From 673391836f51b489f446ab67ea60aaccca266060 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 13 Nov 2024 18:32:06 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 Gemfile                                       |   2 +-
 Gemfile.checksum                              |   2 +-
 Gemfile.lock                                  |   4 +-
 Gemfile.next.checksum                         |   2 +-
 Gemfile.next.lock                             |   4 +-
 .../components/app.vue                        |   2 +-
 .../components/collapsible_section.vue        |   2 +-
 app/assets/stylesheets/framework/crud.scss    |   2 +-
 .../concerns/issuable_collections.rb          |   5 +-
 app/controllers/registrations_controller.rb   |   1 +
 .../concerns/issues/look_ahead_preloads.rb    |   4 +-
 .../work_items/look_ahead_preloads.rb         |   6 +-
 .../work_items/ancestors_resolver.rb          |   2 +-
 app/models/issue.rb                           |  66 ++++++--
 app/models/work_item.rb                       |  21 ++-
 app/models/work_items/type.rb                 |   1 -
 app/models/work_items/widgets/hierarchy.rb    |  13 +-
 app/services/issues/export_csv_service.rb     |   9 +-
 app/services/work_items/export_csv_service.rb |   2 +-
 .../issues_use_correct_work_item_type_id.yml  |   9 +
 config/initializers/1_settings.rb             |   3 +
 ..._create_user_add_on_assignments_history.rb |  27 +++
 ...ing_external_links_for_vulnerabilities.yml |   8 +
 ...sing_external_links_for_vulnerabilities.rb |  26 +++
 db/schema_migrations/20241024062434           |   1 +
 doc/administration/instance_limits.md         |   2 +-
 .../reference_architectures/10k_users.md      |   2 +-
 .../reference_architectures/25k_users.md      |   4 +-
 .../reference_architectures/2k_users.md       |   2 +-
 .../reference_architectures/3k_users.md       |   2 +-
 .../reference_architectures/5k_users.md       |   2 +-
 .../reference_architectures/index.md          |   2 +-
 doc/administration/reply_by_email.md          |  28 ++-
 .../end_to_end_testing_webdriverio/index.md   |   2 +-
 doc/ci/yaml/workflow.md                       |   2 +-
 doc/development/ai_features/index.md          |   2 +-
 doc/development/code_review.md                |   2 +-
 .../database/loose_foreign_keys.md            |   2 +-
 .../database/understanding_explain_plans.md   |   2 +-
 .../documentation/styleguide/index.md         |   2 +-
 doc/development/ee_features.md                |   2 +-
 doc/development/integrations/index.md         |   2 +-
 doc/development/migration_style_guide.md      |   2 +-
 doc/editor_extensions/jetbrains_ide/index.md  |   2 +
 .../jetbrains_troubleshooting.md              |   9 +
 doc/editor_extensions/neovim/index.md         |   2 +
 doc/editor_extensions/visual_studio/index.md  |   1 +
 .../visual_studio_code/index.md               |  77 +++------
 .../visual_studio_code/troubleshooting.md     |   4 +-
 ...dening_operating_system_recommendations.md |   2 +-
 .../index.md                                  |   2 +-
 doc/tutorials/setup_steps/index.md            |   2 +-
 doc/update/versions/gitlab_16_changes.md      |   2 +-
 doc/update/versions/gitlab_17_changes.md      |   4 +
 .../gitlab_advisory_database/index.md         |   2 +-
 .../policies/pipeline_execution_policies.md   |   1 +
 doc/user/profile/notifications.md             |   2 +-
 doc/user/project/code_intelligence.md         |   7 +-
 .../img/code_intelligence_refs_v17_6.png      | Bin 0 -> 10153 bytes
 .../merge_request_troubleshooting.md          |   4 +-
 .../ml/experiment_tracking/mlflow_client.md   |  34 +++-
 lib/api/users.rb                              |   1 +
 .../references/issue_reference_filter.rb      |   3 +-
 .../references/work_item_reference_filter.rb  |   3 +-
 lib/banzai/reference_parser/issue_parser.rb   |   2 +-
 ...sing_external_links_for_vulnerabilities.rb |  12 ++
 lib/gitlab/issues/type_association_getter.rb  |  15 ++
 lib/gitlab/search_results.rb                  |   2 +-
 lib/gitlab/work_items/work_item_hierarchy.rb  |   4 +-
 locale/gitlab.pot                             |  11 +-
 package.json                                  |   2 +-
 scripts/frontend/quarantined_vue3_specs.txt   |   4 -
 spec/features/triggers_spec.rb                |   4 +
 .../atlassian_document_format/emoji.md        |   2 +-
 .../admin_runners/admin_runners_app_spec.js   |  18 +-
 .../group_runners/group_runners_app_spec.js   |  13 +-
 spec/lib/gitlab/current_settings_spec.rb      |   4 +-
 .../importer/gist_importer_spec.rb            |   4 +
 spec/lib/gitlab/gon_helper_spec.rb            |   4 +
 spec/lib/gitlab/import_export/all_models.yml  |   2 +-
 .../issues/type_association_getter_spec.rb    |  19 +++
 ...external_links_for_vulnerabilities_spec.rb |  26 +++
 spec/models/issue_spec.rb                     | 159 ++++++++++++++++--
 spec/models/work_items/type_spec.rb           |   2 -
 .../graphql/mutations/snippets/create_spec.rb |   4 +-
 spec/requests/api/snippets_spec.rb            |  10 +-
 spec/services/snippets/create_service_spec.rb |   6 +-
 .../work_items/update_service_spec.rb         |   3 +
 .../current_organization_context.rb           |   6 +-
 yarn.lock                                     |   8 +-
 90 files changed, 601 insertions(+), 197 deletions(-)
 create mode 100644 config/feature_flags/wip/issues_use_correct_work_item_type_id.yml
 create mode 100644 db/click_house/migrate/main/20241104143552_create_user_add_on_assignments_history.rb
 create mode 100644 db/docs/batched_background_migrations/create_missing_external_links_for_vulnerabilities.yml
 create mode 100644 db/post_migrate/20241024062434_queue_create_missing_external_links_for_vulnerabilities.rb
 create mode 100644 db/schema_migrations/20241024062434
 create mode 100644 doc/user/project/img/code_intelligence_refs_v17_6.png
 create mode 100644 lib/gitlab/background_migration/create_missing_external_links_for_vulnerabilities.rb
 create mode 100644 lib/gitlab/issues/type_association_getter.rb
 create mode 100644 spec/lib/gitlab/issues/type_association_getter_spec.rb
 create mode 100644 spec/migrations/20241024062434_queue_create_missing_external_links_for_vulnerabilities_spec.rb

diff --git a/Gemfile b/Gemfile
index ca4e423a149..6929021b6f1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -247,7 +247,7 @@ gem 'html-pipeline', '~> 2.14.3', feature_category: :markdown
 gem 'deckar01-task_list', '2.3.4', feature_category: :markdown
 gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup', feature_category: :markdown
 gem 'commonmarker', '~> 0.23.10', feature_category: :markdown
-gem 'kramdown', '~> 2.3.1', feature_category: :markdown
+gem 'kramdown', '~> 2.4.0', feature_category: :markdown
 gem 'RedCloth', '~> 4.3.3', feature_category: :markdown
 gem 'org-ruby', '~> 0.9.12', feature_category: :markdown
 gem 'creole', '~> 0.5.0', feature_category: :markdown
diff --git a/Gemfile.checksum b/Gemfile.checksum
index 81f426696d2..d62e27ad335 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -357,7 +357,7 @@
 {"name":"kaminari-activerecord","version":"1.2.2","platform":"ruby","checksum":"0dd3a67bab356a356f36b3b7236bcb81cef313095365befe8e98057dd2472430"},
 {"name":"kaminari-core","version":"1.2.2","platform":"ruby","checksum":"3bd26fec7370645af40ca73b9426a448d09b8a8ba7afa9ba3c3e0d39cdbb83ff"},
 {"name":"knapsack","version":"4.0.0","platform":"ruby","checksum":"a9422688751989d09a40b4bf7f959a71a3bfe7bc49d3cd610c2fcfb6e45482b8"},
-{"name":"kramdown","version":"2.3.2","platform":"ruby","checksum":"cb4530c2e9d16481591df2c9336723683c354e5416a5dd3e447fa48215a6a71c"},
+{"name":"kramdown","version":"2.4.0","platform":"ruby","checksum":"b62e5bcbd6ea20c7a6730ebbb2a107237856e14f29cebf5b10c876cc1a2481c5"},
 {"name":"kramdown-parser-gfm","version":"1.1.0","platform":"ruby","checksum":"fb39745516427d2988543bf01fc4cf0ab1149476382393e0e9c48592f6581729"},
 {"name":"kubeclient","version":"4.11.0","platform":"ruby","checksum":"4985fcd749fb8c364a668a8350a49821647f03aa52d9ee6cbc582beb8e883fcc"},
 {"name":"language_server-protocol","version":"3.17.0.3","platform":"ruby","checksum":"3d5c58c02f44a20d972957a9febe386d7e7468ab3900ce6bd2b563dd910c6b3f"},
diff --git a/Gemfile.lock b/Gemfile.lock
index bf9535fb317..62214da0a90 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1062,7 +1062,7 @@ GEM
     kaminari-core (1.2.2)
     knapsack (4.0.0)
       rake
-    kramdown (2.3.2)
+    kramdown (2.4.0)
       rexml
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
@@ -2142,7 +2142,7 @@ DEPENDENCIES
   jwt (~> 2.9.3)
   kaminari (~> 1.2.2)
   knapsack (~> 4.0.0)
-  kramdown (~> 2.3.1)
+  kramdown (~> 2.4.0)
   kubeclient (~> 4.11.0)
   lefthook (~> 1.7.0)
   letter_opener_web (~> 3.0.0)
diff --git a/Gemfile.next.checksum b/Gemfile.next.checksum
index 183e3a507b8..09dd5d2c1c5 100644
--- a/Gemfile.next.checksum
+++ b/Gemfile.next.checksum
@@ -361,7 +361,7 @@
 {"name":"kaminari-activerecord","version":"1.2.2","platform":"ruby","checksum":"0dd3a67bab356a356f36b3b7236bcb81cef313095365befe8e98057dd2472430"},
 {"name":"kaminari-core","version":"1.2.2","platform":"ruby","checksum":"3bd26fec7370645af40ca73b9426a448d09b8a8ba7afa9ba3c3e0d39cdbb83ff"},
 {"name":"knapsack","version":"4.0.0","platform":"ruby","checksum":"a9422688751989d09a40b4bf7f959a71a3bfe7bc49d3cd610c2fcfb6e45482b8"},
-{"name":"kramdown","version":"2.3.2","platform":"ruby","checksum":"cb4530c2e9d16481591df2c9336723683c354e5416a5dd3e447fa48215a6a71c"},
+{"name":"kramdown","version":"2.4.0","platform":"ruby","checksum":"b62e5bcbd6ea20c7a6730ebbb2a107237856e14f29cebf5b10c876cc1a2481c5"},
 {"name":"kramdown-parser-gfm","version":"1.1.0","platform":"ruby","checksum":"fb39745516427d2988543bf01fc4cf0ab1149476382393e0e9c48592f6581729"},
 {"name":"kubeclient","version":"4.11.0","platform":"ruby","checksum":"4985fcd749fb8c364a668a8350a49821647f03aa52d9ee6cbc582beb8e883fcc"},
 {"name":"language_server-protocol","version":"3.17.0.3","platform":"ruby","checksum":"3d5c58c02f44a20d972957a9febe386d7e7468ab3900ce6bd2b563dd910c6b3f"},
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 8d2508fe98d..91137a4e136 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -1076,7 +1076,7 @@ GEM
     kaminari-core (1.2.2)
     knapsack (4.0.0)
       rake
-    kramdown (2.3.2)
+    kramdown (2.4.0)
       rexml
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
@@ -2169,7 +2169,7 @@ DEPENDENCIES
   jwt (~> 2.9.3)
   kaminari (~> 1.2.2)
   knapsack (~> 4.0.0)
-  kramdown (~> 2.3.1)
+  kramdown (~> 2.4.0)
   kubeclient (~> 4.11.0)
   lefthook (~> 1.7.0)
   letter_opener_web (~> 3.0.0)
diff --git a/app/assets/javascripts/merge_request_dashboard/components/app.vue b/app/assets/javascripts/merge_request_dashboard/components/app.vue
index 16f581ac69e..55d9d1b4d0b 100644
--- a/app/assets/javascripts/merge_request_dashboard/components/app.vue
+++ b/app/assets/javascripts/merge_request_dashboard/components/app.vue
@@ -139,7 +139,7 @@ export default {
                 </div>
               </div>
               <template #pagination>
-                <div v-if="hasNextPage" class="gl-mt-4 gl-flex gl-justify-center">
+                <div v-if="hasNextPage" class="crud-pagination-container gl-flex gl-justify-center">
                   <gl-button :loading="loading" data-testid="load-more" @click="loadMore">{{
                     __('Show more')
                   }}</gl-button>
diff --git a/app/assets/javascripts/merge_request_dashboard/components/collapsible_section.vue b/app/assets/javascripts/merge_request_dashboard/components/collapsible_section.vue
index 1940e45f289..84416e38afe 100644
--- a/app/assets/javascripts/merge_request_dashboard/components/collapsible_section.vue
+++ b/app/assets/javascripts/merge_request_dashboard/components/collapsible_section.vue
@@ -68,7 +68,7 @@ export default {
     is-collapsible
     :collapsed="!open"
     :toggle-aria-label="toggleButtonLabel"
-    :body-class="{ '!gl-mx-0 gl-mb-0': count }"
+    :body-class="{ '!gl-mx-0 gl-mb-0': hasMergeRequests }"
   >
     <template #title>
       {{ title }}
diff --git a/app/assets/stylesheets/framework/crud.scss b/app/assets/stylesheets/framework/crud.scss
index 2b473253b9b..94ecdf5038a 100644
--- a/app/assets/stylesheets/framework/crud.scss
+++ b/app/assets/stylesheets/framework/crud.scss
@@ -92,7 +92,7 @@ $crud-header-min-height: px-to-rem(49px);
 .crud-pagination {
   margin-top: -1px;
 
-  &:not(:has(> .gl-pagination)) {
+  &:not(:has(> .gl-pagination, > .crud-pagination-container)) {
     display: none;
   }
 
diff --git a/app/controllers/concerns/issuable_collections.rb b/app/controllers/concerns/issuable_collections.rb
index c604e343dbd..281aa911490 100644
--- a/app/controllers/concerns/issuable_collections.rb
+++ b/app/controllers/concerns/issuable_collections.rb
@@ -124,7 +124,10 @@ module IssuableCollections
     common_attributes = [:author, :assignees, :labels, :milestone]
     @preload_for_collection ||= case collection_type
                                 when 'Issue'
-                                  common_attributes + [:work_item_type, :project, { project: :namespace }]
+                                  common_attributes + [
+                                    ::Gitlab::Issues::TypeAssociationGetter.call,
+                                    :project, { project: :namespace }
+                                  ]
                                 when 'MergeRequest'
                                   common_attributes + [
                                     :target_project, :latest_merge_request_diff, :approvals, :approved_by_users, :reviewers,
diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 73e98ff6219..5b117233288 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -190,6 +190,7 @@ class RegistrationsController < Devise::RegistrationsController
   end
 
   def check_captcha
+    set_current_organization
     return unless show_recaptcha_sign_up?
     return unless Gitlab::Recaptcha.load_configurations!
 
diff --git a/app/graphql/resolvers/concerns/issues/look_ahead_preloads.rb b/app/graphql/resolvers/concerns/issues/look_ahead_preloads.rb
index cf6fdc12e3b..ac1c4bc91b1 100644
--- a/app/graphql/resolvers/concerns/issues/look_ahead_preloads.rb
+++ b/app/graphql/resolvers/concerns/issues/look_ahead_preloads.rb
@@ -16,7 +16,7 @@ module Issues
           project: [:project_feature, :group]
         },
         :author,
-        :work_item_type
+        ::Gitlab::Issues::TypeAssociationGetter.call
       ]
     end
 
