag_name) { 'tag123' }
 
     context 'on save' do
-      let(:runner) { create(:ci_runner, :group, groups: [group]) }
+      let(:runner) { build(:ci_runner, :group, groups: [group]) }
 
       before do
         runner.tag_list = [tag_name]
@@ -165,10 +165,10 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     describe '#exactly_one_group' do
-      let(:runner) { create(:ci_runner, :group, groups: [group]) }
+      let(:runner) { build(:ci_runner, :group, groups: [group]) }
 
       it 'disallows assigning group if already assigned to a group' do
-        runner.runner_namespaces << create(:ci_runner_namespace, runner: runner)
+        runner.runner_namespaces << build(:ci_runner_namespace, runner: runner)
 
         expect(runner).not_to be_valid
         expect(runner.errors.full_messages).to include('Runner needs to be assigned to exactly one group')
@@ -246,27 +246,23 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
       let_it_be(:default_plan) { create(:default_plan) }
 
       context 'when runner is instance type' do
-        let(:runner) { create(:ci_runner, :instance) }
+        let(:runner) { build(:ci_runner, :instance) }
 
         it 'allows assign allowed_plans' do
           runner.allowed_plan_ids = [default_plan.id]
 
           expect(runner).to be_valid
-          puts runner.errors.full_messages
         end
       end
 
       context 'when runner is not an instance type' do
-        let(:runner) { create(:ci_runner, :group, groups: [group]) }
-
-        subject { runner.allowed_plan_ids = [default_plan.id] }
+        let(:runner) { build(:ci_runner, :group, groups: [group]) }
 
         it 'allows assign allowed_plans' do
           runner.allowed_plan_ids = [default_plan.id]
 
           expect(runner).not_to be_valid
           expect(runner.errors.full_messages).to include('Runner cannot have allowed plans assigned')
-          puts runner.errors.full_messages
         end
       end
     end
@@ -307,14 +303,14 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     subject(:owner) { runner.owner }
 
     context 'when runner does not have creator_id' do
-      let_it_be(:runner) { create(:ci_runner, :instance) }
+      let(:runner) { build(:ci_runner, :instance) }
 
       it { is_expected.to be_nil }
     end
 
     context 'when runner has creator' do
-      let_it_be(:creator) { create(:user) }
-      let_it_be(:runner) { create(:ci_runner, creator: creator) }
+      let(:creator) { create(:user) }
+      let(:runner) { build(:ci_runner, creator: creator) }
 
       it { is_expected.to eq creator }
     end
@@ -330,143 +326,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
   end
 
-  describe '.belonging_to_project' do
-    it 'returns the project runner' do
-      # own
-      own_project = create(:project)
-      own_runner = create(:ci_runner, :project, projects: [own_project])
-
-      # other
-      create(:ci_runner, :project, projects: [other_project])
-
-      expect(described_class.belonging_to_project(own_project.id)).to eq [own_runner]
-    end
-  end
-
-  shared_examples '.belonging_to_parent_groups_of_project' do
-    let_it_be(:group1) { create(:group) }
-    let_it_be(:project1) { create(:project, group: group1) }
-    let_it_be(:runner1) { create(:ci_runner, :group, groups: [group1]) }
-
-    let_it_be(:group2) { create(:group) }
-    let_it_be(:project2) { create(:project, group: group2) }
-    let_it_be(:runner2) { create(:ci_runner, :group, groups: [group2]) }
-
-    let(:project_id) { project1.id }
-
-    subject(:result) { described_class.belonging_to_parent_groups_of_project(project_id) }
-
-    it 'returns the group runner' do
-      expect(result).to contain_exactly(runner1)
-    end
-
-    context 'with a parent group with a runner', :sidekiq_inline do
-      before do
-        group1.update!(parent: group2)
-      end
-
-      it 'returns the group runner from the group and the parent group' do
-        expect(result).to contain_exactly(runner1, runner2)
-      end
-    end
-
-    context 'with multiple project ids' do
-      let(:project_id) { [project1.id, project2.id] }
-
-      it 'raises ArgumentError' do
-        expect { result }.to raise_error(ArgumentError)
-      end
-    end
-  end
-
-  it_behaves_like '.belonging_to_parent_groups_of_project'
-
-  context 'with instance runners sharing enabled' do
-    # group specific
-    let_it_be(:group) { create(:group, shared_runners_enabled: true) }
-    let_it_be(:project) { create(:project, group: group, shared_runners_enabled: true) }
-    let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
-
-    # project specific
-    let_it_be(:project_runner) { create(:ci_runner, :project, projects: [project]) }
-
-    # globally shared
-    let_it_be(:shared_runner) { create(:ci_runner, :instance) }
-
-    describe '.owned_or_instance_wide' do
-      subject { described_class.owned_or_instance_wide(project.id) }
-
-      it 'returns a shared, project and group runner' do
-        is_expected.to contain_exactly(group_runner, project_runner, shared_runner)
-      end
-    end
-
-    describe '.group_or_instance_wide' do
-      subject { described_class.group_or_instance_wide(group) }
-
-      before do
-        # Ensure the project runner is instantiated
-        project_runner
-      end
-
-      it 'returns a globally shared and a group runner' do
-        is_expected.to contain_exactly(group_runner, shared_runner)
-      end
-    end
-  end
-
-  context 'with instance runners sharing disabled' do
-    # group specific
-    let_it_be(:group) { create(:group, shared_runners_enabled: false) }
-    let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
-
-    let(:group_runners_enabled) { true }
-    let(:project) { create(:project, group: group, shared_runners_enabled: false) }
-
-    # project specific
-    let(:project_runner) { create(:ci_runner, :project, projects: [project]) }
-
-    # globally shared
-    let_it_be(:shared_runner) { create(:ci_runner, :instance) }
-
-    before do
-      project.update!(group_runners_enabled: group_runners_enabled)
-    end
-
-    describe '.owned_or_instance_wide' do
-      subject { described_class.owned_or_instance_wide(project.id) }
-
-      context 'with group runners disabled' do
-        let(:group_runners_enabled) { false }
-
-        it 'returns only the project runner' do
-          is_expected.to contain_exactly(project_runner)
-        end
-      end
-
-      context 'with group runners enabled' do
-        let(:group_runners_enabled) { true }
-
-        it 'returns a project runner and a group runner' do
-          is_expected.to contain_exactly(group_runner, project_runner)
-        end
-      end
-    end
-
-    describe '.group_or_instance_wide' do
-      subject { described_class.group_or_instance_wide(group) }
-
-      before do
-        # Ensure the project runner is instantiated
-        project_runner
-      end
-
-      it 'returns a group runner' do
-        is_expected.to contain_exactly(group_runner)
-      end
-    end
-  end
-
   describe '#display_name' do
     let(:args) { {} }
     let(:runner) { build(:ci_runner, **args) }
@@ -504,7 +363,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     context 'without matching project' do
-      let_it_be(:project) { create(:project) }
+      let(:project) { other_project }
 
       it { is_expected.to be_falsey }
     end
@@ -610,88 +469,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     it { is_expected.to contain_exactly(runner1, runner3, runner4) }
   end
 
-  describe '.active' do
-    subject { described_class.active(active_value) }
-
-    let_it_be(:runner1) { create(:ci_runner, :instance, :paused) }
-    let_it_be(:runner2) { create(:ci_runner, :instance) }
-
-    context 'with active_value set to false' do
-      let(:active_value) { false }
-
-      it 'returns paused runners' do
-        is_expected.to contain_exactly(runner1)
-      end
-    end
-
-    context 'with active_value set to true' do
-      let(:active_value) { true }
-
-      it 'returns active runners' do
-        is_expected.to contain_exactly(runner2)
-      end
-    end
-  end
-
-  describe '.paused' do
-    subject(:paused) { described_class.paused }
-
-    let!(:runner1) { create(:ci_runner, :instance, :paused) }
-    let!(:runner2) { create(:ci_runner, :instance) }
-
-    it 'returns paused runners' do
-      expect(described_class).to receive(:active).with(false).and_call_original
-
-      expect(paused).to contain_exactly(runner1)
-    end
-  end
-
-  describe '.with_creator_id' do
-    let_it_be(:admin) { create(:admin) }
-    let_it_be(:user2) { create(:user) }
-
-    let_it_be(:user_runner1) { create(:ci_runner, creator: user2) }
-    let_it_be(:admin_runner1) { create(:ci_runner, creator: admin) }
-    let_it_be(:admin_runner2) { create(:ci_runner, creator: admin) }
-    let_it_be(:runner_without_creator) { create(:ci_runner, creator: nil) }
-
-    subject { described_class.with_creator_id(admin.id.to_s) }
-
-    it { is_expected.to contain_exactly(admin_runner1, admin_runner2) }
-  end
-
-  describe '.created_by_admins' do
-    let_it_be(:admin) { create(:admin) }
-    let_it_be(:user2) { create(:user) }
-    let_it_be(:admin_runner) { create(:ci_runner, creator: admin) }
-    let_it_be(:other_runner) { create(:ci_runner, creator: user2) }
-    let_it_be(:project_runner) { create(:ci_runner, :project, :without_projects, creator: admin) }
-
-    subject { described_class.created_by_admins }
-
-    it { is_expected.to contain_exactly(admin_runner, project_runner) }
-  end
-
-  describe '.with_version_prefix' do
-    subject { described_class.with_version_prefix('15.11.') }
-
-    let_it_be(:runner1) { create(:ci_runner) }
-    let_it_be(:runner2) { create(:ci_runner) }
-    let_it_be(:runner3) { create(:ci_runner) }
-
-    before_all do
-      create(:ci_runner_machine, runner: runner1, version: '15.11.0')
-      create(:ci_runner_machine, runner: runner2, version: '15.9.0')
-      create(:ci_runner_machine, runner: runner3, version: '15.9.0')
-      # Add another runner_machine to runner3 to ensure edge case is handled (searching multiple machines in a single runner)
-      create(:ci_runner_machine, runner: runner3, version: '15.11.5')
-    end
-
-    it 'returns runners containing runner managers with versions starting with 15.11.' do
-      is_expected.to contain_exactly(runner1, runner3)
-    end
-  end
-
   describe '#stale?', :clean_gitlab_redis_cache, :freeze_time do
     let(:runner) { build(:ci_runner, :instance) }
 
