Add latest changes from gitlab-org/gitlab@master

26 files changed, 74 insertions, 56 deletions

diff --git a/data/deprecations/14-3-database-deprecate-legacy-database-conf.yml b/data/deprecations/14-3-database-deprecate-legacy-database-conf.yml
index d02577d34fe..f3f6553729e 100644
--- a/data/deprecations/14-3-database-deprecate-legacy-database-conf.yml
+++ b/data/deprecations/14-3-database-deprecate-legacy-database-conf.yml
@@ -1,5 +1,6 @@
 - name: "Legacy database configuration"
   announcement_milestone: "14.3"
+  announcement_date: "2021-09-22"
   removal_milestone: "15.0"
   body: |
    The syntax of [GitLabs database](https://docs.gitlab.com/omnibus/settings/database.html)
diff --git a/data/deprecations/14-3-repository-push-audit-events.yml b/data/deprecations/14-3-repository-push-audit-events.yml
index 6fafd7ba6db..3a39c1f4304 100644
--- a/data/deprecations/14-3-repository-push-audit-events.yml
+++ b/data/deprecations/14-3-repository-push-audit-events.yml
@@ -11,4 +11,4 @@
   tiers: Premium
   issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/337993
   documentation_url: https://docs.gitlab.com/ee/administration/audit_events.html#repository-push
-  announcement_date: 2021-09-02 # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69024
+  announcement_date: "2021-09-02" # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69024
diff --git a/data/deprecations/deprecation_omniauth-kerberos_gem.yml b/data/deprecations/deprecation_omniauth-kerberos_gem.yml
index f7068552ff9..8adbeb19416 100644
--- a/data/deprecations/deprecation_omniauth-kerberos_gem.yml
+++ b/data/deprecations/deprecation_omniauth-kerberos_gem.yml
@@ -11,5 +11,5 @@
   tiers: [Premium, Ultimate]
   issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/337384
   documentation_url: https://docs.gitlab.com/ee/integration/kerberos.html#upgrading-from-password-based-to-ticket-based-kerberos-sign-ins
-  announcement_date: 2021-22-09
+  announcement_date: "2021-09-22"
 
diff --git a/data/deprecations/distribution_deprecations_14-3.yml b/data/deprecations/distribution_deprecations_14-3.yml
index e43cc7baf09..05263383151 100644
--- a/data/deprecations/distribution_deprecations_14-3.yml
+++ b/data/deprecations/distribution_deprecations_14-3.yml
@@ -1,5 +1,6 @@
 - name: "Rename Task Runner pod to Toolbox" # The name of the feature to be deprecated
   announcement_milestone: "14.2" # The milestone when this feature was first announced as deprecated.
+  announcement_date: "2021-09-22"
   removal_milestone: "14.4" # the milestone when this feature is planned to be removed
   body: | # Do not modify this line, instead modify the lines below.
     The Task Runner pod is used to execute periodic housekeeping tasks within the GitLab application and is often confused with the GitLab Runner. Thus, [Task Runner will be renamed to Toolbox](https://gitlab.com/groups/gitlab-org/charts/-/epics/25).
diff --git a/data/deprecations/serverless.yml b/data/deprecations/serverless.yml
index 5f4a039a9c0..1b99ece154f 100644
--- a/data/deprecations/serverless.yml
+++ b/data/deprecations/serverless.yml
@@ -1,5 +1,6 @@
 - name: "GitLab Serverless"
   announcement_milestone: "14.3"
+  announcement_date: "2021-09-22"
   removal_milestone: "15.0"
   body: |
     [GitLab Serverless](https://docs.gitlab.com/ee/user/project/clusters/serverless/) is a feature set to support Knative-based serverless development with automatic deployments and monitoring.
diff --git a/data/deprecations/templates/_deprecation_template.md.erb b/data/deprecations/templates/_deprecation_template.md.erb
index b6f532147fd..64bd6a75a5e 100644
--- a/data/deprecations/templates/_deprecation_template.md.erb
+++ b/data/deprecations/templates/_deprecation_template.md.erb
@@ -22,6 +22,8 @@ then run `bin/rake gitlab:docs:compile_deprecations`.
 ### <%= deprecation["name"]%>
 