@@ -28,7 +28,7 @@ module Issues
         timelogs: [:timelogs],
         customer_relations_contacts: { customer_relations_contacts: [:group] },
         escalation_status: [:incident_management_issuable_escalation_status],
-        type: :work_item_type
+        type: ::Gitlab::Issues::TypeAssociationGetter.call
       }
     end
   end
diff --git a/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb b/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
index c91a60f723c..27817a43ad3 100644
--- a/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
+++ b/app/graphql/resolvers/concerns/work_items/look_ahead_preloads.rb
@@ -12,9 +12,9 @@ module WorkItems
 
     def preloads
       {
-        work_item_type: :work_item_type,
+        work_item_type: ::Gitlab::Issues::TypeAssociationGetter.call,
         web_url: { namespace: :route, project: [:project_namespace, { namespace: :route }] },
-        widgets: { work_item_type: :enabled_widget_definitions },
+        widgets: { ::Gitlab::Issues::TypeAssociationGetter.call => :enabled_widget_definitions },
         archived: :project
       }
     end
@@ -54,7 +54,7 @@ module WorkItems
           project: [:project_feature, :group]
         },
         :author,
-        :work_item_type,
+        ::Gitlab::Issues::TypeAssociationGetter.call,
         *super
       ]
     end
diff --git a/app/graphql/resolvers/work_items/ancestors_resolver.rb b/app/graphql/resolvers/work_items/ancestors_resolver.rb
index efd01700a31..2608851303c 100644
--- a/app/graphql/resolvers/work_items/ancestors_resolver.rb
+++ b/app/graphql/resolvers/work_items/ancestors_resolver.rb
@@ -57,7 +57,7 @@ module Resolvers
       end
 
       def unconditional_includes
-        [:namespace, :work_item_parent, :work_item_type]
+        [:namespace, :work_item_parent, ::Gitlab::Issues::TypeAssociationGetter.call]
       end
     end
   end
diff --git a/app/models/issue.rb b/app/models/issue.rb
index e4fa7164b62..00c49f93683 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -76,7 +76,13 @@ class Issue < ApplicationRecord
 
   belongs_to :duplicated_to, class_name: 'Issue'
   belongs_to :closed_by, class_name: 'User'
-  belongs_to :work_item_type, class_name: 'WorkItems::Type', inverse_of: :work_items
+  belongs_to :work_item_type, class_name: 'WorkItems::Type'
+
+  # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/499911
+  belongs_to :correct_work_item_type, # rubocop:disable Rails/InverseOf -- Temp association to the same record
+    class_name: 'WorkItems::Type',
+    foreign_key: :correct_work_item_type_id,
+    primary_key: :correct_id
 
   belongs_to :moved_to, class_name: 'Issue', inverse_of: :moved_from
   has_one :moved_from, class_name: 'Issue', foreign_key: :moved_to_id, inverse_of: :moved_to
@@ -195,25 +201,38 @@ class Issue < ApplicationRecord
 
   scope :with_alert_management_alerts, -> { joins(:alert_management_alert) }
   scope :with_api_entity_associations, -> {
-    preload(:work_item_type, :timelogs, :closed_by, :assignees, :author, :labels, :issuable_severity,
-      namespace: [{ parent: :route }, :route], milestone: { project: [:route, { namespace: :route }] },
+    preload(::Gitlab::Issues::TypeAssociationGetter.call,
+      :timelogs, :closed_by, :assignees, :author, :issuable_severity,
+      :labels, namespace: [{ parent: :route }, :route], milestone: { project: [:route, { namespace: :route }] },
       project: [:project_namespace, :project_feature, :route, { group: :route }, { namespace: :route }],
-      duplicated_to: { project: [:project_feature] })
+      duplicated_to: { project: [:project_feature] }
+    )
   }
   scope :with_issue_type, ->(types) {
     types = Array(types)
 
-    # Using != 1 since we also want the guard clause to handle empty arrays
-    return joins(:work_item_type).where(work_item_types: { base_type: types }) if types.size != 1
+    if Feature.enabled?(:issues_use_correct_work_item_type_id, :instance)
+      # Using != 1 since we also want the guard clause to handle empty arrays
+      return joins(:correct_work_item_type).where(work_item_types: { base_type: types }) if types.size != 1
 
-    # This optimization helps the planer use the correct indexes when filtering by a single type
-    where(
-      '"issues"."work_item_type_id" = (?)',
-      WorkItems::Type.by_type(types.first).select(:id).limit(1)
-    )
+      # This optimization helps the planer use the correct indexes when filtering by a single type
+      where(
+        '"issues"."correct_work_item_type_id" = (?)',
+        WorkItems::Type.by_type(types.first).select(:correct_id).limit(1)
+      )
+    else
+      # Using != 1 since we also want the guard clause to handle empty arrays
+      return joins(:work_item_type).where(work_item_types: { base_type: types }) if types.size != 1
+
+      # This optimization helps the planer use the correct indexes when filtering by a single type
+      where(
+        '"issues"."work_item_type_id" = (?)',
+        WorkItems::Type.by_type(types.first).select(:id).limit(1)
+      )
+    end
   }
   scope :without_issue_type, ->(types) {
-    joins(:work_item_type).where.not(work_item_types: { base_type: types })
+    joins(::Gitlab::Issues::TypeAssociationGetter.call).where.not(work_item_types: { base_type: types })
   }
 
   scope :public_only, -> { where(confidential: false) }
@@ -255,7 +274,9 @@ class Issue < ApplicationRecord
   scope :with_non_null_relative_position, -> { where.not(relative_position: nil) }
   scope :with_projects_matching_search_data, -> { where('issue_search_data.project_id = issues.project_id') }
 
-  scope :with_work_item_type, -> { joins(:work_item_type) }
+  scope :with_work_item_type, -> {
+    joins(::Gitlab::Issues::TypeAssociationGetter.call)
+  }
 
   before_validation :ensure_namespace_id, :ensure_work_item_type
 
@@ -336,6 +357,25 @@ class Issue < ApplicationRecord
     [:assignees] + super
   end
 
+  # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/499911
+  def work_item_type
+    return correct_work_item_type if Feature.enabled?(:issues_use_correct_work_item_type_id, :instance)
+
+    super
+  end
+
+  def work_item_type_id=(work_item_type_id)
+    self.correct_work_item_type_id = WorkItems::Type.find_by(id: work_item_type_id)&.correct_id
+
+    super
+  end
+
+  def work_item_type=(work_item_type)
+    self.correct_work_item_type = work_item_type
+
+    super
+  end
+
   def next_object_by_relative_position(ignoring: nil, order: :asc)
     array_mapping_scope = ->(id_expression) do
       relation = Issue.where(Issue.arel_table[:project_id].eq(id_expression))
diff --git a/app/models/work_item.rb b/app/models/work_item.rb
index 8f163e0ad54..cd7157fd002 100644
--- a/app/models/work_item.rb
+++ b/app/models/work_item.rb
@@ -31,7 +31,9 @@ class WorkItem < Issue
     through: :child_links, class_name: 'WorkItem',
     foreign_key: :work_item_id, source: :work_item
 
-  scope :inc_relations_for_permission_check, -> { includes(:author, :work_item_type, project: :project_feature) }
+  scope :inc_relations_for_permission_check, -> {
+    includes(:author, ::Gitlab::Issues::TypeAssociationGetter.call, project: :project_feature)
+  }
 
   class << self
     def find_by_namespace_and_iid!(namespace, iid)
@@ -233,13 +235,17 @@ class WorkItem < Issue
   end
 
   def max_depth_reached?(child_type)
+    # Using the association here temporarily. We should use the `work_item_type_id` column value after the cleanup
+    # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/499911
     restriction = ::WorkItems::HierarchyRestriction.find_by_parent_type_id_and_child_type_id(
-      work_item_type_id,
+      work_item_type.id,
       child_type.id
     )
     return false unless restriction&.maximum_depth
 
-    if work_item_type_id == child_type.id
+    # Using the association here temporarily. We should use the `work_item_type_id` column value after the cleanup
+    # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/499911
+    if work_item_type.id == child_type.id
       same_type_base_and_ancestors.count >= restriction.maximum_depth
     else
       hierarchy(different_type_id: child_type.id).base_and_ancestors.count >= restriction.maximum_depth
@@ -266,9 +272,10 @@ class WorkItem < Issue
   end
 
   def hierarchy(options = {})
+    type_column_name = :"#{::Gitlab::Issues::TypeAssociationGetter.call}_id"
     base = self.class.where(id: id)
-    base = base.where(work_item_type_id: work_item_type_id) if options[:same_type]
-    base = base.where(work_item_type_id: options[:different_type_id]) if options[:different_type_id]
+    base = base.where(type_column_name => attributes[type_column_name.to_s]) if options[:same_type]
+    base = base.where(type_column_name => options[:different_type_id]) if options[:different_type_id]
 
     ::Gitlab::WorkItems::WorkItemHierarchy.new(base, options: options)
   end
@@ -305,7 +312,9 @@ class WorkItem < Issue
   def validate_child_restrictions(child_links)
     return if child_links.empty?
 
-    child_type_ids = child_links.joins(:work_item).select(self.class.arel_table[:work_item_type_id]).distinct
+    type_id_column = :"#{::Gitlab::Issues::TypeAssociationGetter.call}_id"
+
+    child_type_ids = child_links.joins(:work_item).select(self.class.arel_table[type_id_column]).distinct
     restrictions = ::WorkItems::HierarchyRestriction.where(
       parent_type_id: work_item_type_id,
       child_type_id: child_type_ids
diff --git a/app/models/work_items/type.rb b/app/models/work_items/type.rb
index 0c8c2fa6743..2bf41c206d8 100644
--- a/app/models/work_items/type.rb
+++ b/app/models/work_items/type.rb
@@ -60,7 +60,6 @@ module WorkItems
 
     enum base_type: BASE_TYPES.transform_values { |value| value[:enum_value] }
 
-    has_many :work_items, class_name: 'Issue', foreign_key: :work_item_type_id, inverse_of: :work_item_type
     has_many :widget_definitions, foreign_key: :work_item_type_id, inverse_of: :work_item_type
     has_many :enabled_widget_definitions, -> { where(disabled: false) }, foreign_key: :work_item_type_id,
       inverse_of: :work_item_type, class_name: 'WorkItems::WidgetDefinition'
diff --git a/app/models/work_items/widgets/hierarchy.rb b/app/models/work_items/widgets/hierarchy.rb
index ff5de8f0bb0..d32eca87f07 100644
--- a/app/models/work_items/widgets/hierarchy.rb
+++ b/app/models/work_items/widgets/hierarchy.rb
@@ -56,8 +56,15 @@ module WorkItems
       private
 
       def counts_by_state(work_item_type)
-        open_count = counts_by_type_and_state.fetch([work_item_type.id, WorkItem.available_states[:opened]], 0)
-        closed_count = counts_by_type_and_state.fetch([work_item_type.id, WorkItem.available_states[:closed]], 0)
+        type_id_column = Feature.enabled?(:issues_use_correct_work_item_type_id, :instance) ? 'correct_id' : 'id'
+        open_count = counts_by_type_and_state.fetch(
+          [work_item_type.attributes[type_id_column], WorkItem.available_states[:opened]],
+          0
+        )
+        closed_count = counts_by_type_and_state.fetch(
+          [work_item_type.attributes[type_id_column], WorkItem.available_states[:closed]],
+          0
+        )
 
         {
           all: open_count + closed_count,
@@ -68,7 +75,7 @@ module WorkItems
 
       def counts_by_type_and_state
         work_item.descendants
-          .group(:work_item_type_id, :state_id)
+          .group(:"#{::Gitlab::Issues::TypeAssociationGetter.call}_id", :state_id)
           .count
       end
       strong_memoize_attr :counts_by_type_and_state
diff --git a/app/services/issues/export_csv_service.rb b/app/services/issues/export_csv_service.rb
index 538208ce29b..f65ab32d6a4 100644
--- a/app/services/issues/export_csv_service.rb
+++ b/app/services/issues/export_csv_service.rb
@@ -18,7 +18,14 @@ module Issues
     private
 
     def associations_to_preload
-      [:work_item_type, :author, :assignees, :timelogs, :milestone, { project: { namespace: :route } }]
+      [
+        ::Gitlab::Issues::TypeAssociationGetter.call,
+        :author,
+        :assignees,
+        :timelogs,
+        :milestone,
+        { project: { namespace: :route } }
+      ]
     end
 
     def header_to_value_hash
diff --git a/app/services/work_items/export_csv_service.rb b/app/services/work_items/export_csv_service.rb
index 74bc1f526bf..fe5cb08bf3b 100644
--- a/app/services/work_items/export_csv_service.rb
+++ b/app/services/work_items/export_csv_service.rb
@@ -17,7 +17,7 @@ module WorkItems
     private
 
     def associations_to_preload
-      [:project, [work_item_type: :enabled_widget_definitions], :author]
+      [:project, [::Gitlab::Issues::TypeAssociationGetter.call => :enabled_widget_definitions], :author]
     end
 
     def header_to_value_hash
diff --git a/config/feature_flags/wip/issues_use_correct_work_item_type_id.yml b/config/feature_flags/wip/issues_use_correct_work_item_type_id.yml
new file mode 100644
index 00000000000..75044c68012
--- /dev/null
+++ b/config/feature_flags/wip/issues_use_correct_work_item_type_id.yml
@@ -0,0 +1,9 @@
+---
+name: issues_use_correct_work_item_type_id
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/493976
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169798
+rollout_issue_url:
+milestone: '17.6'
+group: group::project management
+type: wip
+default_enabled: false
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 2218f42b07a..ac752da9e52 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -919,6 +919,9 @@ Gitlab.ee do
   Settings.cron_jobs['click_house_events_sync_worker'] ||= {}
   Settings.cron_jobs['click_house_events_sync_worker']['cron'] ||= "*/3 * * * *"
   Settings.cron_jobs['click_house_events_sync_worker']['job_class'] = 'ClickHouse::EventsSyncWorker'
+  Settings.cron_jobs['click_house_user_add_on_assignments_sync_worker'] ||= {}
+  Settings.cron_jobs['click_house_user_add_on_assignments_sync_worker']['cron'] = "*/3 * * * *"
+  Settings.cron_jobs['click_house_user_add_on_assignments_sync_worker']['job_class'] = 'ClickHouse::UserAddOnAssignmentsSyncWorker'
   Settings.cron_jobs['click_house_event_authors_consistency_cron_worker'] ||= {}
   Settings.cron_jobs['click_house_event_authors_consistency_cron_worker']['cron'] ||= "*/30 * * * *"
   Settings.cron_jobs['click_house_event_authors_consistency_cron_worker']['job_class'] = 'ClickHouse::EventAuthorsConsistencyCronWorker'
diff --git a/db/click_house/migrate/main/20241104143552_create_user_add_on_assignments_history.rb b/db/click_house/migrate/main/20241104143552_create_user_add_on_assignments_history.rb
new file mode 100644
index 00000000000..cec32ae38d7
--- /dev/null
+++ b/db/click_house/migrate/main/20241104143552_create_user_add_on_assignments_history.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+class CreateUserAddOnAssignmentsHistory < ClickHouse::Migration
+  def up
+    execute <<~SQL
+      CREATE TABLE IF NOT EXISTS user_add_on_assignments_history
+      (
+        assignment_id UInt64,
+        namespace_path String DEFAULT '0/',
+        user_id UInt64,
+        purchase_id UInt64,
+        add_on_name String,
+        assigned_at DateTime64(6, 'UTC'),
+        revoked_at Nullable(DateTime64(6, 'UTC'))
+      )
+      ENGINE = ReplacingMergeTree(assignment_id)
+      PARTITION BY toYear(assigned_at)
+      ORDER BY (namespace_path, assigned_at, user_id)
+    SQL
+  end
+
+  def down
+    execute <<~SQL
+      DROP TABLE IF EXISTS user_add_on_assignments_history
+    SQL
+  end
+end
diff --git a/db/docs/batched_background_migrations/create_missing_external_links_for_vulnerabilities.yml b/db/docs/batched_background_migrations/create_missing_external_links_for_vulnerabilities.yml
new file mode 100644
index 00000000000..1b0cacaa973
--- /dev/null
+++ b/db/docs/batched_background_migrations/create_missing_external_links_for_vulnerabilities.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: CreateMissingExternalLinksForVulnerabilities
+description: Creates missing ExternalIssueLinks for Vulnerabilities
+feature_category: vulnerability_management
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167564
+milestone: '17.6'
+queued_migration_version: 20241024062434
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/post_migrate/20241024062434_queue_create_missing_external_links_for_vulnerabilities.rb b/db/post_migrate/20241024062434_queue_create_missing_external_links_for_vulnerabilities.rb
new file mode 100644
index 00000000000..fc6ab237bec
--- /dev/null
+++ b/db/post_migrate/20241024062434_queue_create_missing_external_links_for_vulnerabilities.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class QueueCreateMissingExternalLinksForVulnerabilities < Gitlab::Database::Migration[2.2]
+  milestone '17.6'
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "CreateMissingExternalLinksForVulnerabilities"
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 1000
+  SUB_BATCH_SIZE = 100
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :project_settings,
+      :project_id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :project_settings, :project_id, [])
+  end
+end
diff --git a/db/schema_migrations/20241024062434 b/db/schema_migrations/20241024062434
new file mode 100644
index 00000000000..ac38eac53ed
--- /dev/null
+++ b/db/schema_migrations/20241024062434
@@ -0,0 +1 @@
+76be0a005d68f63c00fb2b8006e3a112b2e00756d1bd06c7ea5ceb95b3c0abcf
\ No newline at end of file
diff --git a/doc/administration/instance_limits.md b/doc/administration/instance_limits.md
index 2f612582d0c..eeaa4c643f5 100644
--- a/doc/administration/instance_limits.md
+++ b/doc/administration/instance_limits.md
@@ -29,7 +29,7 @@ Depending on which limits you have configured, you can see:
 - Size limits
 
 Because this page is visible to everybody, unauthenticated users only see the
-the information that is relevant to them.
+information that is relevant to them.
 