@@ -766,7 +543,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     context 'with cache value' do
-      let(:runner) { create(:ci_runner, :stale) }
+      let_it_be_with_refind(:runner) { create(:ci_runner, :stale) }
 
       before do
         stub_redis_runner_contacted_at(cached_contacted_at.to_s)
@@ -794,34 +571,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
   end
 
-  describe '.with_executing_builds' do
-    subject(:scope) { described_class.with_executing_builds }
-
-    let_it_be(:runners_by_status) do
-      Ci::HasStatus::AVAILABLE_STATUSES.index_with { |_status| create(:ci_runner) }
-    end
-
-    let_it_be(:busy_runners) do
-      Ci::HasStatus::EXECUTING_STATUSES.map { |status| runners_by_status[status] }
-    end
-
-    context 'with no builds running' do
-      it { is_expected.to be_empty }
-    end
-
-    context 'with builds' do
-      before_all do
-        pipeline = create(:ci_pipeline, :running)
-
-        Ci::HasStatus::AVAILABLE_STATUSES.each do |status|
-          create(:ci_build, status, runner: runners_by_status[status], pipeline: pipeline)
-        end
-      end
-
-      it { is_expected.to match_array(busy_runners) }
-    end
-  end
-
   describe '#matches_build?' do
     using RSpec::Parameterized::TableSyntax
 
@@ -883,12 +632,14 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     context 'when runner is shared' do
-      let(:runner) { create(:ci_runner, :instance) }
+      let_it_be_with_refind(:runner) { create(:ci_runner, :instance) }
 
       it { is_expected.to be_truthy }
 
       context 'when runner is locked' do
-        let(:runner) { create(:ci_runner, :instance, locked: true) }
+        before do
+          runner.update!(locked: true)
+        end
 
         it { is_expected.to be_truthy }
       end
@@ -1099,24 +850,19 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
   end
 
   describe '#ensure_runner_queue_value' do
-    let(:runner) { create(:ci_runner) }
+    let_it_be_with_refind(:runner) { create(:ci_runner) }
+    let!(:last_update) { runner.ensure_runner_queue_value }
 
     it 'sets a new last_update value when it is called the first time' do
-      last_update = runner.ensure_runner_queue_value
-
       expect(value_in_queues).to eq(last_update)
     end
 
     it 'does not change if it is not expired and called again' do
-      last_update = runner.ensure_runner_queue_value
-
       expect(runner.ensure_runner_queue_value).to eq(last_update)
       expect(value_in_queues).to eq(last_update)
     end
 
     context 'updates runner queue after changing editable value' do
-      let!(:last_update) { runner.ensure_runner_queue_value }
-
       before do
         Ci::Runners::UpdateRunnerService.new(nil, runner).execute(description: 'new runner')
       end
@@ -1127,8 +873,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     context 'does not update runner value after save' do
-      let!(:last_update) { runner.ensure_runner_queue_value }
-
       before do
         runner.touch
       end
@@ -1169,12 +913,12 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
           expect(runner).to be_invalid
 
           expect_redis_update(contacted_at: Time.current)
-          expect { heartbeat }.to change { runner.reload.read_attribute(:contacted_at) }
+          expect_db_update
         end
 
         it 'only updates contacted at in redis cache and database' do
           expect_redis_update(contacted_at: Time.current)
-          expect { heartbeat }.to change { runner.reload.read_attribute(:contacted_at) }
+          expect_db_update
         end
       end
     end
@@ -1188,7 +932,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
       end
     end
 
-    def does_db_update
+    def expect_db_update
       expect { heartbeat }.to change { runner.reload.read_attribute(:contacted_at) }
     end
   end
@@ -1211,31 +955,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
   end
 
-  describe '.assignable_for' do
-    let_it_be(:project) { create(:project) }
-    let_it_be(:group) { create(:group) }
-    let_it_be(:another_project) { create(:project) }
-    let_it_be(:unlocked_project_runner) { create(:ci_runner, :project, projects: [project]) }
-    let_it_be(:locked_project_runner) { create(:ci_runner, :project, locked: true, projects: [project]) }
-    let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
-    let_it_be(:instance_runner) { create(:ci_runner, :instance) }
-
-    context 'with already assigned project' do
-      subject { described_class.assignable_for(project) }
-
-      it { is_expected.to be_empty }
-    end
-
-    context 'with a different project' do
-      subject { described_class.assignable_for(another_project) }
-
-      it { is_expected.to include(unlocked_project_runner) }
-      it { is_expected.not_to include(group_runner) }
-      it { is_expected.not_to include(locked_project_runner) }
-      it { is_expected.not_to include(instance_runner) }
-    end
-  end
-
   describe 'Project-related queries' do
     let_it_be(:projects) { create_list(:project, 2, group: group) }
 
@@ -1269,26 +988,15 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
 
         it { is_expected.to eq owner_project }
 
-        context 'and owner project is deleted' do
+        context 'when corresponding runner project is deleted' do
           before do
-            owner_project.destroy!
-          end
-
-          it { is_expected.to eq owner_project }
-
-          it "changes when corresponding runner project is deleted" do
             project_runner.runner_projects.where(project_id: owner_project.id).delete_all
             project_runner.reload.clear_memoization(:owner)
-
-            expect(project_runner.owner).to eq other_project
           end
 
-          context 'and projects are associated in different order' do
-            before do
-              project_runner.runner_projects.where(project_id: owner_project.id).delete_all
-              project_runner.reload.clear_memoization(:owner)
-            end
+          it { is_expected.to eq other_project }
 
+          context 'and projects are associated in different order' do
             let(:associated_projects) { [owner_project, projects.last, other_project] }
 
             it 'is not sensitive to project ID order' do
@@ -1300,52 +1008,48 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
 
     describe '#belongs_to_one_project?' do
-      it "returns false if there are two projects runner is assigned to" do
-        runner = create(:ci_runner, :project, projects: projects)
+      let(:runner) { build(:ci_runner, :project, projects: projects) }
 
-        expect(runner.belongs_to_one_project?).to be_falsey
+      subject { runner.belongs_to_one_project? }
+
+      context "if there are two projects runner is assigned to" do
+        it { is_expected.to be_falsey }
       end
 
-      it 'returns true if there is only one project runner is assigned to' do
-        runner = create(:ci_runner, :project, projects: projects.take(1))
+      context 'if there is only one project runner is assigned to' do
+        let(:projects) { [project] }
 
-        expect(runner.belongs_to_one_project?).to be_truthy
+        it { is_expected.to be_truthy }
       end
     end
 
     describe '#belongs_to_more_than_one_project?' do
-      context 'project runner' do
-        context 'two projects assigned to runner' do
-          let(:runner) { create(:ci_runner, :project, projects: projects) }
+      subject { runner.belongs_to_more_than_one_project? }
 
-          it 'returns true' do
-            expect(runner.belongs_to_more_than_one_project?).to be_truthy
-          end
+      context 'project runner' do
+        let(:runner) { build(:ci_runner, :project, projects: projects) }
+
+        context 'two projects assigned to runner' do
+          it { is_expected.to be_truthy }
         end
 
         context 'one project assigned to runner' do
-          let(:runner) { create(:ci_runner, :project, projects: projects.take(1)) }
+          let(:projects) { [project] }
 
-          it 'returns false' do
-            expect(runner.belongs_to_more_than_one_project?).to be_falsey
-          end
+          it { is_expected.to be_falsey }
         end
       end
 
       context 'group runner' do
-        let(:runner) { create(:ci_runner, :group, groups: [group]) }
+        let(:runner) { build(:ci_runner, :group, groups: [group]) }
 