 <%= deprecation["body"] -%>
+
+Announced: <%= deprecation["announcement_date"]%>
     <%- end -%>
   <%- end -%>
 <%- else -%>
diff --git a/data/deprecations/templates/example.yml b/data/deprecations/templates/example.yml
index 59e478ab83e..f665dd21530 100644
--- a/data/deprecations/templates/example.yml
+++ b/data/deprecations/templates/example.yml
@@ -12,7 +12,8 @@
 
 - name: "Feature name" # The name of the feature to be deprecated
   announcement_milestone: "XX.YY" # The milestone when this feature was first announced as deprecated.
-  removal_milestone: "XX.YY" # the milestone when this feature is planned to be removed
+  announcement_date: "YYYY-MM-DD" # The date of the milestone release when this feature was first announced as deprecated
+  removal_milestone: "XX.YY" # The milestone when this feature is planned to be removed
   body: | # Do not modify this line, instead modify the lines below.
     <!-- START OF BODY COMMENT
 
@@ -29,5 +30,4 @@
   documentation_url: # (optional) This is a link to the current documentation page
   image_url: # (optional) This is a link to a thumbnail image depicting the feature
   video_url: # (optional) Use the youtube thumbnail URL with the structure of https://img.youtube.com/vi/UNIQUEID/hqdefault.jpg
-  announcement_date: # YYYY-MM-DD format - the date of the milestone release when this feature was first announced as deprecated
   removal_date: # (optional - may be required in the future) YYYY-MM-DD format - the date of the milestone release when this feature is planned to be removed
diff --git a/doc/.vale/gitlab/HeaderGerunds.yml b/doc/.vale/gitlab/HeaderGerunds.yml
deleted file mode 100644
index 9e5fa19f867..00000000000
--- a/doc/.vale/gitlab/HeaderGerunds.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-# Suggestion: gitlab.HeaderGerunds
-#
-# Checks for headers that start with gerunds (ing words).
-# Related to: https://docs.gitlab.com/ee/development/documentation/structure.html
-#
-# For a list of all options, see https://errata-ai.gitbook.io/vale/getting-started/styles
-extends: substitution
-message: 'Can this header start with an imperative verb, instead of a gerund (ing word)?'
-link: https://docs.gitlab.com/ee/development/documentation/styleguide/#heading-titles
-level: suggestion
-scope: heading
-swap:
-  - '^\w*ing.*': 'Troubleshooting'
diff --git a/doc/api/runners.md b/doc/api/runners.md
index 72bf936f9e4..bfdf2d49100 100644
--- a/doc/api/runners.md
+++ b/doc/api/runners.md
@@ -678,6 +678,8 @@ Response:
 
 ## Reset instance's runner registration token
 
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/30942) in GitLab 14.3.
+
 Resets the runner registration token for the GitLab instance.
 
 ```plaintext
@@ -691,6 +693,8 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
 
 ## Reset project's runner registration token
 
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/30942) in GitLab 14.3.
+
 Resets the runner registration token for a project.
 
 ```plaintext
@@ -704,6 +708,8 @@ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
 