 To visit the instance configuration page:
 
diff --git a/doc/administration/reference_architectures/10k_users.md b/doc/administration/reference_architectures/10k_users.md
index 039dcd5e9d8..afe433e7925 100644
--- a/doc/administration/reference_architectures/10k_users.md
+++ b/doc/administration/reference_architectures/10k_users.md
@@ -1385,7 +1385,7 @@ To configure the Praefect nodes, on each one:
 
 1. SSH in to the Praefect server.
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page.
 1. Edit the `/etc/gitlab/gitlab.rb` file to configure Praefect:
 
diff --git a/doc/administration/reference_architectures/25k_users.md b/doc/administration/reference_architectures/25k_users.md
index 3342d64dd66..70ecd742845 100644
--- a/doc/administration/reference_architectures/25k_users.md
+++ b/doc/administration/reference_architectures/25k_users.md
@@ -1391,7 +1391,7 @@ To configure the Praefect nodes, on each one:
 
 1. SSH in to the Praefect server.
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page.
 1. Edit the `/etc/gitlab/gitlab.rb` file to configure Praefect:
 
@@ -1551,7 +1551,7 @@ The following IPs will be used as an example:
 On each node:
 
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page, and _do not_ provide the `EXTERNAL_URL` value.
 1. Edit the Gitaly server node's `/etc/gitlab/gitlab.rb` file to configure
    storage paths, enable the network listener, and to configure the token:
diff --git a/doc/administration/reference_architectures/2k_users.md b/doc/administration/reference_architectures/2k_users.md
index 3d6c1ec1d15..e3d56ee09c7 100644
--- a/doc/administration/reference_architectures/2k_users.md
+++ b/doc/administration/reference_architectures/2k_users.md
@@ -461,7 +461,7 @@ installation has two repository storages: `default` and `storage1`.
 To configure the Gitaly server, on the server node you want to use for Gitaly:
 
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page, and _do not_ provide the `EXTERNAL_URL` value.
 1. Edit the Gitaly server node's `/etc/gitlab/gitlab.rb` file to configure
    storage paths, enable the network listener, and to configure the token:
diff --git a/doc/administration/reference_architectures/3k_users.md b/doc/administration/reference_architectures/3k_users.md
index f25e0db7266..20728bb6c4c 100644
--- a/doc/administration/reference_architectures/3k_users.md
+++ b/doc/administration/reference_architectures/3k_users.md
@@ -1381,7 +1381,7 @@ The following IPs will be used as an example:
 On each node:
 
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page, and _do not_ provide the `EXTERNAL_URL` value.
 1. Edit the Gitaly server node's `/etc/gitlab/gitlab.rb` file to configure
    storage paths, enable the network listener, and to configure the token:
diff --git a/doc/administration/reference_architectures/5k_users.md b/doc/administration/reference_architectures/5k_users.md
index a19f101fd61..91e074b9552 100644
--- a/doc/administration/reference_architectures/5k_users.md
+++ b/doc/administration/reference_architectures/5k_users.md
@@ -1625,7 +1625,7 @@ To configure the Sidekiq nodes, on each one:
    ```
 
 1. [Download and install](https://about.gitlab.com/install/) the Linux package
-   package of your choice. Be sure to follow _only_ installation steps 1 and 2
+   of your choice. Be sure to follow _only_ installation steps 1 and 2
    on the page.
 1. Create or edit `/etc/gitlab/gitlab.rb` and use the following configuration:
 
diff --git a/doc/administration/reference_architectures/index.md b/doc/administration/reference_architectures/index.md
index 0043906a165..ca72be46c40 100644
--- a/doc/administration/reference_architectures/index.md
+++ b/doc/administration/reference_architectures/index.md
@@ -811,7 +811,7 @@ You should take an iterative approach when scaling downwards, to ensure there ar
 
 #### Scaling knock on effects
 
-In some cases, scaling a component significantly may result in knock on effects for downstream components, impacting performance. The architectures are designed with balance in mind to ensure components that depend on each other are congruent in terms of specifications. Notably scaling a component may result in additional throughput being passed to the other components it depends on. As as result, they may need to be scaled as well.
+In some cases, scaling a component significantly may result in knock on effects for downstream components, impacting performance. The architectures are designed with balance in mind to ensure components that depend on each other are congruent in terms of specifications. Notably scaling a component may result in additional throughput being passed to the other components it depends on. As a result, they may need to be scaled as well.
 
 NOTE:
 The architectures have been designed to have elasticity to accommodate an upstream component being scaled. However, reach out to our [Support team](https://about.gitlab.com/support/) before you make any significant changes to your environment to be safe.
diff --git a/doc/administration/reply_by_email.md b/doc/administration/reply_by_email.md
index a3b9db7b110..04c03d17ac5 100644
--- a/doc/administration/reply_by_email.md
+++ b/doc/administration/reply_by_email.md
@@ -27,35 +27,29 @@ Replying by email happens in three steps:
 
 ### GitLab sends a notification email
 
-When GitLab sends a notification and Reply by email is active, the `Reply-To`
-header is set to the address defined in your GitLab configuration, with the
-`%{key}` placeholder (if present) replaced by a specific reply key. In
-addition, this reply key is also added to the `References` header.
+When GitLab sends a notification email:
+
+- The `Reply-To` header is set to your configured email address.
+- If the address contains a `%{key}` placeholder, it's replaced with a specific reply key.
+- The reply key is added to the `References` header.
 
 ### You reply to the notification email
 
 When you reply to the notification email, your email client:
 
-- Sends the email to the `Reply-To` address it got from the notification email
+- Sends the email to the `Reply-To` address it got from the notification email.
 - Sets the `In-Reply-To` header to the value of the `Message-ID` header from the
-  notification email
+  notification email.
 - Sets the `References` header to the value of the `Message-ID` plus the value of
   the notification email's `References` header.
 
 ### GitLab receives your reply to the notification email
 
 When GitLab receives your reply, it looks for the reply key in the
-following headers, in this order:
+[list of accepted headers](incoming_email.md#accepted-headers).
 
-1. `To` header
-1. `References` header
-1. `Delivered-To` header
-1. `Envelope-To` header
-1. `X-Envelope-To` header
-1. `Received` header
+If a reply key is found, your response appears as a comment on the relevant issue,
+merge request, commit, or other item that triggered the notification.
 
-If it finds a reply key, it leaves your reply as a comment on
-the entity the notification was about (issue, merge request, commit...).
-
-For more details about the `Message-ID`, `In-Reply-To`, and `References headers`,
+For more information about the `Message-ID`, `In-Reply-To`, and `References` headers,
 see [RFC 5322](https://www.rfc-editor.org/rfc/rfc5322#section-3.6.4).
diff --git a/doc/ci/examples/end_to_end_testing_webdriverio/index.md b/doc/ci/examples/end_to_end_testing_webdriverio/index.md
index edda6f84c25..2fe27c5507d 100644
--- a/doc/ci/examples/end_to_end_testing_webdriverio/index.md
+++ b/doc/ci/examples/end_to_end_testing_webdriverio/index.md
@@ -158,7 +158,7 @@ to interact with your application, so we need to install and run them.
 Furthermore, WebdriverIO uses Selenium as a common interface to control different browsers,
 so we need to install and run Selenium as well. Luckily, the Selenium project provides the Docker images for Firefox
 [standalone-firefox](https://hub.docker.com/r/selenium/standalone-firefox/) and
-and for Chrome [standalone-chrome](https://hub.docker.com/r/selenium/standalone-chrome/).
+for Chrome [standalone-chrome](https://hub.docker.com/r/selenium/standalone-chrome/).
 (Since Safari and Internet Explorer/Edge are not open source and
 not available for Linux, we are unfortunately unable to use those in GitLab CI/CD).
 
diff --git a/doc/ci/yaml/workflow.md b/doc/ci/yaml/workflow.md
index a783336c689..7c6cfb05051 100644
--- a/doc/ci/yaml/workflow.md
+++ b/doc/ci/yaml/workflow.md
@@ -189,7 +189,7 @@ include:
 The [`MergeRequest-Pipelines` template](https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/gitlab/ci/templates/Workflows/MergeRequest-Pipelines.gitlab-ci.yml)
 makes your pipelines run for the default branch, tags, and
 all types of merge request pipelines. Use this template if you use any of the
-the [merge request pipelines features](../pipelines/merge_request_pipelines.md).
+[merge request pipelines features](../pipelines/merge_request_pipelines.md).
 
 To [include](index.md#include) it:
 
diff --git a/doc/development/ai_features/index.md b/doc/development/ai_features/index.md
index d2486d08618..a94da1a6133 100644
--- a/doc/development/ai_features/index.md
+++ b/doc/development/ai_features/index.md
@@ -915,7 +915,7 @@ Documentation of model changes is crucial for tracking the impact of migrations
 - **Optional** - Investigate if the new model is supported within our current AI-Gateway API specification. This step can usually be skipped. However, sometimes to support a newer model, we may need to accommodate a new API format.
 - Add the new model to our [available models list](https://gitlab.com/gitlab-org/gitlab/-/blob/32fa9eaa3c8589ee7f448ae683710ec7bd82f36c/ee/lib/gitlab/llm/concerns/available_models.rb#L5-10).
 - Change the default model in our [AI-Gateway client](https://gitlab.com/gitlab-org/gitlab/-/blob/41361629b302f2c55e35701d2c0a73cff32f9013/ee/lib/gitlab/llm/chain/requests/ai_gateway.rb#L63-67). Please place the change around a feature flag. We may need to quickly rollback the change.
-- Update the model definitions in AI Gateway following the [agent definition guidelines](#2-create-a-prompt-definition-in-the-ai-gateway)
+- Update the model definitions in AI Gateway following the [prompt definition guidelines](#2-create-a-prompt-definition-in-the-ai-gateway)
 Note: While we're moving toward AI Gateway holding the prompts, feature flag implementation still requires a GitLab release.
 
 #### Migration Tasks for Vertex Models
diff --git a/doc/development/code_review.md b/doc/development/code_review.md
index 0bdb009d2d8..ed2ba55dded 100644
--- a/doc/development/code_review.md
+++ b/doc/development/code_review.md
@@ -440,7 +440,7 @@ consistency, and readability.
 
 Because a maintainer's job only depends on their knowledge of the overall GitLab
 codebase, and not that of any specific domain, they can review, approve, and merge
-merge requests from any team and in any product area.
+MRs from any team and in any product area.
 
 Maintainers are the DRI of assuring that the acceptance criteria of a merge request are reasonably met.
 In general, [quality is everyone's responsibility](https://handbook.gitlab.com/handbook/engineering/quality/),
diff --git a/doc/development/database/loose_foreign_keys.md b/doc/development/database/loose_foreign_keys.md
index d7c480df338..7ce6a7e6584 100644
--- a/doc/development/database/loose_foreign_keys.md
+++ b/doc/development/database/loose_foreign_keys.md
@@ -377,7 +377,7 @@ end
 ```
 
 This endpoint still works when the parent `Project` model is deleted. This can be considered a
-a data leak which should not happen under typical circumstances:
+data leak which should not happen under typical circumstances:
 
 ```ruby
 def show
diff --git a/doc/development/database/understanding_explain_plans.md b/doc/development/database/understanding_explain_plans.md
index 52f3eec1aff..2b2cc300180 100644
--- a/doc/development/database/understanding_explain_plans.md
+++ b/doc/development/database/understanding_explain_plans.md
@@ -260,7 +260,7 @@ states the following on bitmap scans:
 
 > Bitmap Index Scan delivers a bitmap of potential tuple locations; it does not
 > access the heap itself. The bitmap is used by an ancestor Bitmap Heap Scan
-> node, possibly after passing through intermediate Bitmap And and/or Bitmap Or
+> node, possibly after passing through intermediate Bitmap Or and/or Bitmap And
 > nodes to combine it with the results of other Bitmap Index Scans.
 
 ### Limit
diff --git a/doc/development/documentation/styleguide/index.md b/doc/development/documentation/styleguide/index.md
index 60cc312fe61..722e9ccb6e3 100644
--- a/doc/development/documentation/styleguide/index.md
+++ b/doc/development/documentation/styleguide/index.md
@@ -1394,7 +1394,7 @@ To create a diagram, use [Mermaid](https://mermaid.js.org/#/), which has the fol
 - The diagram is rendered as a scalable image, better suited to various output devices and sizes.
 
 To learn how to create diagrams with the [Mermaid syntax](https://mermaid.js.org/intro/syntax-reference.html),
-see the Mermaid [Mermaid user guide](https://mermaid.js.org/intro/getting-started.html)
+see the [Mermaid user guide](https://mermaid.js.org/intro/getting-started.html)
 and the examples on the Mermaid site.
 
 #### Guidelines
diff --git a/doc/development/ee_features.md b/doc/development/ee_features.md
index a94e99aec3e..291869e922c 100644
--- a/doc/development/ee_features.md
+++ b/doc/development/ee_features.md
@@ -621,7 +621,7 @@ file located in `ee/config/routes/admin.rb`.
 
 In EE, it should at least load one file, at most two files. If it cannot find
 any files, an error is raised. In CE, since we don't know if an
-an EE route exists, it doesn't raise any errors even if it cannot find anything.
+EE route exists, it doesn't raise any errors even if it cannot find anything.
 
 This means if we want to extend a particular CE route file, just add the same
 file located in `ee/config/routes`. If we want to add an EE only route, we
diff --git a/doc/development/integrations/index.md b/doc/development/integrations/index.md
index 85888f10145..e8933a0b21d 100644
--- a/doc/development/integrations/index.md
+++ b/doc/development/integrations/index.md
@@ -107,7 +107,7 @@ The following events are supported for integrations:
 