-        it 'returns false' do
-          expect(runner.belongs_to_more_than_one_project?).to be_falsey
-        end
+        it { is_expected.to be_falsey }
       end
 
       context 'shared runner' do
-        let(:runner) { create(:ci_runner, :instance) }
+        let(:runner) { build(:ci_runner, :instance) }
 
-        it 'returns false' do
-          expect(runner.belongs_to_more_than_one_project?).to be_falsey
-        end
+        it { is_expected.to be_falsey }
       end
     end
   end
@@ -1465,47 +1169,12 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
 
     subject(:destroy!) { runner.destroy! }
 
-    it 'does not have projects' do
+    it 'does not have projects and can be destroyed' do
       expect(runner.runner_projects).to be_empty
-    end
-
-    it 'can be destroyed' do
       expect { destroy! }.to change { described_class.count }.by(-1)
     end
   end
 
-  describe '.order_by' do
-    let_it_be(:runner1) { create(:ci_runner, created_at: 1.year.ago, contacted_at: 1.year.ago) }
-    let_it_be(:runner2) { create(:ci_runner, created_at: 1.month.ago, contacted_at: 1.month.ago) }
-
-    before do
-      runner1.update!(token_expires_at: 1.year.from_now)
-    end
-
-    it 'supports ordering by the contact date' do
-      runners = described_class.order_by('contacted_asc')
-
-      expect(runners).to eq([runner1, runner2])
-    end
-
-    it 'supports ordering by the creation date' do
-      runners = described_class.order_by('created_asc')
-
-      expect(runners).to eq([runner2, runner1])
-    end
-
-    it 'supports ordering by the token expiration' do
-      runner3 = create(:ci_runner)
-      runner3.update!(token_expires_at: 1.month.from_now)
-
-      runners = described_class.order_by('token_expires_at_asc')
-      expect(runners).to eq([runner3, runner1, runner2])
-
-      runners = described_class.order_by('token_expires_at_desc')
-      expect(runners).to eq([runner2, runner1, runner3])
-    end
-  end
-
   describe '.runner_matchers' do
     subject(:matchers) { described_class.all.runner_matchers }
 
@@ -1639,7 +1308,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
 
   describe '#uncached_contacted_at' do
     let(:contacted_at_stored) { 1.hour.ago.change(usec: 0) }
-    let(:runner) { create(:ci_runner, contacted_at: contacted_at_stored) }
+    let(:runner) { build(:ci_runner, contacted_at: contacted_at_stored) }
 
     subject { runner.uncached_contacted_at }
 
@@ -2206,74 +1875,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
   end
 
-  describe '.with_upgrade_status' do
-    subject(:scope) { described_class.with_upgrade_status(upgrade_status) }
-
-    let_it_be(:runner_14_0_0) { create(:ci_runner) }
-    let_it_be(:runner_14_1_0_and_14_0_0) { create(:ci_runner) }
-    let_it_be(:runner_14_1_0) { create(:ci_runner) }
-    let_it_be(:runner_14_1_1) { create(:ci_runner) }
-
-    before_all do
-      create(:ci_runner_machine, runner: runner_14_1_0_and_14_0_0, version: '14.0.0')
-      create(:ci_runner_machine, runner: runner_14_1_0_and_14_0_0, version: '14.1.0')
-      create(:ci_runner_machine, runner: runner_14_0_0, version: '14.0.0')
-      create(:ci_runner_machine, runner: runner_14_1_0, version: '14.1.0')
-      create(:ci_runner_machine, runner: runner_14_1_1, version: '14.1.1')
-
-      create(:ci_runner_version, version: '14.0.0', status: :available)
-      create(:ci_runner_version, version: '14.1.0', status: :recommended)
-      create(:ci_runner_version, version: '14.1.1', status: :unavailable)
-    end
-
-    context ':unavailable' do
-      let(:upgrade_status) { :unavailable }
-
-      it 'returns runners with runner managers whose version is assigned :unavailable' do
-        is_expected.to contain_exactly(runner_14_1_1)
-      end
-    end
-
-    context ':available' do
-      let(:upgrade_status) { :available }
-
-      it 'returns runners with runner managers whose version is assigned :available' do
-        is_expected.to contain_exactly(runner_14_0_0, runner_14_1_0_and_14_0_0)
-      end
-    end
-
-    context ':recommended' do
-      let(:upgrade_status) { :recommended }
-
-      it 'returns runners with runner managers whose version is assigned :recommended' do
-        is_expected.to contain_exactly(runner_14_1_0_and_14_0_0, runner_14_1_0)
-      end
-    end
-
-    describe 'composed with other scopes' do
-      subject { described_class.active(false).with_upgrade_status(:available) }
-
-      before do
-        create(:ci_runner_machine, runner: paused_runner_14_0_0, version: '14.0.0')
-      end
-
-      let(:paused_runner_14_0_0) { create(:ci_runner, :paused) }
-
-      it 'returns runner matching the composed scope' do
-        is_expected.to contain_exactly(paused_runner_14_0_0)
-      end
-    end
-  end
-
-  describe '.with_creator' do
-    subject { described_class.with_creator }
-
-    let!(:user) { create(:admin) }
-    let!(:runner) { create(:ci_runner, creator: user) }
-
-    it { is_expected.to contain_exactly(runner) }
-  end
-
   describe '#ensure_token' do
     let(:runner) { build(:ci_runner, registration_type: registration_type) }
     let(:token) { 'an_existing_secret_token' }
@@ -2423,7 +2024,7 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
   end
 
   describe '#dedicated_gitlab_hosted?' do
-    let(:runner) { create(:ci_runner) }
+    let(:runner) { build_stubbed(:ci_runner) }
 
     subject(:is_hosted) { runner.dedicated_gitlab_hosted? }
 
@@ -2452,57 +2053,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     end
   end
 
-  describe 'status scopes', :freeze_time do
-    before_all do
-      freeze_time # Freeze time before `let_it_be` runs, so that runner statuses are frozen during execution
-    end
-
-    after :all do
-      unfreeze_time
-    end
-
-    let_it_be(:online_runner) { create(:ci_runner, :instance, :almost_offline) }
-    let_it_be(:offline_runner) { create(:ci_runner, :instance, :offline) }
-    let_it_be(:never_contacted_runner) { create(:ci_runner, :instance, :unregistered) }
-
-    describe '.online' do
-      subject(:runners) { described_class.online }
-
-      it 'returns online runners' do
-        expect(runners).to contain_exactly(online_runner)
-      end
-    end
-
-    describe '.offline' do
-      subject(:runners) { described_class.offline }
-
-      it 'returns offline runners' do
-        expect(runners).to contain_exactly(offline_runner)
-      end
-    end
-
-    describe '.never_contacted' do
-      subject(:runners) { described_class.never_contacted }
-
-      it 'returns never contacted runners' do
-        expect(runners).to contain_exactly(never_contacted_runner)
-      end
-    end
-
-    describe '.stale' do
-      subject { described_class.stale }
-
-      let!(:stale_runner1) { create(:ci_runner, :unregistered, :stale) }
-      let!(:stale_runner2) { create(:ci_runner, :stale) }
-
-      it 'returns stale runners' do
-        is_expected.to contain_exactly(stale_runner1, stale_runner2)
-      end
-    end
-
-    include_examples 'runner with status scope'
-  end
-
   describe '.available_statuses' do
     subject { described_class.available_statuses }
 
@@ -2521,77 +2071,6 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
     it { is_expected.to eq(7.days.ago) }
   end
 
-  describe '.with_runner_type' do
-    subject { described_class.with_runner_type(runner_type) }
-
-    let_it_be(:instance_runner) { create(:ci_runner, :instance) }
-    let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
-    let_it_be(:project_runner) { create(:ci_runner, :project, :without_projects) }
-
-    context 'with instance_type' do
-      let(:runner_type) { 'instance_type' }
-
-      it { is_expected.to contain_exactly(instance_runner) }
-    end
-
-    context 'with group_type' do
-      let(:runner_type) { 'group_type' }
-
-      it { is_expected.to contain_exactly(group_runner) }
-    end
-
-    context 'with project_type' do
-      let(:runner_type) { 'project_type' }
-
-      it { is_expected.to contain_exactly(project_runner) }
-    end
-
-    context 'with invalid runner type' do
-      let(:runner_type) { 'invalid runner type' }
-
-      it { is_expected.to contain_exactly(instance_runner, group_runner, project_runner) }
-    end
-  end
-
-  describe '.with_sharding_key' do
-    subject(:scope) { described_class.with_runner_type(runner_type).with_sharding_key(sharding_key_id) }
-
-    let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
-    let_it_be(:project_runner) { create(:ci_runner, :project, projects: [project, other_project]) }
-
-    context 'with group_type' do
-      let(:runner_type) { 'group_type' }
-
-      context 'when sharding_key_id exists' do
-        let(:sharding_key_id) { group.id }
-
-        it { is_expected.to contain_exactly(group_runner) }
-      end
-
-      context 'when sharding_key_id does not exist' do
-        let(:sharding_key_id) { non_existing_record_id }
-
-        it { is_expected.to eq [] }
-      end
-    end
-
-    context 'with project_type' do
-      let(:runner_type) { 'project_type' }
-
-      context 'when sharding_key_id exists' do
-        let(:sharding_key_id) { project.id }
-
-        it { is_expected.to contain_exactly(project_runner) }
-      end
-
-      context 'when sharding_key_id does not exist' do
-        let(:sharding_key_id) { non_existing_record_id }
-
-        it { is_expected.to eq [] }
-      end
-    end
-  end
-
   describe '.encode' do
     let(:token_string) { 'test_token_123' }
 