 ## Reset group's runner registration token
 
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/30942) in GitLab 14.3.
+
 Resets the runner registration token for a group.
 
 ```plaintext
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index fd738f43501..d453c5d8336 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -26,6 +26,8 @@ supported using a single PostgreSQL adapter, whereas the new format is changing
 
 This deprecation mainly impacts users compiling GitLab from source because Omnibus will handle this configuration automatically.
 
+Announced: 2021-09-22
+
 ### Audit events for repository push events
 
 Audit events for [repository events](../administration/audit_events.md#repository-push) are now deprecated and will be removed in GitLab 15.0.
@@ -34,6 +36,8 @@ These events have always been disabled by default and had to be manually enabled
 feature flag. Enabling them can cause too many events to be generated which can
 dramatically slow down GitLab instances. For this reason, they are being removed.
 
+Announced: 2021-09-02
+
 ### OmniAuth Kerberos gem
 
 The `omniauth-kerberos` gem will be removed in our next major release, GitLab 15.0.
@@ -42,12 +46,16 @@ This gem has not been maintained and has very little usage. We therefore plan to
 
 Note that we are not deprecating the Kerberos SPNEGO integration, only the old password-based Kerberos integration.
 
+Announced: 2021-09-22
+
 ### GitLab Serverless
 
 [GitLab Serverless](../user/project/clusters/serverless/index.md) is a feature set to support Knative-based serverless development with automatic deployments and monitoring.
 
 We decided to remove the GitLab Serverless features as they never really resonated with our users. Besides, given the continuous development of Kubernetes and Knative, our current implementations do not even work with recent versions.
 
+Announced: 2021-09-22
+
 ## 14.4
 
 ### Rename Task Runner pod to Toolbox
@@ -55,3 +63,5 @@ We decided to remove the GitLab Serverless features as they never really resonat
 The Task Runner pod is used to execute periodic housekeeping tasks within the GitLab application and is often confused with the GitLab Runner. Thus, [Task Runner will be renamed to Toolbox](https://gitlab.com/groups/gitlab-org/charts/-/epics/25).
 
 This will result in the rename of the sub-chart: `gitlab/task-runner` to `gitlab/toolbox`. Resulting pods will be named along the lines of `{{ .Release.Name }}-toolbox`, which will often be `gitlab-toolbox`. They will be locatable with the label `app=toolbox`.
+
+Announced: 2021-09-22
diff --git a/doc/update/index.md b/doc/update/index.md
index 0088212a20f..fadb55684f8 100644
--- a/doc/update/index.md
+++ b/doc/update/index.md
@@ -298,7 +298,7 @@ and [Helm Chart deployments](https://docs.gitlab.com/charts/). They come with ap
 Ruby 2.7.4 is required. Refer to [the Ruby installation instructions](../install/installation.md#2-ruby)
 for how to proceed.
 
-- GitLab 14.3.0 contains background migrations to [address Primary Key overflow risk for tables with an integer PK](https://gitlab.com/groups/gitlab-org/-/epics/4785) for the tables listed below:
+- GitLab 14.3.0 contains post-deployment migrations to [address Primary Key overflow risk for tables with an integer PK](https://gitlab.com/groups/gitlab-org/-/epics/4785) for the tables listed below:
 
   - [`ci_builds.id`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70245)
   - [`ci_builds.stage_id`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66688)
diff --git a/doc/user/compliance/compliance_report/index.md b/doc/user/compliance/compliance_report/index.md
index c51636e33f5..d30cedfb3cd 100644
--- a/doc/user/compliance/compliance_report/index.md
+++ b/doc/user/compliance/compliance_report/index.md
@@ -14,17 +14,32 @@ Compliance report gives you the ability to see a group's merge request activity.
 high-level view for all projects in the group. For example, code approved for merging into
 production.
 
-To access compliance report for a group, go to **{shield}** **Security & Compliance > Compliance**
-on the group's menu.
+You can use the report to:
+
+- Get an overview of the latest merge request for each project.
+- See if merge requests were approved and by whom.
+- See merge request authors.
+- See the latest [CI/CD pipeline](../../../ci/pipelines/index.md) result for each merge request.
+
+## View the compliance report for a group
+
+Prerequisites:
+
+- You must be an administrator or have the Owner role for the group.
+
+To view the compliance report:
+
+1. On the top bar, select **Menu > Groups** and find your group.
+1. On the left sidebar, select **Security & Compliance > Compliance**.
 
 NOTE:
-Compliance report shows only the latest merge request on each project.