 | Event type                                                                                     | Default | Value                | Trigger |
 |:-----------------------------------------------------------------------------------------------|:--------|:---------------------|:--|
-| Alert event                                                                                    |         | `alert`              | A a new, unique alert is recorded. |
+| Alert event                                                                                    |         | `alert`              | A new, unique alert is recorded. |
 | Commit event                                                                                   | ✓       | `commit`             | A commit is created or updated. |
 | [Deployment event](../../user/project/integrations/webhook_events.md#deployment-events)        |         | `deployment`         | A deployment starts or finishes. |
 | [Work item event](../../user/project/integrations/webhook_events.md#work-item-events)          | ✓       | `issue`              | An issue is created, updated, or closed. |
diff --git a/doc/development/migration_style_guide.md b/doc/development/migration_style_guide.md
index a442ccd0a43..ab7151fe66d 100644
--- a/doc/development/migration_style_guide.md
+++ b/doc/development/migration_style_guide.md
@@ -762,7 +762,7 @@ timeout after failing to acquire the lock within the specified time period
 and allow other transactions to proceed:
 
 ```sql
--- Transaction 2 (version with with lock timeout)
+-- Transaction 2 (version with lock timeout)
 BEGIN;
 SET LOCAL lock_timeout to '100ms'; -- added by the lock retry helper.
 ALTER TABLE my_notes ADD COLUMN title text;
diff --git a/doc/editor_extensions/jetbrains_ide/index.md b/doc/editor_extensions/jetbrains_ide/index.md
index fce555826c8..8bb1a15e056 100644
--- a/doc/editor_extensions/jetbrains_ide/index.md
+++ b/doc/editor_extensions/jetbrains_ide/index.md
@@ -176,6 +176,8 @@ built-in error reporting tool:
 ## Related topics
 
 - [Code Suggestions](../../user/project/repository/code_suggestions/index.md)
+- [JetBrains troubleshooting](jetbrains_troubleshooting.md)
+- [GitLab Language Server documentation](../language_server/index.md)
 - [About the Create:Editor Extensions Group](https://handbook.gitlab.com/handbook/engineering/development/dev/create/editor-extensions/)
 - [Open issues for this plugin](https://gitlab.com/gitlab-org/editor-extensions/gitlab-jetbrains-plugin/-/issues/)
 - [Plugin documentation](https://gitlab.com/gitlab-org/editor-extensions/gitlab-jetbrains-plugin/-/blob/main/README.md)
diff --git a/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md b/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
index 53bdfdfdc2f..e5f4a4c630d 100644
--- a/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
+++ b/doc/editor_extensions/jetbrains_ide/jetbrains_troubleshooting.md
@@ -32,6 +32,15 @@ To enable GitLab Language Server debug logs:
 
 The debug logs are available in the `idea.log` log file.
 
+## Use an HTTP proxy
+
+If you experience [certificate errors](#certificate-errors) or other connection errors, and
+use a HTTP proxy to connect to your GitLab instance, you must
+[configure the Language Server to use a proxy](../language_server/index.md#configure-the-language-server-to-use-a-proxy)
+for the GitLab Language Server.
+
+You can also [enable proxy authentication](../language_server/index.md#enable-proxy-authentication).
+
 ## Error: `unable to find valid certification path to requested target`
 
 The GitLab Duo plugin verifies TLS certificate information before connecting to your GitLab instance.
diff --git a/doc/editor_extensions/neovim/index.md b/doc/editor_extensions/neovim/index.md
index 4cea47a0363..4a35a7824ce 100644
--- a/doc/editor_extensions/neovim/index.md
+++ b/doc/editor_extensions/neovim/index.md
@@ -169,4 +169,6 @@ rm ~/.local/share/nvim/gitlab-code-suggestions-language-server-*
 
 ## Related topics
 
+- [Neovim troubleshooting](neovim_troubleshooting.md)
 - [View source code](https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim)
+- [GitLab Language Server documentation](../language_server/index.md)
diff --git a/doc/editor_extensions/visual_studio/index.md b/doc/editor_extensions/visual_studio/index.md
index 36706e526e8..12f96cc3d6d 100644
--- a/doc/editor_extensions/visual_studio/index.md
+++ b/doc/editor_extensions/visual_studio/index.md
@@ -72,6 +72,7 @@ Report any issues, bugs, or feature requests in the
 - [About the Create:Editor Extensions Group](https://handbook.gitlab.com/handbook/engineering/development/dev/create/editor-extensions/)
 - [Open issues for this plugin](https://gitlab.com/gitlab-org/editor-extensions/gitlab-visual-studio-extension/-/issues/)
 - [View source code](https://gitlab.com/gitlab-org/editor-extensions/gitlab-visual-studio-extension)
+- [GitLab Language Server documentation](../language_server/index.md)
 
 ## Troubleshooting
 
diff --git a/doc/editor_extensions/visual_studio_code/index.md b/doc/editor_extensions/visual_studio_code/index.md
index eac2574fc3b..31840dac458 100644
--- a/doc/editor_extensions/visual_studio_code/index.md
+++ b/doc/editor_extensions/visual_studio_code/index.md
@@ -10,48 +10,38 @@ description: "Use the GitLab Workflow extension for VS Code to handle common Git
 The [GitLab Workflow extension](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow)
 for Visual Studio Code integrates GitLab Duo and other GitLab features directly into your IDE.
 
-The GitLab Workflow extension streamlines your VS Code workflow with AI-assisted features:
+This extension brings the GitLab features you use every day directly into your VS Code environment:
 
-- **GitLab Duo Chat**: Interact with an AI assistant directly in VS Code. See
-  [how to set up GitLab Duo Chat](../../user/gitlab_duo_chat/index.md#use-gitlab-duo-chat-in-vs-code).
-- [**GitLab Duo Code Suggestions**](#code-suggestions-features): Suggest completions to your current line of code,
-  or write natural-language code comments to get more substantive suggestions.
+- [View issues](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#browse-issues-review-mrs) and merge requests.
+- Run [common commands](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#commands)
+  from the Visual Studio Code [Command Palette](https://code.visualstudio.com/docs/getstarted/userinterface#_command-palette).
+- Create and [review](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#merge-request-reviews)
+  merge requests.
+- [Validate your GitLab CI/CD configuration](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#validate-gitlab-cicd-configuration).
+- View [pipeline status](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#information-about-your-branch-pipelines-mr-closing-issue) and
+  [job outputs](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#view-the-job-output).
+- [Create](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#create-snippet) and manage snippets.
+- [Browse repositories](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#browse-a-repository-without-cloning)
+  without cloning them.
+- [View security findings](https://marketplace.visualstudio.com/items?itemName=gitlab.gitlab-workflow#security-findings).
 
-## Code Suggestions features
+For detailed information on these features, refer to the [GitLab Workflow extension documentation](https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/blob/main/README.md).
 
-GitLab Duo Code Suggestions provides AI-powered suggestions as you type in VS Code, helping you write code more efficiently.
-To interact with a [suggestion](../../user/project/repository/code_suggestions/index.md) on the current line:
+The GitLab Workflow extension also streamlines your VS Code workflow with AI-assisted features:
 
-- To accept the entire suggestion, press <kbd>Tab</kbd>.
-- To accept the suggestion word-by-word, press <kbd>Command</kbd> + <kbd>→</kbd> (right arrow).
-- To accept an entire line, right-click and select **Accept Line**.
-
-GitLab Duo can also generate code based on comments in the file you're editing in VS Code. When you write comments in a
-[supported file type](https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/tree/main/vendor/grammars?ref_type=heads),
-use natural language to describe what you want the code to do. Press <kbd>Enter</kbd> to see suggestions from
-GitLab Duo inline in your current file.
-
-To learn more, see the [documentation for Code Suggestions](../../user/project/repository/code_suggestions/index.md).
-
-### Configure more languages for Code Suggestions
-
-To add more languages to Code Suggestions:
-
-1. Find your desired language in the list of
-   [language identifiers](https://code.visualstudio.com/docs/languages/identifiers#_known-language-identifiers)
-   for VS Code. You need the **Identifier** for a later step.
-1. In VS Code, open the extension settings for **GitLab Workflow**:
-   1. On the top bar, go to **Code > Settings > Extensions**.
-   1. Search for **GitLab Workflow** in the list, then select **Manage** (**{settings}**) **> Extension Settings**.
-   1. In your **User** settings, find
-      **GitLab › Duo Code Suggestions: Additional Languages** and select **Add Item**.
-1. In **Item**, add the language identifier, and select **OK**.
+- [**GitLab Duo Chat**](../../user/gitlab_duo_chat/index.md#use-gitlab-duo-chat-in-vs-code):
+  Interact with an AI assistant directly in VS Code.
+- [**GitLab Duo Code Suggestions**](../../user/project/repository/code_suggestions/index.md):
+  Suggest completions to your current line of code, or write natural-language code comments to get
+  more substantive suggestions.
 
 ## Set up the GitLab Workflow extension
 
 This extension requires you to create a GitLab personal access token, and assign it to the extension:
 
-1. [Install the extension](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow) from the Visual Studio Marketplace and enable it. If you use an unofficial version of VS Code, install the extension from the [Open VSX Registry](https://open-vsx.org/extension/GitLab/gitlab-workflow).
+1. [Install the extension](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow)
+   from the Visual Studio Marketplace and enable it. If you use an unofficial version of VS Code, install the
+   extension from the [Open VSX Registry](https://open-vsx.org/extension/GitLab/gitlab-workflow).
 1. To sign in to your GitLab instance, run the command **GitLab: Authenticate** in VS Code.
    1. Open the Command Palette:
       - For macOS, press <kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>P</kbd>.
@@ -97,25 +87,6 @@ or **Accept Next Line Of Inline Suggestion**:
    or **Accept Next Line Of Inline Suggestion**.
 1. Press <kbd>Enter</kbd> to save your changes.
 
-## Integrate with GitLab
-
-This extension brings the GitLab features you use every day directly into your VS Code environment:
-
-- [View issues](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#browse-issues-review-mrs) and merge requests.
-- Run [common commands](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#commands)
-  from the Visual Studio Code [Command Palette](https://code.visualstudio.com/docs/getstarted/userinterface#_command-palette).
-- Create and [review](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#merge-request-reviews)
-  merge requests.
-- [Validate your GitLab CI/CD configuration](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#validate-gitlab-cicd-configuration).
-- View [pipeline status](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#information-about-your-branch-pipelines-mr-closing-issue) and
-  [job outputs](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#view-the-job-output).
-- [Create](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#create-snippet) and manage snippets.
-- [Browse repositories](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow#browse-a-repository-without-cloning)
-  without cloning them.
-- [View security findings](https://marketplace.visualstudio.com/items?itemName=gitlab.gitlab-workflow#security-findings).
-
-For detailed information on these features, refer to the [GitLab Workflow extension documentation](https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/blob/main/README.md).
-
 ## Create a snippet
 
 Create a [snippet](../../user/snippets.md) to store and share bits of code and text with other users.
@@ -237,6 +208,8 @@ This search query looks for:
 
 ## Related topics
 
+- [Troubleshooting the GitLab Workflow extension for VS Code](troubleshooting.md)
 - [Download the GitLab Workflow extension](https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow)
 - Extension [source code](https://gitlab.com/gitlab-org/gitlab-vscode-extension/)
 - [GitLab Duo documentation](../../user/project/repository/code_suggestions/index.md)
+- [GitLab Language Server documentation](../language_server/index.md)
diff --git a/doc/editor_extensions/visual_studio_code/troubleshooting.md b/doc/editor_extensions/visual_studio_code/troubleshooting.md
index 2ce5c62c972..dcb3ed21c4c 100644
--- a/doc/editor_extensions/visual_studio_code/troubleshooting.md
+++ b/doc/editor_extensions/visual_studio_code/troubleshooting.md
@@ -44,8 +44,8 @@ Request failed: Can't add GitLab account for https://gitlab.com. Check your inst
 Fetching resource from https://gitlab.com/api/v4/personal_access_tokens/self failed
 ```
 
-GitLab Duo Code Suggestions does not support authenticated proxies. For the proposed feature,
-see [issue 1234](https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/1234) in the extension's project.
+You must [enable proxy authentication](../language_server/index.md#enable-proxy-authentication)
+for the GitLab Language Server.
 
 ## Configure self-signed certificates
 
diff --git a/doc/security/hardening_operating_system_recommendations.md b/doc/security/hardening_operating_system_recommendations.md
index eef8e6f105c..966688245d3 100644
--- a/doc/security/hardening_operating_system_recommendations.md
+++ b/doc/security/hardening_operating_system_recommendations.md
@@ -9,7 +9,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 General hardening guidelines are outlined in the [main hardening documentation](hardening.md).
 
 You can configure the underlying operating system to increase overall security. In a
-a controlled environment such as a self-managed GitLab instance it requires additional
+controlled environment such as a self-managed GitLab instance it requires additional
 steps, and in fact is often required for certain deployments. FedRAMP is an example of
 such a deployment.
 
diff --git a/doc/tutorials/create_gitlab_pipeline_push_to_google_artifact_registry/index.md b/doc/tutorials/create_gitlab_pipeline_push_to_google_artifact_registry/index.md
index abcf1459de2..caf591d5678 100644
--- a/doc/tutorials/create_gitlab_pipeline_push_to_google_artifact_registry/index.md
+++ b/doc/tutorials/create_gitlab_pipeline_push_to_google_artifact_registry/index.md
@@ -50,7 +50,7 @@ Learn how to connect GitLab to Google Cloud and create a GitLab pipeline using r
 1. [Create a standard mode Docker format Artifact Registry repository](https://cloud.google.com/artifact-registry/docs/repositories/create-repos#create).
 
 1. Connect your Artifact Registry repository to your GitLab project by following the
-   instructions in [Set up the Google Artifact Registry registry in a GitLab project](../../user/project/integrations/google_artifact_management.md).
+   instructions in [Set up the Google Artifact Registry in a GitLab project](../../user/project/integrations/google_artifact_management.md).
 
 ## Clone your GitLab repository
 
diff --git a/doc/tutorials/setup_steps/index.md b/doc/tutorials/setup_steps/index.md
index 34bca678c8b..a1ba5dac9c9 100644
--- a/doc/tutorials/setup_steps/index.md
+++ b/doc/tutorials/setup_steps/index.md
@@ -360,7 +360,7 @@ The echo step takes a single input `echo`, prints it to the logs, and outputs it
    glab ci status
    ```
 
-1. Follow the job under "View Logs" until the pipeline completes completes. Here's an example of a successful output:
+1. Follow the job under "View Logs" until the pipeline completes. Here's an example of a successful output:
 
    ```shell
    $ /step-runner ci
diff --git a/doc/update/versions/gitlab_16_changes.md b/doc/update/versions/gitlab_16_changes.md
index 35815d8ca8d..3354283c74d 100644
--- a/doc/update/versions/gitlab_16_changes.md
+++ b/doc/update/versions/gitlab_16_changes.md
@@ -1769,7 +1769,7 @@ was recently created:
 | 15.11                | [15.11](#workaround-instance-created-with-1511) |
 
 Most instances should use the 15.9 procedure. Only very new instances require the
-the 15.10 or 15.11 procedures. If you've migrated GitLab using backup and restore,
+15.10 or 15.11 procedures. If you've migrated GitLab using backup and restore,
 the database schema comes from the original instance. Select the workaround based
 on the source instance.
 
diff --git a/doc/update/versions/gitlab_17_changes.md b/doc/update/versions/gitlab_17_changes.md
index 01fa6dd2cf1..c58e1b4aa26 100644
--- a/doc/update/versions/gitlab_17_changes.md
+++ b/doc/update/versions/gitlab_17_changes.md
@@ -96,6 +96,10 @@ Specific information applies to Linux package installations:
   Prior to upgrading, you must ensure your installation is using
   [PostgreSQL 14](https://docs.gitlab.com/omnibus/settings/database.html#upgrade-packaged-postgresql-server).
 
+- Packages are no longer built for Ubuntu 18.04
+
+  Ensure that your operating system has been upgraded to Ubuntu 20.04 or later before attempting to upgrade GitLab.
+
 ### Non-expiring access tokens
 
 Access tokens that have no expiration date are valid indefinitely, which is a
diff --git a/doc/user/application_security/gitlab_advisory_database/index.md b/doc/user/application_security/gitlab_advisory_database/index.md
index b5ac80d39eb..6682b068d74 100644
--- a/doc/user/application_security/gitlab_advisory_database/index.md
+++ b/doc/user/application_security/gitlab_advisory_database/index.md
@@ -1,5 +1,5 @@
 ---
-stage: Secure
+stage: Application Security Testing
 group: Vulnerability Research
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
diff --git a/doc/user/application_security/policies/pipeline_execution_policies.md b/doc/user/application_security/policies/pipeline_execution_policies.md
index ce213b8cffe..b12c89990a8 100644
--- a/doc/user/application_security/policies/pipeline_execution_policies.md
+++ b/doc/user/application_security/policies/pipeline_execution_policies.md
@@ -59,6 +59,7 @@ Note the following:
 - Pipeline execution policies remain in effect even if the project lacks a CI/CD configuration file.
 - The order of the policies matters for the applied suffix.
 - If any policy applied to a given project has `suffix: never`, the pipeline fails if another job with the same name is already present in the pipeline.
+- Pipeline execution policies are enforced on all branches and pipeline sources. You can use [workflow rules](../../../ci/yaml/workflow.md) to control when pipeline execution policies are enforced.
 
 ### Job naming best practice
 
diff --git a/doc/user/profile/notifications.md b/doc/user/profile/notifications.md
index a630804ef49..a1340de5feb 100644
--- a/doc/user/profile/notifications.md
+++ b/doc/user/profile/notifications.md
@@ -338,7 +338,7 @@ Notification email messages include GitLab-specific headers. To better manage yo
 you can filter the notification emails based on the content of these headers.
 
 For example, you could filter all emails from a specific project where you are being assigned a
-a merge request or an issue.
+merge request or an issue.
 