@@ -2607,34 +2086,525 @@ RSpec.describe Ci::Runner, type: :model, factory_default: :keep, feature_categor
   end
 
   describe 'scopes' do
-    let_it_be(:runner_contacted_yesterday) { create(:ci_runner, contacted_at: 1.day.ago) }
-    let_it_be(:runner_contacted_today) { create(:ci_runner, contacted_at: Time.current) }
-    let_it_be(:runner_contacted_week_ago) { create(:ci_runner, contacted_at: 1.week.ago) }
-    let_it_be(:runner_never_contacted) { create_list(:ci_runner, 2, contacted_at: nil) }
+    context 'for order_contacted_at scope' do
+      let_it_be(:runner_contacted_yesterday) { create(:ci_runner, contacted_at: 1.day.ago) }
+      let_it_be(:runner_contacted_today) { create(:ci_runner, contacted_at: Time.current) }
+      let_it_be(:runner_contacted_week_ago) { create(:ci_runner, contacted_at: 1.week.ago) }
+      let_it_be(:runner_never_contacted) { create_list(:ci_runner, 2, contacted_at: nil) }
 
-    describe '.order_contacted_at_asc' do
-      subject { described_class.order_contacted_at_asc }
+      describe '.order_contacted_at_asc' do
+        subject { described_class.order_contacted_at_asc }
 
-      it 'orders runners by contacted_at in ascending order with nulls first' do
-        is_expected.to eq([
-          *runner_never_contacted,
-          runner_contacted_week_ago,
-          runner_contacted_yesterday,
-          runner_contacted_today
-        ])
+        it 'orders runners by contacted_at in ascending order with nulls first' do
+          is_expected.to eq([
+            *runner_never_contacted,
+            runner_contacted_week_ago,
+            runner_contacted_yesterday,
+            runner_contacted_today
+          ])
+        end
+      end
+
+      describe '.order_contacted_at_desc' do
+        subject { described_class.order_contacted_at_desc }
+
+        it 'orders runners by contacted_at in descending order with nulls last' do
+          is_expected.to eq([
+            runner_contacted_today,
+            runner_contacted_yesterday,
+            runner_contacted_week_ago,
+            *runner_never_contacted
+          ])
+        end
       end
     end
 
-    describe '.order_contacted_at_desc' do
-      subject { described_class.order_contacted_at_desc }
+    describe '.belonging_to_project' do
+      it 'returns the project runner' do
+        own_runner = create(:ci_runner, :project, projects: [project])
 