+The compliance report shows only the latest merge request on each project.
 
 ## Merge request drawer
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/299357) in GitLab 14.1.
 
-When you click on a row, a drawer is shown that provides further details about the merge
+When you select a row, a drawer is shown that provides further details about the merge
 request:
 
 - Project name and [compliance framework label](../../project/settings/index.md#compliance-frameworks),
@@ -36,22 +51,6 @@ request:
 - A list of users that approved the merge request.
 - The user that merged the merge request.
 
-## Use cases
-
-This feature is for people who care about the compliance status of projects within their group.
-
-You can use the report to:
-
-- Get an overview of the latest merge request for each project.
-- See if merge requests were approved and by whom.
-- See merge request authors.
-- See the latest [CI Pipeline](../../../ci/pipelines/index.md) result for each merge request.
-
-## Permissions
-
-- On [GitLab Ultimate](https://about.gitlab.com/pricing/) tier.
-- By **Administrators** and **Group Owners**.
-
 ## Approval status and separation of duties
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/217939) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.3.
@@ -85,14 +84,23 @@ The data provides a comprehensive view with respect to merge commits. It include
 merge request author, merge request ID, merge user, pipeline ID, group name, project name, and merge request approvers.
 Depending on the merge strategy, the merge commit SHA can be a merge commit, squash commit, or a diff head commit.
 
-To download the Chain of Custody report, navigate to **{shield}** **Security & Compliance > Compliance** on the group's menu and click **List of all merge commits**
+To download the Chain of Custody report:
+
+1. On the top bar, select **Menu > Groups** and find your group.
+1. On the left sidebar, select **Security & Compliance > Compliance**.
+1. Select **List of all merge commits**.
 
 ### Commit-specific Chain of Custody Report **(ULTIMATE)**
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/267629) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.6.
 
-You can generate a commit-specific Chain of Custody report for a given commit SHA. To do so, select
-the dropdown next to the **List of all merge commits** button at the top of the compliance report.
+You can generate a commit-specific Chain of Custody report for a given commit SHA.
+
+1. On the top bar, select **Menu > Groups** and find your group.
+1. On the left sidebar, select **Security & Compliance > Compliance**.
+1. At the top of the compliance report, to the right of **List of all merge commits**, select the down arrow (**{angle-down}**).
+1. Enter the merge commit SHA, and then select **Export commit custody report**.
+   SHA and then select **Export commit custody report**.
 
 NOTE:
 The Chain of Custody report download is a CSV file, with a maximum size of 15 MB.
diff --git a/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml b/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
index 43ecc4b96d5..00b771f1e5c 100644
--- a/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Jobs/Code-Quality.gitlab-ci.yml
@@ -7,7 +7,7 @@ code_quality:
   variables:
     DOCKER_DRIVER: overlay2
     DOCKER_TLS_CERTDIR: ""
-    CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/ci-cd/codequality:0.85.24"
+    CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/ci-cd/codequality:0.85.24-gitlab.1"
   needs: []
   script:
     - export SOURCE_CODE=$PWD
diff --git a/workhorse/authorization_test.go b/workhorse/authorization_test.go
index f0a03779d5d..7c56ec171cc 100644
--- a/workhorse/authorization_test.go
+++ b/workhorse/authorization_test.go
@@ -10,7 +10,7 @@ import (
 
 	"gitlab.com/gitlab-org/labkit/correlation"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/api"
diff --git a/workhorse/go.mod b/workhorse/go.mod
index 4c272310232..834ad382983 100644
--- a/workhorse/go.mod
+++ b/workhorse/go.mod
@@ -9,9 +9,9 @@ require (
 	github.com/alecthomas/chroma v0.7.3
 	github.com/aws/aws-sdk-go v1.37.0
 	github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054 // indirect
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/disintegration/imaging v1.6.2
 	github.com/getsentry/raven-go v0.2.0
+	github.com/golang-jwt/jwt/v4 v4.0.0
 	github.com/golang/gddo v0.0.0-20190419222130-af0f2af80721
 	github.com/golang/protobuf v1.5.2
 	github.com/gomodule/redigo v2.0.0+incompatible
diff --git a/workhorse/go.sum b/workhorse/go.sum
index d30ea93e18e..f928b7f7a92 100644
--- a/workhorse/go.sum
+++ b/workhorse/go.sum
@@ -207,7 +207,6 @@ github.com/denisenkom/go-mssqldb v0.0.0-20191001013358-cfbb681360f0/go.mod h1:xb