 The following table lists all GitLab-specific email headers:
 
diff --git a/doc/user/project/code_intelligence.md b/doc/user/project/code_intelligence.md
index c92891ea174..7d28015e749 100644
--- a/doc/user/project/code_intelligence.md
+++ b/doc/user/project/code_intelligence.md
@@ -165,5 +165,8 @@ Use code intelligence to see all uses of an object:
    - Enter the `/~` keyboard shortcut to open the file finder, and enter the file's name.
    - In the upper right, select **Find file**.
 1. Point to the object, then select it.
-1. In the dialog, select **References** to view a list of the
-   files that use this object.
+1. In the dialog, select:
+   - **Definition** to see a definition of this object.
+   - **References** to view a list of the files that use this object.
+
+   ![This variable is referenced twice in this project.](img/code_intelligence_refs_v17_6.png)
diff --git a/doc/user/project/img/code_intelligence_refs_v17_6.png b/doc/user/project/img/code_intelligence_refs_v17_6.png
new file mode 100644
index 0000000000000000000000000000000000000000..db154494d49fedb34b054629af9e16bff1c15225
GIT binary patch
literal 10153
zcmZ{K1yq~e(k@PEXbVMxyOt8HxD_i_ic=&=af&+>cS6tt#f!UJ39ccy7b)&iTuSgu
z&v)*B&bsTr$(v-qGtV<KduFZ7to3e)$_LqJPsyI5prAaHmy=dQK|upPuD?G)fBgQz
zJS+A1gJB_|B!Plb9Rs-ig!y=n>Z~R!iBd5_vHOUAYNes=qOJ5^$i&_j^vTrT*bL-h
z>+py|K@sr~dR*F?xqPDWu(h#s7V;3K`xip!as5}!K}Yj1h>Nu-owkw+jg-BU84VwZ
z6U0d;_LPQ(M#Ra~Tu4p&-M{INccOHbE-ns2931ZM?jUy_kiC-y2bZ9rAO|Nm2RAqS
zBZA%8)6V6S2fLj!{Xa(juN`SKXA>tY2Nx@QJDR_CKN;J*x`@)z{dM#|uYclnu`>UU
zCp+hVZ|iY`9Dg+&Tp&)4|BYtmVfFu^{nh+K``5nyaVPTEn2?&8v%QV$->5Y0tX#yn
zMgHaE{}ulyNRhv`gjB3N%xtu!t!&NgoFA!Tyga-j9RI84e`V_Yhsnh&@ZZe;()^n#
z!tpm-|CPOeO7k!2V{OEqig5f-oyDG>s@54lmLA7JPRAJq1wiokgNl-xPJ)7hj-v8j
zL+0V(;rRIE{{9|$h@f^IWMO8%y}i4;yT87^xx7T4pPwHb9G;w<Zg205jg9T^A738y
zE-Wmaot@3h%x-ROE-o%X!lR@$!vzJz7V)HcxCM@nj{oe#g@wf5ic3XC#smh2%E>BL
zSJy5tuS!eG?(O}a5tdI&%~)Ms3k`*omsc7Z7$cEaS69~q{ex<%n$U>ok&)4xn_E~z
zQ+s=7S7*=E)X)9>14TuZ=%~2E!{d_TG6#F-mX<a>U4x5@Ki?9QbF%a5>l#qPYb`CT
z)6+Ba@(PEBM*jS{G&8j*EGXXC*aQ+&czO9992{$E=r}vO`}+mW&o9J({np+8%f#4p
zdu#jb^ej0!t+}bi!`<uGuX#@o@9F6o8*BTITDr;~)GvPbER%i6%*?5&slT3BI6gjp
z7S%8}_iKH9<7R2|Pye{LyFCKYe^J|WyS{gpTI1?qbu+gX7n{)213z!<o|u@toLO93
zTfe`&+STwm-s-&FKG@yeeYm?{2N@=0Hs9_aMTLFYw~7k#ao*ZHP9IrYrPoBZ4s|wW
z`uYTXFY3BKK3kryzrVf}&w;zNOkI?;9eSqn^YMbKhR<^wukY?la%1eQOv-1rn!A2J
z+}`D+Ly+C$r{|YfBXhN7iF6*rDe-~pd}i{xk=mAtd-_4gF{N&<p3SvstDF0u9MT%9
zl6NA$?I^i-uIz7~UH+(Vm>I6PJ39{#blYER8{R(NcZ~mS0y*m$Q2i9Qv(&sWQBzXe
ze{^y&*i|sIdmd81j2K=xEU4I=heam+h>!L?yu4mZ$~q3oT|Y*0a&Rjb_y3ugo}S;_
z{a$F9zi48pYx5<0OUj-jt>gaUQX=~2rl|EKo@6+Dehg94Ke{wESPqPBy1#!wES*s$
zw9G5&TwLGw!V!m64TV*Gy{)-!K}8FC7IULj)r}+mkrn;(`y0;wqf=`)+q)^9TN5+u
zZG7@a%WD>HnM=OmbhLEluHSRY;Dck!YgTS^cAjmtid|MtqqRTQ9lRe<+_F(nXi(&(
zB{V#K?WcRGsDGqFC_AeMPGidqiMk_7xRT0BXRDAoEHsq()HAN{vUT;%>|gWf_n~#F
z>E`6%VX5Qr^s$iQqMdZ+^bMVo5Tb?Wzi;@U=`u!Yy2rUVaa}gzLRsi{aI}E;l7Xd+
zCh#(?U-a@jf>ChW*{^+BP!L^GD)z-oMuiQ@guW1#IDjf0Feg;q&+v!Yh`F5j3&4Xm
zlN0R#$nZhw%-n}YLVZJc`>K+t5zp*nRXcMk(*xQ8SYpKNk%XaiDr1=ehVc1>$EvmI
zY)EQUY7Kuy1^V5aRy<lRBpwu(>42x}KSI+ZVmTz`j_DtlU+SgXVj1+bXp`fS5ODa*
zyo3kUVvP@y52u+q3w848g%Nuxg#!@cY=6#1@1)AUkRl7Bs$ZLukKqdc#W&(HI??_U
ze9;UPu&1d&K@tb}`=+ZDzEyPKf|_l{?i<g|jo!hMcow()1pMv?|IAqg=v_uqqfy)-
zZ?{4YJT<|D+uf_t+37iZ&#<JbMJL0{IXdC{n~GbKHFo{e<rQ;LaZx@c83n%=_%7ki
zKj;%;@%56cXKX|6NSiZ&&48N(BJ->swO~F!;=7-)&aUd1Bj}6UO>#pbAQn5tYuGcG
zrLAV+JdgG3A4#iSpP0-qR@dl!s+H@h{}91!+bB6gOrEMI^ugNw(Bd~*1k!&N;{Hlk
zU}SD~izEj<M%mSMiQ56MbUZkQ^=Nj|rkpEjg53tLD1e}IC9^NwmKVKta<+-R#PM;3
zLN;dC1<$|w6}E&>u;~r#g`99$7c+sAU16c%-x#3t#l=NQu4U7@<?^BLzXpWE{ZhtN
zZOGAps11h(Ow(&LKAhYWFGPJk%2wW};FFSGC2L2?iPOr6gS{;qSj0SpC`?k4yE|lV
z0yyv^6#eT;IK|SYplp$h;0?lFDSieDfjmJ6n&&m~PU~{AZ_{uCpne00XTWG5Z|As6
z6fj}&SA3z;fzSqpi$T?doNN93y^_7n95FI%<6}&vWOxA6Ktyhp<hX*&DxQa{x;G(t
zpdM?<7xdCzvmSkn8rzN#DtD9Ic&PAGOssav`l^U$4DBQhGA3z8npHZ=yFbfF$<x8!
zE%9=EctAfviOeiNskpkV$sOHAoK&%JQwK+^h!+#gR@W9;h0z7Scl2Uw2|4g1B^4?{
zSMZ@Kx^!TwQR8TIl9`mc-yJf6Ol(o|Sk~E}YHD8Ly)v`oCORH_oAyh6!@d%S`lAHX
z93l*BW6g2~y$-lE*Y4MP*|I0%Fs_;SUVC@7t7}?C>jL+4RP;=#9&70wz<oPRMfID)
zkhNa1f)qe=WUu%$cs-vN9ZUDEq$20UJY?(wi66lTPRJk4D#_M;l4Z&oR07ukI2dEh
ztEE&N-Kkhx5IpOHOMC%E+zL)|oPm7!c_z{Ia{*+dZ%yM;JSRrrtv@e!iaUmt5l?_e
z*rU(SLvR0d&s8^8fYXEAMIum{KCfozc@h59I=_x{V*(z88e`b51&7m%d>P4!>3v4r
zCDs<uh$5_-C@C<Td3!<hlSq2Rti;}{k)|_{YU|~Oqdl*>7JGit>*#`<Q>A3?j^z1>
zv-0DOkH5q5{l~E<b3&M=c@r3$#DN;JzHQ$^@T6^7(fKDK(5QFQ3Mp0DFy~`mhOhUw
zh5=zbZ7?laBbw*ykr~kUED-4%OYx#Ffby8$3gxDFC|z)LQjT;74Fnkn>*-NXH2@hW
zcb}Z3`Zd3a><FNRA^^mHe7r|j*Ss`Oi8P6>>q~#{>jXg0eAYhL*86BfE*joltmojQ
zO+E_-7-i$m%VuUx74S)~Ui*TztN0d&zWTq3FiR_XZZo~>qGB{<+abgZ#0NmI>VQ<r
zovKrwLX85uMKj%Su5*<Yy0<H6*~--ult9)eix{AZeMbvc=R=i{$0!TvczJne@;S7w
z6?>!Vcjge66d+Umhr3Nw$p=+<&Yc~MMr+x0T>WXXH<`;FtSD4RHXi`YBSU^AOSh|z
z^;jnbO>ycBV}o?h2`hP2_-tMdoWE7U=DWE6NyG-h+Q>P1^K~I4zz-FO=@PIJ*#Q^!
zXdX;YfJh0Zf{n8A<ZE8i`u3qd`Km%T8!F8Vl*h;v(`__cFj}2OY?p%R49m{lgq82K
zWESM&_G}i=`N4$ir@}%;Qsj%KrtEjHJ_|NmTM#%eOoNQJjng>Ub|<`8{v*F@YSHz`
z2b+UBRiWBqbadeOFJe78-c2~!`*&5+X0T?a<q#+k8CQ6&9MevVP9<$<ZF%hC5H~lb
z@^NNtWp%|EEx3>w15{u#1Iwc0ElB9c0@*Q9V)420K;-!Ypz1_8GPtXB(elv{886;#
z<M<SG(7}curTE#@cOUOhl4Psjphuc3@5T(0W6sa$zm|JWyF?DJ-25IUA@}$Q((aOp
zdcOV{8_2oB$76@?HBKgz9-2DzcG~C|?<$!kVlT3*47J3SjRt5V6Gq0?5xi4RQpz3_
z%|TW<eh#tk+f+{u#}I_U%rZ0IJ2(U|EwHoT!Dho78W+k~5(U32dLw9`sRJsqHF5<p
zz=Zl1Z%Bgy^5vlc$Xb@Dey3*~W0~LD<9@FQ8vZdPHW4-d<<Yu`zq80;DxOyEcmGQ>
z>Z5YWk@N73xSu|ogC_~Y;5Y1FGxZ`tSZBOus8N@}4pYuz21mLoW`=_b{Z<WrXWuVU
z_brH}YW3G4qf*BrCztrmjk6@-TBJrREe25x=&y`N(l2RKjFquUeT+o^;8<ioJURTB
z+R=l%YVa~MWZpnyGitSq`9-;jo^H##4CsS$65uHrHpn(+^joC=Qt-06&)FZEL(w1X
z9F;b`Y_T@`);76Z+Fq-zChVz#W~lt0r|}}u>+eM<*sfA2W_s8JM*2zxE7I-PVctta
zj>HBCN3Ep}$6aqB1gQrbV%GzJNV)Qkwq73;{4h)|_@R^Eap8U2*Y#5m0z~WZjKc!K
z_plqUNT0cJk{Pg^)@Jo@_pI_s6&lH;mIuB?XOhG@?_6mip;wLL>AQm5PoF%Yv5eH=
z#_A5~;TTo-+!aL-rMAy{A<r%AvUVia<1UY_*Lon?*`;?+NKJ?$B^>b+8t`qs(Behj
zpc=3UAs2VM^UaIT_YUZD&o^Th+Fm8{DO2OHZeO?X;P=Hw8G;zT%CnuejGG4&hKB%+
zmnnZ7UF$>6$3t$^m&quVTK!hz>Nc9=cIU?W#g<G^aS>u|te;jprLO$EUqXhQe?{|d
zxD*_p!rpj`bMY%y8j!HR!r%sh6Zv8^Vz93~yxRU43H&*c>Fb`k<{&2nQW5ywcE_}W
zgF`T$%@;P&w)#Ajk5AprPmt43Z^tKHd$t{dAMqjf5<3Ljqdh?@l3VyyE4fNZe`q?P
zRpiUh4LEHwOQgS;?iD$4U4++}_FRj&=<lEza~fFuoddj?Y3nSXJQT(yLm#T$eYuoO
ztx+BdPToTOo;X>hy<{m@vAQy0uY1cjCZuw&Pn1WbibntmvG#7H+e1&gK&AS#6wIV3
zw};-(lu8nr&7T$vgFqm(B!PZT-F9o}!BCPY^BGw4Qkob4<*4A~h|5!U!o>NAZLgIf
z!Q~+bBi}QhWx=yyQmfUuw)Dyv3DLZ_J|E#7h#RQ}TXd#2$)+l+uW?_ISm;O*F_tm`
zbn?|MhQtH8hC0)A-2kR5YsHr;AmjMDMebtO)y5}VCjs5FKTtv8<i+Ci>QfJwC1_FR
zhJTL4w}g51(xKmfTnD=|NK$1geMcqVq^rdq;oI6Mnpf1z&>D~#0`JRtgC5<Ki%|0Q
zhSXL4N_}3?BI=c@w&%Vj&kC$oxSsnA>X0*fjTC89^W+CXjW_A=+_dbKnbUeyeZdxu
zKO6hXKAd;NkFJ+)4isFj81n=>oj^u{oWXr+EWo3FnTSXyiN-9j3Wx=m02qKzZ*+YT
zAR7F{wi)Pz|8+=1f}8bGzNDQO(WCGPE9*7pCDDrl$b%a#D=j(n9WC{hX1<HnAEOu+
zEE8$<_Q~XHm9ifYHRLTWT>eBj&?V6~f5ljl<i0Y%sR)Xpd-K7og<M33GiG$ZV}dFK
zDlXRMqxTX3443<%HKi6FT}QmD*#$jCj5*3#7jF$bb5I@0Xq0jJ=uUf13&yarEOVT(
zL{Gy(gv4C*8b1NAuRfb0DlWYwyQt|V=O*>0TJ}sEW_6d|S}QrUf4H`P4^G(jFXq9f
z#I2{0x#=gz%*G<^;Hk@C<L{9v&DIQ|kd&g5M2IawlNSXSnHOB~MdWWAW8Zrn!5u)w
zYlFw3AN?Xce&M*Wl-V8VpVfI&QTy*AL-zW>;3<8yn&-<63$I-5NAw$=Ar7=&FmEef