-      it 'orders runners by contacted_at in descending order with nulls last' do
-        is_expected.to eq([
-          runner_contacted_today,
-          runner_contacted_yesterday,
-          runner_contacted_week_ago,
-          *runner_never_contacted
-        ])
+        # other
+        create(:ci_runner, :project, projects: [other_project])
+
+        expect(described_class.belonging_to_project(project.id)).to contain_exactly own_runner
+      end
+    end
+
+    describe '.belonging_to_parent_groups_of_project' do
+      let_it_be(:group1) { create(:group) }
+      let_it_be(:project1) { create(:project, group: group1) }
+      let_it_be(:runner1) { create(:ci_runner, :group, groups: [group1]) }
+
+      let_it_be(:group2) { create(:group) }
+      let_it_be(:project2) { create(:project, group: group2) }
+      let_it_be(:runner2) { create(:ci_runner, :group, groups: [group2]) }
+
+      let(:project_id) { project1.id }
+
+      subject(:result) { described_class.belonging_to_parent_groups_of_project(project_id) }
+
+      it 'returns the group runner' do
+        expect(result).to contain_exactly(runner1)
+      end
+
+      context 'with a parent group with a runner', :sidekiq_inline do
+        before do
+          group1.update!(parent: group2)
+        end
+
+        it 'returns the group runner from the group and the parent group' do
+          expect(result).to contain_exactly(runner1, runner2)
+        end
+      end
+
+      context 'with multiple project ids' do
+        let(:project_id) { [project1.id, project2.id] }
+
+        it 'raises ArgumentError' do
+          expect { result }.to raise_error(ArgumentError)
+        end
+      end
+    end
+
+    context 'with instance runners sharing enabled' do
+      # group specific
+      let_it_be(:group) { create(:group, shared_runners_enabled: true) }
+      let_it_be(:project) { create(:project, group: group, shared_runners_enabled: true) }
+      let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
+
+      # project specific
+      let_it_be(:project_runner) { create(:ci_runner, :project, projects: [project]) }
+
+      # globally shared
+      let_it_be(:shared_runner) { create(:ci_runner, :instance) }
+
+      describe '.owned_or_instance_wide' do
+        subject { described_class.owned_or_instance_wide(project.id) }
+
+        it 'returns a shared, project and group runner' do
+          is_expected.to contain_exactly(group_runner, project_runner, shared_runner)
+        end
+      end
+
+      describe '.group_or_instance_wide' do
+        subject { described_class.group_or_instance_wide(group) }
+
+        before do
+          # Ensure the project runner is instantiated
+          project_runner
+        end
+
+        it 'returns a globally shared and a group runner' do
+          is_expected.to contain_exactly(group_runner, shared_runner)
+        end
+      end
+    end
+
+    context 'with instance runners sharing disabled' do
+      # group specific
+      let_it_be(:group) { create(:group, shared_runners_enabled: false) }
+      let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
+
+      let(:group_runners_enabled) { true }
+      let_it_be(:project) { create(:project, group: group, shared_runners_enabled: false) }
+
+      # project specific
+      let(:project_runner) { create(:ci_runner, :project, projects: [project]) }
+
+      # globally shared
+      let_it_be(:shared_runner) { create(:ci_runner, :instance) }
+
+      before do
+        project.update!(group_runners_enabled: group_runners_enabled)
+      end
+
+      describe '.owned_or_instance_wide' do
+        subject { described_class.owned_or_instance_wide(project.id) }
+
+        context 'with group runners disabled' do
+          let(:group_runners_enabled) { false }
+
+          it 'returns only the project runner' do
+            is_expected.to contain_exactly(project_runner)
+          end
+        end
+
+        context 'with group runners enabled' do
+          let(:group_runners_enabled) { true }
+
+          it 'returns a project runner and a group runner' do
+            is_expected.to contain_exactly(group_runner, project_runner)
+          end
+        end
+      end
+
+      describe '.group_or_instance_wide' do
+        subject { described_class.group_or_instance_wide(group) }
+
+        before do
+          # Ensure the project runner is instantiated
+          project_runner
+        end
+
+        it 'returns a group runner' do
+          is_expected.to contain_exactly(group_runner)
+        end
+      end
+    end
+
+    describe '.active' do
+      subject { described_class.active(active_value) }
+
+      let_it_be(:runner1) { create(:ci_runner, :instance, :paused) }
+      let_it_be(:runner2) { create(:ci_runner, :instance) }
+
+      context 'with active_value set to false' do
+        let(:active_value) { false }
+
+        it 'returns paused runners' do
+          is_expected.to contain_exactly(runner1)
+        end
+      end
+
+      context 'with active_value set to true' do
+        let(:active_value) { true }
+
+        it 'returns active runners' do
+          is_expected.to contain_exactly(runner2)
+        end
+      end
+    end
+
+    describe '.paused' do
+      subject(:paused) { described_class.paused }
+
+      let!(:runner1) { create(:ci_runner, :instance, :paused) }
+      let!(:runner2) { create(:ci_runner, :instance) }
+
+      it 'returns paused runners' do
+        expect(described_class).to receive(:active).with(false).and_call_original
+
+        expect(paused).to contain_exactly(runner1)
+      end
+    end
+
+    describe '.with_creator_id' do
+      let_it_be(:admin) { create(:admin) }
+      let_it_be(:user2) { create(:user) }
+
+      let_it_be(:user_runner1) { create(:ci_runner, creator: user2) }
+      let_it_be(:admin_runner1) { create(:ci_runner, creator: admin) }
+      let_it_be(:admin_runner2) { create(:ci_runner, creator: admin) }
+      let_it_be(:runner_without_creator) { create(:ci_runner, creator: nil) }
+
+      subject { described_class.with_creator_id(admin.id.to_s) }
+
+      it { is_expected.to contain_exactly(admin_runner1, admin_runner2) }
+    end
+
+    describe '.created_by_admins' do
+      let_it_be(:admin) { create(:admin) }
+      let_it_be(:user2) { create(:user) }
+      let_it_be(:admin_runner) { create(:ci_runner, creator: admin) }
+      let_it_be(:other_runner) { create(:ci_runner, creator: user2) }
+      let_it_be(:project_runner) { create(:ci_runner, :project, :without_projects, creator: admin) }
+
+      subject { described_class.created_by_admins }
+
+      it { is_expected.to contain_exactly(admin_runner, project_runner) }
+    end
+
+    describe '.with_version_prefix' do
+      subject { described_class.with_version_prefix('15.11.') }
+
+      let_it_be(:runner1) { create(:ci_runner) }
+      let_it_be(:runner2) { create(:ci_runner) }
+      let_it_be(:runner3) { create(:ci_runner) }
+
+      before_all do
+        create(:ci_runner_machine, runner: runner1, version: '15.11.0')
+        create(:ci_runner_machine, runner: runner2, version: '15.9.0')
+        create(:ci_runner_machine, runner: runner3, version: '15.9.0')
+        # Add another runner_machine to runner3 to ensure edge case is handled (searching multiple machines in a single runner)
+        create(:ci_runner_machine, runner: runner3, version: '15.11.5')
+      end
+
+      it 'returns runners containing runner managers with versions starting with 15.11.' do
+        is_expected.to contain_exactly(runner1, runner3)
+      end
+    end
+
+    describe '.with_executing_builds' do
+      subject(:scope) { described_class.with_executing_builds }
+
+      let_it_be(:runners_by_status) do
+        Ci::HasStatus::AVAILABLE_STATUSES.index_with { |_status| create(:ci_runner) }
+      end
+
+      let_it_be(:busy_runners) do
+        Ci::HasStatus::EXECUTING_STATUSES.map { |status| runners_by_status[status] }
+      end
+
+      context 'with no builds running' do
+        it { is_expected.to be_empty }
+      end
+
+      context 'with builds' do
+        before_all do
+          pipeline = create(:ci_pipeline, :running)
+
+          Ci::HasStatus::AVAILABLE_STATUSES.each do |status|
+            create(:ci_build, status, runner: runners_by_status[status], pipeline: pipeline)
+          end
+        end
+
+        it { is_expected.to match_array(busy_runners) }
+      end
+    end
+
+    describe '.assignable_for' do
+      let_it_be(:group) { create(:group) }
+      let_it_be(:another_project) { other_project }
+      let_it_be(:unlocked_project_runner) { create(:ci_runner, :project, projects: [project]) }
+      let_it_be(:locked_project_runner) { create(:ci_runner, :project, locked: true, projects: [project]) }
+      let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
+      let_it_be(:instance_runner) { create(:ci_runner, :instance) }
+
+      context 'with already assigned project' do
+        subject { described_class.assignable_for(project) }
+
+        it { is_expected.to be_empty }
+      end
+
+      context 'with a different project' do
+        subject { described_class.assignable_for(another_project) }
+
+        it { is_expected.to include(unlocked_project_runner) }
+        it { is_expected.not_to include(group_runner) }
+        it { is_expected.not_to include(locked_project_runner) }
+        it { is_expected.not_to include(instance_runner) }
+      end
+    end
+
+    describe '.order_by' do
+      let_it_be(:runner1) { create(:ci_runner, created_at: 1.year.ago, contacted_at: 1.year.ago) }
+      let_it_be(:runner2) { create(:ci_runner, created_at: 1.month.ago, contacted_at: 1.month.ago) }
+
+      before do
+        runner1.update!(token_expires_at: 1.year.from_now)
+      end
+
+      it 'supports ordering by the contact date' do
+        runners = described_class.order_by('contacted_asc')
+
+        expect(runners).to eq([runner1, runner2])
+      end
+
+      it 'supports ordering by the creation date' do
+        runners = described_class.order_by('created_asc')
+
+        expect(runners).to eq([runner2, runner1])
+      end
+
+      it 'supports ordering by the token expiration' do
+        runner3 = create(:ci_runner)
+        runner3.update!(token_expires_at: 1.month.from_now)
+
+        runners = described_class.order_by('token_expires_at_asc')
+        expect(runners).to eq([runner3, runner1, runner2])
+
+        runners = described_class.order_by('token_expires_at_desc')
+        expect(runners).to eq([runner2, runner1, runner3])
+      end
+    end
+
+    describe '.with_upgrade_status' do
+      subject(:scope) { described_class.with_upgrade_status(upgrade_status) }
+
+      let_it_be(:runner_14_0_0) { create(:ci_runner) }
+      let_it_be(:runner_14_1_0_and_14_0_0) { create(:ci_runner) }
+      let_it_be(:runner_14_1_0) { create(:ci_runner) }
+      let_it_be(:runner_14_1_1) { create(:ci_runner) }
+
+      before_all do
+        create(:ci_runner_machine, runner: runner_14_1_0_and_14_0_0, version: '14.0.0')
+        create(:ci_runner_machine, runner: runner_14_1_0_and_14_0_0, version: '14.1.0')
+        create(:ci_runner_machine, runner: runner_14_0_0, version: '14.0.0')
+        create(:ci_runner_machine, runner: runner_14_1_0, version: '14.1.0')
+        create(:ci_runner_machine, runner: runner_14_1_1, version: '14.1.1')
+
+        create(:ci_runner_version, version: '14.0.0', status: :available)
+        create(:ci_runner_version, version: '14.1.0', status: :recommended)
+        create(:ci_runner_version, version: '14.1.1', status: :unavailable)
+      end
+
+      context ':unavailable' do
+        let(:upgrade_status) { :unavailable }
+
+        it 'returns runners with runner managers whose version is assigned :unavailable' do
+          is_expected.to contain_exactly(runner_14_1_1)
+        end
+      end
+
+      context ':available' do
+        let(:upgrade_status) { :available }
+
+        it 'returns runners with runner managers whose version is assigned :available' do
+          is_expected.to contain_exactly(runner_14_0_0, runner_14_1_0_and_14_0_0)
+        end
+      end
+
+      context ':recommended' do
+        let(:upgrade_status) { :recommended }
+
+        it 'returns runners with runner managers whose version is assigned :recommended' do
+          is_expected.to contain_exactly(runner_14_1_0_and_14_0_0, runner_14_1_0)
+        end
+      end
+
+      describe 'composed with other scopes' do
+        subject { described_class.active(false).with_upgrade_status(:available) }
+
+        before do
+          create(:ci_runner_machine, runner: paused_runner_14_0_0, version: '14.0.0')
+        end
+
+        let(:paused_runner_14_0_0) { create(:ci_runner, :paused) }
+
+        it 'returns runner matching the composed scope' do
+          is_expected.to contain_exactly(paused_runner_14_0_0)
+        end
+      end
+    end
+
+    describe '.with_creator' do
+      subject { described_class.with_creator }
+
+      let!(:user) { create(:admin) }
+      let!(:runner) { create(:ci_runner, creator: user) }
+
+      it { is_expected.to contain_exactly(runner) }
+    end
+
+    describe 'status scopes', :freeze_time do
+      before_all do
+        freeze_time # Freeze time before `let_it_be` runs, so that runner statuses are frozen during execution
+      end
+
+      after :all do
+        unfreeze_time
+      end
+
+      let_it_be(:online_runner) { create(:ci_runner, :instance, :almost_offline) }
+      let_it_be(:offline_runner) { create(:ci_runner, :instance, :offline) }
+      let_it_be(:never_contacted_runner) { create(:ci_runner, :instance, :unregistered) }
+
+      describe '.online' do
+        subject(:runners) { described_class.online }
+
+        it 'returns online runners' do
+          expect(runners).to contain_exactly(online_runner)
+        end
+      end
+
+      describe '.offline' do
+        subject(:runners) { described_class.offline }
+
+        it 'returns offline runners' do
+          expect(runners).to contain_exactly(offline_runner)
+        end
+      end
+
+      describe '.never_contacted' do
+        subject(:runners) { described_class.never_contacted }
+
+        it 'returns never contacted runners' do
+          expect(runners).to contain_exactly(never_contacted_runner)
+        end
+      end
+
+      describe '.stale' do
+        subject { described_class.stale }
+
+        let!(:stale_runner1) { create(:ci_runner, :unregistered, :stale) }
+        let!(:stale_runner2) { create(:ci_runner, :stale) }
+
+        it 'returns stale runners' do
+          is_expected.to contain_exactly(stale_runner1, stale_runner2)
+        end
+      end
+
+      include_examples 'runner with status scope'
+    end
+
+    describe '.with_runner_type' do
+      subject { described_class.with_runner_type(runner_type) }
+
+      let_it_be(:instance_runner) { create(:ci_runner, :instance) }
+      let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
+      let_it_be(:project_runner) { create(:ci_runner, :project, :without_projects) }
+
+      context 'with instance_type' do
+        let(:runner_type) { 'instance_type' }
+
+        it { is_expected.to contain_exactly(instance_runner) }
+      end
+
+      context 'with group_type' do
+        let(:runner_type) { 'group_type' }
+
+        it { is_expected.to contain_exactly(group_runner) }
+      end
+
+      context 'with project_type' do
+        let(:runner_type) { 'project_type' }
+
+        it { is_expected.to contain_exactly(project_runner) }
+      end
+
+      context 'with invalid runner type' do
+        let(:runner_type) { 'invalid runner type' }
+
+        it { is_expected.to contain_exactly(instance_runner, group_runner, project_runner) }
+      end
+    end
+
+    describe '.with_sharding_key' do
+      subject(:scope) { described_class.with_runner_type(runner_type).with_sharding_key(sharding_key_id) }
+
+      let_it_be(:group_runner) { create(:ci_runner, :group, groups: [group]) }
+      let_it_be(:project_runner) { create(:ci_runner, :project, projects: [project, other_project]) }
+
+      context 'with group_type' do
+        let(:runner_type) { 'group_type' }
+
+        context 'when sharding_key_id exists' do
+          let(:sharding_key_id) { group.id }
+
+          it { is_expected.to contain_exactly(group_runner) }
+        end
+
+        context 'when sharding_key_id does not exist' do
+          let(:sharding_key_id) { non_existing_record_id }
+
+          it { is_expected.to eq [] }
+        end
+      end
+
+      context 'with project_type' do
+        let(:runner_type) { 'project_type' }
+
+        context 'when sharding_key_id exists' do
+          let(:sharding_key_id) { project.id }
+
+          it { is_expected.to contain_exactly(project_runner) }
+        end
+
+        context 'when sharding_key_id does not exist' do
+          let(:sharding_key_id) { non_existing_record_id }
+
+          it { is_expected.to eq [] }
+        end
       end
     end
   end
diff --git a/spec/services/packages/create_event_service_spec.rb b/spec/services/packages/create_event_service_spec.rb
index ca7c0cb597a..335dc80ae78 100644
--- a/spec/services/packages/create_event_service_spec.rb
+++ b/spec/services/packages/create_event_service_spec.rb
@@ -57,9 +57,15 @@ RSpec.describe Packages::CreateEventService, feature_category: :package_registry
 