 github.com/denisenkom/go-mssqldb v0.9.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
 github.com/dgraph-io/badger v1.6.0/go.mod h1:zwt7syl517jmP8s94KqSxTlM6IMsdhYy6psNgSztDR4=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
@@ -304,6 +303,8 @@ github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zV
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.0.0 h1:RAqyYixv1p7uEnocuy8P1nru5wprCh/MH2BIlW5z5/o=
+github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/gddo v0.0.0-20190419222130-af0f2af80721 h1:KRMr9A3qfbVM7iV/WcLY/rL5LICqwMHLhwRXKu99fXw=
diff --git a/workhorse/internal/artifacts/artifacts_upload_test.go b/workhorse/internal/artifacts/artifacts_upload_test.go
index ce078c78559..2b11d56f4ee 100644
--- a/workhorse/internal/artifacts/artifacts_upload_test.go
+++ b/workhorse/internal/artifacts/artifacts_upload_test.go
@@ -14,7 +14,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/api"
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/filestore"
diff --git a/workhorse/internal/filestore/file_handler.go b/workhorse/internal/filestore/file_handler.go
index 06948941c04..b4d7250fe0c 100644
--- a/workhorse/internal/filestore/file_handler.go
+++ b/workhorse/internal/filestore/file_handler.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 
 	"gitlab.com/gitlab-org/labkit/log"
 
diff --git a/workhorse/internal/filestore/file_handler_test.go b/workhorse/internal/filestore/file_handler_test.go
index b1d4e64b666..16af56dcf48 100644
--- a/workhorse/internal/filestore/file_handler_test.go
+++ b/workhorse/internal/filestore/file_handler_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
 	"gocloud.dev/blob"
 
diff --git a/workhorse/internal/imageresizer/image_resizer.go b/workhorse/internal/imageresizer/image_resizer.go
index a21d2838acb..cd0fa946530 100644
--- a/workhorse/internal/imageresizer/image_resizer.go
+++ b/workhorse/internal/imageresizer/image_resizer.go
@@ -186,12 +186,15 @@ func (r *Resizer) Inject(w http.ResponseWriter, req *http.Request, paramsData st
 	}
 	defer imageFile.reader.Close()
 
+	widthLabelVal := strconv.Itoa(int(params.Width))
+
 	outcome.originalFileSize = imageFile.contentLength
 
 	setLastModified(w, imageFile.lastModified)
 	// If the original file has not changed, then any cached resized versions have not changed either.
 	if checkNotModified(req, imageFile.lastModified) {
 		writeNotModified(w)
+		imageResizeDurations.WithLabelValues(params.ContentType, widthLabelVal).Observe(time.Since(start).Seconds())
 		outcome.ok(statusClientCache)
 		return
 	}
@@ -221,7 +224,6 @@ func (r *Resizer) Inject(w http.ResponseWriter, req *http.Request, paramsData st
 		return
 	}
 
-	widthLabelVal := strconv.Itoa(int(params.Width))
 	imageResizeDurations.WithLabelValues(params.ContentType, widthLabelVal).Observe(time.Since(start).Seconds())
 
 	outcome.ok(statusSuccess)
diff --git a/workhorse/internal/secret/jwt.go b/workhorse/internal/secret/jwt.go
index 04335e58f76..804f3a9aba9 100644
--- a/workhorse/internal/secret/jwt.go
+++ b/workhorse/internal/secret/jwt.go
@@ -3,7 +3,7 @@ package secret
 import (
 	"fmt"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 )
 
 var (
diff --git a/workhorse/internal/testhelper/testhelper.go b/workhorse/internal/testhelper/testhelper.go
index d94341cd2b6..7e66563e438 100644
--- a/workhorse/internal/testhelper/testhelper.go
+++ b/workhorse/internal/testhelper/testhelper.go
@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/labkit/log"
diff --git a/workhorse/internal/upload/accelerate.go b/workhorse/internal/upload/accelerate.go
index 08a84c6f670..81f44d33a82 100644
--- a/workhorse/internal/upload/accelerate.go
+++ b/workhorse/internal/upload/accelerate.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/api"
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/helper"
diff --git a/workhorse/internal/upload/body_uploader_test.go b/workhorse/internal/upload/body_uploader_test.go
index 35509cb86c4..aeb366616ca 100644
--- a/workhorse/internal/upload/body_uploader_test.go
+++ b/workhorse/internal/upload/body_uploader_test.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/api"
diff --git a/workhorse/internal/upload/saved_file_tracker_test.go b/workhorse/internal/upload/saved_file_tracker_test.go
index b294d04b216..b34dd9aed4f 100644
--- a/workhorse/internal/upload/saved_file_tracker_test.go
+++ b/workhorse/internal/upload/saved_file_tracker_test.go
@@ -3,7 +3,7 @@ package upload
 import (
 	"context"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 
 	"net/http"
 	"testing"
diff --git a/workhorse/upload_test.go b/workhorse/upload_test.go
index 0c4ac2357a3..24c14bb12aa 100644
--- a/workhorse/upload_test.go
+++ b/workhorse/upload_test.go
@@ -14,7 +14,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/api"