zAo9iM5j44)Os$N8Fk<hdZAlZLc8vl+gVzj2=RkL%0Kw?L>0dI4L%XO8Cgh1k&oCyj
zAbQon6@{c2c)GO#u`zQdo6Id6FC`0l#Uxt{-!AW#<t3&WUV48|5?XyA)p(8S)Ygp(
zQaC3~eum!QgM1j2skg^+UOhuchIvoI9Gxb_H<*8UNfFF$Dc^XDRW!ZnOeElmZ(|%6
zB&KS;F2wn&4}t@d*ob=d)n=4oSLK77x*hq}-nV4#f|uZUtk(nkU~Ouf0A9uhS)EJB
z=z7qGuB%=Ta&0&RyJ=I{eI@&l!v7F;VWxFzcS-(h<!#aA-R;p6us`W$0DcBn!uG&x
zH&g!ZC7aop8XGsFL%;-IJ&hhSXtk!~ZRxw{SUXD4eo=}eomtdVQiT${630KERWyOG
zIBM~(>m-OKBiWM4*p`4qMX?#;p<MJom7Z}&EIf(Ra(Bd#t=R<=dbYgm#}J0tZ+OOF
z>xIV2OiLZ^>bQ-plZME@_=x@>GFT&qGTIVmCWU3X`faUg?OOYjkxWc;03((kCM?97
zA(>ti6Kj)K$1zr$uwPxd2)#hRKUCe}isYQlIoCaYaNRn7kaAk?vA~X}GU3qq<>hI8
zrM6tJ^vjiPIq-Q-+hR|WX_msiY?b^fj0JV9lpz><Bxa?C4iHB9IZ=A794@2u8z<N%
z@?|~`eCJIqL2(r&4edMhYrs}c48F#2QE0zx5jB4Tx9fmZ;F^F??A-4nz;@S)R$*@t
zU^iTr?qmdgXt--<?a5YP2GeC7wG^i)x4hdr?D$K8tObw@NY!7&Oz6;}DH3)9tO)6J
zgiozx;X0q>d{N+fGTk|Y3L*@OA*}rL{>0ek)rwW<tO~YJVxe;)?*Px3H_ew{?>S>C
z#aboFAyBrDNv<y{?{!Q$D!K$08#fS5H3<O^(raCTLcdj{WM#2Sh#ccyIN-^{!Gy79
zVO5f2<v@1>qYuUeDk}c5iR(E*Q+PFcDj)(iUX#fV4casLyp3ogLXyn=EjOk}sNH3D
z0Ma4AHY6Bq>DIHI*3IW@N)nce{QhT1^a8W@IR&u0mH~|tb5z|%Av8oilC|yT^rtpU
z8;v6FeI5;z)Q@y!jrRv7KTH!Fq2-Kfrkg+EOK4biSd_7GhD1@A8eap{bZCb|?fdz*
za@f@tAaMUYpQ2nes7{Xz!9C_G*rnb9@8U^QJ#2P9I`&&<(vK85Dg+!gkB%q^(<(W(
zg!BkONW&uwpjYE;wtMAhNx!w0bz`pn*&8Nz>cL!1j_T&<;W10T64<x#+KuHN4@e&j
zWsHW#;Q?2gLhkzL@qxFJI})G*lzYb@J@*g90RYa8rnD2^M#k}LlA(3$o)cM!BRl9m
zORtwc{ss+r>Dr!mdkR7Www7SANRjZ#D?1T_1_VIosSGIC3K0;f@fPkxf{x}6x4L;1
z#;qJX4)I9R;RXy(Lj(xR&XgB6CM0yVcpdqTg1ILn(eBbQteYYRrk=Wy!EA?tbd)^K
zi5ZbI`o+WGAYs#k$EMRSvkD{Z?S~tt0ZNTOuX@t79fKmiRLRaQDr)%%9YjvZtTs1&
zR<sED#12~79E2XZ*kgb|yS{q&wldyv8D?TdqZ3BX4zEhzw4=qS(mRer$<pK+0rlEV
zs?U4+WDG!5g?p-=A>=WN0-y=aomkb7Jpm8~(I_Up?3^H30zJ#VoO3oRZ+LHUy&WBJ
zjpsv#X(LX=Djd>(72A4TYamXle$C9JebgiBG4NdJweioVpruy^?LKh*WAbIucHur}
z+D5O-kC?^SjsERliLm?a6u;xEzHsAL$RfOnOQ%;Y0A7i-QGUoBx6+S?hKcVPfPy+?
zCTc!ho_6kemZJ%Knq*PMJk{WP;-H!qMT*pq1?-PU7D3tOdF6h7C7h7iUVB3tGaKvF
zQG%#g(eU*L6u<y4L~!3TBQPtQAWfvbQH^~J&nP_ujaS$fT0`HM!~Gd}4bF7W7LZ-y
zh??%nZ0I3;J!VdI2t7`agtAlILd%ghMUADRodz`&5F=7?0%pMMWd;QRAiu9@R*k=W
zi#n&{bAH=sV4*bOy4~4s$W_T(HGPIZ`PRvWQoL02TiwYvJ*ipFz*}DpqLhOVg8+5y
z$pJ0#_fa<@NHrv3eGjz(wSI)iky+HHOa-R;s($3~o52s#OA_xg(|n>whx?d`>=-*I
z#$Nh-SIDe|7BpAtljn`jSs9El0fyIe!QO4)u@=Jt%*WpTPtWI*MP49LhWH*ubS#hE
z4NKat;BgcPd^xagZJX~K?9>U3MOb{hRC}BbjA=c+g(I;%%>N=VR!@->dy)>*e>E)_
zr^v{Wdtc#4yPb-Ue=uE^Zw3fLq2;a5&kH*+GZ6?lDNZ+h+JOH)o}>`#4EYiYIL&~-
zd@C(^+Ib|lJD2s$+vfgk^uKV-T?=DQyVOq|4TjbY$6+9&HGgg4)B}&$3~}LC&F)fZ
zSIhZeZ+|w(Z+C7Bf2X))u#H(ZSmmGV?+61Oje{CdE&J9`88ZGIVerIaluLii+4wvT
zH!^P@C#eI+Jy{kY?dln_?hmC5P6zyoN;O}LdeGn#olqY4!1fx?_4HA1{~7t7>w_w1
z{UFVqPL+YijP}qSe+=atQ|~56=Kl4`flVjG+l9v2LSoGU>zU=!3915o%D}p~7fWfa
zzWh@+!Ak0i+fB{Q8L^?JSu+?Vwwf$J&DE@O%Ho=P#8TsVT^u_q%(U3X23M`Go_De6
z83}#Ii+$P_E<PIcAM}GFgpyAf`Y;m099|pnNI0nWpb^qCysnN=A(o3BrirTYzrv1(
z|J0|E)~f9nht+1l%O?-)(qc`~1PEw+@*MULg$hd_o4;mZvszScQX+sWdeqR+aE9bw
z2pnF>!7M*+=6x>$G!wYFRP%X;XvvRc(pi&?VfSMjX%8bNX8}i^<{Pcezh%SyoJ|Da
zU<U4bd)I$|?T~Ft**WG~O^n5c(iM%`mR+(KXdpU;<0kRsMKhOza0Rx9SdKFDjcW?K
zH#YgnFBZNkk{UMyHgil6!D)7Lbu#rQ=YZGw><z1O?1Rj&>!f^QXf(*wluR)lrUs#N
zxxXkqGUq~sIP6KsBET*>8-|WZu{*2tuVn0YOI}g7j_WGbdefsl^i7jKRcb_Qlv<rd
z>Dd=lLIyN#MM;g8=ItB^8bZ!DXD6%q8+1eni}r4&=fhWx$40*?sSW!+H_v|qY?8q6
zC08Y|pI7y?@kihb?+2pyVqQKIK9Xm?i8AtZ#v$%RbDKFg;;=nd5WmJO3&guFqq0#{
zbTu-J0{;GOqdj?ao;W*?l!#63drI>o)V4?dnbr^NW3oZeZ5D+dDX<nPnIz~%cq8|0
z!o7$4xz=l6JUT+PYtmoUH?0%cY^@%Hx{zcsshcNSsrbVZDFCh0DgqkLi5us>oW@8n
z%hAt^p{0z0KuWHvPV&qFg5Q|91VG=S4)beN%$+smv5jBPIQ_{MW0X)tRT=TC;!Jl_
zft?szK_GGLH-Vx-fF-$ZW`DZGd3eQLou%w&oh3eDKFDK&QRs&{mP0IG_)luFngM^@
zD=>h!4Xsx(fORy@@?qq(b?3zVeb*2->BAtRTA3HeWPn5-3@;6Z*woIDK@0lgG&DL^
zKh~MzVgWI~Sra=pVR4}TYxhdEWwMtX-l&6HS6#G>rjcK?oebHh_%8*jq~$TdA^YO3
zI5M#&oii_-W_LcCI^btz@FthaS(RM3@JU8Ea`{V1NvU>0c;kpr>Uf+=z<qymqy|7k
za#__Sq48kO(H{L>!o{x=+?1?$BtQk~GGsWvhkwW^>F0F#;s<m$D<0UGYb{P?ht|Xg
z^_k(pCMtQsB^{l@4<-ihD35)=LVXQb4$r@_^a~fpm9w#L818hV)@?`@GH!}&ae)ry
zeO{?Wk?hqLz$~S|>A}Vs_~M9S<G8ar+}srALS#T5Ho_w^FV+Lug>yuGPZ&w@9}~m{
zN)RIim1(nNegZ0(y$XUVm?}<_N2b&KFt7vFI2*D7{ql9{1V5GqNg|jVt7=Whq^v;1
z$)Y+mfYnO$@nejLltO#+N;X;$26G4Di--i3{yYZI;fjENT+^q=G9?rj1b9v|6(;C=
z7^4k%lKlYbESnef`t)Lw20IGb;9O+0I|h|yQuUvGy@}m_;t5;)8%h<Stm0stO?8)y
zpn@3r*OSQ;sziVh#8<CEW+zP2wJoU<$pF-}ylW(#1p7-BU5!i7+sQT;Q&{V-U2}HK
zTPsSpJ6DZFV?bVSo~7(jxLlQMCkop+Zd_s^(TX8u{zEe4p^Ed>>1IHxicR|W+37cd
z-lgWmtpw_Qu$7|?Y|9bqj$;R|tBe|7A;k^5rkGIB&SoxUWy&&ZW_Fy7o?xwWq9i*J
zK}Kim<1;zX4njq9#wfM(C>5HO^eviKO;n9>>pI^vneSX6ucwU_R9DAYJuXttaKqjb
zLUKYB0Bs#CP@ab~q3*cnmh0EiKkt!n0+<%-IPHq`gosNM!1`r<Tmz=0wfq?g&B1Tk
zAjHD({jS*qAko0OPd-r@iPiO6dq$~mx6v<kBlhGfS<2PT?y~gX1}(@wqqpbd<~C&p
zZSa)QTUZsz)lrpsbkI)o>E<>Sj}ogi#(JM%_RqT$`L@LvEn#0aJXPc9b*y==n_GON
zu(qs%F>sE^d*d0JfFhilnP2rSt?wzz04Pt5bcTH5@`16?AB<JL^KraxQ(>4^@B(o$
zNjl-f8Fm2@CTwb3!Ic;6X7mv|C4%*RuoC|hn6I)ir6gwPa%Zd>s`SRfP~&iAs%NLV
zfi0t{2y9v^UC?%l8mdU#rlK~f6ZnlPXaFv=vi6xM5l|1-0ws8RhmNe;kHR$}?K@>e
z`pfB;(*?>7)s1y^=dVoW_a-JsDUE}AK8`v_5D3Sn3raP+h>0~Lt_~VuFHeB)_@9#S
z*6@F!jrpVO5cl5cB+^#7F;mPv{9;3l-!Bx<B#K>~!BeMxdXkv3?8h#A+6p&pS*et&
zRKeBF9F0{EW~Tdbk37mek*uL-1uYHPRB(ZM`S^Ko2Wu1g)6zJ0yH^#!>GHj5;P(~c
zIwlv&zt=94l&6_#rS?6&w>a0e73Ztc1<-*CVr|i^N?I_Lb&gpRQGZk_g}Bt6kW+%0
zoyu}|aaQn<gWh1Z=bEu~%KVq&z9DB>=)xM=5J&G1Sjroq@B)5=*Ar{(YWhR=)hd$t
z&2Mk<=U1Npfc2YzUo(vec-9KEsnyOcq$Xj4rjP(U>ONq0HE{-Y`-PJaM-a3D$D<J@
z1>T=*XC?*9Eib<$?`IEzO4((&!9UsfQB9kK;caVudhJ;hZp(<1fqQdqO0X7h(JdLd
zPJV&=V4WrBZui&h-t$ryf^eb?7G0ucdC+%LhZ7sdI00kaSYT6qd?%)l_$&=JEtRs9
zH8;>?;hhLoE@bWG-5R?RZcJl-)W;lZS_nJ)Vb4cea>m4%7^Zy@XLw`dV>)(Ra`#)I
z9`moL3WXg`nSS|k!;+x~jKE9A_A{1vC|C7&z3;g>4kr=w`IWz``VW|rk~@=A^ftC8
zj7Q_Kt7pxLtK{G(L=dou5I^wqE#_IZd3k|(p4gmOWUBHAuw4#Z2K^oT_>h4I#3vEI
zN;d%B=g8-i1HX4#6IT3m<Zqi2+`S!{h=`aKX{2&q+vcZ^Og3;Qd%YphR%L-4e>;A)
zF8mV-=!(p%zch@0g>LgpxKZV9SvU?_e(=%cY}B~_3bvz2p=6hbB^nRKXgKw_@n?Sn
zYcMehdx$;||4y6mvbwq-eT{CUTtwMHnW(z_pfFz6i=nNHF=kX%{C#F9Krnig_cNce
zS@)5~I)@RV-tr6X=Bcn%V)vl49^UIa{y6BcOtfN$5WBD&DX^d9j9hHP*fwU}4ITqA
zi~iB7yYWrl#x-sI&#bouubxAnF&o31ON|ZVBcv3Z+G*5Wr6lOFdz732vuroUyS^VZ
zMR?+7wD8{`jz5%f`cQ-EZy?sAVqeN<p2zqZCZ<wW<hzNBgMOrzh*#08kK5mQOGmY%
z9KdcnAF3DqT5mR~{luIqPd|(BHxHZu+aIn*#rb&zD%Z|5c<<MY2`>b1W?p|x2NW7^
zu0?{88Lxn!uY6%B5NJWz9!+Mp2t^XipRHe}o=w~Gm5S`uRDOpkZc_<|0I*n~jr=vW
z;ruacBW&?Oj&f_#@bo?qFd9OEm=XH9uweE5-U;-kX^*0{y<ejs`pk->vADl-w76~d
z@Gs=EMF2^IayO<RiG;~qy=)1qU?RS!OZgB<%duS{1;SnU2`BIM=6#5%-1+@OgF9BU
zRksn!JBrW)fw%!JQ%u%ZN;%&^q_5b6(QJQNvCXM4?qrk7mB~rO2{a5u0e9*-#(#gO
z=ip@yDo=Cs*TBIUcE2LJt7g~9e2u8K(M#iP`)K-jgbMHPSpb8Wz3A=`>6>_JAwzKI
zf%5|Y$Imd)Xkp^;F+9t)u-|U5ycL0q@e7SwSCX6E5X5GskFN2jx(MKszXY5Un)-Uw
z+(r(3aqBQJqYYg)*1HXU7gx_v?Zq@MeYp{+gj<{P+FB<5b6jwxh95Qc=5Kj(8IF>-
z0biEtpu<cAFYlPewM|0jwylRyIe6&Xx^XK>w$zMYzN^)#8*X_{q!QH*gq|UdK2=2k
zow+nDcUbJ#s&>S$R?pabPfea3JteUhck)2`JC+8=ho;CjNytJmEV-5umosI~tQ^F~
zEMuH5`m(E4Jm*r19hOjv9Ekszm}BfuPSxh~z%RVyGS3efyZsgD>X6QrhZ%`FKLM|>
zc+rbWa#%Pi+}eZ*1?ap!WF{ZyqO2xNWy`%fl80<rShUjo+}n8m?vbjAIrUT-n(TFQ
zW3aegJF?kw3_l(!QseK+c`t%8%O0nI?N5*6Pku^_;^pM0l5+(jWkW3?>Sxu)uB$8}
zI+>w67DDpy6p^XMK5XlFT6&=tOS}?h;<ulc0(EM=J_unBt$epZ`0DF9t%sv^x*maV
zj2Yh|G=wZ}eM)E#5JAq;%=fiL_r?x>S<9MMAx*=fW`JD`Wc}w#+m*2+FROIa9BLy*
zC*D301bPL5aa-{QgWkVmOBy^|7P#z*$Xh(?et6^i0TxBD!W>-4QTz0GobT@;I(eB7
K(iM_Mf&T{%C7VS6