       context 'with a deploy token' do
         let_it_be(:user) { create(:deploy_token) }
+        let(:hashed_deploy_token_id) { 'hashed-deploy-token-id-sha256' }
+        let(:event_attrs) { super().merge(additional_properties: { deploy_token_id: hashed_deploy_token_id }) }
 
         let(:property) { 'deploy_token' }
 
+        before do
+          allow(Gitlab::CryptoHelper).to receive(:sha256).and_return(hashed_deploy_token_id)
+        end
+
         it 'updates the correct metrics' do
           expect { service }.to trigger_internal_events('pull_package_from_registry').with(event_attrs)
             .and increment_usage_metrics(
diff --git a/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb b/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
index 5c8a7042453..3692b8208d1 100644
--- a/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/nuget_packages_shared_examples.rb
@@ -966,6 +966,7 @@ RSpec.shared_examples 'process nuget delete request' do |user_type, status, auth
         args[:property] = 'guest'
       elsif auth == :deploy_token
         args[:property] = 'deploy_token'
+        args[:additional_properties] = { deploy_token_id: Gitlab::CryptoHelper.sha256(deploy_token.id) }
       else
         args[:user] = user
         args[:property] = 'user'
diff --git a/workhorse/go.mod b/workhorse/go.mod
index f823cf12435..530696655f6 100644
--- a/workhorse/go.mod
+++ b/workhorse/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.0
 	github.com/BurntSushi/toml v1.4.0
-	github.com/alecthomas/chroma/v2 v2.14.0
+	github.com/alecthomas/chroma/v2 v2.18.0
 	github.com/alicebob/miniredis/v2 v2.34.0
 	github.com/aws/aws-sdk-go-v2 v1.36.4
 	github.com/aws/aws-sdk-go-v2/config v1.28.1
@@ -32,10 +32,10 @@ require (
 	github.com/stretchr/testify v1.10.0
 	gitlab.com/gitlab-org/gitaly/v16 v16.11.0-rc1.0.20250408053233-c6d43513e93c
 	gitlab.com/gitlab-org/labkit v1.24.1
-	gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250516184650-7c5a084f7c1f
+	gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250624075830-6ed48147bb25
 	go.uber.org/goleak v1.3.0
 	gocloud.dev v0.40.1-0.20241107185025-56954848c3aa
-	golang.org/x/image v0.20.0
+	golang.org/x/image v0.28.0
 	golang.org/x/net v0.40.0
 	golang.org/x/oauth2 v0.30.0
 	google.golang.org/grpc v1.71.1
@@ -158,12 +158,12 @@ require (
 	go.opentelemetry.io/otel/trace v1.34.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/crypto v0.38.0 // indirect
-	golang.org/x/mod v0.23.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/mod v0.25.0 // indirect
+	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
 	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.30.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
 	google.golang.org/api v0.197.0 // indirect
 	google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect
diff --git a/workhorse/go.sum b/workhorse/go.sum
index 7b5d7753d48..177f4e82499 100644
--- a/workhorse/go.sum
+++ b/workhorse/go.sum
@@ -114,10 +114,10 @@ github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5
 github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
 github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
-github.com/alecthomas/assert/v2 v2.7.0 h1:QtqSACNS3tF7oasA8CU6A6sXZSBDqnm7RfpLl9bZqbE=
-github.com/alecthomas/assert/v2 v2.7.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.14.0 h1:R3+wzpnUArGcQz7fCETQBzO5n9IMNi13iIs46aU4V9E=
-github.com/alecthomas/chroma/v2 v2.14.0/go.mod h1:QolEbTfmUHIMVpBqxeDnNBj2uoeI4EbYP4i6n68SG4I=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.18.0 h1:6h53Q4hW83SuF+jcsp7CVhLsMozzvQvO8HBbKQW+gn4=
+github.com/alecthomas/chroma/v2 v2.18.0/go.mod h1:RVX6AvYm4VfYe/zsk7mjHueLDZor3aWCNE14TFlepBk=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
@@ -632,8 +632,8 @@ gitlab.com/gitlab-org/go/reopen v1.0.0 h1:6BujZ0lkkjGIejTUJdNO1w56mN1SI10qcVQyQl
 gitlab.com/gitlab-org/go/reopen v1.0.0/go.mod h1:D6OID8YJDzEVZNYW02R/Pkj0v8gYFSIhXFTArAsBQw8=
 gitlab.com/gitlab-org/labkit v1.24.1 h1:/Rw5ZyTyORNPHTgKSUmykhI4lSWjQdGZcm+r4ASFVkU=
 gitlab.com/gitlab-org/labkit v1.24.1/go.mod h1:vnGUmGdIjTs1PLDbLPduQMHgky77l26MESy2jGR1aw8=
-gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250516184650-7c5a084f7c1f h1:4LqdW/FSOYkIFbIXYgeJiSywlWrlRZu3ZjR/52AglDI=
-gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250516184650-7c5a084f7c1f/go.mod h1:G/uyhLyG53gWlNSoTuWirrqS42PKcobyiQZvEAaJ9o8=
+gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250624075830-6ed48147bb25 h1:qh/nK7xIwHAMLaP0yB2gMKer7Qnj/bKF0w+L7RSod2E=
+gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/clients/gopb v0.0.0-20250624075830-6ed48147bb25/go.mod h1:G/uyhLyG53gWlNSoTuWirrqS42PKcobyiQZvEAaJ9o8=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
 go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
@@ -699,8 +699,8 @@ golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+h
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.20.0 h1:7cVCUjQwfL18gyBJOmYvptfSHS8Fb3YUDtfLIZ7Nbpw=
-golang.org/x/image v0.20.0/go.mod h1:0a88To4CYVBAHp5FXJm8o7QbUl37Vd85ply1vyD8auM=
+golang.org/x/image v0.28.0 h1:gdem5JW1OLS4FbkWgLO+7ZeFzYtL3xClb97GaUzYMFE=
+golang.org/x/image v0.28.0/go.mod h1:GUJYXtnGKEUgggyzh+Vxt+AviiCcyiwpsl8iQ8MvwGY=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -729,8 +729,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
-golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -809,8 +809,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -896,8 +896,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -964,8 +964,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/yarn.lock b/yarn.lock
index ecc25376d99..6999778fc7b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -316,12 +316,12 @@
     "@babel/template" "^7.27.1"
     "@babel/types" "^7.27.1"
 