literal 0
HcmV?d00001

diff --git a/doc/user/project/merge_requests/merge_request_troubleshooting.md b/doc/user/project/merge_requests/merge_request_troubleshooting.md
index 096d3c0b4fc..2443eb7ebab 100644
--- a/doc/user/project/merge_requests/merge_request_troubleshooting.md
+++ b/doc/user/project/merge_requests/merge_request_troubleshooting.md
@@ -151,8 +151,8 @@ to determine the cause of the error. GitLab SaaS users should
 
 ## Cached merge request count
 
-In a group, the sidebar displays the total count of open merge requests. This value is cached if it's greater than
-than 1000. The cached value is rounded to thousands (or millions) and updated every 24 hours.
+In a group, the sidebar displays the total count of open merge requests. This value is cached if it's
+greater than 1000. The cached value is rounded to thousands (or millions) and updated every 24 hours.
 
 ## Check out merge requests locally through the `head` ref
 
diff --git a/doc/user/project/ml/experiment_tracking/mlflow_client.md b/doc/user/project/ml/experiment_tracking/mlflow_client.md
index f912bddbe55..66b5353b806 100644
--- a/doc/user/project/ml/experiment_tracking/mlflow_client.md
+++ b/doc/user/project/ml/experiment_tracking/mlflow_client.md
@@ -71,6 +71,9 @@ candidate metadata. To associate a candidate to a CI/CD job:
 1. In your training code within the run execution context, add the following code snippet:
 
    ```python
+   import os
+   import mlflow
+
    with mlflow.start_run(run_name=f"Candidate {index}"):
      # Your training code
 
@@ -90,6 +93,8 @@ client. Models are registered under `/<your project>/-/ml/models`.
 #### Creating a model
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 description = 'Model description'
@@ -105,6 +110,8 @@ model = client.create_registered_model(model_name, description=description)
 #### Fetching a model
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 model = client.get_registered_model(model_name)
@@ -113,6 +120,8 @@ model = client.get_registered_model(model_name)
 #### Updating a model
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 description = 'New description'
@@ -122,6 +131,8 @@ client.update_registered_model(model_name, description=description)
 #### Deleting a model
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 client.delete_registered_model(model_name)
@@ -133,6 +144,8 @@ Every model has an associated experiment with the same name prefixed by `[model]
 To log a candidate/run to the model, use the experiment passing the correct name:
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 exp = client.get_experiment_by_name(f"[model]{model_name}")
@@ -144,6 +157,8 @@ run = client.create_run(exp.experiment_id)
 #### Creating a model version
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 description = 'Model version description'
@@ -155,6 +170,8 @@ version. You can set the version by passing a tag during model version creation.
 must follow [SemVer](https://semver.org/) format.
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
@@ -171,7 +188,9 @@ client.create_model_version(model_name, version, description=description, tags=t
 
 #### Updating a model
 
-```python
+```python\
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
@@ -182,6 +201,8 @@ client.update_model_version(model_name, version, description=description)
 #### Fetching a model version
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
@@ -191,6 +212,8 @@ client.get_model_version(model_name, version)
 #### Getting latest versions of a model
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 client.get_latest_versions(model_name)
@@ -204,6 +227,8 @@ client.get_latest_versions(model_name)
 #### Loading a model version
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version'  # e.g. '1.0.0'
@@ -224,6 +249,8 @@ and metrics. The run ID can either be found at the Model version page in GitLab,
 or by using the MLflow client:
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
@@ -242,6 +269,8 @@ client.log_batch(run_id, metric_list, param_list, tag_list)
 GitLab creates a package that can be used by the MLflow client to upload files.
 
 ```python
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
@@ -263,6 +292,9 @@ Artifacts will then be available under `https/<your project>/-/ml/models/<model_
 Similar to candidates, it is also possible to link a model version to a CI/CD job:
 
 ```python
+import os
+from mlflow import MlflowClient
+
 client = MlflowClient()
 model_name = '<your_model_name>'
 version = '<your_version>'
diff --git a/lib/api/users.rb b/lib/api/users.rb
index 51521568c50..3cdd710b853 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -1100,6 +1100,7 @@ module API
     resource :user do
       before do
         authenticate!
+        set_current_organization
       end
 
       # Enabling /user endpoint for the v3 version to allow oauth
diff --git a/lib/banzai/filter/references/issue_reference_filter.rb b/lib/banzai/filter/references/issue_reference_filter.rb
index 5c2e3513ac8..9a6dd834e84 100644
--- a/lib/banzai/filter/references/issue_reference_filter.rb
+++ b/lib/banzai/filter/references/issue_reference_filter.rb
@@ -22,7 +22,8 @@ module Banzai
         end
 
         def parent_records(parent, ids)
-          parent.issues.where(iid: ids.to_a).includes(:project, :namespace, :work_item_type)
+          parent.issues.where(iid: ids.to_a)
+                .includes(:project, :namespace, ::Gitlab::Issues::TypeAssociationGetter.call)
         end
 
         def object_link_text_extras(issue, matches)
diff --git a/lib/banzai/filter/references/work_item_reference_filter.rb b/lib/banzai/filter/references/work_item_reference_filter.rb
index 237cd944830..1fa1a791bad 100644
--- a/lib/banzai/filter/references/work_item_reference_filter.rb
+++ b/lib/banzai/filter/references/work_item_reference_filter.rb
@@ -12,7 +12,8 @@ module Banzai
         self.object_class   = WorkItem
 
         def parent_records(parent, ids)
-          parent.work_items.where(iid: ids.to_a).includes(:project, :namespace, :work_item_type)
+          parent.work_items.where(iid: ids.to_a)
+                .includes(:project, :namespace, ::Gitlab::Issues::TypeAssociationGetter.call)
         end
 
         def parent_type
diff --git a/lib/banzai/reference_parser/issue_parser.rb b/lib/banzai/reference_parser/issue_parser.rb
index d0e74044bba..83c8c9517f4 100644
--- a/lib/banzai/reference_parser/issue_parser.rb
+++ b/lib/banzai/reference_parser/issue_parser.rb
@@ -68,7 +68,7 @@ module Banzai
 
       def node_includes
         includes = [
-          :work_item_type,
+          ::Gitlab::Issues::TypeAssociationGetter.call,
           :namespace,
           :author,
           :assignees,
diff --git a/lib/gitlab/background_migration/create_missing_external_links_for_vulnerabilities.rb b/lib/gitlab/background_migration/create_missing_external_links_for_vulnerabilities.rb
new file mode 100644
index 00000000000..669951b9d9f
--- /dev/null
+++ b/lib/gitlab/background_migration/create_missing_external_links_for_vulnerabilities.rb
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class CreateMissingExternalLinksForVulnerabilities < BatchedMigrationJob
+      feature_category :vulnerability_management
+      def perform; end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::CreateMissingExternalLinksForVulnerabilities.prepend_mod
diff --git a/lib/gitlab/issues/type_association_getter.rb b/lib/gitlab/issues/type_association_getter.rb
new file mode 100644
index 00000000000..b71783357eb
--- /dev/null
+++ b/lib/gitlab/issues/type_association_getter.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Issues
+    module TypeAssociationGetter
+      def self.call
+        if Feature.enabled?(:issues_use_correct_work_item_type_id, :instance)
+          :correct_work_item_type
+        else
+          :work_item_type
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/search_results.rb b/lib/gitlab/search_results.rb
index b94184cfe8c..70be8b1b864 100644
--- a/lib/gitlab/search_results.rb
+++ b/lib/gitlab/search_results.rb
@@ -186,7 +186,7 @@ module Gitlab
 
     def issues(finder_params = {})
       issues = IssuesFinder.new(current_user, issuable_params.merge(finder_params)).execute
-                 .preload(:work_item_type) # rubocop: disable CodeReuse/ActiveRecord -- preload for permission checks
+                 .preload(::Gitlab::Issues::TypeAssociationGetter.call) # rubocop: disable CodeReuse/ActiveRecord -- preload for permission checks
 
       unless default_project_filter
         project_ids = project_ids_relation
diff --git a/lib/gitlab/work_items/work_item_hierarchy.rb b/lib/gitlab/work_items/work_item_hierarchy.rb
index e71bf2bce6a..6604a1cb329 100644
--- a/lib/gitlab/work_items/work_item_hierarchy.rb
+++ b/lib/gitlab/work_items/work_item_hierarchy.rb
@@ -41,7 +41,9 @@ module Gitlab
       def with_type_filter(conditions, cte)
         return conditions unless options[:same_type]
 
-        conditions.and(objects_table[:work_item_type_id].eq(cte.table[:work_item_type_id]))
+        type_column_name = :"#{::Gitlab::Issues::TypeAssociationGetter.call}_id"
+
+        conditions.and(objects_table[type_column_name].eq(cte.table[type_column_name]))
       end
     end
   end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 35170536b06..002e20b468c 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -49189,6 +49189,9 @@ msgstr ""
 msgid "Secrets|Add secret"
 msgstr ""
 
+msgid "Secrets|An error occurred while fetching the Secret manager status. Please try again."
+msgstr ""
+
 msgid "Secrets|Created"
 msgstr ""
 
@@ -49231,6 +49234,12 @@ msgstr ""
 msgid "Secrets|New secret"
 msgstr ""
 
+msgid "Secrets|Please wait while the Secrets manager is provisioned. It is safe to refresh this page."
+msgstr ""
+
+msgid "Secrets|Provisioning in progress"
+msgstr ""
+
 msgid "Secrets|Revoke"
 msgstr ""
 
@@ -49249,7 +49258,7 @@ msgstr ""
 msgid "Secrets|Secrets Manager has been provisioned for this project."
 msgstr ""
 
-msgid "Secrets|Secrets represent sensitive information your CI job needs to complete work. This sensitive information can be items like API tokens, database credentials, or private keys. Unlike CI/CD variables, which are always presented to a job, secrets must be explicitly required by a job."
+msgid "Secrets|Secrets can be items like API tokens, database credentials, or private keys. Unlike CI/CD variables, secrets must be explicitly requested by a job."
 msgstr ""
 
 msgid "Secrets|Select a reminder interval"
diff --git a/package.json b/package.json
index 8c3459678ea..8e3439ea0b2 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "@gitlab/favicon-overlay": "2.0.0",
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/query-language": "^0.0.5-a-20241105",
-    "@gitlab/svgs": "3.120.0",
+    "@gitlab/svgs": "3.121.0",
     "@gitlab/ui": "102.1.0",
     "@gitlab/web-ide": "^0.0.1-dev-20240909013227",
     "@mattiasbuelens/web-streams-adapter": "^0.1.0",
diff --git a/scripts/frontend/quarantined_vue3_specs.txt b/scripts/frontend/quarantined_vue3_specs.txt
index 18acb566ac4..ba863d2530c 100644
--- a/scripts/frontend/quarantined_vue3_specs.txt
+++ b/scripts/frontend/quarantined_vue3_specs.txt
@@ -36,14 +36,12 @@ ee/spec/frontend/boards/components/board_new_issue_spec.js
 ee/spec/frontend/boards/components/epic_board_content_sidebar_spec.js
 ee/spec/frontend/boards/components/epics_swimlanes_spec.js
 ee/spec/frontend/ci/pipeline_details/header/pipeline_header_spec.js
-ee/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
 ee/spec/frontend/ci/runner/admin_runners_dashboard/admin_runners_wait_times_spec.js
 ee/spec/frontend/ci/runner/components/runner_details_spec.js
 ee/spec/frontend/ci/runner/components/runner_form_fields_spec.js
 ee/spec/frontend/ci/runner/components/runner_header_spec.js
 ee/spec/frontend/ci/runner/components/runner_usage_spec.js
 ee/spec/frontend/ci/runner/components/stat/runner_upgrade_status_stats_spec.js
-ee/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
 ee/spec/frontend/ci/runner/group_runners_dashboard/group_runners_wait_times_spec.js
 ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
 ee/spec/frontend/ci/secrets/components/secrets_breadcrumbs_spec.js
@@ -210,7 +208,6 @@ spec/frontend/ci/pipelines_page/components/pipeline_multi_actions_spec.js
 spec/frontend/ci/pipelines_page/components/pipelines_artifacts_spec.js
 spec/frontend/ci/pipelines_page/components/pipelines_filtered_search_spec.js
 spec/frontend/ci/runner/admin_runner_show/admin_runner_show_app_spec.js
-spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
 spec/frontend/ci/runner/components/registration/registration_instructions_spec.js
 spec/frontend/ci/runner/components/runner_details_spec.js
 spec/frontend/ci/runner/components/runner_form_fields_spec.js
@@ -218,7 +215,6 @@ spec/frontend/ci/runner/components/runner_managers_table_spec.js
 spec/frontend/ci/runner/components/runner_platforms_radio_spec.js
 spec/frontend/ci/runner/components/runner_tags_spec.js
 spec/frontend/ci/runner/group_runner_show/group_runner_show_app_spec.js
-spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
 spec/frontend/ci_settings_pipeline_triggers/components/edit_trigger_modal_spec.js
 spec/frontend/clusters/agents/components/activity_history_item_spec.js
 spec/frontend/clusters/agents/components/revoke_token_button_spec.js
diff --git a/spec/features/triggers_spec.rb b/spec/features/triggers_spec.rb
index 8adde5fee19..c389b65ff6b 100644
--- a/spec/features/triggers_spec.rb
+++ b/spec/features/triggers_spec.rb
@@ -18,6 +18,10 @@ RSpec.describe 'Triggers', :js, feature_category: :continuous_integration do
   end
 
   describe 'triggers page' do
+    before do
+      stub_feature_flags(ci_tanukey_ui: false)
+    end
+
     describe 'create trigger workflow' do
       before do
         sign_in(user)
diff --git a/spec/fixtures/lib/kramdown/atlassian_document_format/emoji.md b/spec/fixtures/lib/kramdown/atlassian_document_format/emoji.md
index 11adf377188..a551d15c307 100644
--- a/spec/fixtures/lib/kramdown/atlassian_document_format/emoji.md
+++ b/spec/fixtures/lib/kramdown/atlassian_document_format/emoji.md
@@ -1,4 +1,4 @@
 Grinning with unicode 😀 and heart eyes with raw unicode 😍, non-standard
 Atlassian :awthanks:, non-standard customer emoji
-:thumbsup::skin-tone-2:, and invalid is ignored
+\:thumbsup::skin-tone-2:, and invalid is ignored
 
diff --git a/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js b/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
index 96b169093a5..1c4c69a6072 100644
--- a/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
+++ b/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
@@ -105,6 +105,7 @@ describe('AdminRunnersApp', () => {
   const createComponent = ({
     props = {},
     mountFn = shallowMountExtended,
+    stubs,
     provide,
     ...options
   } = {}) => {
@@ -132,6 +133,10 @@ describe('AdminRunnersApp', () => {
           show: showToast,
         },
       },
+      stubs: {
+        RunnerFilteredSearchBar: true,
+        ...stubs,
+      },
       ...options,
     });
 
@@ -178,10 +183,11 @@ describe('AdminRunnersApp', () => {
     });
 
     it('shows the runner tabs', () => {
-      const tabs = findRunnerTypeTabs().text();
-      expect(tabs).toMatchInterpolatedText(
-        `All ${mockRunnersCount} ${I18N_INSTANCE_TYPE} ${mockRunnersCount} ${I18N_GROUP_TYPE} ${mockRunnersCount} ${I18N_PROJECT_TYPE} ${mockRunnersCount}`,
-      );
+      const tabs = findRunnerTypeTabs().text().replace(/\s+/g, ' ');
+      expect(tabs).toContain(`All ${mockRunnersCount}`);
+      expect(tabs).toContain(`${I18N_INSTANCE_TYPE} ${mockRunnersCount}`);
+      expect(tabs).toContain(`${I18N_GROUP_TYPE} ${mockRunnersCount}`);
+      expect(tabs).toContain(`${I18N_PROJECT_TYPE} ${mockRunnersCount}`);
     });
 
     it('shows the total', () => {
@@ -208,10 +214,6 @@ describe('AdminRunnersApp', () => {
     it('fetches only tab counts', () => {
       expect(mockRunnersCountHandler).toHaveBeenCalledTimes(TAB_COUNT_QUERIES);
     });
-
-    it('does not shows counters', () => {
-      expect(findRunnerStats().text()).toBe('');
-    });
   });
 
   it('shows the runners list', async () => {
diff --git a/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js b/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
index daead38fa1c..fdc27d42b68 100644
--- a/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
+++ b/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
@@ -101,6 +101,7 @@ describe('GroupRunnersApp', () => {
     props = {},
     provide = {},
     mountFn = shallowMountExtended,
+    stubs,
     ...options
   } = {}) => {
     const { cacheConfig, localMutations } = createLocalState();
@@ -123,6 +124,10 @@ describe('GroupRunnersApp', () => {
         localMutations,
         ...provide,
       },
+      stubs: {
+        RunnerFilteredSearchBar: true,
+        ...stubs,
+      },
       mocks: {
         $toast: {
           show: showToast,
@@ -149,9 +154,11 @@ describe('GroupRunnersApp', () => {
   it('shows the runner tabs with a runner count for each type', async () => {
     await createComponent({ mountFn: mountExtended });
 
-    expect(findRunnerTypeTabs().text()).toMatchInterpolatedText(
-      `All ${mockGroupRunnersCount} Group ${mockGroupRunnersCount} Project ${mockGroupRunnersCount}`,
-    );
+    const tabs = findRunnerTypeTabs().text().replace(/\s+/g, ' ');
+    expect(tabs).toContain(`All ${mockGroupRunnersCount}`);
+    expect(tabs).toContain(`Group ${mockGroupRunnersCount}`);
+    expect(tabs).toContain(`Project ${mockGroupRunnersCount}`);
+    expect(tabs).not.toContain('Instance');
   });
 
   it('shows the runner setup instructions', () => {
diff --git a/spec/lib/gitlab/current_settings_spec.rb b/spec/lib/gitlab/current_settings_spec.rb
index a65ee004dba..85aae03912b 100644
--- a/spec/lib/gitlab/current_settings_spec.rb
+++ b/spec/lib/gitlab/current_settings_spec.rb
@@ -112,9 +112,9 @@ RSpec.describe Gitlab::CurrentSettings, feature_category: :shared do
         allow(Gitlab::ApplicationSettingFetcher).to receive(:current_application_settings).and_return(nil)
       end
 
-      context 'and the current organization is known', :with_current_organization do
+      context 'and the current organization is known' do
         before do
-          allow(Organizations::OrganizationSetting).to receive(:for).and_return(organization_settings)
+          ::Current.organization = organization_settings.organization
         end
 
         it 'retrieves settings using OrganizationSetting' do
diff --git a/spec/lib/gitlab/github_gists_import/importer/gist_importer_spec.rb b/spec/lib/gitlab/github_gists_import/importer/gist_importer_spec.rb
index 26ce68b2132..75bcb933cb4 100644
--- a/spec/lib/gitlab/github_gists_import/importer/gist_importer_spec.rb
+++ b/spec/lib/gitlab/github_gists_import/importer/gist_importer_spec.rb
@@ -35,6 +35,10 @@ RSpec.describe Gitlab::GithubGistsImport::Importer::GistImporter, :with_current_
     }.stringify_keys
   end
 
+  before do
+    allow(::Current).to receive(:organization_id).and_return(current_organization.id)
+  end
+
   describe '#execute' do
     context 'when success' do
       let(:validator_result) do
diff --git a/spec/lib/gitlab/gon_helper_spec.rb b/spec/lib/gitlab/gon_helper_spec.rb
index 68615b21d9b..ff51367f318 100644
--- a/spec/lib/gitlab/gon_helper_spec.rb
+++ b/spec/lib/gitlab/gon_helper_spec.rb
@@ -81,6 +81,10 @@ RSpec.describe Gitlab::GonHelper, feature_category: :shared do
 
     context 'when ui_for_organizations feature flag is enabled' do
       context 'when current_organization is set', :with_current_organization do
+        before do
+          Current.organization = current_organization
+        end
+
         it 'exposes current_organization' do
           expect(gon).to receive(:current_organization=).with(
             current_organization.slice(:id, :name, :web_url, :avatar_url)
diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml
index 9f6044578e9..707bbde7d0b 100644
--- a/spec/lib/gitlab/import_export/all_models.yml
+++ b/spec/lib/gitlab/import_export/all_models.yml
@@ -10,6 +10,7 @@ issues:
 - milestone
 - iteration
 - work_item_type
+- correct_work_item_type
 - notes
 - resource_label_events
 - resource_weight_events
@@ -86,7 +87,6 @@ issues:
 work_item_type:
 - issues
 - namespace
-- work_items
 - widget_definitions
 - enabled_widget_definitions
 - child_restrictions
diff --git a/spec/lib/gitlab/issues/type_association_getter_spec.rb b/spec/lib/gitlab/issues/type_association_getter_spec.rb
new file mode 100644
index 00000000000..1ac67d3bb02
--- /dev/null
+++ b/spec/lib/gitlab/issues/type_association_getter_spec.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Issues::TypeAssociationGetter, feature_category: :team_planning do
+  describe '.call' do
+    subject { described_class.call }
+
+    it { is_expected.to eq(:correct_work_item_type) }
+
+    context 'when issues_use_correct_work_item_type_id feature flag is disabled' do
+      before do
+        stub_feature_flags(issues_use_correct_work_item_type_id: false)
+      end
+
+      it { is_expected.to eq(:work_item_type) }
+    end
+  end
+end
diff --git a/spec/migrations/20241024062434_queue_create_missing_external_links_for_vulnerabilities_spec.rb b/spec/migrations/20241024062434_queue_create_missing_external_links_for_vulnerabilities_spec.rb
new file mode 100644
index 00000000000..151b31b243c
--- /dev/null
+++ b/spec/migrations/20241024062434_queue_create_missing_external_links_for_vulnerabilities_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueCreateMissingExternalLinksForVulnerabilities, feature_category: :vulnerability_management do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :project_settings,
+          column_name: :project_id,
+          interval: described_class::DELAY_INTERVAL,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      }
+    end
+  end
+end
diff --git a/spec/models/issue_spec.rb b/spec/models/issue_spec.rb
index 45ea604e4c0..a869b60fb95 100644
--- a/spec/models/issue_spec.rb
+++ b/spec/models/issue_spec.rb
@@ -463,36 +463,72 @@ RSpec.describe Issue, feature_category: :team_planning do
         .to contain_exactly(issue)
     end
 
-    it 'returns issues with the given issue types' do
-      expect(described_class.with_issue_type(%w[issue incident]))
-        .to contain_exactly(issue, incident)
-    end
-
     context 'when multiple issue_types are provided' do
-      it 'joins the work_item_types table for filtering' do
+      it 'returns issues with the given issue types' do
+        expect(described_class.with_issue_type(%w[issue incident]))
+          .to contain_exactly(issue, incident)
+      end
+
+      it 'joins the work_item_types table for filtering with issues.correct_work_item_type_id column' do
         expect do
           described_class.with_issue_type([:issue, :incident]).to_a
         end.to make_queries_matching(
           %r{
-            INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."id"\s=\s"issues"\."work_item_type_id"
+            INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."correct_id"\s=\s"issues"\."correct_work_item_type_id"
             \sWHERE\s"work_item_types"\."base_type"\sIN\s\(0,\s1\)
           }x
         )
       end
+
+      context 'when issues_use_correct_work_item_type_id FF is disabled' do
+        before do
+          stub_feature_flags(issues_use_correct_work_item_type_id: false)
+        end
+
+        it 'joins the work_item_types table for filtering with issues.work_item_type_id column' do
+          expect do
+            described_class.with_issue_type([:issue, :incident]).to_a
+          end.to make_queries_matching(
+            %r{
+              INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."id"\s=\s"issues"\."work_item_type_id"
+              \sWHERE\s"work_item_types"\."base_type"\sIN\s\(0,\s1\)
+            }x
+          )
+        end
+      end
     end
 
     context 'when a single issue_type is provided' do
-      it 'uses an optimized query for a single work item type' do
+      it 'uses an optimized query for a single work item type using issues.correct_work_item_type_id column' do
         expect do
           described_class.with_issue_type([:incident]).to_a
         end.to make_queries_matching(
           %r{
-            WHERE\s\("issues"\."work_item_type_id"\s=
-            \s\(SELECT\s"work_item_types"\."id"\sFROM\s"work_item_types"\sWHERE\s"work_item_types"\."base_type"\s=\s1
+            WHERE\s\("issues"\."correct_work_item_type_id"\s=
+            \s\(SELECT\s"work_item_types"\."correct_id"\sFROM\s"work_item_types"
+            \sWHERE\s"work_item_types"\."base_type"\s=\s1
             \sLIMIT\s1\)\)
           }x
         )
       end
+
+      context 'when issues_use_correct_work_item_type_id FF is disabled' do
+        before do
+          stub_feature_flags(issues_use_correct_work_item_type_id: false)
+        end
+
+        it 'uses an optimized query for a single work item type using issues.work_item_type_id column' do
+          expect do
+            described_class.with_issue_type([:incident]).to_a
+          end.to make_queries_matching(
+            %r{
+              WHERE\s\("issues"\."work_item_type_id"\s=
+              \s\(SELECT\s"work_item_types"\."id"\sFROM\s"work_item_types"\sWHERE\s"work_item_types"\."base_type"\s=\s1
+              \sLIMIT\s1\)\)
+            }x
+          )
+        end
+      end
     end
 
     context 'when no types are provided' do
@@ -517,16 +553,33 @@ RSpec.describe Issue, feature_category: :team_planning do
         .to contain_exactly(task)
     end
 
-    it 'uses the work_item_types table for filtering' do
+    it 'uses the work_item_types table and issues.correct_work_item_type_id for filtering' do
       expect do
         described_class.without_issue_type(:issue).to_a
       end.to make_queries_matching(
         %r{
-          INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."id"\s=\s"issues"\."work_item_type_id"
+          INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."correct_id"\s=\s"issues"\."correct_work_item_type_id"
           \sWHERE\s"work_item_types"\."base_type"\s!=\s0
         }x
       )
     end
+
+    context 'when issues_use_correct_work_item_type_id FF is disabled' do
+      before do
+        stub_feature_flags(issues_use_correct_work_item_type_id: false)
+      end
+
+      it 'uses the work_item_types table and issues.work_item_type_id for filtering' do
+        expect do
+          described_class.without_issue_type(:issue).to_a
+        end.to make_queries_matching(
+          %r{
+            INNER\sJOIN\s"work_item_types"\sON\s"work_item_types"\."id"\s=\s"issues"\."work_item_type_id"
+            \sWHERE\s"work_item_types"\."base_type"\s!=\s0
+          }x
+        )
+      end
+    end
   end
 
   describe '.order_severity' do
@@ -2500,4 +2553,86 @@ RSpec.describe Issue, feature_category: :team_planning do
       let(:field) { :description }
     end
   end
+
+  describe '#work_item_type' do
+    let_it_be_with_reload(:issue) { create(:issue, project: reusable_project) }
+
+    it 'uses the correct_work_item_type_id column to fetch the associated type' do
+      expect do
+        issue.work_item_type
+      end.to make_queries_matching(/FROM "work_item_types" WHERE "work_item_types"\."correct_id" =/)
+    end
+
+    context 'when the issues_use_correct_work_item_type_id feature flag is disabled' do
+      before do
+        stub_feature_flags(issues_use_correct_work_item_type_id: false)
+      end
+
+      it 'uses the work_item_type_id column to fetch the associated type' do
+        expect do
+          issue.work_item_type
+        end.to make_queries_matching(/FROM "work_item_types" WHERE "work_item_types"\."id" =/)
+      end
+    end
+  end
+
+  describe '#work_item_type_id=', :aggregate_failures do
+    it 'also sets correct_work_item_type_id' do
+      issue = build(:issue, project: reusable_project, work_item_type: nil)
+      work_item_type = create(:work_item_type, :non_default)
+
+      expect(issue.work_item_type_id).to be_nil
+      expect(issue.correct_work_item_type_id).to be_nil
+
+      issue.work_item_type_id = work_item_type.id
+
+      expect(issue.work_item_type_id).to eq(work_item_type.id)
+      expect(issue.correct_work_item_type_id).to eq(work_item_type.correct_id)
+    end
+
+    context 'when work_item_type_id does not exist in the DB' do
+      it 'validates work item type presence correctly' do
+        issue = build(:issue, project: reusable_project, work_item_type: nil)
+
+        expect(issue.work_item_type_id).to be_nil
+        expect(issue.correct_work_item_type_id).to be_nil
+
+        issue.work_item_type_id = non_existing_record_id
+
+        expect(issue).to be_invalid
+        expect(issue.errors.full_messages).to contain_exactly("Work item type can't be blank")
+      end
+    end
+
+    context 'when work_item_type_id is nil' do
+      it 'validates work item type presence correctly' do
+        issue = build(:issue, project: reusable_project)
+
+        expect(issue.work_item_type_id).to be_present
+        expect(issue.correct_work_item_type_id).to be_present
+
+        issue.work_item_type = nil
+        issue.work_item_type_id = nil
+
+        # A before_validation callback will set the default type if it's nil. Just testing that setting a nil
+        # work_item_type_id doesn't break anything
+        expect(issue).to be_valid
+      end
+    end
+  end
+
+  describe '#work_item_type=' do
+    it 'also sets correct_work_item_type', :aggregate_failures do
+      issue = build(:issue, project: reusable_project, work_item_type: nil)
+      work_item_type = create(:work_item_type, :non_default)
+
+      expect(issue.work_item_type).to be_nil
+      expect(issue.correct_work_item_type).to be_nil
+
+      issue.work_item_type = work_item_type
+
+      expect(issue.work_item_type).to eq(work_item_type)
+      expect(issue.correct_work_item_type).to eq(work_item_type)
+    end
+  end
 end
diff --git a/spec/models/work_items/type_spec.rb b/spec/models/work_items/type_spec.rb
index b736b72a582..10b4e35e7a3 100644
--- a/spec/models/work_items/type_spec.rb
+++ b/spec/models/work_items/type_spec.rb
@@ -8,8 +8,6 @@ RSpec.describe WorkItems::Type, feature_category: :team_planning do
   end
 
   describe 'associations' do
-    it { is_expected.to have_many(:work_items).with_foreign_key('work_item_type_id') }
-
     it 'has many `widget_definitions`' do
       is_expected.to have_many(:widget_definitions)
         .class_name('::WorkItems::WidgetDefinition')
diff --git a/spec/requests/api/graphql/mutations/snippets/create_spec.rb b/spec/requests/api/graphql/mutations/snippets/create_spec.rb
index f3223c3988a..9f9b312f12e 100644
--- a/spec/requests/api/graphql/mutations/snippets/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/create_spec.rb
@@ -115,7 +115,7 @@ RSpec.describe 'Creating a Snippet', feature_category: :source_code_management d
         it 'adds an organization_id' do
           expect do
             subject
-          end.to change { Snippet.where(organization_id: Current.organization_id).count }.by(1)
+          end.to change { Snippet.where(organization_id: current_organization.id).count }.by(1)
         end
       end
     end
@@ -133,7 +133,7 @@ RSpec.describe 'Creating a Snippet', feature_category: :source_code_management d
         it 'does not add an organization_id' do
           expect do
             subject
-          end.not_to change { Snippet.where(organization_id: Current.organization_id).count }
+          end.not_to change { Snippet.where(organization_id: current_organization.id).count }
         end
       end
 
diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb
index f42ab3dfcbf..b31cd39bf2a 100644
--- a/spec/requests/api/snippets_spec.rb
+++ b/spec/requests/api/snippets_spec.rb
@@ -262,7 +262,7 @@ RSpec.describe API::Snippets, :aggregate_failures, factory_default: :keep, featu
     end
   end
 
-  describe 'POST /snippets/' do
+  describe 'POST /snippets/', :with_current_organization do
     let(:base_params) do
       {
         title: 'Test Title',
@@ -280,11 +280,15 @@ RSpec.describe API::Snippets, :aggregate_failures, factory_default: :keep, featu
 
     subject { post api("/snippets/", personal_access_token: user_token), params: params }
 
+    before do
+      allow(Current).to receive(:organization_id).and_return(current_organization.id)
+    end
+
     shared_examples 'snippet creation' do
       let(:snippet) { Snippet.find(json_response["id"]) }
-      let(:organization_id) { Current.organization_id }
+      let(:organization_id) { current_organization.id }
 
-      it 'creates a new snippet', :with_current_organization do
+      it 'creates a new snippet' do
         expect do
           subject
         end.to change { PersonalSnippet.count }.by(1)
diff --git a/spec/services/snippets/create_service_spec.rb b/spec/services/snippets/create_service_spec.rb
index 5254a318221..501f847b953 100644
--- a/spec/services/snippets/create_service_spec.rb
+++ b/spec/services/snippets/create_service_spec.rb
@@ -340,7 +340,7 @@ RSpec.describe Snippets::CreateService, feature_category: :source_code_managemen
       end
 
       context 'when Current.organization is set', :with_current_organization do
-        let(:extra_opts) { { organization_id: Current.organization_id } }
+        let(:extra_opts) { { organization_id: current_organization.id } }
 
         it 'sets the organization_id to nil' do
           expect(snippet.organization_id).to be_nil
@@ -368,10 +368,10 @@ RSpec.describe Snippets::CreateService, feature_category: :source_code_managemen
       it_behaves_like 'invalid params error response'
 
       context 'when Current.organization is set', :with_current_organization do
-        let(:extra_opts) { { organization_id: Current.organization_id } }
+        let(:extra_opts) { { organization_id: current_organization.id } }
 
         it 'sets the organization_id to the current organization' do
-          expect(snippet.organization_id).to eq(Current.organization_id)
+          expect(snippet.organization_id).to eq(current_organization.id)
         end
 
         it 'does not set organization_id to the default organization' do
diff --git a/spec/services/work_items/update_service_spec.rb b/spec/services/work_items/update_service_spec.rb
index 0649b3d741a..7cd1077bbcd 100644
--- a/spec/services/work_items/update_service_spec.rb
+++ b/spec/services/work_items/update_service_spec.rb
@@ -72,6 +72,9 @@ RSpec.describe WorkItems::UpdateService, feature_category: :team_planning do
         before do
           task_type = WorkItems::Type.default_by_type(:task)
           work_item.update_columns(work_item_type_id: task_type.id)
+          # reload necessary temporarily as correct_work_item_type_id is updated with a DB trigger
+          # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/499911
+          work_item.reload
         end
 
         it 'does not apply the quick action' do
diff --git a/spec/support/shared_contexts/current_organization_context.rb b/spec/support/shared_contexts/current_organization_context.rb
index 039e97abdae..e1a5f22a605 100644
--- a/spec/support/shared_contexts/current_organization_context.rb
+++ b/spec/support/shared_contexts/current_organization_context.rb
@@ -8,9 +8,9 @@ RSpec.shared_context 'with current_organization setting', shared_context: :metad
   end
 
   before do
-    allow(Current).to receive(:organization).and_return(current_organization)
-    allow(Current).to receive(:organization_id).and_return(current_organization.id)
-    allow(Current).to receive(:organization_assigned).and_return(true)
+    allow_next_instance_of(::Gitlab::Current::Organization) do |organization|
+      allow(organization).to receive(:organization).and_return(current_organization)
+    end
   end
 end
 
diff --git a/yarn.lock b/yarn.lock
index 35ca3ad0015..c99a7703a4e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1402,10 +1402,10 @@
     stylelint-declaration-strict-value "1.10.4"
     stylelint-scss "6.0.0"
 
-"@gitlab/svgs@3.120.0":
-  version "3.120.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.120.0.tgz#0f26908d4ded2e3f63b6e5028afbe8b59b7fe6dc"
-  integrity sha512-lsMKCgg0o3FLbNzvNPahkDtKGOH4U99bHff2aGlyqYFIpPvGFes/DfGr0IXVtWdfavZyoT42zE0/rquG64bANw==
+"@gitlab/svgs@3.121.0":
+  version "3.121.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.121.0.tgz#57cacc895929aef4320632396373797a64b230ff"
+  integrity sha512-ZekVjdMZrjrNEjdrOHsJYCu7A+ea3AkuNUxWIZ3FaNgJj4Oh21RlTP7bQKnRSXVhBbV1jg1PgzQ1ANEoCW8t4g==
 
 "@gitlab/ui@102.1.0":
   version "102.1.0"