-"@babel/parser@^7.1.0", "@babel/parser@^7.14.7", "@babel/parser@^7.23.5", "@babel/parser@^7.23.9", "@babel/parser@^7.25.3", "@babel/parser@^7.26.10", "@babel/parser@^7.27.1", "@babel/parser@^7.27.2":
-  version "7.27.2"
-  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.27.2.tgz#577518bedb17a2ce4212afd052e01f7df0941127"
-  integrity sha512-QYLs8299NA7WM/bZAdp+CviYYkVoYXlDW2rzliy3chxd1PQjej7JORuMJDJXJUb9g0TT+B99EwaVLKmX+sPXWw==
+"@babel/parser@^7.1.0", "@babel/parser@^7.14.7", "@babel/parser@^7.23.5", "@babel/parser@^7.23.9", "@babel/parser@^7.26.10", "@babel/parser@^7.27.1", "@babel/parser@^7.27.2", "@babel/parser@^7.27.5":
+  version "7.27.5"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.27.5.tgz#ed22f871f110aa285a6fd934a0efed621d118826"
+  integrity sha512-OsQd175SxWkGlzbny8J3K8TnnDD0N3lrIUtB92xwyRpzaenGZhxDvxN/JgU00U3CDZNj9tPuDJ5H0WS4Nt3vKg==
   dependencies:
-    "@babel/types" "^7.27.1"
+    "@babel/types" "^7.27.3"
 
 "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@^7.23.3":
   version "7.23.3"
@@ -1026,10 +1026,10 @@
     debug "^4.3.1"
     globals "^11.1.0"
 
-"@babel/types@^7.0.0", "@babel/types@^7.0.0-beta.49", "@babel/types@^7.22.15", "@babel/types@^7.22.19", "@babel/types@^7.22.5", "@babel/types@^7.23.0", "@babel/types@^7.24.7", "@babel/types@^7.26.10", "@babel/types@^7.27.1", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4":
-  version "7.27.1"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.27.1.tgz#9defc53c16fc899e46941fc6901a9eea1c9d8560"
-  integrity sha512-+EzkxvLNfiUeKMgy/3luqfsCWFRXLb7U6wNQTk60tovuckwB15B191tJWvpp4HjiQWdJkCxO3Wbvc6jlk3Xb2Q==
+"@babel/types@^7.0.0", "@babel/types@^7.0.0-beta.49", "@babel/types@^7.22.15", "@babel/types@^7.22.19", "@babel/types@^7.22.5", "@babel/types@^7.23.0", "@babel/types@^7.24.7", "@babel/types@^7.26.10", "@babel/types@^7.27.1", "@babel/types@^7.27.3", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4":
+  version "7.27.6"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.27.6.tgz#a434ca7add514d4e646c80f7375c0aa2befc5535"
+  integrity sha512-ETyHEk2VHHvl9b9jZP5IHPavHYk57EhanlRRuae9XCpb/j5bDCbPPMOBfCWhnl/7EDJz0jEMCi/RhccCE8r1+Q==
   dependencies:
     "@babel/helper-string-parser" "^7.27.1"
     "@babel/helper-validator-identifier" "^7.27.1"
@@ -1465,13 +1465,13 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.134.0.tgz#d377ed04560e096155e6f2ff96532b32f65f5db9"
   integrity sha512-j80CQRNCdBIF0bykqWHCafYh/NaZg67Z5aZ9Whq28V+Od9l1KTn4Qb1SEd71hRLfDEkFQibdBc4L+CVVR98Q/w==
 
-"@gitlab/ui@114.0.1":
-  version "114.0.1"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-114.0.1.tgz#847f1ab2ce56bcb504b95c9c7535799fb4defa0c"
-  integrity sha512-JvXGyIqye/MuM7s2NqGWfd6rsPYv2+o/r//nxzS7ginRM/yJQbSNIJo+yPuxOREqnONmzuqCpeigYyBcPE2PHw==
+"@gitlab/ui@114.7.1":
+  version "114.7.1"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-114.7.1.tgz#8e6492db172a89b88b0c5716eef56b0c5ad618ba"
+  integrity sha512-KeUkxEWDHqYZXpvNzAhVH2lmuO7nilc3vGf/SKq2l/UPvqqOcCiZ61JBQ7J1CrIOQxUDSxLJGe54QVYteAn/OA==
   dependencies:
     "@floating-ui/dom" "1.7.0"
-    echarts "^5.3.2"
+    echarts "^5.6.0"
     iframe-resizer "^4.3.2"
     lodash "^4.17.20"
     popper.js "^1.16.1"
@@ -3922,33 +3922,33 @@
   dependencies:
     throttle-debounce "^3.0.1"
 
-"@vue/compat@^3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/compat/-/compat-3.5.13.tgz#b8f715dc4ff0b4964165d51e0023bd2631de5ae5"
-  integrity sha512-Q3xRdTPN4l+kddxU98REyUBgvc0meAo9CefCWE2lW8Fg3dyPn3vSCce52b338ihrJAx1RQQhO5wMWhJ/PAKUpA==
+"@vue/compat@^3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/compat/-/compat-3.5.17.tgz#a773242493df345979ea3dacac7acf6ba84f4b3e"
+  integrity sha512-o95xqA4tIIXbimPEBBsw94iXI5kp880Gpby8dct2EC7qPYHwQis5Bb/HxoPd8H56HIzxtiiZpMwOOWOs79KVRw==
   dependencies:
-    "@babel/parser" "^7.25.3"
+    "@babel/parser" "^7.27.5"
     estree-walker "^2.0.2"
-    source-map-js "^1.2.0"
+    source-map-js "^1.2.1"
 
-"@vue/compiler-core@3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/compiler-core/-/compiler-core-3.5.13.tgz#b0ae6c4347f60c03e849a05d34e5bf747c9bda05"
-  integrity sha512-oOdAkwqUfW1WqpwSYJce06wvt6HljgY3fGeM9NcVA1HaYOij3mZG9Rkysn0OHuyUAGMbEbARIpsG+LPVlBJ5/Q==
+"@vue/compiler-core@3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-core/-/compiler-core-3.5.17.tgz#23d291bd01b863da3ef2e26e7db84d8e01a9b4c5"
+  integrity sha512-Xe+AittLbAyV0pabcN7cP7/BenRBNcteM4aSDCtRvGw0d9OL+HG1u/XHLY/kt1q4fyMeZYXyIYrsHuPSiDPosA==
   dependencies:
-    "@babel/parser" "^7.25.3"
-    "@vue/shared" "3.5.13"
+    "@babel/parser" "^7.27.5"
+    "@vue/shared" "3.5.17"
     entities "^4.5.0"
     estree-walker "^2.0.2"
-    source-map-js "^1.2.0"
+    source-map-js "^1.2.1"
 
-"@vue/compiler-dom@3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/compiler-dom/-/compiler-dom-3.5.13.tgz#bb1b8758dbc542b3658dda973b98a1c9311a8a58"
-  integrity sha512-ZOJ46sMOKUjO3e94wPdCzQ6P1Lx/vhp2RSvfaab88Ajexs0AHeV0uasYhi99WPaogmBlRHNRuly8xV75cNTMDA==
+"@vue/compiler-dom@3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-dom/-/compiler-dom-3.5.17.tgz#7bc19a20e23b670243a64b47ce3a890239b870be"
+  integrity sha512-+2UgfLKoaNLhgfhV5Ihnk6wB4ljyW1/7wUIog2puUqajiC29Lp5R/IKDdkebh9jTbTogTbsgB+OY9cEWzG95JQ==
   dependencies:
-    "@vue/compiler-core" "3.5.13"
-    "@vue/shared" "3.5.13"
+    "@vue/compiler-core" "3.5.17"
+    "@vue/shared" "3.5.17"
 
 "@vue/compiler-sfc@2.7.16":
   version "2.7.16"
@@ -3961,28 +3961,28 @@
   optionalDependencies:
     prettier "^1.18.2 || ^2.0.0"
 
-"@vue/compiler-sfc@^3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/compiler-sfc/-/compiler-sfc-3.5.13.tgz#461f8bd343b5c06fac4189c4fef8af32dea82b46"
-  integrity sha512-6VdaljMpD82w6c2749Zhf5T9u5uLBWKnVue6XWxprDobftnletJ8+oel7sexFfM3qIxNmVE7LSFGTpv6obNyaQ==
+"@vue/compiler-sfc@^3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-sfc/-/compiler-sfc-3.5.17.tgz#c518871276e26593612bdab36f3f5bcd053b13bf"
+  integrity sha512-rQQxbRJMgTqwRugtjw0cnyQv9cP4/4BxWfTdRBkqsTfLOHWykLzbOc3C4GGzAmdMDxhzU/1Ija5bTjMVrddqww==
   dependencies:
-    "@babel/parser" "^7.25.3"
-    "@vue/compiler-core" "3.5.13"
-    "@vue/compiler-dom" "3.5.13"
-    "@vue/compiler-ssr" "3.5.13"
-    "@vue/shared" "3.5.13"
+    "@babel/parser" "^7.27.5"
+    "@vue/compiler-core" "3.5.17"
+    "@vue/compiler-dom" "3.5.17"
+    "@vue/compiler-ssr" "3.5.17"
+    "@vue/shared" "3.5.17"
     estree-walker "^2.0.2"
-    magic-string "^0.30.11"
-    postcss "^8.4.48"
-    source-map-js "^1.2.0"
+    magic-string "^0.30.17"
+    postcss "^8.5.6"
+    source-map-js "^1.2.1"
 
-"@vue/compiler-ssr@3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/compiler-ssr/-/compiler-ssr-3.5.13.tgz#e771adcca6d3d000f91a4277c972a996d07f43ba"
-  integrity sha512-wMH6vrYHxQl/IybKJagqbquvxpWCuVYpoUJfCqFZwa/JY1GdATAQ+TgVtgrwwMZ0D07QhA99rs/EAAWfvG6KpA==
+"@vue/compiler-ssr@3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-ssr/-/compiler-ssr-3.5.17.tgz#14ba3b7bba6e0e1fd02002316263165a5d1046c7"
+  integrity sha512-hkDbA0Q20ZzGgpj5uZjb9rBzQtIHLS78mMilwrlpWk2Ep37DYntUz0PonQ6kr113vfOEdM+zTBuJDaceNIW0tQ==
   dependencies:
-    "@vue/compiler-dom" "3.5.13"
-    "@vue/shared" "3.5.13"
+    "@vue/compiler-dom" "3.5.17"
+    "@vue/shared" "3.5.17"
 
 "@vue/component-compiler-utils@^3.1.0":
   version "3.3.0"
@@ -4005,18 +4005,18 @@
   resolved "https://registry.yarnpkg.com/@vue/devtools-api/-/devtools-api-6.6.4.tgz#cbe97fe0162b365edc1dba80e173f90492535343"
   integrity sha512-sGhTPMuXqZ1rVOk32RylztWkfXTRhuS7vgAKv0zjqk8gbsHkJ7xfFf+jbySxt7tWObEJwyKaHMikV/WGDiQm8g==
 
-"@vue/server-renderer@^3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/server-renderer/-/server-renderer-3.5.13.tgz#429ead62ee51de789646c22efe908e489aad46f7"
-  integrity sha512-wAi4IRJV/2SAW3htkTlB+dHeRmpTiVIK1OGLWV1yeStVSebSQQOwGwIq0D3ZIoBj2C2qpgz5+vX9iEBkTdk5YA==
+"@vue/server-renderer@^3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/server-renderer/-/server-renderer-3.5.17.tgz#9b8fd6a40a3d55322509fafe78ac841ede649fbe"
+  integrity sha512-BOHhm8HalujY6lmC3DbqF6uXN/K00uWiEeF22LfEsm9Q93XeJ/plHTepGwf6tqFcF7GA5oGSSAAUock3VvzaCA==
   dependencies:
-    "@vue/compiler-ssr" "3.5.13"
-    "@vue/shared" "3.5.13"
+    "@vue/compiler-ssr" "3.5.17"
+    "@vue/shared" "3.5.17"
 
-"@vue/shared@3.5.13":
-  version "3.5.13"
-  resolved "https://registry.yarnpkg.com/@vue/shared/-/shared-3.5.13.tgz#87b309a6379c22b926e696893237826f64339b6f"
-  integrity sha512-/hnE/qP5ZoGpol0a5mDi45bOd7t3tjYJBjsgCsivow7D48cJeV5l05RD82lPqi7gRiphZM37rnhW1l6ZoCNNnQ==
+"@vue/shared@3.5.17":
+  version "3.5.17"
+  resolved "https://registry.yarnpkg.com/@vue/shared/-/shared-3.5.17.tgz#e8b3a41f0be76499882a89e8ed40d86a70fa4b70"
+  integrity sha512-CabR+UN630VnsJO/jHWYBC1YVXyMq94KKp6iF5MQgZJs5I8cmjw6oVMO1oDbtBkENSHSSn/UadWlW/OAgdmKrg==
 
 "@vue/test-utils-vue3@npm:@vue/test-utils@^2.4.6":
   version "2.4.6"
@@ -7006,13 +7006,13 @@ duplexify@^3.4.2, duplexify@^3.6.0:
     readable-stream "^2.0.0"
     stream-shift "^1.0.0"
 
-echarts@^5.3.2:
-  version "5.3.3"
-  resolved "https://registry.yarnpkg.com/echarts/-/echarts-5.3.3.tgz#df97b09c4c0e2ffcdfb44acf518d50c50e0b838e"
-  integrity sha512-BRw2serInRwO5SIwRviZ6Xgm5Lb7irgz+sLiFMmy/HOaf4SQ+7oYqxKzRHAKp4xHQ05AuHw1xvoQWJjDQq/FGw==
+echarts@^5.3.2, echarts@^5.6.0:
+  version "5.6.0"
+  resolved "https://registry.yarnpkg.com/echarts/-/echarts-5.6.0.tgz#2377874dca9fb50f104051c3553544752da3c9d6"
+  integrity sha512-oTbVTsXfKuEhxftHqL5xprgLoc0k7uScAwtryCgWF6hPYFLRwOUHiFmHGCBKP5NPFNkDVopOieyUqYGH8Fa3kA==
   dependencies:
     tslib "2.3.0"
-    zrender "5.3.2"
+    zrender "5.6.1"
 
 editorconfig@^0.15.3:
   version "0.15.3"
@@ -10373,7 +10373,7 @@ lru-cache@^6.0.0:
   dependencies:
     yallist "^4.0.0"
 
-magic-string@^0.30.11:
+magic-string@^0.30.17:
   version "0.30.17"
   resolved "https://registry.yarnpkg.com/magic-string/-/magic-string-0.30.17.tgz#450a449673d2460e5bbcfba9a61916a1714c7453"
   integrity sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==
@@ -11355,10 +11355,10 @@ nan@^2.14.0, nan@^2.17.0, nan@^2.18.0:
   resolved "https://registry.yarnpkg.com/nan/-/nan-2.19.0.tgz#bb58122ad55a6c5bc973303908d5b16cfdd5a8c0"
   integrity sha512-nO1xXxfh/RWNxfd/XPfbIfFk5vgLsAxUR9y5O0cHMJu/AW9U95JLXqthYHjEp+8gQ5p96K9jUp8nbVOxCdRbtw==
 
-nanoid@^3.3.8:
-  version "3.3.8"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.8.tgz#b1be3030bee36aaff18bacb375e5cce521684baf"
-  integrity sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==
+nanoid@^3.3.11:
+  version "3.3.11"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.11.tgz#4f4f112cefbe303202f2199838128936266d185b"
+  integrity sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==
 
 nanomatch@^1.2.9:
   version "1.2.13"
@@ -12245,12 +12245,12 @@ postcss@^7.0.14, postcss@^7.0.36, postcss@^7.0.5, postcss@^7.0.6:
     picocolors "^0.2.1"
     source-map "^0.6.1"
 
-postcss@^8.4.14, postcss@^8.4.23, postcss@^8.4.32, postcss@^8.4.35, postcss@^8.4.48, postcss@^8.5.3:
-  version "8.5.3"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.3.tgz#1463b6f1c7fb16fe258736cba29a2de35237eafb"
-  integrity sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==
+postcss@^8.4.14, postcss@^8.4.23, postcss@^8.4.32, postcss@^8.4.35, postcss@^8.5.3, postcss@^8.5.6:
+  version "8.5.6"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.6.tgz#2825006615a619b4f62a9e7426cc120b349a8f3c"
+  integrity sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==
   dependencies:
-    nanoid "^3.3.8"
+    nanoid "^3.3.11"
     picocolors "^1.1.1"
     source-map-js "^1.2.1"
 
@@ -13704,7 +13704,7 @@ source-list-map@^2.0.0:
   resolved "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.1.tgz#3993bd873bfc48479cca9ea3a547835c7c154b34"
   integrity sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==
 
-"source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.0.1, source-map-js@^1.2.0, source-map-js@^1.2.1:
+"source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.0.1, source-map-js@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"
   integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==
@@ -15934,10 +15934,10 @@ zen-observable@0.8.15:
   resolved "https://registry.yarnpkg.com/zen-observable/-/zen-observable-0.8.15.tgz#96415c512d8e3ffd920afd3889604e30b9eaac15"
   integrity sha512-PQ2PC7R9rslx84ndNBZB/Dkv8V8fZEpk83RLgXtYd0fwUgEjseMn1Dgajh2x6S8QbZAFa9p2qVCEuYZNgve0dQ==
 
-zrender@5.3.2:
-  version "5.3.2"
-  resolved "https://registry.yarnpkg.com/zrender/-/zrender-5.3.2.tgz#f67b11d36d3d020d62411d3bb123eb1c93cccd69"
-  integrity sha512-8IiYdfwHj2rx0UeIGZGGU4WEVSDEdeVCaIg/fomejg1Xu6OifAL1GVzIPHg2D+MyUkbNgPWji90t0a8IDk+39w==
+zrender@5.6.1:
+  version "5.6.1"
+  resolved "https://registry.yarnpkg.com/zrender/-/zrender-5.6.1.tgz#e08d57ecf4acac708c4fcb7481eb201df7f10a6b"
+  integrity sha512-OFXkDJKcrlx5su2XbzJvj/34Q3m6PvyCZkVPHGYpcCJ52ek4U/ymZyfuV1nKE23AyBJ51E/6Yr0mhZ7xGTO4ag==
   dependencies:
     tslib "2.3.0"